GPDR Information Clause for candidates for employees and co-workers

1. Fenbro sp. z o. o. based in Warsaw, ul. Al. Jerozolimskie 181B, 02-222 Warszawa, entered into the register of entrepreneurs kept by the District Court for the Capital City of Warsaw in Warsaw, 12th Commercial Division of the National Court Register, under KRS number: 0000947765, NIP: 7011070120, REGON: 521057577 – is the Personal Data Administrator (hereinafter referred to as the Administrator) of candidates for employees and co-workers, hereinafter referred to as Candidates.

2. Candidates’ personal data are processed by the Administrator for the following purposes: 

a) recruitment of employees and co-workers,

b) for the purposes of future recruitment, provided that the Candidate consents to such processing.

3. Providing personal data is voluntary, but necessary for the Candidate’s participation in the recruitment process. In particular, the Administrator has the right to request that Candidates provide or document personal data specified in Art. 221 § 1 of the Act of June 26, 1974 – Labour Code or personal data necessary to conclude a civil law contract. 

4. The Administrator processes personal data for the period necessary to achieve the purposes listed in point 2 above. Moreover, if the Candidate consents to the processing of personal data for the purposes of future recruitment, referred to in point. 2 letter b above, the Administrator will process such data for the indicated purpose for a period of three years from the date of such consent or until the Candidate withdraws consent before the expiry of this period, which will not affect the lawful processing of data before withdrawal of consent. Personal data may be processed for a period longer than that indicated in this point if such an obligation imposed on the Administrator results from specific legal provisions or is justified by the pursuit or defence of claims.

5. The source of personal data processed by the Administrator are Candidates. 

6. The legal basis for the processing of Candidates’ personal data is:

a) art. 6 section 1 letter b GDPR, i.e. the necessity to take action at the request of the Candidate before concluding the contract, or

b) art. 6 section 1 letter a GDPR, i.e. the Candidate’s consent to the processing of personal data for the purposes of future recruitment, or 

c) art. 6 section 1 letter c GDPR – legal obligation arising from legal provisions – i.e. Art. 229 of the Labour Code, or

d) art. 9 section 2 letter h GDPR – the necessity of processing for the purposes of health prevention or occupational medicine and to assess the employee’s ability to work, or

e) art. 6 section 1 letter f GDPR – the legitimate interest of the administrator consisting in the possibility of taking actions related to protection against claims or pursuing claims related to the recruitment process.

7. The Administrator uses tools from Google Ireland Ltd (Gmail, Google Workspace). As a rule, data processed as part of the use of these tools is processed on servers located within the EEA (European Economic Area). However, the entity providing these tools may be obliged to transfer data to third parties if such an obligation is imposed on it by law or if the transfer is necessary due to the characteristics of the services provided (SaaS, hosting, etc.). The transfer of personal data to the United States is based on the Decision of the European Commission of July 10, 2023 on ensuring an adequate level of protection by the EU-US Data Protection Framework (Article 45(1) of the GDPR). The entity importing personal data, i.e. Google LLC, meets the decision criteria and participates in the Data Protection Framework (DPF) program: https://www.dataprivacyframework.gov/s/participant-search . The above processing concerns e-mail communication. In the remaining scope, Candidates’ personal data are not transferred to a third country or international organization within the meaning of the provisions of the GDPR. 

8. The Administrator does not disclose personal data to third parties without the express consent of the data subject. Personal data, without the consent of the data subject, may be made available only to public law entities, i.e. authorities and administration (e.g. tax authorities, law enforcement authorities and other entities authorized by generally applicable legal provisions, such as ZUS or the Tax Office). in cases provided for by generally applicable law.

9. Personal data may be entrusted for processing to Entities processing such data for the Administrator. The Administrator entrusts the personal data of Candidates to IT companies providing hosting services, servicing Internet domains and dealing with the operation of computer systems used by the Administrator.

10. Candidates’ personal data are not subject to profiling.

11. In accordance with the provisions of the GDPR, Candidates have the right to: 

a) be informed about the processing of personal data, 

b) access to their personal data, 

c) correcting, supplementing, updating and rectifying personal data, 

d) deletion of data (right to be forgotten), 

e) processing restrictions, 

f) data transfer, 

g) object to the processing of personal data, 

h) in the case of the legal basis referred to in point 6(a). b above – the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal, 

i) not being subject to profiling, 

j) submit a complaint to the supervisory authority (i.e. the President of the Personal Data Protection Office), taking into account the rules for using and exercising these rights arising from the provisions of the GDPR.

12. All inquiries, requests and complaints regarding the processing of personal data by the Administrator, hereinafter referred to as Notifications, should be sent to the e-mail address: [email protected] or in writing to the following address: Fenbro sp. z o.o., ul. Al. Jerozolimskie 181B, 02-222 Warszawa.

13. The Notification must clearly indicate:

a) data of the person or persons concerned by the Notification,

b) the event that is the reason for the Notification,

c) the demands and the legal basis for these demands,

d) the expected way of resolving the matter.