Recruitment

Fulfilling the obligations imposed by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons in relation to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (‘RODO’), in relation to the processing of Candidates‘ personal data by GWW Legal, GWW Legal presents below information on the principles of processing Candidates’ personal data, including the purposes of processing, the legal basis for processing, the storage period, the recipients of personal data, as well as the rights of persons whose personal data are processed by GWW Legal.

1. CONTACT DETAILS OF THE CONTROLLER

In matters concerning personal data, the Administrator can be contacted:

• if contacted by post, by sending a letter to: Personal Data Coordinator: 4 Książęca Street, 00-498, Warsaw, marked ‘Personal Data’,
• in the case of contact by e-mail, by sending an e-mail to: odo@gww.pl.

2. WHAT PERSONAL DATA IS PROCESSED BY THE ADMINISTRATOR AND WHAT IS THE SOURCE OF SUCH DATA

The Administrator processes the Candidates’ personal data which was provided to him/her directly by the Candidates or by the entities conducting/supporting the recruitment processes, in connection with the recruitment conducted by the Administrator (including recruitment agencies), in particular the data contained in the recruitment application, data created or provided during the recruitment process (e.g. data contained in the recruitment application/CV/other recruitment documents, data provided during interviews).

The Administrator processes the Candidates’ personal data only to the extent necessary for the current recruitment process and, in the case of Candidates to whom the recruitment is subject to the provisions of the Labour Law, to the extent specified in such provisions, in particular name(s) and surname, date of birth, contact details indicated by the Candidates, information on education, professional qualifications, previous employment history.

If the recruitment application sent by the Candidate will contain additional data beyond the scope required by GWW Legal (e.g. information on interests, image), their processing will be based on the Candidate’s voluntary consent, which is deemed to be the fact that the Candidate provided them to the Administrator or consented to their transfer to the Administrator. This consent may be withdrawn at any time (by sending a request by post or email – the Administrator’s addresses are indicated in Section 1). If the Candidate does not consent to GWW Legal processing the Candidate’s additional data, please do not include it in the recruitment application, CV and other recruitment documents.

With the Candidate’s explicit consent, the Administrator will leave the Candidate’s application documents in its Candidate database and will process the Candidate’s submitted personal data also for the purposes of future recruitment.

3. PURPOSE OF PERSONAL DATA PROCESSING AND LEGAL BASIS

The Administrator processes the Candidates’ personal data:

(a) for the purposes of recruitment:

• when it is necessary to take action at the Candidate’s request prior to the conclusion of a contract of mandate, contract for specific work, contract for the provision of services or any other contract of a similar nature with the Candidate (legal basis under Article 6(1)(b) of the RODO); the provision of personal data in this case is a condition for participation in the recruitment process;
• where the Candidate applies for employment on the basis of a contract of employment, his/her personal data indicated in the Labour Code are processed by the Administrator on the basis of Article 22¹ § 1 of the Labour Code in conjunction with Article 6(1)(c) RODO; the provision of personal data in such a case results from the provisions of the law and is a condition for participation in the recruitment process;
• on the basis of the Candidate’s voluntary consent, in the event that the Candidate provides additional data (e.g. image) beyond the scope required by GWW Legal; providing data in such a case is voluntary and does not affect the possibility of participation in the recruitment process;
• on the basis of the Candidate’s voluntary consent, in the case of willingness to participate in future recruitment processes; providing data in such a case is voluntary and does not affect the possibility of participation in the current recruitment process;

(b) for the purposes of legitimate interests pursued by the Administrator or third parties (legal basis in Art. 6(1)(f) RODO), which are: verification of the Candidate’s qualifications and skills, setting the terms and conditions of work/cooperation, performance of contracts concluded with entities conducting/supporting recruitment processes (including contracts with recruitment agencies and providers of recruitment portals used by the Candidate), performance of the Administrator’s internal administrative purposes and procedures, including those related to personal data protection; providing personal data in such cases is voluntary, however, failure to provide such data may result in the impossibility to perform the purposes resulting from the Administrator’s legitimate interests.

4. RECIPIENTS OF PERSONAL DATA

The Administrator shall make personal data available to other entities (recipients of personal data) only if it has a legal basis for doing so. If the Administrator transfers personal data to recipients located outside the European Union or the European Economic Area (EEA), this shall only take place if an adequate level of data protection has been confirmed for that third country by the European Commission or an adequate level of data protection has been agreed with the recipient (e.g. using so-called standard contractual clauses).

Candidates’ personal data may be made available to public authorities or other entities entitled to such access by law.

Recipients of Candidates’ personal data may also be: IT service providers, IT/technical support/service providers, suppliers of software used in the recruitment process, courier or postal services providers, recruitment service providers (including recruitment agencies, recruitment advertisement providers, recruitment management system providers), other entities cooperating with the Administrator in relation to the services provided (e.g. consulting/auditing companies).

Due to the fact that the Administrator conducts business activity jointly with GWW Ladziński, Cmoch i Wspólnicy spółka komandytowa with its registered office in Warsaw (GWW Tax), Candidates’ personal data may be processed by GWW Tax.

The processing of Candidates’ personal data in ICT systems, may result in the transfer of this data to the servers of software and IT service providers. Some of these servers are located in the USA. Data transfer to the USA only takes place if the data recipient has joined the EU-US Data Protection Framework (i.e. the European Commission has confirmed an adequate level of data protection) or an adequate level of data protection has been agreed with the data recipient using so-called standard contractual clauses. A copy of the applicable safeguards including standard contractual clauses can be obtained from the Controller.

