Privacy Policy
This is an English translation for information purposes. The binding version of this document is the Polish one — Polityka prywatności. In case of any discrepancy, the Polish version prevails.
We explain what data we collect, why, on what legal basis and for how long we store it. The rules on cookies are set out in a separate document — our Cookie Policy.
Contents
1. Data controller
ul. Świeradowska 47, 02-662 Warsaw, Poland
VAT ID (NIP) 5214123352 · KRS 0001181406 · REGON 542134749
Employment agency, register no. 35876
E-mail: office@expertwork.biz
In all matters concerning the processing of personal data and the exercise of your rights, you may contact the Controller at the e-mail or postal address above.
2. What data we process and for what purpose
The scope of the data depends on how you use the website. The table below sets out the purposes, the scope and the legal bases of processing (in accordance with the GDPR — Regulation (EU) 2016/679).
| Purpose | Scope of data | Legal basis |
|---|---|---|
| Handling employer enquiries (the “Request recruitment” form) and providing recruitment services | Full name, company, e-mail, phone, area, content of the message | Article 6(1)(b) GDPR (steps prior to entering into and performance of a contract) and (f) (legitimate interest: business contact and handling the enquiry) |
| Participation of candidates in recruitment processes (the “Apply / leave your CV” form) | Full name, e-mail, phone, area, link (LinkedIn / portfolio), content of the message and the data contained in the CV | Article 6(1)(a) GDPR (consent) and (b) and (f); as regards data required by law — Article 221 of the Polish Labour Code |
| Participation in future recruitment processes | Data as above | Article 6(1)(a) GDPR (voluntary, separate consent) |
| Operation and security of the website, statistics | Technical data: IP address, browser type, server logs | Article 6(1)(f) GDPR (legitimate interest: security and correct operation) |
Please do not include special categories of data (Article 9 GDPR) in the forms or in your CV — for instance health, origin or beliefs. They are not needed in the recruitment process.
3. Providing data is voluntary
Providing your data is voluntary, but necessary in order to handle an enquiry or to take part in a recruitment process. Failure to provide the required data will make it impossible to contact you or to consider your application.
4. Data retention periods
- Employer enquiries: for the duration of the correspondence and the provision of the service, and thereafter until claims become time-barred.
- Candidate data: for the duration of the given recruitment process.
- Consent for future recruitment: until it is withdrawn, and no longer than 12 months from the date the application was submitted.
- Technical data and logs: for the period necessary to ensure security and for statistics.
5. Recipients of the data
The data may be disclosed to trusted processors acting on the Controller's instructions under data processing agreements: the hosting and e-mail provider (LH.pl, operated by H88 S.A., Poznań) and providers of IT tools supporting the handling of enquiries. In the case of candidates, the recipients may include prospective employers (the Controller's clients), to whom we present candidates after obtaining consent or on the basis of a contract.
The data may also be disclosed to authorities entitled to receive it under the law.
6. Transfers outside the EEA
The Controller does not transfer personal data outside the European Economic Area. The website uses no external CDNs, font providers or analytics tools — all page resources are served from the Controller's server located in the European Union.
Should the use of a provider outside the EEA become necessary in the future, any transfer will take place solely on the basis of the safeguards provided for in the GDPR (including standard contractual clauses or an adequacy decision), and this Policy will be updated.
7. Your rights
You have the right to:
- access your data and obtain a copy of it,
- rectify (correct) your data,
- erase your data,
- restrict the processing,
- data portability,
- object to processing based on legitimate interest,
- withdraw your consent at any time — without affecting the lawfulness of processing carried out before the withdrawal,
- lodge a complaint with a supervisory authority.
To exercise these rights, contact the Controller (details in section 1). The supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.
8. Cookies
The website uses no analytics or marketing cookies and does not profile its users. The only cookie present supports the login session of the administration panel and is necessary for it to work. A detailed description — including the cookie table, information on server logs and instructions for managing settings in your browser — is set out in our Cookie Policy.
9. Automated decisions and profiling
The data is not used for automated decision-making, including profiling, producing legal effects concerning you. Decisions in recruitment processes are taken by people.
10. Data security
The Controller applies technical and organisational measures appropriate to the risk — including SSL/HTTPS encryption of the connection, restricting access to the data to authorised persons only, and access control for the administration panel — in order to protect the data against unauthorised access, loss or destruction.
11. Changes to this Privacy Policy
The Controller may update this Policy. The current version is always available on the website together with the date from which it takes effect.