What personal data do we process and where do we get them from?
We process your personal data, voluntarily provided by you as part of your application and participation in the recruitment process conducted by BR-AG.
Providing personal data is always voluntary, however, the failure to provide the data necessary for the recruitment process will prevent your participation in the recruitment process.
For what purpose do we process your data and on what grounds?
When you register your participation in our recruitment process, we may process your data for the purpose of recruitment:
when it is necessary to act on your request before entering into a contract of mandate, a contract for work, a contract for services or any other contract of a similar nature (legal basis in Article 6, section 1, letter b of the GDPR). The provision of personal data is in this case a condition for us to accept your recruitment application.
based on the legal provisions (legal basis of Article 22¹ § 1 of the Labour Code in connection with Article 6 section 1 letter c of the GDPR), if you apply for employment on the basis of an employment contract. The provision of personal data in such a case results from the law and is a condition for participation in the recruitment procedure.
Other data (e.g. image) provided by you in your recruitment application are processed on the basis of your voluntary consent, which you have expressed by sending us your recruitment application and their submission does not affect the possibility of participation in the recruitment process.
We process your personal data on the basis of your voluntary consent, if you have given your consent for us to process your data for future recruitment purposes. Please be informed that providing your data in such cases is voluntary, and the fact that you do not give your consent has no influence on the possibility of participation in the recruitment process.
Your personal data may also be processed for the purpose of ensuring and demonstrating compliance with the legal obligations imposed on the BR-AG, when the processing is necessary to fulfil the legal obligation of BR-AG (legal basis of Article 6, section 1, letter c of the GDPR).
We may also process your data on the basis of our legitimate interest in determining, asserting or defending our claims if the claims relate to our recruitment, as well as for archiving and evidentiary purposes that pursue our legitimate interest in securing information in the event of a legitimate need or obligation to prove facts (legal basis Article 6, section 1 letter f of GDPR).
Who is the recipient of your data?
We only share your personal data with others if we have legal grounds for doing so. If we transfer your personal data to recipients outside the European Union or the European Economic Area (EEA), this will only take place if the European Commission has confirmed the applicable level of data protection in relation to this third country, if an appropriate level of data protection has been agreed with the recipient (e.g. using so-called standard contractual clauses) or if we have obtained your consent.
Your personal data may be made available to public authorities or other entities entitled to such access under the law.
Depending on the purpose for which we process your data, the recipients of your personal data may also include entities providing IT services (in particular Google LLC), such as hosting, or providing BR-AG with ICT systems, telecommunication entrepreneurs, providers of job advertisement publication services (in particular Pracuj.pl Group), providers of recruitment management systems (in particular TOMhrm and eRecruitment Solutions sp. z o.o.), law firms, companies providing HR and payroll services and consulting companies with which we cooperate.
The processing of your data may result in their transfer to servers of software and IT services providers, in connection with BR-AG’s use of the services/software they provide. Some of these servers are located in the USA. The transfer of data to the United States takes place pursuant to the European Commission’s Implementing Decision of 12.07.2016 on the adequacy of protection provided by the EU-US Privacy Shield (the so-called “adequacy decision” pursuant to Article 45 of the GDPR). You have the opportunity to obtain a copy of such data.
For what period of time do we store your data?
If BR-AG enters into a contract with you after the recruitment process is completed, your personal data will be stored for the duration of your employment relationship or any other type of relationship, as required by law.
If after completion of the recruitment process BR-AG does not conclude a contract with you, BR-AG will delete your recruitment documents after the completion of the recruitment process, as long as no other legitimate interests of BR-AG conflict with such deletion and in case you have agreed to future recruitments – after 24 months from the end of the recruitment process.
We only process personal data in order to demonstrate and perform the obligations incumbent on BR-AG to the extent and for the period necessary to fulfil those obligations and demonstrate that the obligations incumbent on us have been fulfilled.
If the processing of your data is necessary to determine, seek or defend claims – your personal data will be processed by us by the time of the claims’ prescription or resolution of the dispute.
What are your rights?
To the extent and in cases stipulated by legal regulations, you are given the following rights:
the right to withdraw the consent expressed by you (the consent is voluntary and may be revoked at any time, with no impact on the lawfulness of processing made prior to the withdrawal of the consent)
the right of access and the right to obtain the copy of one’s data
the right to correct one’s personal data
the right to delete your personal data
the right to limit the processing of one’s data/li>
the right to transfer one’s personal data
the right to object to processing
BR-AG will implement the aforementioned rights in compliance with the GDPR and other applicable legal provisions.
You are also entitled to lodge a complaint to a competent supervision body, if you think the processing of your personal data breaches the provisions of the GDPR. The President of the Office for the Protection of Personal Data is the competent supervisory body in Poland.
Information on automated decision-making, including profiling
We do not apply these mechanisms for automatic decision-making process with respect to decisions that would involve legal effects towards you or would affect you significantly in another way, including based on profiling.