Contents

Introduction

Nokia Corporation, including its affiliates, is committed to respecting your privacy and complying with applicable privacy laws.

About This Notice

This Privacy Notice provides information about personal data which are processed by Nokia Corporation, including its affiliates (‘Nokia’, ‘we’, ‘our’ or ‘us’) in relation to individuals who apply to work for, or who attend a recruitment event or undertake a work assessment with Nokia. This includes prospective employees, interns, and contractors.

You may also receive related privacy notices from the Nokia websites in the various locations in which we operate, in local languages and to reflect local requirements as appropriate.

This Privacy Notice does not cover personal data that you may provide to Nokia when interacting with us other than in relation to your recruitment or related enquires, for example, when using one of our products or services. Our general Privacy Notice is available here: We care about your privacy | Nokia home page. If you are successful in your application to Nokia, your personal data will be processed in accordance with a separate employee privacy notice.

You are not required to provide your personal data to Nokia. If you choose not to provide your personal data, we may not be able to continue the recruitment process with you or to respond to queries you may have. The latter does not apply to the section within the recruitment process that relates to a voluntary inclusion and diversity questionnaire – this questionnaire is always voluntary and your decision to complete it will not affect the overall recruitment process.

Special Notice - if you are under 16 years old and wish to apply for a Nokia sponsored education or innovation event

Except in those cases where Nokia organizes educational events specifically designed for children, we do not intentionally collect personal data of individuals under 16 years old. If you are under 16 years old (or a different age to reflect local legal requirement as communicated on the Nokia website in your location) please do not send us your personal data for example, your name, address, and email address. If you wish to contact Nokia in a way which requires you to submit your personal data (such as for education or innovation events) please ensure your parent or guardian will do so on your behalf.

What personal data do we process about you?

We process personal data relating to individuals who apply to work for, or who attend a recruitment event and/or undertake an assessment (hereafter ‘Applicants’). We collect personal data directly from you as well as from other available sources, such as our recruitment service providers or referees, to the extent relevant and permitted by applicable law. Subject to applicable law and practice, these are the categories of personal data that are collected and processed in the recruitment context:

Information you provide:

• Contact Information, such as your name, pronoun preference, street address, telephone number, email address, and other contact information.
• Application Materials, such as your CV, résumé, and cover letter.
• Experience, such as your previous work, practical and other relevant experience.
• Education, such as your education, including level, type, subject-matter, degrees, diplomas and certificates, and institutions.
• Position of Interest, such as positions, roles, and opportunities of interest, and if applicable, position offered.
• Skills,Skills, such as skills, languages, and other competencies.
• Certifications, such as your professional and other work-related licenses, permits and certifications held.
• Reference Details, such as your information you provide relating to references.
• Online Account Information, such as your username and password to access the Careers Site, application identifiers, and IP address and device identifiers that may be automatically collected
• Social media, such as LinkedIn.
• Communication preferences, such as preferred communication method and language.
• Event information, such as your dietary restrictions, travel and accommodation details, government-issued identification to access one of our physical premises, and other details specific to a particular recruiting interview, meeting or other event.
• Work authorization, such as your work authorization status and relevant visa or other immigration.
• Health/medical information, such as COVID-19 symptoms and test results, vaccination status, temperature, disability, etc. We collect this information for specific purposes to accommodate a disability or illness and promote employee (including prospective employee) health and public health.
• Identification and photograph, such as a copy of your passport, driver’s license, and photograph or video image.
• Other information, such as any other information you otherwise elect to provide to us (e.g., conflict of interest declarations, employment preferences, willingness to relocate, current salary, desired salary, awards or professional memberships) or information found from public sources as well as information related to vetting process (background or credit checks), depending on the position for which you are applying, in the cases required or enabled according to Nokia Global Vetting Standard Operating Procedures.

For the purposes of recruitment, special categories of data (‘sensitive personal data’) including personal data regarding health data may be processed only as permitted or required by local law for the purposes of adjusting the recruitment process, for assessing eligibility for positions and fitness to work and provision of facilities in the workplace to accommodate health problems or for the establishment, exercise, or defence of claims. Sensitive personal data include race, religion, ethnicity, nationality or national origin, age, gender identity, sex life or practices or sexual orientation, marital status, medical or health information (including disability status), genetic or biometric information, biometric templates, political or philosophical beliefs, political party or trade union membership, veteran status, background check information, judicial data such as criminal records or information on other judicial or administrative proceedings.

