Information Clause for Job Applicants (Privacy Policy)
This information clause applies to candidates participating in recruitment processes conducted by DEVENTON D. MATCZAK N. MATCZAK SPÓŁKA JAWNA on behalf of employers established in Poland, the European Union or the European Economic Area, including foreign temporary employment agencies assigning workers to user employers. The masculine form “candidate” is used solely for simplicity and readability. All provisions of this clause apply equally to female and male candidates.
1. Data Controller and Contact Details
The controller of personal data is DEVENTON D. MATCZAK N. MATCZAK SPÓŁKA JAWNA, ul. Garbary 35/9, 61-868 Poznań, Poland, Tax Identification Number (NIP): PL7831810484, an employment agency entered in the National Register of Employment Agencies under number 23784, hereinafter referred to as “Deventon” or the “Controller.”
For matters concerning the processing of personal data, the Controller may be contacted by email at rodo@deventon.pl, by post at the address indicated above, or by telephone at +48 600 474 958.
2. Recruitment Model
Deventon provides employment placement services. The potential employer may be an entity that employs the candidate directly or a temporary employment agency that employs the worker and assigns them to perform work for a user employer.
In the temporary employment model, the formal employer is the temporary employment agency, while the user employer is the entity for which, and under whose supervision and direction, the work is actually performed. The temporary employment agency and the user employer may participate in the assessment of the candidate and the organisation of subsequent stages of the recruitment process.
After receiving the candidate’s data, the foreign temporary employment agency and the user employer generally act as separate data controllers to the extent that they independently determine the purposes and means of processing. They are required to provide the candidate with their own information concerning the processing of personal data.
If, after employment, the temporary employment agency assigns the worker to another user employer or another project, any further processing and sharing of data is carried out under the responsibility of that agency and the relevant user employer.
3. Purposes and Legal Bases for Processing
Personal data will be processed for the following purposes:
- receiving and registering an application, contacting the candidate, and assessing their qualifications, experience, licences, language skills, availability and compliance with the requirements of the selected job offer;
- presenting the candidate to a potential employer, including a foreign temporary employment agency, and, where necessary, to a user employer;
- organising interviews, professional or language tests, preparing an employment offer and documentation related to assigning the candidate to work abroad;
- verifying qualifications, professional licences and the candidate’s right to work in the country of employment;
- fulfilling legal obligations applicable to Deventon as an employment agency;
- ensuring the security of systems and communications, documenting the recruitment process, handling complaints, preventing misuse, and establishing, pursuing or defending claims;
- conducting future recruitment processes – only after obtaining the candidate’s separate and voluntary consent.
The legal basis for processing data in the current recruitment process is Article 6(1)(b) of the GDPR, i.e. taking steps at the candidate’s request in connection with the provision of employment placement services and efforts to enter into an agreement with a potential employer. Where applicable, processing is also based on Article 6(1)(c) of the GDPR, in particular in connection with obligations arising from legislation concerning the labour market and employment services, and Article 6(1)(f) of the GDPR, i.e. the legitimate interests of the Controller, including security, documentation of the process, handling complaints and protection against claims.
Processing data for future recruitment processes is based on Article 6(1)(a) of the GDPR, i.e. the candidate’s separate consent. Refusal to provide such consent does not affect participation in the current recruitment process.
4. Scope of Processed Data
Deventon may process, in particular: first and last name, contact details, date of birth – where necessary, information concerning education, qualifications, professional experience, employment history, language skills, licences and certificates, driving licence – where required for a particular position, availability, employment expectations, information concerning willingness to relocate and the right to work, as well as data provided during recruitment interviews.
At the initial application stage, Deventon does not require the candidate to provide their PESEL number, bank account number, marital status, information about children, or a full copy of an identity document. Such data may be obtained at a later stage only where necessary to fulfil a specific legal obligation, prepare required documentation or conclude an agreement.
Please do not include special categories of personal data in application documents, in particular information concerning health, disability, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation, unless such information is objectively necessary for a specific recruitment process. Such data will only be actively used where an appropriate legal basis exists, in particular separate explicit consent pursuant to Article 9(2)(a) of the GDPR or a legal obligation.
