Personal Data Processing

Information on the Principles of Personal Data Processing and Protection at Polarys Polska sp. z o.o.

In accordance with Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: “GDPR”), we hereby inform you that:

Joint Controllers

The joint controllers of the personal data of a candidate applying for employment (hereinafter: the “Candidate”) are:

POLARYS POLSKA Sp. z o.o., with its registered office in Kraków, ul. Rakowicka 1/20-21, 31-511 Kraków, entered into the Register of Entrepreneurs of the National Court Register maintained by the District Court for Kraków-Śródmieście in Kraków, 11th Commercial Division, under KRS number: 0000680468, NIP: 6751595669,

and

SILAMIR Société par actions simplifiée, with its registered office in Paris, 23 Rue d’Anjou 75008 Paris, entered into the Registre du Commerce et des Sociétés under number RCS: 533217725

(hereinafter collectively: the “Joint Controllers” or “Controllers”).

 

Contact Details

For all matters related to the processing of personal data, the Candidate may contact the Joint Controllers via email:

dpo.pl@polarysgroup.com – contact address for POLARYS POLSKA Sp. z o.o.

ptroutaud@silamir.com – contact address for SILAMIR Société par actions simplifiée

Purposes of Processing

The Controllers process the Candidate’s personal data for the following purposes:

  1. conducting the current recruitment process and assessing the Candidate’s application;
  2. conducting recruitment processes on behalf of the Controllers’ clients and business partners;
  3. enabling the Candidate to participate in future recruitment processes conducted by the Controllers, both for their own needs and for the needs of their clients and business partners, provided that the Candidate has given consent;
  4. fulfilling obligations imposed on the Joint Controllers under GDPR (in particular maintaining records and documentation) – based on Article 6(1)(c) GDPR (processing necessary for compliance with a legal obligation).

Mandatory Personal Data

Providing the following personal data:

  1. first name(s) and surname;
  2. contact details indicated by the Candidate (e.g., residential address, email address, telephone number);
  3. education;
  4. professional qualifications;
  5. employment history

is mandatory and necessary for conducting the current recruitment process. The legal basis for processing these personal data is Article 6(1)(c) GDPR in connection with the obligation arising from Article 22¹ § 1 of the Polish Labour Code.

Voluntary Personal Data

Providing personal data other than those listed above is voluntary. The legal basis for processing such data, as well as processing personal data for future recruitment processes, is the Candidate’s consent, i.e., Article 6(1)(a) GDPR.

Automated Decision-Making

The Candidate’s personal data will not be used for automated decision-making, including profiling.

Transfers to Third Countries

Due to the Controllers’ use of services provided by Google LLC (a data recipient), the Candidate’s personal data may be transferred to the following third countries:

United Kingdom, Canada, United States, Chile, Brazil, Israel, Saudi Arabia, Qatar, India, China, South Korea, Japan, Singapore, Taiwan (Republic of China), Indonesia, Australia.

Legal Basis for Transfers

  1. For the United Kingdom, Canada, Israel, Japan, and South Korea – adequacy decisions issued by the European Commission.
  2. For the United States – Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 establishing an adequate level of protection under the EU–US Data Privacy Framework.
  3. For Chile, Brazil, Saudi Arabia, Qatar, India, China, Singapore, Taiwan (Republic of China), Indonesia, and Australia – Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

The Candidate may obtain a copy of the safeguards applied when transferring data to third countries.

Recipients of Personal Data

Recipients of the Candidate’s personal data will include:

  1. clients and business partners of the Controllers for whom recruitment processes are conducted, to the extent necessary to carry out such processes and assess the Candidate’s application;
  2. the provider of the ATS (Applicant Tracking System);
  3. the entity providing data hosting services to the Controller;
  4. the entity providing remote communication tools;
  5. entities authorized to receive data under applicable law.

The Joint Controllers reserve the right to disclose selected information concerning the Candidate to competent authorities or third parties that submit a relevant request based on an appropriate legal basis, in accordance with applicable law.

Data Retention Period

The Candidate’s personal data will be processed:

  1. until the completion of the current recruitment process – for data processed for the purposes of ongoing recruitment;
  2. until the Candidate withdraws consent – for data processed on the basis of consent, including for future recruitment processes.

Rights of the Candidate (Data Subject Rights)

In connection with the processing of personal data, the Candidate has the following rights:

  1. the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
  2. the right of access to personal data, including obtaining information about the data being processed and receiving a copy of the data (the first copy is free of charge);
  3. the right to obtain information on the essential arrangements between the Joint Controllers regarding the purposes and means of processing personal data;
  4. the right to rectification of personal data if they are incorrect, outdated, or incomplete;
  5. the right to erasure of personal data (“right to be forgotten”) in cases provided for by law, in particular when:
  6. the data are no longer necessary for the purposes for which they were collected,
  7. the Candidate has effectively withdrawn consent and the Controllers have no other legal basis for processing,
  8. the processing is unlawful,
  9. erasure is required by law;
  10. the right to request restriction of processing if the Candidate contests the accuracy of the data, the processing is unlawful, or the Controllers no longer need the data but the Candidate requires them for the establishment, exercise, or defense of legal claims;
  11. the right to lodge a complaint with the President of the Personal Data Protection Office if the Candidate believes that the processing of their personal data violates GDPR or other data protection regulations.