Ericsson Recruitment Privacy Notice

We are glad you are exploring career opportunities with Ericsson.

This Recruitment Privacy Notice describes how Telefonaktiebolaget LM Ericsson and other Ericsson Group companies you interact with processes personal data collected throughout our recruitment and hiring process. It sets out what personal data we collect, why we collect it, how we use it, with whom we share it and what rights you have in relation to your personal data.

The Ericsson entity to which you have submitted your job application is the data controller responsible for the processing of your personal data as described in this notice. However, for certain processing activities, Ericsson AB and other Ericsson Group companies may jointly determine the purposes and means of processing, meaning that they act as joint controllers for such personal data. To provide you with a seamless experience, including in relation to the exercise of your data subject rights, we have centralized key aspects of our privacy operations covered by a joint controller arrangement. Contact details for our central privacy team are set out in the section How to contact Ericsson below and information on how to exercise your rights is provided in the section Your rights below.

1.1 Who is responsible for your personal data processing?

Your personal data will be processed by two joint controllers, meaning they decide jointly how and why personal data is processed:

• Telefonaktiebolaget LM Ericsson ("LME"), which sets the group-wide recruitment framework for Ericsson including the tools used, the categories of data collected, and the applicable procedures.
• The local Ericsson Group company that will be your employer and that has decided to fill the position you are applying for.

For roles within Ericsson’s global functions where the employing entity has not yet been confirmed, LME acts as the primary controller until the local entity is determined. You will be informed of the local employing entity as soon as a decision is made. After that the local entity will act as joint controller with LME, except for any processing required by local law, for which the local Ericsson Group Company acts as an independent controller.

Where multiple local Ericsson entities are involved in a recruitment process, they act as independent controllers and do not jointly control each other's processing of your personal data.

We have centralized key aspects of our privacy operations covered by the joint controller arrangement. Contact details for our central privacy team are listed in the section “How to contact Ericsson” and information on how to exercise your rights is set forth in the section “Your rights” below.

1.2 What personal data do we process, for which purposes, and on which legal bases?

1.2.1 Job candidates

This section applies to you as a job candidate for any position at Ericsson.

Sources of personal data

We collect your personal data from you in connection with your application and during any interviews with us. Where relevant and permissible under applicable laws, we also collect information from recruitment agencies, previous employers, our employees, publicly available information, and referees.

If you do not share your personal data with us

You are not obliged to share your personal data with us. However, certain information is necessary for us to process your application and to enter into an employment contract with you. Such necessary information is clearly marked in the application form. If you do not provide us with the information, we may not be able to process your application or fulfil our obligations towards you.

Background checks and vetting

As part of Ericsson’s recruitment process, background checks may be conducted for candidates applying for positions classified as high-risk due to the nature of the role or the level of access to sensitive information and resources. Such checks are carried out only where appropriate and permitted under applicable law. The purpose of these checks is to verify information provided during the recruitment process and to assess the candidate’s suitability, integrity, and reliability for the position.

The scope and nature of any background checks conducted depend on the position, level of responsibility, and applicable legal requirements in the relevant jurisdiction.

Any information obtained through the background check process is handled in accordance with Ericsson’s internal procedures and is shared only with personnel involved in the recruitment process and relevant compliance assessments, on a need-to-know basis.