During the recruitment process, we will also ask you to provide (on a voluntary basis and where permitted by local law), gender identity and other diversity and/or inclusion monitoring information to allow us to undertake diversity and/or inclusion monitoring within our business. It is not mandatory to provide this information and you are free to decline to share it with us by selecting the ‘prefer not to say’ (or similar opt-out wording) on the applicable form (rather than selecting the relevant gender, i.e., male, female, or non-binary (or analogous choice) and continue with your application. A failure to tick a relevant gender box will be assumed to be a ‘prefer not to say’ selection. This information is used solely and exclusively for statistical purposes and will not be used in any way for recruitment or selection decisions. If you do provide this information, it will then be processed in accordance with this policy on the lawful bases identified below. Gender identity and other information provided to us in this manner will be anonymized wherever practicable and required by applicable law

Where permitted by applicable law, we will also inquire about criminal records to enable us to make recruitment decisions and assess suitability for particular work, we will process information about criminal convictions and offences (including alleged offences). We will process this sensitive personal data to enter a contract with you, to comply with a legal obligation, for our legitimate interests (in selecting suitable employees, workers, and contractors), and to exercise or perform employment law rights or obligations. Otherwise, we ask that you avoid submitting information that may qualify as sensitive personal data under applicable law, except where such information is legally required.

Information from Other Sources

For background check reports in connection with your application, and as permitted by applicable law, Nokia obtains information about you from other sources:

• References: details about experience, education, skills and other information contained in reference letters or otherwise obtained from references (such as on a phone call).
• Educational Records:Educational Records: transcripts, diplomas, and letters of attendance, verification or similar from educational institutions you attended.
• Licensing / Certification Organizations: registrations with professional licensing organisations.
• Criminal Record Registries: details about criminal records.
• Immigration Status: details about immigration status from applicable local agencies.
• Credit Reports: reports about your credit history and applicable bankruptcies, from local credit bureaus, if applicable.
• Technical information: When you access our services online, our web servers automatically create records of your visit. These records typically include IP-address, access times, the sites linked from, pages visited, the links and features used, the content viewed or requested, browser or application type, language, and other such information. When you use our services or otherwise interact with us over telecommunications networks, certain additional information, such as your mobile subscription number, may be transmitted to Nokia by the telecommunications operator as a standard part of that communication See also our Cookie policy.
• Other information, such as information found from public sources as well as information related to vetting process (background or credit checks…), depending on the position for which you are applying, in the cases required or enabled following Nokia Global Vetting SOP.

Use of Information

The information that you submit on the Careers site or by other means, will be used for Nokia’s global personnel recruitment, management and planning purposes, as permitted by applicable law. Where the collection or processing is based on your consent, you may withdraw your consent at any time to the extent permitted by applicable law. This will not affect the validity of the processing prior to the withdrawal of consents to above and will only be shared on a strict need- to- know basis with.

The following chart contains information about how we use personal data and the legal bases for such use. Please note that one or more purposes may apply simultaneously.