5. STORAGE PERIOD OF PERSONAL DATA

The Administrator shall not keep personal data longer than necessary to achieve the purposes for which the data were collected.

If the recruitment is concluded with a contract, the personal data will be stored for the duration of the employment relationship, in accordance with legal requirements.

If a contract is not concluded at the end of the recruitment process, the recruitment documents shall be deleted at the end of the recruitment process, provided that no other legitimate interests of the Administrator conflict with this deletion and, where the Candidate has given consent for future recruitment, the Candidate’s personal data shall be deleted no later than after the expiry of the period for which the consent to process them has been given.

Personal data processed for the purpose of demonstrating and fulfilling the obligations incumbent on the Administrator shall be processed for the period necessary to fulfil those obligations and to demonstrate that the obligations incumbent on the Administrator have been fulfilled.

6. INFORMATION ON AUTOMATED DECISION-MAKING, INCLUDING PROFILING

Personal data will not be processed in a purely automated manner (including profiling), which may produce legal consequences for the data subjects or in a similar manner significantly affect their situation.

7. RIGHTS OF PERSONAL DATA SUBJECTS

To the extent and in the cases prescribed by law, in particular the RODO, data subjects (data subjects), including Candidates, have the following rights:

• The right to withdraw consent (Article 7 of the RODO) – if the processing of personal data is carried out on the basis of consent, this consent may be withdrawn by the data subject at any time (however, this does not affect the lawfulness of the processing carried out before the withdrawal of consent). Consent is entirely voluntary.
• Right of access and right to obtain a copy of the data (Article 15 RODO) – the data subject is entitled to obtain from the Controller information about the processing of his/her personal data – including the source of the personal data, the purposes of the processing, the categories of personal data processed, the intended duration of the processing and the recipients to whom the data are disclosed – and to obtain a copy of his/her personal data that are processed by the Controller. The right to obtain a copy must not adversely affect the rights and freedoms of others (including those arising from copyright or trade secrets).
• Right to rectification (amendment) of personal data (Article 16 RODO) – the data subject has the right to request the Controller to rectify inaccurate or complete incomplete personal data concerning the data subject.
• Right to erasure of personal data (‘right to be forgotten’ of Art. 17 RODO) – the data subject has the right to request from the Controller the immediate erasure of his/her personal data where (i) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed, (ii) he/she has withdrawn the consent on the basis of which the processing took place and there will be no other legal basis for the Controller to process the data subject’s personal data, (iii) he/she has objected under Art. 21(1) RODO to the processing and there will be no overriding legitimate grounds for the processing of his/her personal data or he/she has objected under Art. 21(2) RODO against the processing of his or her personal data, (iv) his or her personal data have been unlawfully processed, (v) the erasure of his or her personal data is required in order to comply with a legal obligation to which the Controller is subject, (vi) his or her personal data have been collected in connection with the offering of information society services as referred to in Article 8(1) RODO. The right to erasure is not an absolute right. This right does not apply to the extent that the processing is necessary, inter alia, to comply with a legal obligation requiring processing under the law to which the Controller is subject or to establish, assert or defend claims.
• Right to restrict the processing of personal data (Article 18 RODO) – the data subject has the right to request the Controller to restrict the processing of his/her personal data where (i) he/she questions the
• the accuracy of his/her personal data – for a period of time allowing the Controller to verify the accuracy of the data; (ii) the processing is unlawful and the data subject objects to the erasure of the personal data, requesting instead the restriction of its use, (iii) the Controller no longer needs the personal data for the purposes of the processing, but the data are needed by the data subject to establish, assert or defend a claim; (iv) the data subject has raised an objection under Article 21(1) to the processing – until it is established whether the legitimate grounds on the part of the Controller override the grounds of the data subject’s objection. The exercise of this right means that the Controller may only process the requested personal data, with the exception of storage, with the data subject’s consent or for the establishment, exercise or defence of claims, or for the protection of the rights of another natural or legal person, or for important grounds of public interest of the Union or of a Member State.
• Right to data portability (Article 20 RODO) – The data subject has the right to receive, in a structured, commonly used machine-readable format, personal data concerning him or her which he or she has provided to the Controller, and has the right to have that personal data transferred to another controller without hindrance from the Controller to whom the personal data has been provided, where (i) the processing is based on consent or on a contract; and (ii) the processing is carried out by automated means. In doing so, the Data Subject has the right to request that his or her personal data be sent by the Controller directly to another controller, insofar as this is technically possible. The exercise of the right to data portability, shall not adversely affect the rights and freedoms of others.
• Right to object (Article 21 RODO) – the data subject has the right to object at any time – on grounds relating to his/her particular situation – to the processing of personal data concerning him/her based, inter alia, on the legitimate interests of the Controller, including profiling. The exercise of this right means that the Controller is no longer allowed to process these personal data unless they demonstrate the existence of compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or grounds for establishing, asserting or defending claims. If the Controller processes personal data for the purposes of direct marketing, the data subject has the right to object at any time to the processing of personal data concerning them for such marketing, including profiling, to the extent that the processing is related to such direct marketing. The exercise of this right means that the Controller will not process the personal data for such purposes.

The Controller will exercise the above rights in accordance with the provisions of the RODO and other relevant legislation. In order to exercise the data subject’s rights or to obtain further information regarding their rights, please contact the Controller (contact details are indicated in section 1).

8. RIGHT TO COMPLAIN

If the Candidate considers that the processing of his/her personal data by the Controller violates the provisions of the RODO or other generally applicable data protection legislation, he/she may lodge a complaint with the President of the Data Protection Authority.