Notice on processing of personal data in the recruitment process

Data controller

The controller of candidates’ personal data processed in connection with participation in recruitment (“Data”) is the firm to which you are applying, i.e. Wardyński i Wspólnicy sp.k., Al. Ujazdowskie 10, 00-478 Warsaw, or WiW Services sp. z o.o., Al. Ujazdowskie 10, 00-478 Warsaw (the “Controller”). In matters related to the Data, in particular exercise of rights held under data protection regulations, please contact us in writing at the Controller’s address or by email to: dane.osobowe@wardynski.com.pl 

Purposes and grounds for processing Data

The Data will be processed for the following purposes and on the following legal grounds:

1. For the purpose of conducting the current recruitment process:

The grounds for processing of Data by the Controller are:

• Art. 6(1)(c) GDPR—processing necessary for compliance with a legal obligation to which the Controller is subject (exclusively with regard to recruitment concerning an employment contract)
• Art. 6(1)(b) GDPR—processing necessary to take steps prior to entering into a contract
• Art. 6(1)(a) or 9(2)(a) GDPR—in other respects—the candidate’s consent (in the latter case, if application documents contain special categories of data specified in Art. 9(1) GDPR, for example data concerning disability).

The Controller’s right to request the Data is provided by law or is necessary to enter into the contract, submission of the Data is necessary to participate in the recruitment process, and failure to submit the Data will prevent participation in the process. Otherwise, submission of the Data is voluntary, but may impact the assessment of suitability for work at the position for which the recruitment is held.

2. For the purpose of future recruitments, if consent to processing of Data in this respect is given:

The basis for processing the Data is consent, i.e. Art. 6(1)(a) or 9(2)(a) GDPR (in the latter case if application documents contain special categories of data specified in Art. 9(1) GDPR).

If the candidate does not consent to processing of Data by the Controller for the purposes of future recruitments, the Data will not be considered in future recruitments.

3. For the purpose of establishment, exercise or defence of legal claims (when necessary and in justified instances):

The grounds for processing of Data by the Controller are:

• Art. 6(1)(f) GDPR—i.e. a legitimate interest of the Controller, namely the ability to establish, exercise or defend against legal claims
• Art. 9(2)(f) GDPR—i.e. the necessity to establish, exercise or defend against legal claims in the case of special categories of data.

Sources of Data

If a recruitment agency participated in the recruitment process, the Controller may have received from the agency the following categories of Data: name, date of birth, contact details indicated by the candidate, information about education, professional qualifications, and employment to date, and other personal data provided by the candidate.

Data recipients

The candidate’s Data may be provided to entities with whom the Controller has concluded service agreements, such as recruitment agencies, independent recruiters working with the Controller, consultants, suppliers of IT tools supporting implementation of recruitment processes, advertisers, and entities from the Controller’s capital group. Personal data will not be transferred outside the European Economic Area.

Data storage period

The candidate’s personal Data will be stored for the duration of the recruitment process.

If the candidate consented to participation in future recruitment processes and processing of his or her Data for the purposes of such processes, the Data provided to us may be processed within two years after granting such consent.

To the extent that processing of Data occurs on the basis of consent, the Data may be processed until withdrawal of consent, but no longer than the aforementioned periods.

If necessary and in justified instances, the Data will stored for the period necessary for establishment, exercise or defence of legal claims.

Rights of the data subject

In connection with the Controller’s processing of the candidate’s Data, the candidate has the right of access to the Data, rectification of the Data, erasure or restriction of processing, the right to object to processing, and the right to Data portability. The candidate also has a right to lodge a complaint with the supervisory authority (i.e. the President of the Personal Data Protection Office). The ability to exercise these rights may depend on the basis for processing the given category of Data, and also on the occurrence of other circumstances provided by law. For additional information in this regard, please contact us in the manner indicated at the beginning of this notice.

Moreover, to the extent that the Controller processes the candidate’s Data based on his or her consent, the candidate has a right to withdraw consent at any time by contacting the Controller in the aforementioned manner. Withdrawal of consent shall not affect the lawfulness of processing occurring prior to withdrawal of consent.

Automated decision-making

The candidate’s Data will not be processed in a manner connected with automated decision-making, including profiling.