Purpose	Description	Personal Data	Legal Basis
Application Evaluation	Evaluate suitability and fit for applicable roles and opportunities.	Contact Information; Application Materials; Experience; Education; Position of Interest; Skills; Certifications; Reference Details; References; Educational Records; Work Authorization; Identification and Photograph; Licensing Certification Organizations; Immigration Status; and Other Information.	Manage our prospective contractual relationship with you.
Application Processing and Recruitment	Transmission and efficient processing of applications, interviews, and recruitment events, including any related travel and meals. Conduct a vetting process and assessments as required or permitted by applicable local law, to set up or conduct interviews, to communicate with third parties such as references concerning your skills, experiences, qualifications, work history and education, and to evaluate you for the position you have applied for or for other open vacancies. Verifying the information that an Applicant provides during the screening/interview process, which will not take place until the Applicant confirms that such verification can take place). Note that assessments may involve asking a third party to process such assessments on our behalf.	Contact Information; Application Materials; Position of Interest; Reference Details; Online Account Information; Communication Preferences; Identification and Photograph and Event Information.	Manage our prospective contractual relationship with you. Based on our legitimate interests, such as facilitating in-person meetings to get to know you better.
Communication and Updates	Respond to your inquiries and communicate with you about your application to obtain additional information, inform you about the status of your application and make changes to our terms and policies.	Contact Information; Application Materials; Position of Interest; Online Account Information; Communication Preferences; and Other Information (such as information specific to your request).	Manage our prospective contractual relationship with you.
References	Contact references to obtain additional information about candidate suitability.	Reference Details; and References.	Manage our prospective contractual relationship with you.
Application Verifications and Background Checks	If we offer you a position, conduct verifications and background checks via a third-party provider, including by contacting references, to confirm the veracity of application details, such as education, experience, work authorization and qualifications, and to obtain history of Criminal Records.	Contact Information; Application Materials; Experience; Education; Certifications; Position of Interest; Reference Details; References; Educational Records; Work Authorization; Identification and Photograph; Licensing / Certification Organizations; Criminal Record Registries; Immigration Status; Credit Reports, Social Media Information; and Other Information.	Manage our prospective contractual relationship with you. Comply with our legal obligations. Based on our legitimate interests, such as ensuring the accuracy of your application and promoting a safe work environment
On-boarding	If we hire you, incorporate personal data into our human resources system and use it to manage the new-hire process. Any such information can become part of your employee file and used for other employment-related purposes.	Contact Information; Application Materials; Experience; Education; Position of Interest; Skills; Certifications;Educational Information; Work Authorization; Online Account Information; Identification and Photograph; and Communication Preferences.	Manage our contractual relationship with you.
Diversity and Inclusion	Monitor and foster equal opportunity in recruitment processes, including to comply with related applicable laws and regulations.	Diversity Information; Contact Information; Application Materials; Experience; Education; Position of Interest; Skills; and Certifications.	Comply with our legal obligations. Based on our legitimate interest in promoting equitable recruitment practices and a diverse workplace.
Compliance with Legal Requirements In All Countries In Which We Operate	Comply with legal and other requirements applicable to our businesses in all countries in which we operate, such as determining any conflict of interest that may arise as a result of you taking up a particular role, record-keeping obligations, conducting audits to verify that our internal processes function as intended, compliance with government inspections and other requests from government or other public authorities; respond to legal process such as subpoenas; pursue legal rights and remedies; defend litigation; and manage any internal complaints or claims (including those received through the hotline). Carry out screening of applicants against publicly available or government issued sanctions lists and media sources.	Contact Information; Application Materials; Experience; Education; Position of Interest; Skills; Certifications; Reference Details; References; Educational Information; Work Authorization; Licensing / Certification Organizations; Criminal Record Registries; Immigration Status; and Other Information.	Comply with our legal obligations.
Improving Recruiting Processes	Identify opportunities and implement changes to make our recruitment processes more effective, efficient and engaging, including through analytics, including analysis of our applicant pool in order to better understand who is applying to positions at Nokia and how to enhance Inclusion and Diversity and to develop and improve our recruitment and resourcing processes, websites and other related services, and aggregate reporting. Where feasible, we use aggregated anonymous information in the improvement of the recruiting process.	Contact Information; Application Materials; Experience; Education; Position of Interest; Skills; Certifications; Reference Details; Work Authorization; Online Account Information; Communication Preferences; Event Information; and Other Information.	Based on our legitimate interests, such as making it easier to navigate the job postings and other material on our Careers Site.
General Business Operations	Carry out legitimate internal business activities, such as internal training, monitoring for and preventing fraud, enforcing our terms & conditions, protecting our rights, privacy, safety or property, and/or that of our affiliates, you or others, detecting and preventing cyberattacks, managing mergers, acquisitions, sales, reorganizations, joint ventures, assignments, transfers, or disposals and integration with purchaser.	Contact Information; Application Materials; Experience; Education; Position of Interest; Skills; Certifications; Reference Details; Work Authorization; Online Account Information; Identification and Photograph; Communication Preferences; Event Information; and Other Information.	Based on our legitimate interests, such as training our recruiting personnel on how to evaluate applications.

