Information clause concerning the processing of personal data in the recruitment process by PAIH S.A.

Pursuant to Article 13(1) and 13(2) of Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU L 119, p. 1) (hereinafter referred to as “GDPR”) we inform that:

1. Data controller
The controller of your personal data is Polska Agencja Inwestycji i Handlu S.A. with its seat in Warsaw at ul. Krucza 50 (00-025 Warszawa), entered into the register of entrepreneurs of the National Court Register by the Capital City of Warsaw District Court, under the number KRS 0000109815 (hereinafter referred to as “Controller” or “PAIH”). The Controller can be reached through the contact form on www.paih.gov.pl, by sending an email to: iod@paih.gov.pl, or by traditional mail at the address of the Controller’s seat stated above.

The contact person in all matters related to the protection of personal data and your rights is the Data Protection Officer. You can contact the Data Protection Officer by sending an e-mail to iod@paih.gov.pl or by traditional mail at the address of the Controller’s seat stated above with a note saying “c/o the Data Protection Officer.”

3. Purposes and grounds for processing personal data
In the scope referred to in labour law provisions, your personal data are processed:

1) in case of an offer of employment based on an employment agreement - in order to conduct and complete the recruitment process with your participation, as regards the categories of data required in accordance with Article 221 § 1 of the Labour Code, pursuant to Article 6(1)(c) of the GDPR;

2) if data beyond the scope of Article 22¹ §1 of the Labour Code are provided during the recruitment process referred to in item 1 - in order to conduct and complete the recruitment process with your participation, pursuant to Article 6(1)(a) of the GDPR;

3) in case of an offer of employment based on a civil law agreement - in order to conduct and complete the recruitment process with your participation, including taking steps on your request prior to entering into the Agreement, pursuant to Article 6(1)(b) of the GDPR;

4) in case of an a offer of employment of a foreigner - in addition to the purposes stated in item 1 and 2 above, also for the purpose to verify whether the employment is legal, pursuant to Article 6(1)(c) of the GDPR, or legalise the employment, pursuant to Article 6(1)(b) of the GPDR;

5) if you make a separate consent to participate in future recruitment efforts - for the purpose of conducting future recruitments with your participation, pursuant to Article 6(1)(a) of the GDPR. Granting consent is voluntary, and once granted consent may be withdrawn at any time (which does not affect the lawfulness of activities conducted prior to withdrawal);

6) after completing the recruitment process - for the potential establishment, exercise or defence of legal claims, pursuant to Article 6(1)(f) of the GDPR.

Submitting other personal data in a scope not defined by labour law provisions will be treated as your consent to process such personal data. Granting consent is voluntary, and the consent can be withdrawn at any time (which does not affect the legality of processing prior to withdrawal).

The Controller may share your personal data with entities processing them on request and in the name of the Controller under a concluded data processing agreement for the purpose of providing services specified in the Agreement to the Controller, in particular as regards managing electronic mail, hosting, IT, administrative services, legal services or consulting.

Your personal data will be stored:

a) until the recruitment process is completed, subject to subpoint (c),
b) for the establishment, exercise or defence of claims – until the claims are time-barred arising under generally applicable provisions of Polish law,
c) in case of granting consent for future recruitments, your data will be stored for 6 months from the end of the recruitment process or withdrawal of your consent, whichever occurs earlier,
d) until the obligations to store personal data resulting from generally applicable provisions of law expire.

6. Rights of data subjects
According to the GDPR, you have the right to access data, to rectify data, to erase data, to restrict the processing of data, to object to the processing of data, to transfer data, and to file a complaint with the Chairman of the Personal Data Protection Office.
In addition, pursuant to Article 21 of the GDPR, with respect to processing which takes place pursuant to Article 6(1)(f), data subjects are also entitled to object to processing performed by the Controller in this respect.

In case of employment based on an employment agreement - submission of personal data in the scope specified by labour law provisions (first and last name, date of birth, contact details, education, professional qualifications, previous employment history) is voluntary, however PAIH as the entity conducting the recruitment process is entitled to demand the data specified in Article 22¹ § 1 of the Labour Code. If you refuse to submit these data, we will be unable to process your application. Submitting personal data other than specified above is fully voluntary.
In case of employment under a civil law agreement - submission of personal data is voluntary. Failure to submit data such as first and last name, contact details, education, professional qualifications and previous employment history may make it impossible to process your application because we may be unable to contact you or review your application.
In case of foreigners - the Controller may request submission of personal data required by generally applicable provisions of law and of documents that allow the Controller to verify the ability to employ you legally or are necessary to legalise your employment. Failure to submit such documents may hinder your employment, no matter its form.
Submitting other personal data in a scope not defined by labour law provisions or required by the Controller will be treated as your consent to process such personal data (Article 6(1)(a) of the GDPR). Granting consent in such case is voluntary, and once granted consent may be withdrawn at any time (which does not affect the lawfulness of activities conducted prior to withdrawal).