Przejdź do treści

Policies | Privacy Policy

Privacy Policy

regarding recruitment, establishing, and performing an employment/cooperation relationship (employment)

This Privacy Policy contains information pursuant to Articles 13 and 14 of the GDPR.

1. Subject of the Privacy Policy

This privacy policy (hereinafter referred to as the „Privacy Policy„) defines the rules, legal bases, and purposes of processing Personal Data by the Personal Data Controller:

  • 1.1. obtained by the Controller directly from Data Subjects, including via e-mail sent by the Data Subject, or through recruitment agencies – for the purposes specified in Section 3.3 of the Privacy Policy;
  • 1.2. obtained by the Controller from publicly available sources, i.e., recruitment or social networking portals (intended for posting professional user profiles and establishing professional contacts) – for the purposes specified in Section 3.3 of the Privacy Policy;
  • 1.3. obtained by the Controller in the manner specified in Sections 1.1 and 1.2 above – for the purposes specified in Section 3.4 of the Privacy Policy;
  • 1.4. obtained by the Controller in the manner specified in Sections 1.1 and 1.2 above or provided by the Data Subject in connection with a given employment relationship – for the purposes specified in Section 3.5 of the Privacy Policy.

Personal Data is always processed for a specific purpose/purposes. The Controller processes only the Data necessary to achieve them.

2. Definitions

  • 2.1. Personal Data Controller / Controller – a natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
  • 2.2. Personal Data / Data – information about the Data Subject obtained by the Controller in the manner specified in Section 1 of the Privacy Policy.
  • 2.3. Contractors – clients, contractors (including subcontractors), partners, associates, employees, public and private entities, etc., cooperating/interacting in any form with the Company (including at the stage of analyzing cooperation opportunities and agreeing on its terms) as part of its business activities.
  • 2.4. Data Subject – an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person; for the purposes of this Privacy Policy – in particular, a person making available or transmitting Personal Data for employment purposes, applying for employment, entering into an employment contract, or transmitting Personal Data within a given employment relationship or, in certain situations, family members of employed persons and third parties indicated by employed persons.
  • 2.5. Supervisory Authority – an independent public authority established by an EU Member State to protect the fundamental rights and freedoms of natural persons in relation to processing personal data and to facilitate the free flow of personal data within the European Union.
  • 2.6. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
  • 2.7. Employment / Employment Relationship – a legal relationship the subject of which is the employment of an employee/associate, including an intern or trainee, regardless of the legal basis of employment or cooperation relationship, in particular an employment contract or a civil law contract (employee/employed person – a party to the aforementioned legal relationship).