Providing personal data to us through the Careers website is voluntary. However, if you do not provide sufficient information, Nokia may be unable to consider your employment application or, if you are hired, your subsequent promotion, transfer, or relocation.

We may also process your personal data for a secondary purpose where it is closely related to the initial use of your data, for example, audits, investigations, dispute resolution, litigation, and defence of claims.

If you provide us with personal data of a reference or any other individual as part of your application, it is your responsibility to obtain consent from that individual prior to providing the information to us.

Who Has Access to Your Personal Data?

The extent to which your personal data are made accessible will depend upon the nature of the data concerned. Access to your personal data within Nokia will be limited to those who have a need to know the data for the purposes described in in this Notice, including Human Resources, Legal & Compliance, Communications, Finance and Accounting, and Internal Audit.

Assessment Tools

All applicants must answer questions which are necessary to ensure that individuals can lawfully enter a contract with a Nokia company if they are successful in their application team. Save for graduate hires or as specifically notified to you in a bespoke privacy notice or a supplementary privacy statement during the recruitment process, no profiling or automated decision making will take place to determine suitability or eligibility for employment or engagement as a contractor.

Does Nokia share your Personal Data?

Nokia will disclose your personal data as stated below:

• Consent: Nokia may share your personal data if you have given your consent for Nokia to do so.
• Nokia companies and authorized third parties: Nokia may share your personal data with Nokia personnel, agents, and contractors involved in the job application and recruitment processes with the Nokia group of companies or authorized third parties who process personal data for Nokia for the purposes described in this Privacy Notice. Nokia authorized third parties may include, for example, recruitment agencies, professional advisors, external legal counsel, consumer credit reporting agencies, recruiting systems providers, and other third-party suppliers. These Nokia authorized third parties are not permitted to use your personal data for any other purposes. We require them to act consistently with this Statement and to use appropriate security measures to protect your personal data.
• Mandatory disclosures: Nokia may be obligated by law to disclose your personal data to certain authorities or other third parties, for example, to government agencies responsible for employment activities or statistical information or to the police or other law enforcement agencies, for example in context of conducting a vetting process or diversity and/or inclusion monitoring. Nokia may also disclose and use your personal data in accordance with applicable law to defend Nokia’s legitimate interests, for example, in civil or criminal legal proceedings.
• Mergers and acquisitions: Where Nokia decide to sell, buy, merge, or otherwise reorganize its businesses in certain countries, this may involve disclosing personal data to prospective or actual purchasers and their advisers.
• International transfers of personal data: Our recruitment and resourcing activities may make use of resources and servers located in various countries around the world. Your personal data may be added to our international resume database, which is currently located in the European Union. This means that your personal data may be transferred outside the country to where you are applying to as an applicant, including to countries outside the European Economic Area (EEA). Such other countries do not always have laws providing specific protection for personal data or they have different rules on privacy and data protection. In such cases we use measures to provide adequate protection and safeguards for your personal data as required by applicable law, these measures include [Binding Corporate Rules], Standard Contractual Clauses and other approved transfer mechanisms for transfers to third parties as well as any additional local legal requirements. [You can find a copy of Nokia Binding Corporate Rules here [ ]

What steps are taken to safeguard your Personal Data?

Privacy and security are key considerations for Nokia. We have assigned specific responsibilities to address privacy and security related matters. We have implemented technology and policies with the objective of protecting your privacy from unauthorised access and improper use and will update these measures as new technology becomes available, as appropriate. We enforce our internal policies and guidelines through an appropriate selection of activities, including proactive and reactive risk management, security and privacy engineering, training, and assessments. We take appropriate steps to address online security, physical security, risk of data loss and other such risks taking into consideration the risk represented by the processing and the nature of the data being protected. Also, we limit access to our databases containing personal data to authorized persons having a justified need to access such information.

Data quality

We take reasonable steps to keep the personal data we possess accurate and to delete incorrect or unnecessary personal data. We will only retain your personal data for as long as necessary to fulfill the purposes outlined in this Privacy Notice or otherwise communicated to you unless a longer period is required by law.

