Kyoto Group - Candidate Privacy Notice

1. Introduction and data controller information

This notice explains how Kyoto Group AS (“Kyoto,” “we,” or “us”) handles personal
data about job applicants and candidates. It applies to candidates applying for roles
with Kyoto in any location where Kyoto recruits.

We process candidate personal data in line with the EU General Data Protection
Regulation (GDPR), the UK GDPR where applicable, and the privacy laws of the country where you apply.

Data controller details

• Effective date: June 15, 2026
  

• Data controller: Kyoto Group AS,

  Askekroken 11, 0277 Oslo, Norway

• Contact: privacy@kyotogroup.no

Where you are engaged through an employer of record that entity may also processyour personal data as an independent controller under its own privacy notice. Kyotomay receive and share employment-related information with that entity wherenecessary to manage your engagement, comply with legal obligations, and administerwork-related arrangements.

 

2. What personal information we collect and how we use it

Category	Examples	Purpose	Legal basis
Application and candidate data	Name, contact details, CV, cover letter, employment history, education, qualifications, skills, professional experience, portfolio, LinkedIn profile, and other application materials	Managing your application, assessing suitability, communicating with you, and conducting interviews	Pre-contractual steps and legitimate interest
Recruitment assessment data	Interview notes, assessment results, role-fit notes, hiring manager feedback, AI-assisted summaries, and candidate comparisons	Evaluating candidates, supporting consistent recruitment, and improving the recruitment process	Legitimate interest and pre-contractual steps
References and verification	References, qualification checks, right-to-work information, and immigration status	Verifying information, complying with legal obligations, and assessing suitability for a role	Legal obligation where applicable, legitimate interest, and pre-contractual steps
Recruitment administration	Communications, scheduling information, interview availability, travel or reimbursement details where applicable	Managing recruitment logistics and candidate communications	Legitimate interest and pre-contractual steps
Talent pool data	CV, role interests, skills, contact details, and prior application history	Considering you for future roles	Consent or legitimate interest where permitted, with opt-out

 

AI assisted recruitment tools 

We may use AI-assisted tools, including ChatGPT or similar tools, to help our HR team organize, summarize, and review application materials such as CVs, cover letters, interview notes, and other information submitted by candidates. These tools may help identify relevant experience, summarize qualifications, compare application materials against role requirements, and support administrative efficiency in the recruitment process. 

AI-assisted tools support our recruitment team and do not make hiring decisions. Kyoto personnel remain responsible for reviewing applications, assessing candidates, and making recruitment decisions.

3. How long do we keep your personal information

We keep your personal information for different periods depending on the type of information and legal requirements in the countries where you work. 

Type of data	Retention period
Recruitment records for unsuccessful candidates	Up to 1 year after the recruitment process ends, unless a longer period is required for legal claims
Talent pool records	Up to 1 year if you agree to be considered for future opportunities
Successful candidate records	Transferred to the employee file and retained under our Employee Privacy Notice
Verification or right-to-work records	As required or permitted by applicable law

We delete candidate personal data when we no longer need it, unless we are legally required or permitted to keep it longer.   

4. Who we share your personal information with

We may share candidate personal data with: 

• Kyoto employees involved in the recruitment process. 

• HR and recruitment providers. 

• AI-assisted productivity or recruitment support tools used to help organize or summarize application materials. 

• Recruitment agencies or referees. 

• Employers of record, relocation, immigration, or onboarding providers where relevant. 

• IT and communications providers. 

• Legal advisers, auditors, insurers, and other professional advisers.

• Public authorities where required by law. 

 

Our external partners operate under appropriate contractual safeguards. Where personal data is transferred outside the EEA or UK, we use EU Standard Contractual Clauses or other approved transfer mechanisms where required.