PRIVACY NOTICE

Klauzula informacyjna RODO · GDPR information notice

Introduction

In this Privacy Notice we fulfil the information duty arising from Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the "GDPR" or "General Data Protection Regulation").

This Privacy Notice describes how we collect, use and process your personal data and how we comply with our legal obligations towards you in doing so. Your privacy matters to us and we are committed to protecting your right to the confidentiality of your data.

The Privacy Notice applies to the personal data of our Candidates, Clients, Suppliers, Staff and other people we may contact to obtain further information about our recruitment activities or our Candidates, or who have been named as a reference or as an emergency contact for a member of Staff.

This Privacy Notice applies in the relevant countries in which we operate internationally. Different countries may take slightly different approaches to data privacy, so this Privacy Notice also contains sections that apply in particular countries. This allows us to make sure we comply with all applicable data privacy legislation.

Malek Recruitment processes personal data in accordance with the applicable data protection laws and regulations and makes every effort to keep personal data secure and protected while it is processed.

Please note that we may change this Privacy Notice from time to time. If you would like to stay up to date, we invite you to review the current Privacy Notice on this page, where we will publish any changes.

If you are unhappy with any aspect of our Privacy Notice, you may have the rights set out below: the right of access to your personal data, the right to rectification, erasure or restriction of processing, the right to object to processing, and the right to data portability.

If you suspect any misuse, loss of, or unauthorised access to your personal information, please let us know immediately.

The data controller, Malek Recruitment, can be contacted by post at MR EXECUTIVE SEARCH LLC SPÓŁKA KOMANDYTOWA, ul. Szpitalna 8/8, 00-031 Warsaw, Poland, preferably marked "Administrator Danych Osobowych" (Data Controller), or by e-mail at ADO@MalekRecruitment.com.

Who is the controller of your data?

The controller of your data is MR EXECUTIVE SEARCH LLC SPÓŁKA KOMANDYTOWA (trading as Malek Recruitment, hereinafter "Malek Recruitment"), with its registered office in Warsaw at ul. Szpitalna 8/8, 00-031 Warsaw, entered in the register of entrepreneurs kept by the District Court for the Capital City of Warsaw, 12th Commercial Division of the National Court Register, under KRS number 0000799981, NIP (tax ID) 5252798891.

How to contact the Data Controller at Malek Recruitment

If you are unhappy with any aspect of our Privacy Notice, you may have the rights set out below: the right of access to your personal data, the right to rectification, erasure or restriction of processing, the right to object to processing, and the right to data portability.

If you suspect any misuse, loss of, or unauthorised access to your personal information, please let us know immediately.

The data controller can be contacted by post at MR EXECUTIVE SEARCH LLC SPÓŁKA KOMANDYTOWA, ul. Szpitalna 8/8, 00-031 Warsaw, Poland, preferably marked "Administrator Danych Osobowych" (Data Controller), or by e-mail at ADO@MalekRecruitment.com.

What kind of data do we collect?

We collect the personal data of:

• Candidates
• Clients
• Suppliers
• Others

Candidate data

To offer you the best employment opportunities tailored to your needs, we need to process certain information about you. We only ask for data that will genuinely help us support you in searching for and changing jobs, such as your name, age, contact details, education and employment history. Where appropriate and in accordance with local laws and requirements, we may also collect information about your health or criminal record.

Depending on the relevant circumstances and the applicable local laws and requirements, we may collect some or all of the information listed below in order to offer you employment opportunities suited to the circumstances and your requirements. In some jurisdictions we are restricted from processing some of the data listed below; in those jurisdictions we will not process that data:

• name and surname;
• age / date of birth;
• gender;
• photograph;
• marital status;
• contact details;
• education;
• employment history;
• details of your references;
• immigration status (where a work permit is required);
• nationality / citizenship / place of birth;
• criminal record information, where required for the position you wish to apply for;
• details of your current remuneration, pension and employee benefits;
• information about your interests and needs regarding future employment;
• any additional information you choose to give us;
• any additional information your references choose to give us;
• any additional information our Clients may give us about you, or that we obtain from external sources such as websites and professional portals.

Please note that the above list of categories of personal data we may collect is not exhaustive.