Interacting with Nokia through social media

If you choose to interact with Nokia through social media on a Nokia administered social media page such as Facebook, Instagram, Twitter or LinkedIn, your personal data (such as your name, your profile picture and the fact that you are interested in Nokia) will be visible to all visitors of your personal webpage depending on your privacy settings on the relevant social media platform and will also be visible to Nokia. Nokia does not track your activity across the social media sites that you use. Please review your accounts on the relevant social media platform if you would like to request deletion of any data that you shared on these sites. For more information on how your personal data are processed on those social media platforms, we refer you to the privacy settings of the related social media platform.

How long does Nokia retain recruitment personal data?

We may delete your account and your image and video from our recruitment management system within 3 years from the end of the year during which you have last accessed it, updated it or applied for a position at Nokia. Where we have a legitimate interest to do so we may retain data for longer than 3 years. If you are hired by Nokia, Nokia will retain your personal data for longer periods, in accordance with legal and regulatory requirements. As some countries have different timeframes for how long data must be retained, retention periods may vary to comply with local law. Information may be held for a longer period where there is a legal or regulatory reason to do so (in which case it will be deleted once no longer required for the legal or regulatory purpose) or for 2 years to contact you for future opportunities if you have specifically consented to that purpose.

Your rights and how to exercise them

We aim to keep our information about you as accurate as possible. We will honour your rights under applicable data protection laws. You may request:

• access to your personal data;
• correction, or deletion of your personal data (but only where they are no longer required for a legitimate business purpose);
• that the processing of your personal data is restricted; and/or
• that you receive personal data that you have provided to Nokia, in a structured, digital form to be transmitted to another party if this is technically feasible.

You may submit these requests by managing your account and profile in our recruitment management system or, if that is not possible, by contacting us. Especially if you withdraw your consent or wish us to delete or stop processing your personal data, we may not be able to continue the recruitment process with you.

These rights are not absolute, and they do not always apply in all cases.

In response to a request, we will ask you to verify your identify if we need to (and to the extent permitted by applicable law), and to provide information that helps us to understand your request better. If we do not comply with your request, we will explain why.

Contact information

If you are not satisfied with what we provide when you exercise your rights, you can let us know by contacting us here Contact us | Nokia. If you are still dissatisfied, you also have the right to lodge a complaint with a relevant privacy supervisory authority.

Who is the controller of your Personal Data?

Nokia Corporation of Karaportti 3, 02610 Espoo, Finland is the controller of your personal data. You may also by using contact information provided in the applicable Nokia websites.

Changes to this Privacy Notice

Nokia may change this Privacy Notice at any time with or without notice. However, if this Privacy Notice is changed in a material, adverse way, Nokia will post a notice advising of such change at the beginning of this Privacy Notice and in the recruitment management system for 30 days. We recommend that you re-visit this Privacy Notice from time to time to learn of any such changes to this Privacy Notice.

I have read the Nokia Recruitment Privacy Notice and I hereby grant my consent to Nokia processing my personal data in accordance with that Nokia Recruitment Privacy Notice. I have the right to withdraw my consent at any time by contacting Nokia here.

California Applicant Recruitment Privacy Policy

Additional Information Regarding California

Last updated:December 2022

Collection and Disclosure of Personal Information

The following chart includes: (1) the categories of personal information, as defined under California law, that we plan to collect and have collected and disclosed within the preceding 12 months; and (2) the categories of third parties to which we disclosed personal information for our operational business purposes within the preceding 12 months.