Information concerning criminal convictions and offences is processed only where permitted by European Union law or the law of a Member State. Candidates should not provide such information unless Deventon has informed them that it is required for the relevant position.
5. Recipients of Personal Data
Personal data may be disclosed or entrusted, solely to the extent necessary, to:
- persons authorised by Deventon to conduct recruitment and handle candidate processes;
- providers of hosting, email, ATS, CRM, HR and IT services, as well as entities providing legal, audit or information security services;
- potential employers established in Poland, the EU or the EEA, including foreign temporary employment agencies;
- user employers for whom the candidate may perform work, where the transfer of data is necessary to assess the candidate for a specific position, project or assignment period;
- public authorities and other entities entitled to receive data under applicable law.
Data may be provided to the user employer directly by Deventon or through a foreign temporary employment agency. The scope of data will be limited to information necessary to assess the candidate and organise the recruitment process.
Deventon does not distribute a single application to an unlimited or unspecified number of entities. Each presentation of a candidate should relate to a specific job offer, position, project or employer consistent with the candidate’s qualifications and preferences.
6. Information About the Temporary Employment Agency and User Employer
If the name of the foreign temporary employment agency or user employer has been specified in the job advertisement or application form, or communicated to the candidate during an interview, the candidate’s data may be transferred to that entity as part of the indicated recruitment process.
If the identity of the temporary employment agency or user employer has not been disclosed beforehand, Deventon will inform the candidate by telephone, before transferring the data, of at least the entity’s name, country of establishment, position or type of project, and the entity’s role in the recruitment process. The candidate may refuse to have their data transferred to a specific entity without affecting their ability to participate in other recruitment processes.
7. Transfers of Data Outside the European Economic Area
The processes covered by this clause are conducted exclusively for employers and user employers established in Poland, the European Union or the European Economic Area. As part of these processes, Deventon does not transfer candidate applications to employers or user employers established outside the EEA.
If the use of a particular IT tools provider would technically involve the transfer of data outside the EEA, such transfer may take place only in accordance with Chapter V of the GDPR, in particular on the basis of an adequacy decision issued by the European Commission, standard contractual clauses or another mechanism provided for by law.
8. Data Retention Period
Data relating to the current recruitment process will be stored for the duration of the process and, as a general rule, for up to 24 months after its completion, in particular for the purpose of documenting the recruitment process, handling complaints, and establishing, pursuing or defending claims.
If the candidate is assigned to work or the required documentation is concluded, the data will be retained for the period required by applicable law and for as long as necessary to perform and settle the services and protect against claims.
Data processed for future recruitment processes will be stored for 24 months from the date of consent or until consent is withdrawn earlier. After withdrawal of consent, the data will not be used for future recruitment processes unless another legal basis exists for its continued storage.
In the event of a dispute, data may be retained until the dispute has been finally resolved and the resulting decision has been enforced.
9. Voluntary Provision of Data
Providing personal data is voluntary; however, failure to provide data necessary to assess the candidate, establish contact or prepare documentation may prevent participation in a particular recruitment process.
Consent to participate in future recruitment processes is entirely voluntary. Refusal to provide consent or its subsequent withdrawal will not result in any negative consequences in the current recruitment process.
10. Candidate Rights
The candidate has the right to: access their personal data and obtain a copy thereof; rectify their data; erase their data – in cases provided for by law; restrict processing; data portability – where processing is based on consent or a contract and is carried out by automated means; object to processing based on Article 6(1)(f) of the GDPR; and withdraw consent at any time where processing is based on consent.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn. A request to erase data does not apply to data that Deventon is required to continue processing due to a legal obligation or for the purpose of establishing, pursuing or defending claims.
To exercise these rights, please contact Deventon at rodo@deventon.pl.
11. Right to Lodge a Complaint with a Supervisory Authority
If the candidate believes that the processing of their personal data violates applicable law, they have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).
12. Automated Decision-Making
Deventon does not make decisions concerning candidates that produce legal effects or similarly significantly affect them solely by automated means. IT tools may be used to assist in organising and matching applications; however, the final assessment of a candidate and the decision to present their application are made or approved by a human.