This notice explains what happens to your personal data when you use this site: the pay calculator, the worker profile form, the company request form, the request for contractor's-liability (tilaajavastuu) documents, and the e-mails we exchange afterwards. It is written to meet Article 13 of the General Data Protection Regulation (GDPR) and section 4 of the Finnish Act on the Protection of Privacy in Working Life (759/2004), which applies to job applicants as well as employees.
Short version: the calculator sends nothing anywhere. A profile you send is used to assess your suitability for construction work in Finland and to contact you; it is kept for two years after the last recruitment process you took part in. The talent pool is a separate choice, based on your consent, for 12 months at a time. No decision about you is made by a machine. You can see, correct or delete your data by writing to info@gene-works.fi with your application ID.
Who is responsible for your data (controller)
Who is responsible for your data (controller)
Item
Details
Controller
Gene-Works Oy, a company registered in Finland
Business ID (Y-tunnus)
2198820-6
Registered address
Tommolankatu 9, c/o Prismakeskus, 45130 Kouvola, Finland
Contact for data protection matters
info@gene-works.fi — subject line "Privacy". We have not appointed a separate data protection officer; the same address reaches the people who handle your data.
Supervisory authority
Office of the Data Protection Ombudsman, Finland (tietosuojavaltuutettu), tietosuoja.fi
Version of this notice
26 September 2026 — checked against the sources listed at the end; legal review pending
The calculator — nothing leaves your browser
The pay calculator runs entirely in your browser. Your answers (trade, experience band, shift, tax percentage, basis for the right to work) and the result are not sent to us and are not stored on our side. You do not need to give a name or an e-mail address to see a result.
Only if you press "Send my profile" is a snapshot of the calculation (your answers, the pay group range, the rates and the version of the rate tables) attached to your profile form — so that we check your case against the same numbers you saw. Until you send the form, the snapshot exists only in your browser's session storage and disappears when you close the tab. Details: Cookies.
Where your application is stored
Your application is stored in Cloudflare Workers KV — a key-value storage that replicates across Cloudflare’s network, so copies may exist outside the EU. It is encrypted at rest, and Cloudflare acts as our processor under its GDPR data-processing agreement. Our own server reads the queue of messages to send and nothing else. We plan to move the storage to a database pinned to the EU; until then this page says plainly where the data actually is.
What we process, why, on what basis and for how long
What we process, why, on what basis and for how long
Data
Purpose
Legal basis
Retention
Worker profile — trade; experience band; country of residence; basis for the right to work in Finland (and, if you give it, permit type and validity); e-mail; optionally phone or Telegram, preferred language of communication, earliest start month, rotation preference, English level; the calculation snapshot; the language of the page; the campaign tag (UTM) if you came from an advertisement; your application ID and the time of sending
To assess whether we can offer you construction work in Finland, to contact you for a short call, to prepare a written offer when a site needs your trade, and to keep a record of what we told you and when
Steps at your request before a possible employment contract (GDPR Art. 6(1)(b)); the employer's legal duty to verify the right to work of foreign employees (Aliens Act 301/2004, GDPR Art. 6(1)(c)); only directly necessary data is collected (Act 759/2004, section 3)
2 years after the end of the last recruitment process you took part in — the period accepted by the Data Protection Ombudsman (decision 13.8.2020) and matching the limitation periods for claims about recruitment. Then deleted.
Talent pool — the same profile, kept after the recruitment process for future sites
To keep you in our pool of candidates and to send you a short monthly update on sites and vacancies, which also reminds you how to leave the pool
Your consent (GDPR Art. 6(1)(a)) — a separate, unticked box on the form. You can withdraw at any time; withdrawing does not affect anything done before
12 months from your consent. Towards the end we ask you to reconfirm; without reconfirmation the profile is deleted. If a recruitment process starts in the meantime, the 2-year rule above applies from its end.
Right-to-work records — after we hire you: the basis of your right to work and its validity, and the documents showing it (passport or ID, residence permit card)
Legal duty of the employer to verify the right to work and to keep the basis available for the occupational safety authority
2 years after the end of the employment relationship. These documents are never asked for on this site — only by invitation, for a specific site, after we have spoken with you.