Categories of Personal Information	Disclosed to Which Categories of Third Parties for Operational Business Purposes
Identifiers, such as name, alias, postal address, unique personal identifiers, IP address that can reasonably be linked or associated with a particular California resident or household, email address, account name, online identifiers, and government-issued identifiers (e.g., Social Security number, driver’s license number)	Affiliates; third-party service providers; professional advisors, such as legal advisers, accountants, and financial advisers; legal authorities and government agencies for the purposes of background checks.
Personal information as defined in the California customer records law, such as name, contact information, signature, Social Security number, passport number; financial, education and employment information, physical characteristics, or description.	Affiliates; third-party service providers; professional advisors, such as legal advisers, accountants, and financial advisers; legal authorities, government agencies and regulators.
Protected Class Information, such as characteristics of protected classifications under California or federal law, such as sex, age, gender, race, disability, medical conditions, citizenship, military/veteran status, gender identity and expression, primary language, political affiliation/activities, and immigration status.	Third-party service providers; professional advisors, such as legal advisers, and financial advisers and government agencies.
Commercial Information, such as travel expenses	Third-party travel providers and Accountants.
Internet or network activity information, such as regarding our website or online application portal, timestamp information, and access and activity logs	Affiliates; third-party service providers and professional advisors.
Geolocation Data, such as approximate location of devices used to access our website or online application portal, derived from IP address	Affiliates and third-party service providers.
Audio/Video Data. Audio, electronic, visual, and similar information, such as [photographs and call and video recordings]	Affiliates and third-party service providers
Education Information subject to the federal Family Educational Rights and Privacy Act such as student transcripts, grade point average,grades, academic standing, disciplinary records, and confirmation of graduation	Affiliates; third-party service providers; professional advisors, such as legal advisers, accountants, and financial advisers; legal authorities, government agencies and regulators.
Employment Information. Professional or employment-related information, such as [work history and prior employer, information from reference checks, work experience, qualifications, training and skills, work authorization, CV, résumé, cover letter, professional and other work-related licenses, permits and certifications held, and publicly accessible information posted on your professional social media accounts]	Affiliates; third-party service providers and, government agencies.
Sensitive Personal Information. Personal information that reveals an individual’s Social Security, driver’s license, state identification card, or passport number; account log-in; racial or ethnic origin, religious or philosophical beliefs, citizenship, immigration status, or union membership. Personal information collected and analyzed concerning an individual’s sexual orientation.	Affiliates; third-party service providers and, government agencies.

We may also disclose the above categories of personal information to a third party in the context of any reorganization, financing transaction, merger, sale, joint venture, partnership, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).

We do not “sell” or “share” your personal information, including your sensitive personal information, as defined under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act. We have not engaged in such activities in the 12 months preceding the date this policy was last updated. Without limiting the foregoing, we do not “sell” or “share” the personal information, including the sensitive personal information, of minors under 16 years of age.

Individual Requests

You may, subject to applicable law, make the following requests:

1. You may request that we disclose to you the following information covering the 12 months preceding your request:

   1. the categories of personal information we collected about you and the categories of sources from which we collected such personal information;
   2. The business or commercial purpose for collecting personal information about you; an
   3. The categories of personal information about you that we otherwise disclosed, and the categories of third parties to whom we disclosed such personal information (if applicable).
2. You may request to correct inaccuracies in your personal information.
3. You may request to have your personal information deleted.
4. You may request to receive a copy of your personal information, including specific pieces of personal information, including a copy of the personal information you provided to us in a portable format.

We will not unlawfully retaliate against you for making an individual request. To make a request, please contact us at toll free number +1 214-519-8633 or use Submit Your Request (custhelp.com). We will verify and respond to your request consistent with applicable law, taking into account the type and sensitivity of the personal information subject to the request. We may need to request additional personal information from you, such as passport details to verify your identity and protect against fraudulent requests. If you maintain a password-protected account with us, we may verify your identity through our existing authentication practices for your account and require you to re-authenticate yourself before disclosing or deleting your personal information. If you make a request to delete, we may ask you to confirm your request before we delete your personal information.

Purposes for the Collection and Use of Sensitive Personal Information

We may use sensitive personal information for purposes of performing services for our business, providing services as requested by you, and ensuring the security and integrity of our business, infrastructure, and the individuals we interact with. This includes, without limitation, receiving and processing your job application, evaluating your suitability for the position(s) you are applying for, conducting background checks, analyzing, and monitoring diversity, making you an offer (subject to our discretion), fulfilling administrative functions, complying with law, legal process, or requests from governmental or regulatory authorities, and exercising or defending legal claims.

California Applicant Recruitment Privacy Policy

We may change or update this Policy from time to time. When we do, we will communicate changes and updates to this Policy by posting the updated Policy on Nokia’s intranet with a new “Last Updated” date.

Contact Us

Please contact HR services at Contact us | Nokia if you require further information regarding this Policy.

Authorized Agents

If you want to make a request as an authorized agent on behalf of a California resident, you may use the submission methods noted above. As part of our verification process, we may request that you provide, as applicable, proof concerning your status as an authorized agent. In addition, we may require the individual on whose behalf you are making the request to verify their own identity or your permission to submit the request.