Staff Privacy Notice
Last Updated: June 4, 2026
This Privacy Notice explains why we collect personal data of our staff members and what we do with it when we are the controller of that personal data.
In this notice, "Staff" refers to current and former employees, individual contractors, interns, and job applicants. Within CubiCasa and its entities, the data controller will be the CubiCasa entity you have your employment or contractual relationship with.
This privacy notice supplements the privacy notice available at https://www.cubi.casa/privacy-notice/.
1. How do we collect information and what information do we process?
We process personal data for the purposes outlined in Section 4. While this information is primarily provided by you directly, we may also receive relevant details from authorities (like local tax administration to process payroll).
This data is organized into the following categories:
- Identification and Contact Data: Name, address, phone number, personal email, date of birth, and national identification numbers (e.g., SSN, NI number, or Tax ID).
- Employment and Professional Data: Job title, department, work history, educational qualifications, professional certifications, and references from previous employers.
- Financial and Compensation Data: Bank account details, salary, tax status, bonus information, and benefits/pension details.
- Recruitment Data: Information provided in your CV, cover letter, or during interviews, including right-to-work documentation.
- Work Performance and Discipline: performance reviews, training records, and attendance or disciplinary records.
- Technical and Usage Data: Information regarding your use of company IT systems, such as log-in times, IP addresses, and activity on company-issued devices or software (e.g., Slack, email, or CubiCasa internal tools). This includes data collected through information security tools deployed on corporate-owned devices, such as endpoint detection and response (EDR) systems and device management platforms (e.g., CarbonBlack EDR and Workspace ONE). These tools collect endpoint metadata, including process activity, network connection metadata (IP addresses, ports, protocols, and domain names), file system changes, and device configuration data. These tools do not monitor or record the content of electronic communications (e.g., emails, chats, or web browsing content).
- Sensitive Information (Special Categories): Where required or permitted by law, we may process information regarding your health (e.g., for sick leave management and compliance with occupational health and social security obligations). Such processing is based on compliance with legal obligations under applicable labor and social security legislation (Article 9(2)(b) GDPR).
2. Purposes and legal bases for the processing of your personal data
We process your data for specific purposes under the following legal bases:
- Fulfillment of Contract and legal obligations: To perform our obligations under your employment or service contract, such as paying your compensation, managing your benefits, and administering your pension. To comply with statutory requirements, including tax laws, labor laws, social security obligations, and health and safety regulations.
- Legitimate Interests: To ensure the efficient management of our business. This includes workforce planning, career path development, maintaining IT security (including the deployment of endpoint detection and response tools and device management platforms on corporate-owned devices), protecting company property, and conducting internal investigations. With respect to IT security monitoring, the employer's legitimate interest in protecting its networks, systems, and data constitutes a valid legal basis under Article 6(1)(f) GDPR.
- Consent: In limited cases, we may ask for your explicit consent for specific activities (e.g., using your photo in marketing materials). You have the right to refuse or withdraw this consent at any time.
3. How long do we retain your information?
CubiCasa retains your personal data only for as long as is necessary to fulfill the purposes for which it was collected.
- During Employment or service agreement: Most data is kept for the duration of your relationship with us. However, we will always either delete or anonymise your personal data where we do not have a legal basis for keeping it anymore. We must retain some data in accordance with local statutory retention requirements. In Finland, information required for bookkeeping purposes is retained for 10 years after the end of the fiscal year.
- After Termination: We retain certain information (e.g., tax records or employment history) for a period defined by local statutory retention requirements. In Spain, this includes, among others, a four (4) year retention period for tax and social security records, and the retention of employment documentation for the applicable statute of limitations period under Spanish labor law. In Finland, information about your employment contract and basic personal data must be retained for 10 years after the termination of the employment relationship; and records of training or disciplinary records are retained for 5 years after the termination of employment.
- Applicants: If you are not hired, we generally delete your application data within 24 months unless you consent to us keeping it for future opportunities. If we do not have a legal basis for keeping your personal data after a decision of non-recruitment, we delete the personal data immediately.
4. How is the personal data we collect disclosed?
We do not sell your personal data. We may share your information with the following parties:
- 4.1 Service Providers: Third-party vendors who provide services such as payroll processing, benefits administration, IT support, and cloud storage.
- 4.2 Internal Disclosure: Your data may be shared within the CubiCasa family of companies (e.g., for global management or reporting purposes).
- 4.3 Professional Advisors: Lawyers, auditors, or insurers when necessary for legal or business advice.
- 4.4 For Legal Reasons: We may disclose data to government authorities, tax offices, or law enforcement to comply with legal obligations or court orders.
- 4.5 Business Transfers: If CubiCasa is involved in a merger or acquisition, staff data may be transferred to the new entity under strict confidentiality.
5. Transfer of personal information outside the EEA
As a global company, CubiCasa may transfer your personal data to countries outside the European Economic Area (EEA), such as the United States. In these cases, we ensure your data is protected by implementing Standard Contractual Clauses (SCCs) or other legally recognized safeguards to maintain a level of protection equivalent to that in the EEA. Further information on the specific safeguards applied may be obtained by contacting us at the address set out in Section 8 below.
6. Your rights
Depending on your location, you may have the following rights regarding your personal data:
- Access: The right to request a copy of the personal data we hold about you.
- Rectification: The right to correct inaccurate or incomplete data.
- Erasure ("Right to be Forgotten"): The right to request deletion of your data where it is no longer needed.
- Restriction and Objection: The right to object to or restrict certain types of processing, such as for legitimate interests.
- Data Portability: The right to receive your data in a structured, machine-readable format.
- Right to lodge a Complaint: You have the right to lodge a complaint with the competent supervisory authority.
- In Spain, the competent authority is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid (www.aepd.es).
- In Finland, the competent authority is Data Protection Ombudsman: https://tietosuoja.fi/etusivu
To exercise these rights, please contact the HR department (hr@cubicasa.com).
7. Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our practices or legal requirements. Updated versions will be posted on our internal portal or emailed to staff directly.
8. Contact us
If you have questions about this Privacy Notice or how your data is handled, please contact:
hr@cubicasa.com