Purposes of processing: why do we process your personal data?	Personal data categories we may process in this context	Legal basis for our processing (where required under applicable laws)
To administer the recruitment process and communicate with the job candidate	Contact information, such as your name, email address, phone number, and time zone Voice and image recording in connection with interviews	Legitimate interests
To evaluate the job candidate	Information included in your application documents, e.g., title, current and previous employer(s), professional experience, certificates, education, languages, etc. Other information provided by you in the hiring process Personal data collected in the course of interviews, including transcripts, and video and audio recordings Results from tests and assessments carried out during the recruitment process, including a personality, skill, or leadership profile Information provided by any references	Legitimate interests
To perform background checks and vetting; identity, employment history, education, professional integrity	Identity data, such as name, date of birth, address history, ID/passport, contact details CV, previous roles, references Degrees, certifications Directorships, conflicts of interest Information provided on your professional social media, such as LinkedIn	Legitimate interests
To perform background checks and vetting; financial checks, criminal records, and sanctions watchlists	Credit history, bankruptcy Criminal convictions, police extracts Sanctions lists, adverse media	Legitimate interests Compliance with legal obligation (for legally required background checks in certain countries) Where required by applicable law, Ericsson will obtain the candidate's explicit consent before initiating a background check. Such consent relates solely to the commencement of the background check and does not constitute the legal basis for the subsequent processing of personal data arising from the check.
To manage and/or assist in connection with visa/immigration matters	Contact information, such as your name, email address, phone number Passport data, nationality, any immigration documents Where necessary, information related to your immigration status and supporting documentation required for visa or work permit applications	Consent Compliance with legal obligations
To prepare an employment contract	Identification information, e.g., date of birth, personal identity number Compensation details Information necessary to verify your right to work, such as your immigration status, visa or work permit details Personal data necessary to enable electronic signature of documents, including technical data such as IP address, authentication data, and audit logs	Legal obligation Performance of contract
To consider the candidate for further opportunities	Contact information, such as your name, email address, phone number, and time zone Information included in your application documents, e.g., title, current and previous employer(s), professional experience, certificates, education, languages, etc. Publicly searchable data, such as social media or online portfolios Other information provided by you in the hiring process	Legitimate interest
To provide insights and statistics The processing activity is limited to the aggregation of personal data. Following aggregation, the data is anonymized and subsequently used solely in its anonymized form for statistical purposes.	Personal data as above Gender	Legitimate interest
To comply with equality and labor laws, including to be able to provide reasonable accommodations and accessibility	Where legally required, health data and diversity data	Compliance with legal obligations

1.2.2 Referees and other persons appearing in connection with recruitment

This section applies to you if you are listed as a reference or for any other reason appear as a point of contact in connection with an application process.

Purposes of processing: why do we process your personal data?	Personal data categories we may process in this context	Legal basis for our processing (where required under applicable laws)
To collect and assess information from referees in connection with a job candidate's participation in a recruitment process with us	Contact information, such as name, title, employer, email address, phone number Information about the referee's relationship with the job candidate Reference information provided by the referee	Legitimate interests

1.3 How long do we keep your personal data?

Ericsson retains personal data only for as long as necessary to fulfil the purposes described in this notice.

Talent profiles

Inactive candidate profiles will be erased automatically after 12 months (6 months for Germany, Pakistan, Poland, Switzerland, and the United Kingdom).

Job candidates

Job candidates’ personal data will be retained for the duration of the recruitment process and for up to two years after the process has ended. This allows us to comply with legal obligations and to establish, exercise, or defend legal claims.

Uploaded CVs for use in the matching functionality will be purged after 24 hours if the candidate does not apply for a job.

Legal requirements

In some cases, Ericsson may retain personal data for longer where required by applicable national law, for example to comply with employment or anti-discrimination legislation.

Referees

Personal data regarding referees and other individuals appearing in connection with recruitment will be retained as follows:

• Referees etc. for job candidates who enter into an employment contract with Ericsson: in accordance with the retention periods appliable to the relevant job candidate’s personal data.
• Referees etc. for job candidates who do not enter into an employment contract with Ericsson: in accordance with applicable national law.

1.4 Who do we share your personal data with?

Access to personal data will be granted on a need-to-know basis with geographical and legal limits considered. Ericsson ensures that all individuals with access to personal data, including third parties, are required to protect and handle the information in accordance with legal and contractual obligations as well as instructions from Ericsson.

We may also disclose your personal data if required to do so by law, for example in response to a court order or to otherwise cooperate with governmental agencies. If the processing is based on compliance with legal obligation outside of the EEA, the Ericsson entities established in Europe will rely on legitimate interest as the legal basis where applicable. Categories of recipients would include judicial and governmental bodies, regulatory bodies, law enforcement authorities, and national security organizations.