3. Information Regarding the Processing of Personal Data by the Controller

  • 3.1. The Personal Data Controller is Phoenix Systems SA with its registered office in Warsaw (02-758), ul. Mangalia 2a („Company„), as an employing entity, in particular on the basis of an employment relationship (employer) or a civil law contract (mandator/ordering party); e-mail address: office@phoenix-rtos.com.
  • 3.2. Contact with the Personal Data Controller / representative of the Controller is possible via e-mail sent to: office@phoenix-rtos.com.
  • 3.3. With regard to Personal Data referred to in Sections 1.1 and 1.2 of the Privacy Policy, the Controller processes Personal Data for purposes related to recruitment, conducting recruitment activities, verifying candidates’ qualifications, establishing or pursuing claims by the Company as part of its business activity, as well as defending against such claims:
    • 3.3.1. to the extent including: first name(s) and surname, company name, date of birth, place of residence / place of business activity (correspondence address), contact details, education, and employment history of the Data Subject applying for employment with the Controller, and other Data when necessary to exercise a right or fulfill an obligation under the law;
    • 3.3.2. pursuant to Article 221 § 1 of the Labor Code, Article 6(1)(b) GDPR (processing is necessary in order to take steps at the request of the data subject prior to entering into a contract), Article 6(1)(f) GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party), as well as the relevant provisions of the Civil Code applicable to concluding contracts.
  • 3.4. With regard to Personal Data referred to in Section 1.1 of the Privacy Policy, the Controller processes Personal Data for purposes related to drafting and concluding an employment contract, establishing or pursuing claims by the Company as part of its business activity, as well as defending against such claims:
    • 3.4.1. to the extent including: first name(s) and surname, company name, date of birth, PESEL number (or in its absence, the type and number of identity document), place of residence / place of business activity (correspondence address), NIP (Tax Identification Number) or REGON number, contact details, education, employment history, payment account number of the Data Subject applying for employment with the Controller, and other Data when necessary to exercise a right or fulfill an obligation under the law;
    • 3.4.2. pursuant to Article 221 § 1 and Article 29 § 1 of the Labor Code, Article 6(1)(b) GDPR (processing is necessary in order to take steps at the request of the data subject prior to entering into a contract), Article 6(1)(c) GDPR (processing is necessary for compliance with a legal obligation to which the controller is subject), Article 6(1)(f) GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party), as well as the relevant provisions of the Civil Code applicable to concluding contracts.
  • 3.5. With regard to Personal Data referred to in Section 1.1 of the Privacy Policy, after establishing the employment relationship, the Controller processes Personal Data for purposes related to: performing the contract and public law obligations related to the contract, including the exercise of rights and duties resulting from the Labor Code, executive regulations to the Labor Code, and other regulations concerning the execution of the employment relationship; fulfilling the Controller’s obligations as a payer of social security contributions (including reporting the employed person to social security and health insurance and submitting settlement documents); fulfilling the Controller’s obligations as a tax withholding agent for personal income tax; Controller’s obligations towards regulatory/inspection authorities (e.g., ZUS, PIP, tax office); Controller’s obligations related to PPK (Employee Capital Plans); Controller’s obligations related to providing preventive health examinations and preventive healthcare for workers; promoting the Company’s activities, products, and services and offering them to Contractors; enabling cooperation with Contractors; ensuring the security of confidential information and IT systems of the Company; ensuring the proper use of entrusted property and IT or telecommunication systems of the Company (including corporate email and internet access) for business purposes; establishing or pursuing claims by the Company as part of its business activity and defending against such claims; ensuring compliance with internal regulations, policies, and procedures of the Company:
    • 3.5.1. to the extent including: first name(s) and surname, company name, date of birth, PESEL number (or in its absence, the type and number of identity document), place of residence / place of business activity (correspondence address), NIP or REGON number, contact details (including business contact details), education, employment history, personal data of the employee’s children and other immediate family members (if providing such data is necessary due to using specific rights under labor law or social security regulations), payment account number, employment and work performance data (including salary, performance evaluation, job description, attendance info, taxes and social security contributions, data required for business trip settlements, penalties and awards info, compliance with workplace policies, driver’s license details in case of driving company vehicles, image – photo for badge/ID card, health data), and other Data when necessary to exercise a right or fulfill an obligation under the law;
