Information clause on personal data processing in recruitment at WCD Sp. z o.o.

According to art 13 clauses 1-2 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter referred to as "GDPR"), please be informed that:

1. Personal data Controller

   The data controller is WCD Sp. z o.o., with its seat in Warsaw (02-958), at ul. Stanisława Kostki Potockiego 2 lok. 2, registered in the Register of Entrepreneurs maintained by the District Court for the Capital City of Warsaw, XII Commercial Division of the National Court Register under the KRS number 0000943104, Regon 52094520600000 VAT number: PL9512532638, (Wecode Agency).

   In matters related to personal data protection you may contact the Controller at the address given above or at the address: youmail@wecode.agency

1. The basis for processing of personal data:

   The Controller processes your personal data for the purpose of recruitment process and protection against employment discrimination claims. In addition, your personal data may be processed for purposes related to future recruitment processes, based on your separate consent.Your personal data is processed on the following legal grounds and for the following purposes:

   1. Based on Article 6(1)(c) of the GDPR data processing is necessary to fulfil the legal obligation imposed on the Controller and resulting from Article 22¹ of the Labour Code Act of 26 June 1974 in the scope of data such as: forename (forenames) and surname, date of birth, contact details. In addition, to the extent that the provision if such data is necessary for the performance of work at given position - education, professional qualifications, and employment history.
   2. Based on Article 6(1)(a) of the GDPR, i.e. processed on the basis of your voluntary consent. We process personal data on this legal basis for the purpose of future recruitment using your, once submitted consent in application form. We will process your data in subsequent recruitment procedures only if that consent will be given in your application documents or you will check on the website checkbox with a consent to the processing of personal data for this purposes.
   3. Based on Article 6(1)(b) of the GDPR i.e. for a single, current recruitment. This is the basis for proceeding in the case of current recruitment – when you send us your application documents in response to our job advertisement.
   4. Based on Article 6(1)(f) of the GDPR that is when we process personal data for the purpose of the Controller legitimate interest in selecting the best candidate and investigating, defending or establishing claims of employment discrimination.

1. Rights related to the processing of personal data

   You have:

   1. The right to correct (rectify) your personal data - you can send us a statement about the inaccuracy of your personal data;
   2. The right to access your personal data - you have the right to obtain information about what personal data of yours we process;
   3. Right to erasure - if in your opinion there are no grounds for us to process your data, you can demand that we erase it;
   4. Right to data portability - you may request to receive personal data your which you provided us, in a structured, commonly used and machine-readable format and you have the right to transmit those data to another controller
   5. Right to restrict processing – that means that you can limit the way in which we use your data. You may wish to exercise this right because you have issues with the content of the information we hold, or how we have processed that data. In this case you do not demand to delete the data, because you need them to protect or establish claims or for the duration of your objection to the processing. Restriction of processing in this case means that during this time, we will process your data only to the limited extent indicated by you.
   6. Right to object – you have a right to object, on grounds relating to your particular situation, to processing based on a legitimate interest, or that is necessary for a task carried out in the public interest or in the exercise of official authority. Controller may refuse this objection if we demonstrate compelling legitimate grounds for the processing activity which overrides your interests, rights, and freedoms, or for the establishment, exercise, or defense of claims.

1. Obligation to provide data, grant consent

   Providing personal data in accordance with the Labour Code is necessary for recruitment. Providing personal data not required by the Labour Code is voluntary. At any time, you can withdraw the consent you have given. However, this does not affect the lawfulness of previously performed processing.

1. For the purpose of recruitment, we may process your data:
   • forename (forenames) and surname;
   • date of birth;
   • contact data indicated by the candidate;
   • education;
   • professional qualifications;
   • other data placed on your own initiative in the CV;

1. Recipients and processors of personal data

   Personal data, without your consent, will not be shared with other controllers of personal data. However, they may be transferred to entities with whom we cooperate to the extent necessary to fulfill the purpose of processing, such as:

   1. entities that provide legal services for us;
   2. entities providing access to platforms used to improve the work of the Controller’s operations (e.g recruitment portals, cloud services):
      
      • Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).
      • Facebook (Facebook Ireland Ltd. based in Ireland).
      • Linkedin (605 W Maude Ave, Sunnyvale, CA 94085, USA)
   3. entities providing IT services for us.

1. Is my data transferred to a third country?

   As a rule, the Controllers do not intend to transfer personal data to recipients outside the European Economic Area, i.e. to third countries, or to international organisations.However, in connection with the use of cloud applications there may be transfers of data outside the EEA, but only to entities that guarantee the protection of your rights in accordance with the GDPR.

1. How long will my personal data be processed?

   The period of processing of your personal data is related to the purposes of processing indicated above.

   1. personal data will be processed for the time necessary for the recruitment process, but not longer than 12 months from the end of recruitment.
   2. If the Controller obtains your voluntary, additional consent for the processing your personal data for the purposes of future recruitments then your personal data will be processing until withdrawn of the consent or until we do not need your data for recruitment process but no longer than 12 months from obtaining your data.

   The processing period may be extended each time by the limitation period for claims, if the processing of your personal data is necessary to establish or pursue any claims or defend against such claims by WCD Sp. z o.o.

1. Right to lodge a complaint

   If you believe that we are processing your personal data in an unlawful manner, you may file a complaint with the competent supervisory authority, which in the Republic of Poland is: Office for Personal Data Protection (Urząd Ochrony Danych Osobowych), 2 Stawki Street, 00-193 Warsaw, Hotline: 606-950-000, e-mail: kancelaria@uodo.gov.pl

1. Will my data be processed in such a way that decisions are automatically issued against me?

   No personal data will be used for automated individual decision-making, including profiling.