We may collect other sensitive personal data about you, such as health information or criminal record, where appropriate and in accordance with local law and where required for the position you wish to apply for. We will never do so without your freely given and explicit consent.

If you do not agree to this, you have the right to withdraw your consent at any time.

Client data

If you are a Client of Malek Recruitment, we need to collect and use information about you or individuals in your organisation in the course of providing services to you, such as:

• finding Candidates suitable for you or your organisation,
• providing you with recruitment process outsourcing services,
• consultancy in support of the above.

As a rule we only need your contact details or the contact details of individuals in your organisation (such as their names, telephone numbers and e-mail addresses) to enable our relationship to run smoothly, or for consultancy within the scope of the activities carried out by Malek Recruitment, which constitutes the controller's legitimate interest.

We may also hold additional information that someone in your organisation has chosen to give us, in certain circumstances, for example when dealing with finance and credit-control teams.

Supplier data

We need the contact details of the relevant individuals in your organisation so that we can communicate with you. We also need other information, such as your bank account details, so that we can pay you for the services you provide (where this forms part of the contractual arrangements between us).

People whose data we receive from Candidates and Staff, for example references and emergency contacts

To provide Candidates with suitable employment opportunities in a safe way and to be prepared for every eventuality for them and for our Staff, we need some basic general information. We only ask for very basic contact details so that we can get in touch with you for a reference, or when you have been named as an emergency contact by one of our Candidates or Staff.

How do we collect your personal data?

Candidate data

We collect your personal data in two ways: personal data we receive directly from you, and personal data we obtain from other sources.

You may share information with us in a number of ways, at your discretion. These may include:

• leaving a printed copy of your CV;
• sending your CV by e-mail to a member of Staff, or attending an interview;
• applying for positions through a job search engine.

We also obtain Candidates' personal data from other sources:

• your references may disclose your personal information;
• our Clients may share your personal information with us;
• we may obtain information about you while searching for potential Candidates in external sources such as LinkedIn and other websites;
• when you have been recommended to us.

Client data

We collect Client personal data in two ways: personal data we receive directly from you, and personal data we obtain from other sources.

We share a common goal – securing the best people for your organisation. We will receive data directly from you in three ways:

• when you contact us proactively, usually by telephone or e-mail;
• when we contact you, by telephone or e-mail or, more generally, through the business development activities of our Staff;
• from other publicly available sources and from third parties (for example from our Candidates, to the extent they give us your details as their reference).

Supplier data

We collect your personal data in the course of our cooperation.

People whose data we receive from Candidates and Staff, for example references and emergency contacts

We collect your contact details only when a Candidate or a member of Staff names you as their emergency contact, or a Candidate gives us your details as a reference.

How do we use your personal data?

Candidate data

The main reason we use your personal data is to present the recruitment projects we are running and to check whether you are interested in a conversation. The next step is inviting you to recruitment interviews and helping you find employment or other work suited to you.

Personal data that you have provided voluntarily, or that is publicly available (including on LinkedIn), such as your name, surname, e-mail address or any information provided in an application form, contained in a CV and application documents, or in correspondence addressed to Malek Recruitment, is collected and processed by Malek Recruitment for the following purposes.

Broadly, we use Candidate data in two ways:

• Information activities – the first and principal area of our activity is the presentation of the recruitment projects we run, in the form of job offers, and information about our clients and the positions they offer. In addition, given our knowledge of the market and the wealth of information we hold, we are happy to share our knowledge and market information with you. In this respect we may provide you with free information materials, including our review of personnel changes, Zmiany Personalne.
• Recruitment activities – the main area of our activity is, of course, recruitment: connecting the right Candidates with the right positions.

Below we list the various ways in which we use and process your personal data for this purpose, where appropriate and in accordance with local laws and requirements:

• collecting your data from you and from other public sources, such as LinkedIn;
• storing and updating your data in our database so that we can contact you about recruitment;
• providing our recruitment services and improving the recruitment process;
• assessing your data against positions we believe may be suitable for you;
• sending your information to Clients for job applications or to assess your qualifications;
• fulfilling our obligations under any contracts concluded between us;
• fulfilling our obligations under any contracts between Malek Recruitment and third parties in connection with your recruitment;
• carrying out client satisfaction surveys;
• verifying the data you have provided using external resources (such as psychometric assessments or skills tests) or requests for information (such as references, qualifications and, potentially, criminal record, to the extent appropriate and in accordance with local law);
• processing your data so that we can send you selected, relevant information materials about recruitment or other correspondence we believe may interest you.