    • 3.5.2. pursuant to Article 221 § 1 and Article 29 § 1 of the Labor Code, Article 6(1)(b) GDPR (performance of a contract), Article 6(1)(c) GDPR (compliance with a legal obligation), Article 6(1)(f) GDPR (legitimate interests of the Controller or a third party), Article 9(2)(b) GDPR (carrying out obligations and exercising specific rights in the field of employment and social security law), Article 9(2)(f) GDPR (establishment, exercise, or defense of legal claims), Article 9(2)(h) GDPR (preventive or occupational medicine, assessment of the working capacity of the employee), the Act of 13 October 1998 on the Social Insurance System, the Act of 26 July 1991 on Personal Income Tax, other legal acts imposing legal obligations on the Controller, and relevant provisions of the Civil Code applicable to concluding and performing contracts.
  • 3.6. Regarding Personal Data other than specified in Sections 3.3–3.5 or Data used for other purposes, the Controller processes Personal Data for recruitment purposes (e.g., photo image, CV details, future recruitments) or establishing and executing the employment relationship (including company benefits, commercial health insurance, group insurance) – based on Article 6(1)(a) or Article 9(2)(a) GDPR (Data Subject’s explicit consent). Providing such Data is completely voluntary.
  • 3.7. Personal Data will be transferred by the Controller to entities authorized to obtain it by law (ZUS, tax authorities, NFZ, occupational health units, courts, bailiffs, inspection bodies) and entities to which transfer is necessary to perform the contract with the Data Subject.
  • 3.8. In connection with Covid-19 or other epidemics, health data may be shared with the Chief Sanitary Inspectorate (GIS) and crisis management services in accordance with internal epidemic procedures.
  • 3.9. The Controller may transfer Personal Data to service providers (recruitment portals, software/IT providers, accounting, legal, banking, insurance, courier/postal, medical, archiving, shredding, auditing, training, transport, security/monitoring, OHS/BHP, and travel management services). Data may also be shared with Contractors for business collaboration. Recipients may act as „data processors” or independent „data controllers.”
  • 3.10. Due to using Google Cloud / G Suite services provided by Google LLC (Mountain View, CA, USA), Personal Data may be processed in third countries outside the European Economic Area (EEA). This is conducted in compliance with GDPR using appropriate safeguards (e.g., Standard Contractual Clauses approved by the European Commission).
  • 3.11. The Controller retains Personal Data only as long as necessary to achieve the purpose for which it was collected or to comply with legal requirements.
  • 3.12. Personal Data from Sections 1.1 and 1.2 will be processed:
    • 3.12.1. for the duration of the recruitment process;
    • 3.12.2. for the period necessary to establish employment (if both parties agree);
    • 3.12.3. for future recruitments (if consent was granted);
    • 3.12.4. after recruitment, for purposes specified in Section 3.14.
  • 3.13. Personal Data from Sections 1.1 and 1.4 will be processed:
    • 3.13.1. for employee records: during employment + 10 years after the calendar year of termination (for contracts starting Jan 1, 2019 onwards or with ZUS RIA submitted) OR 50 years after termination (for contracts starting before Jan 1, 2019);
    • 3.13.2. for other document sets: during the period of employment;
    • 3.13.3. after termination for purposes in Sections 3.14 and 3.15;
    • 3.13.4. for non-employment contracts: for the duration of the relationship and post-termination per Sections 3.14 and 3.15.
  • 3.14. Regardless of consent withdrawal or termination of legal grounds, the Controller may process Data as necessary to fulfill legal obligations, for archiving/evidentiary purposes (legitimate interest under Art. 6(1)(f) and Art. 5(2) GDPR), and considering applicable statutes of limitations for claims.
  • 3.15. After termination, Data may be processed for business continuity (e.g., access to work mailboxes, files, repositories, intellectual property documentation, project history, contractor agreements, and legal defense). Personal email addresses will not be actively used for client acquisition.
  • 3.16. Providing Data required by law or contract is necessary to participate in recruitment or execute the contract. Failure to provide it prevents participation or employment. Voluntary data (Art. 3.6) can be withheld without affecting employment, though it may prevent access to specific benefits.
  • 3.17. The Controller will not transfer Data outside the EEA unless explicitly stated in this Privacy Policy.
  • 3.18. If Data is collected from third parties, the Controller will inform the Data Subject of the source.
  • 3.19. Personal Data will not be processed by automated decision-making, including profiling.
  • 3.20. Under GDPR, the Data Subject has the right to:
    • 3.20.1. access their Personal Data;
    • 3.20.2. request immediate rectification or completion of Data;
    • 3.20.3. request erasure („right to be forgotten”);
    • 3.20.4. request restriction of processing;
    • 3.20.5. be informed about recipients notified of rectification/erasure/restriction;
    • 3.20.6. receive Data in a structured, machine-readable format (data portability);
    • 3.20.7. object to processing at any time;
    • 3.20.8. withdraw consent at any time (without affecting prior lawful processing).
  • 3.21. Pursuant to Art. 77 GDPR, the Data Subject has the right to lodge a complaint with the Supervisory Authority – President of the Personal Data Protection Office (Urząd Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).

4. Changes to the Privacy Policy

This Privacy Policy is subject to ongoing review and may be updated as necessary.
The current version of the Privacy Policy was adopted and is effective as of October 27, 2025.