Where local laws provide additional or different requirements regarding the processing of personal data, such laws will apply accordingly.

1.4.1 Categories of recipients

Ericsson Group

Your personal data is shared with relevant Ericsson Group entities in accordance with our international data transfer mechanisms (as stated in the section “International data transfers” below) where necessary to fulfill the purposes described in this privacy notice.

M&A

In the event that Ericsson sells or restructures a business or assets, Ericsson may disclose your personal data to a potential buyer of such business or assets. If Ericsson or a substantial portion of Ericsson’s assets are acquired by a third party, personal data may be shared if necessary. In such cases, appropriate confidentiality obligations and safeguards will be applied.

Suppliers

Ericsson works with third-party service providers to provide services on behalf of Ericsson. These third parties act on our behalf as data processors and are contractually bound to process the personal data only in accordance with our instructions. In certain cases the third parties may act as controllers and process the data for their own purposes, for example when we use law firms’ and travel agencies’ services.

We limit the personal data provided to these service providers to what is necessary for them to perform their functions on our behalf, and we require them to comply with applicable laws and to maintain the confidentiality of such personal data. Third party suppliers are for example:

• Cloud service providers (e.g. data storage, software hosting)
• AI-driven service providers (e.g. machine learning and generative AI platforms and HR analytics platforms)
• HR and recruitment service providers (e.g. background check agencies, talent assessment platforms)
• Legal and compliance service providers (e.g. law firms)
• Relocation, tax and travel management services (e.g. visa processing, tax advisory, corporate travel agencies)
• Other third party service providers (e.g. document signing platforms)

1.5 International data transfers

Since Ericsson is present around the globe, personal data will be transferred across international borders to Ericsson entities in other countries and to our contracted service providers. In limited circumstances, we may disclose data to public authorities where required by applicable laws, subject to appropriate safeguards. Some countries may not have similar data protection laws as the country where we collect your personal data. In such cases, Ericsson implements appropriate safeguards to protect your personal data as described below.

You may request further information about international transfers and obtain a copy of the relevant safeguards by contacting us.

• We may transfer your personal data from the EEA to countries/sectors which the European Commission has found to provide adequate level of data protection. Information on countries that have been granted with an adequacy decision is available here.
• We may transfer your personal data from the UK to the countries and territories covered by the UK adequacy regulations. Information on countries covered by the UK Adequacy regulations is available here.
• We may transfer your personal data from Switzerland to the countries and territories that are considered to provide appropriate level of protection under the Ordinance to the Federal Act on Data Protection. Information on countries that guarantee an adequate level of data protection according to the Swiss authority is available here.
• We may rely on our Binding Corporate Rules approved by the European data protection authorities to transfer personal data between Ericsson Group BCR Members. A copy of our Binding Corporate Rules is available is available here.
• We may rely on the EU Commission’s Standard Contractual Clauses available here or other appropriate safeguards under the GDPR as well as the UK Addendums to the EU Standard Contractual Clauses and other appropriate safeguards under the UK data protection law.

1.6 Your Rights

Subject to the applicable data protection laws, you may have the following rights in relation to your personal data. You can exercise your rights by using this form. Ericsson will respond within the timeframe required by applicable law.

Right to access your personal data. You have the right to obtain confirmation on whether Ericsson processes personal data about you and receive a copy of such data as well as information on how we process your personal data.

Right to rectification. You have the right to rectify any inaccurate personal data we process about you or have any incomplete personal data about you completed.

Right to erasure. You have the right to have your personal data deleted, if (i) the personal data has been unlawfully processed; (ii) we no longer need such data for the purposes of the processing; or (iii) the processing is based on consent and you withdraw your consent, and we have no other legal basis for processing the data. However, Ericsson will not delete your personal data if Ericsson has a legal obligation to retain the data, the personal data is still necessary for the purposes of processing, or if we can demonstrate compelling legitimate grounds for continuing the processing.

Right to data portability. You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, and you may have that data ported directly to another controller, where such personal data is processed based on your consent or to perform a contract with you.