We may use your personal data for the above purposes where we consider it necessary for our legitimate interests. If you do not agree, in certain circumstances you have the right to object. From time to time we may send you information we believe may interest you, or ask you to help us connect other Candidates with job offers. We may also use your data to help us establish, exercise or defend legal claims.

Malek Recruitment processes data for the purpose for which it was collected (the primary purpose). Your data may, however, also be processed for other purposes permitted by law (secondary purposes) where the primary and secondary purposes are closely related. The following secondary purposes are permitted:

• transferring data to an archive;
• audits and/or investigations;
• implementing business and management control mechanisms;
• resolving disputes and conducting court proceedings.

Please note that this list is not exhaustive.

Client data

The main area of our activity is, of course, recruitment, by providing you with Candidates. Below we list the various ways in which we use your data for this purpose:

• storing and updating your data in our database so that we can contact you about recruitment activities;
• keeping records of our conversations and meetings so that we can provide you with selected services;
• carrying out client satisfaction surveys;
• processing your data in order to select appropriate information campaigns;
• establishing, exercising or defending legal claims.

We may use your personal data for these purposes where we consider it necessary for our legitimate interests. If you do not agree, in certain circumstances you have the right to object.

Supplier data

The main reason we use your personal data is to make sure the contractual arrangements between us can be properly implemented, so that the relationship runs smoothly, and to meet legal requirements. Below we list the various ways in which we use your data for this purpose:

• storing and updating your data in our database so that we can contact you in connection with our contracts;
• offering you services or obtaining support and services from you;
• fulfilling certain legal obligations.

We may use your personal data for these purposes where we consider it necessary for our legitimate interests. If you do not agree, in certain circumstances you have the right to object.

People whose data we receive from Candidates and Staff, for example references and emergency contacts

We will use the information given to us by a Candidate only for the following purposes:

• if our Candidates or Staff name you on our form as an emergency contact, we will contact you in the event of an accident or emergency concerning them;
• if our Candidate or prospective member of Staff has named you as a reference, we will contact you to obtain a reference. This is an important part of our process of ensuring the quality of Candidates and may decide whether a person gets a job;
• if our Candidate or prospective member of Staff has named you as a reference, we may from time to time use your data to contact you about recruitment activities we believe may interest you, in which case we will use your data for the same purposes as our Clients' data.

We may use your personal data for these purposes where we consider it necessary for our legitimate interests. Malek Recruitment does not use profiling. If you do not agree, you have the right to object.

Who do we share your personal data with?

We may share your data, where appropriate and in accordance with local laws and requirements, with the following people and to the following extent:

• individuals and organisations that hold information related to your references or your application to work with us, such as current, future or potential employers, educational institutions and examination bodies, and employment and recruitment agencies;
• tax, audit and other authorities, where we believe in good faith that the law or other regulations require us to share this data (for example at the request of a tax authority or in connection with any anticipated legal proceedings);
• external service providers who perform functions on our behalf (including external consultants, business partners and professional advisers such as lawyers, auditors and accountants, technical support staff and IT consultants testing and developing our business technology systems);
• external providers of outsourced IT services and document storage services, where we have concluded an appropriate data processing agreement (or similar safeguard);
• CRM (Customer Relationship Management) platforms and technology providers;
• in the case of Candidates: potential employers and other recruitment agencies/organisations, in order to increase your chances of finding employment;
• in the case of Candidates and the references of our Candidates and prospective members of the team: third parties we have engaged to provide services such as verification of references, qualifications and criminal record, to the extent such checks are appropriate and in accordance with local law.

How do we protect your personal data?

We are committed to taking all reasonable and appropriate measures to protect the personal information we hold from misuse, loss or unauthorised access. To this end we have implemented a range of appropriate technical and organisational measures. These include measures for dealing with any suspected data security breach.