Company request — company name, Business ID (optional), contact name, e-mail, phone, what you need (trades, headcount, site or city, start date), your message
To reply within one working day, to prepare an offer and to keep the correspondence
Steps at your request before a possible contract (GDPR Art. 6(1)(b)); our legitimate interest in answering business enquiries (Art. 6(1)(f))
For as long as the enquiry and any contract following it are open. Enquiries that lead to no contract are deleted after 24 months (decision of 26 September 2026); legal review may shorten it.
Request for tilaajavastuu documents — company name, Business ID, e-mail
To send you our contractor's-liability document package and to record which version was sent to whom and when
Act on the Contractor's Obligations and Liability 1233/2006 (the client must obtain the documents before signing); GDPR Art. 6(1)(b) and 6(1)(f)
2 years after the end of the work under the contract, matching the client's own retention duty. 24 months when no contract follows (decision of 26 September 2026).
Anti-spam data — a hidden timestamp set when the form loads and an empty hidden field
To reject submissions filled in by robots (too fast, or the hidden field filled)
Our legitimate interest in keeping the forms usable (GDPR Art. 6(1)(f))
Processed only while your form is being received; not stored.
Technical data — your IP address and browser type, processed by our hosting provider to deliver the pages and protect the site
Delivering the site; protection against attacks
Legitimate interest of the hosting provider and ours (GDPR Art. 6(1)(f))
We do not receive or store this data. Page-view statistics reach us only in aggregated form, without cookies — see Cookies.
Swipe the table sideways on a phone.
What we do not ask — and why
Finnish law allows an employer to process only data that is directly necessary for the employment relationship (Act 759/2004, section 3). Consent does not make extra questions lawful, so the form does not have them. We do not ask for your date of birth, gender, family situation, health, religion, union membership, personal identity code, home address, nationality, photo, bank account or any files.
We ask for your basis for working in Finland because the employer must verify the right to work by law; this is a question about legal status, not about nationality or origin (Non-discrimination Act 1325/2014, section 8). We collect your data from you only. We do not search social media or other sources about you. If that ever changes for a specific step — for example a check with an authority — we tell you first, as section 4 of Act 759/2004 requires.
Who receives your data (recipients and processors)
Who receives your data (recipients and processors)
Recipient
What they get
Where
Role
Our recruitment team at Gene-Works Oy
Your full profile and the correspondence
Finland
Controller — the only people who read your profile
Cloudflare, Inc. (hosting of the site, the form endpoints and the storage behind them; Web Analytics)
Technical request data, and the application itself: it is stored in Cloudflare Workers KV until our server has delivered the messages and for as long as the record is kept. Analytics is cookieless and aggregated.
Served and stored on Cloudflare’s network, which replicates globally, under its GDPR data-processing agreement
Processor
Resend (e-mail delivery service)
The e-mails our own server sends: your confirmation and the internal card addressed to our mailbox. The service processes e-mail addresses, subjects and delivery timestamps.
Message metadata is processed in the United States. TODO: transfer basis (EU–US Data Privacy Framework certification or standard contractual clauses) is being confirmed at legal review.
Processor
Telegram (instant notification to our recruiters) — only if this channel is switched on
One line without personal details: the application ID, the trade and the country. No name, no e-mail, no phone, no calculation.
Third country; TODO: confirm at legal review whether the channel stays on and on what transfer basis
Processor
A client company (user company, käyttäjäyritys) — only when we propose you for a specific site, and you know about it
What the client needs for its own legal duties: your name, trade, qualifications and cards with validity, your right-to-work basis and validity, agreed rate and hours. Never your passport copy, tax card, bank details or net pay — see Data and confidentiality
Finland
Independent controller for the data it receives
Occupational safety authority (työsuojelu, formerly AVI) and other authorities
What the law entitles them to on request — contracts, collective-agreement classification, hours, payslips, right-to-work basis
Finland
Authority
Swipe the table sideways on a phone.
We do not sell or rent your data, and we do not use it for advertising. In the current version of the site nothing is written to a database: your form becomes an e-mail to our mailbox (and, if switched on, a Telegram card) plus a confirmation to you. When we add storage, it will be located in the EU and this notice will be updated with a new version date.