Right to restriction. You have the right to restrict our processing of your personal data where you believe that the personal data we process is inaccurate or our processing is unlawful. You may also restrict our processing if Ericsson no longer needs the personal data, but you want us to store the data for the establishment, exercise, or defense of legal claims.

You may also require us to restrict the processing of your personal data for the period when we assess your right to object to the processing of your personal data.

Right to object. You have the right to object to our processing of your personal data when we rely on our legitimate interests or those of a third party or if we in an exceptional case perform tasks in public interest. If you object, we will cease processing your personal data and erase the data, unless we can demonstrate compelling legitimate grounds for the processing, or if the data is needed for the establishment, exercise, or defense of legal claims.

Right to information. You have the right to receive transparent information about how we process your personal data. We usually provide you with this information in our privacy notices and other similar documentation and communications.

Right to withdraw your consent. You have the right to withdraw any consent for processing you provided at any given time. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

Right to lodge a complaint with a supervisory authority. You also have the right to lodge a complaint regarding the processing of your personal data. If your complaint relates to a data processing activity in Sweden or a Group steered process, you can contact the Swedish Authority for Privacy Protection (IMY) here. You can also submit a complaint to your own national data protection authority. You can find EEA supervisory authority contact details here, in the local privacy notice (if applicable), or by reaching out to your local Data  Protection Officer or Group Data Protection Officer. Contact details for Ericsson’s Group Data Protection Officer are set out in the section “How to contact Ericsson” below.

1.7 Automated decision-making and profiling

Ericsson uses technology to support and enhance its recruitment processes. In some cases, we may use automated tools and artificial intelligence (AI) to help assess applications, analyze candidate information, and identify relevant skills, qualifications, experience, or other criteria that may be relevant to a role.

Ericsson may also use automatic disqualifier questions as part of the application process. These questions are designed to assess whether candidates meet certain essential requirements for a particular position, such as having the legal right to work in the relevant job location. If a candidate's response indicates that a mandatory requirement is not met, the candidate may be automatically excluded from further consideration for that role.

In addition, Ericsson may use AI-enabled matching and ranking tools to compare candidate profiles against role requirements. This may include the creation of benchmark candidate profiles against which applications are assessed and assigned a match score. These activities involve an automated analysis of personal data to evaluate aspects relating to a candidate's professional qualifications, skills, experience, or suitability for a role.

Any insights, recommendations, scores, rankings, or other outputs generated by these tools are used to support, not replace, the judgment of Ericsson's talent acquisition teams and hiring managers. Except where candidates are automatically excluded based on predefined mandatory eligibility criteria, all hiring decisions involve meaningful human review and oversight.

We use the information provided in an individual's application, together with information generated through interviews, assessments, and recruitment tools, to evaluate their suitability for employment. Following this assessment process, a candidate may be rejected for the position, offered employment, or considered for other suitable opportunities within Ericsson.

1.8 Cookies

Ericsson’s career site places necessary cookies on your device. These cookies are session cookies, required to provide the tool's functionality. Please click the following link to view the cookies collected for Ericsson Careers.

1.9 How to contact Ericsson

If you have any questions or a complaint pertaining to your personal data you can contact the LME Data Protection Officer by mail at Ericsson AB, Group Function Legal Affairs, 164 80 Stockholm, Sweden or you can send an e-mail to ericsson.group.privacy@ericsson.com.

It is also possible to contact a local Data Protection Officer in your country. You can find the respective contact details here.

As set forth in the section “Your rights” above, you can exercise your rights under applicable data protection law by using this form or by reaching out to a Data Protection Officer.

1.10 Changes to this Recruitment Privacy Notice

Ericsson may, from time to time, make changes to this Recruitment Privacy Notice to reflect any changes in our data processing practices. We recommend that you visit this Recruitment Privacy Notice on occasion to learn about new privacy practices or changes. If we make material changes to the way in which we use your personal data, we will use reasonable efforts to notify you by means consistent with applicable law and will take additional steps as required by applicable law.