If you suspect any misuse, loss of, or unauthorised access to your personal information, please let us know immediately.

The Malek Recruitment data protection officer can be contacted by post at MR EXECUTIVE SEARCH LLC SPÓŁKA KOMANDYTOWA, ul. Szpitalna 8/8, 00-031 Warsaw, Poland, preferably marked "Inspektor Danych Osobowych" (Data Protection Officer), or by e-mail at ADO@MalekRecruitment.com.

How long do we keep your personal data?

For information activities, if we have had no meaningful contact with you (or with the company you work for or with) for a period of ten years, we will delete your personal data from our systems, unless we believe in good faith that the law or other regulations require us to keep it (for example because of obligations towards tax authorities or in connection with any anticipated legal proceedings).

For recruitment activities, if we have had no meaningful contact with you (or with the company you work for or with) for a period of five years, we will delete your personal data from our systems, unless we believe in good faith that the law or other regulations require us to keep it.

By "meaningful contact" we mean, for example, communication between us (verbal or written) or your active use of our services. If you are a Candidate, we will consider it meaningful contact if you submit an updated CV on our website or take part in any correspondence or conversation. We will also consider it meaningful contact if you contact us about potential positions, verbally or in writing.

How can you access, correct or withdraw the personal data you have given us?

Even where we already hold your personal data, you still have various rights in relation to it. To find out more, please contact us. We will try to deal with your request without undue delay and, in any case, in accordance with the requirements of the applicable law. Please note that we may keep a record of your correspondence to help us resolve any issues you raise.

Right to object: if we use your data because we consider it necessary for our legitimate interests and you do not agree, you have the right to object. We will respond to your request within 30 days (although in some cases we may be entitled to extend this period). As a rule, we will only disagree with you if certain limited conditions apply.

Right to withdraw consent: once you have consented to the processing of your personal data for specific activities, you may withdraw your consent at any time.

Data subject access requests: you have the right at any time to ask us to confirm what information we hold about you, and you may request that such information be changed, updated or deleted. At that point we may comply with your request or, additionally, ask you to verify your identity or provide further information about your request, or refuse your request where the law permits, giving reasons for our decision.

Right to erasure: in certain situations (for example where your data has been processed unlawfully) you have the right to request the "erasure" of your personal data. We will respond to your request within 30 days (although in some cases we may be entitled to extend this period) and will only disagree with you if certain limited conditions apply. If your request is granted we will delete your data, but we will generally assume that you would prefer us to keep your name and e-mail address on our register of people who do not wish to be contacted. In this way we reduce the likelihood of contacting you in future should your data be collected in other circumstances. You are free to decide that you do not want us to do this.

Right to data portability: you have the right, at your discretion, to transfer your data from us to another data controller. We will help you do this – either by transferring your data directly on your behalf, or by providing you with copies in a commonly used, machine-readable format.

Right to lodge a complaint with a supervisory authority: you also have the right to lodge a complaint with the competent supervisory authority – the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, telephone (+48) 22 531 03 00, kancelaria@uodo.gov.pl.

How can you object, withdraw consent, erase or transfer your data?

Simply submit your request to the Malek Recruitment data controller: MR EXECUTIVE SEARCH LLC SPÓŁKA KOMANDYTOWA, ul. Szpitalna 8/8, 00-031 Warsaw, Poland, preferably marked "Inspektor Danych Osobowych" (Data Protection Officer), or by e-mail at ADO@MalekRecruitment.com.

How do we store and transfer your data abroad?

Malek Recruitment operates internationally, which allows us to offer services at their current level. To continue operating in this way, it may be necessary to transfer or store your data abroad.

Your data may be transferred to:

• third parties (for example advisers or other Suppliers of Malek Recruitment);
• Clients abroad;
• Clients in your country, who may in turn transfer your data abroad;
• a cloud service provider.

To ensure that your personal data is adequately protected, we have put appropriate procedures in place with the external entities we share your personal data with, to guarantee that they treat your personal data in a manner consistent with data protection law.