Transfers outside the EU and EEA
Your profile goes to our mailbox at a Finnish e-mail provider and stays in the EU; any database we add will be located in the EU. Two tools may process limited data outside the EEA: the e-mail delivery service (Resend, United States — addresses, subjects and delivery timestamps of the e-mails we send) and, if switched on, Telegram for a short internal notification. Transfers outside the EEA require a basis under Chapter V of the GDPR — an adequacy decision or standard contractual clauses. TODO: the exact basis for each tool is being confirmed at legal review; this paragraph will then be updated. You may ask us for a copy of the relevant safeguards at info@gene-works.fi.
No automated decisions
The calculator is guidance, not a decision. It shows a preliminary pay-group range based on your answers and the published collective-agreement tables; the group, the rate and all terms are confirmed by a person after checking your documents and skills, and only in a written offer. No profiling and no automated decision with legal effect on you (GDPR Art. 22) takes place on this site or in our recruitment.
Your rights and how to use them
You have the right to access the data we hold about you, to have it corrected, to have it deleted, to restrict or object to processing, to receive the data you gave us in a machine-readable form, and to withdraw a consent at any time. Withdrawing consent does not affect what was done before it.
How: write to info@gene-works.fi from the e-mail address you used on the form and quote your application ID (GW-2026-…). We reply within one month, as the GDPR requires; in a complex case we may extend by two months and tell you why. Every talent-pool e-mail also carries a link to leave the pool or delete your profile. Deletion has limits: where the law obliges us to keep a record (for example the right-to-work basis of an employee, or a profile within the two-year period after a recruitment), we tell you what is kept and until when.
If you think we handle your data unlawfully, you can complain to the Office of the Data Protection Ombudsman (tietosuojavaltuutettu), tietosuoja.fi. We would like to hear from you first, but that is not a condition.
Security
The site is served over an encrypted connection. Your profile is read only by our recruitment team. We never ask for money, deposits or your passport before a signed contract; documents proving your right to work are requested by invitation, for a specific site, into a protected storage — not through this site's forms and not by chat. Every message from us comes from an @gene-works.fi address and quotes your ID; if a message does not, do not answer it — forward it to info@gene-works.fi.
Sign-in links and sessions: the link in your confirmation e-mail works once and expires after 30 days; the session it creates lives 30 days on that device or until you log out. We keep a hash of the IP address that sent the form, not the address itself, so that we can brake abuse without keeping a log of where people write from.
Common questions
Does the calculator store anything about me?
No. Everything happens in your browser. Only if you press "Send my profile" is the calculation attached to your form, and it is stored in your browser's session storage until you close the tab.
I sent a profile but did not tick the talent-pool box. What happens to it?
It is used for the current recruitment and kept for two years after that recruitment ends, then deleted. You will not receive the monthly update.
Will a client see my passport, tax card or how much I take home?
No. A client sees what it needs for its own legal duties — your name, trade, cards with validity, right-to-work basis and the agreed rate and hours. Details: Data and confidentiality.
How do I delete my data?
Write to info@gene-works.fi with your application ID, or use the link in any talent-pool e-mail. We confirm what was deleted and what, if anything, the law obliges us to keep and until when.
Do you use my e-mail for advertising?
No. You receive a confirmation, messages about your own recruitment and, only if you ticked the box, one short update a month about sites and vacancies.
Sources this notice relies on
GDPR Articles 6, 12–22 and Chapter V · Act on the Protection of Privacy in Working Life 759/2004, sections 3 and 4 · Aliens Act 301/2004, chapter 5 (employer's duties and the two-year record) · Non-discrimination Act 1325/2014, section 8 · Act on the Contractor's Obligations and Liability 1233/2006 · Decision of the Data Protection Ombudsman of 13 August 2020 on the retention of applicant data (two years after the last recruitment). Checked against the source texts on 25–26 September 2026.
Privacy notice, version of 26 September 2026. Checked 26 September 2026 against the sources above; legal review pending. Changes to this notice are published on this page with a new version date.