Every processing of your data must rest on a proper legal basis in accordance with the applicable regulations. The legal basis for processing your data for recruitment activities – including assessing a candidate's qualifications for a given position, assessing a candidate's abilities and skills needed for the position, and selecting the right person or people in recruitment activities – is:

• a provision of law (Article 22¹ § 1 of the Polish Labour Code) and processing necessary to conclude an employment contract – for the following data: name and surname; parents' first names; date of birth; place of residence (correspondence address); education; employment history;
• your consent to the processing of data provided in correspondence, a form, a CV and a cover letter, or publicly available data.

On what basis do we process your personal data?

Legitimate interests

Article 6(1)(f) of the GDPR applies here – it says that we may process your data where this "is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data".

We do not believe that any of the following activities cause harm in any way – in fact they help us offer interesting job opportunities and market information, and involve you in recruitment activities that may support your professional development. In the case of our clients, of course, we take care to conduct high-quality activities. You nevertheless have the right to object to our processing of your personal data on this basis.

Candidate data

We consider it a reasonable expectation that if you are looking for a job, have shared your CV with us, or have posted information about your professional experience, competences or position on a social network specialising in professional contacts, you have no objection to us collecting or otherwise using your personal data to send you recommended job offers and market information or to provide recruitment services, to share this information with potential employers, and to check your skills against our database of vacancies.

When it looks as though you will be hired, your prospective employer may also wish to verify the information you have given us (such as the results of psychometric assessments or skills tests) or to confirm your references, qualifications or criminal record information, to the extent such checks are appropriate and in accordance with local law.

We need to carry out these activities so that we can operate as a profitable business and help you and other Candidates find jobs. We also have our own obligations under the law, which it is in our legitimate interest to fulfil. Where we believe in good faith that it is necessary, we may share your data in connection with the prosecution of offences, the collection of taxes and actual or anticipated legal proceedings.

We want to provide you with individually tailored recommended job offers and market information to help you in your job search. We therefore consider it legitimate to process your data to make sure we send you the most relevant content.

Client data

To provide you with the best possible service, we keep your personal data and/or the personal data of contact persons in your organisation, as well as records of our conversations, meetings, registered positions and workplaces. From time to time we may ask you to complete a client satisfaction survey or ask for a recommendation. We consider this a legitimate activity – we regard the above uses of your data as necessary for our legitimate interests as an organisation providing you with a range of recruitment services.

Supplier data

We use and store the data of individuals in our organisation to make it easier to receive services from you as one of our Suppliers. We also hold financial data so that we can pay you for your services. We regard all such activities as necessary for our legitimate interests as a recipient of your services.

People whose data we receive from Candidates and Staff, for example references and emergency contacts

If our Candidate or prospective member of Staff has named you as a reference, we will use your data to contact you for a reference. This is part of our quality assurance process, so we consider it necessary for our legitimate interests as an organisation offering recruitment services and employing staff.

If a Candidate or member of Staff has given us your details as an emergency contact, we will use them to contact you in the event of an accident or emergency. We are sure you will agree that this is an important part of our people-oriented organisation and therefore necessary for our legitimate interests.

For what purposes do we rely on your consent?

In certain circumstances we are required to obtain your consent to process your personal data in connection with specific activities.

Article 4(11) of the GDPR states that consent means "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her".

So you must give us your consent freely, without any pressure from us; you must know what you are consenting to; and you should have control over which processing activities you consent to and which you do not. Above all, you must take a positive, affirmative action in giving us your consent. We will keep a record of consents given in this way.

You have, of course, the right to withdraw your consent to these activities. You can do this at any time. Simply submit your request to the Malek Recruitment data controller: MR EXECUTIVE SEARCH LLC SPÓŁKA KOMANDYTOWA, ul. Szpitalna 8/8, 00-031 Warsaw, Poland, marked "Inspektor Danych Osobowych" (Data Protection Officer), or by e-mail at ADO@MalekRecruitment.com.

Establishing, exercising or defending legal claims

Sometimes it may be necessary for us to process personal data and, where appropriate and in accordance with local laws and requirements, sensitive personal data in connection with exercising or defending legal claims. Article 9(2)(f) of the GDPR permits this where processing "is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity".

Such circumstances may arise, for example, when we need legal advice in connection with legal proceedings, or when the law requires certain information to be retained or disclosed as part of a court process.