Information obligation for Candidates

Information on the Processing of Job Applicants’ Personal Data by Benefit Systems S.A. 1. Data Controller

The controller of your personal data is Benefit Systems S.A., with its registered office in Warsaw (hereinafter “we” or “Benefit Systems”), Pl. Europejski 2, 00-844 Warsaw. You can contact us via email at daneosobowe@benefitsystems.pl or in writing at the following address: Pl. Europejski 2, 00-844 Warsaw, with the note “Personal Data.”

2. Data Protection Officer

We have appointed a Data Protection Officer whom you may contact regarding all matters related to the processing of personal data and the exercise of your rights under the GDPR. You may contact the Data Protection Officer via email at iod@benefitsystems.pl or in writing at the following address: Pl. Europejski 2, 00-844 Warsaw, with the note “DPO.”

3. What personal data do we process about you, and where do we get it from?

Generally, we obtain your personal data directly from you. We process the personal data contained in the job application you submit, the information you provide, and other data collected during the recruitment process (i.e., during interviews and competency tests). We may also process personal data obtained from a recruitment agency representing you or provided to us by your employers (when you consent to a reference check), as well as data contained on publicly available professional and business websites, such as your LinkedIn

4. For what purpose, on what legal basis, and for how long do we process your personal data?

• If employment is to be based on an employment contract: Your personal data specified in the Labor Code or other specific laws (as required by the job posting) are processed in accordance with legal provisions or to take action at your request prior to entering into the contract (e.g., start date, compensation) (legal basis—Article 6(1)(b) and (c) of the GDPR). The data will be processed for the period necessary to conduct the recruitment process for the position you are applying for and to select a candidate, and subsequently, in the event that we need to repeat this recruitment process. We will not process your data for these purposes for longer than 12 months from the date we receive your application for a specific recruitment process.

• If employment is to be based on a civil law contract: Your personal data, such as identification information, contact details, education, professional qualifications, employment history, start date, and compensation, are processed to take action at your request prior to entering into a contract (legal basis—Article 6(1)(b) of the GDPR).

• We process your email address based on our legitimate interest in conducting and managing the recruitment process in our recruitment system. For this reason, if you decide to apply with us, we require you to provide your email address (legal basis—Article 6(1)(f) of the GDPR). The data will be processed for the period necessary to conduct the recruitment process for the position you are applying for and to select a candidate, and subsequently, in the event that we need to repeat this recruitment process. We will not process your data for these purposes for longer than 12 months from the date we receive your application for a specific recruitment process.

• Data related to the verification of your statements contained in your application and provided during the recruitment process, in particular your competencies, including data obtained as a result of competency tests (e.g., information about your knowledge and skills), collected by us or a recruitment agency working with us, or gathered from LinkedIn or other publicly available professional and business websites, are processed to pursue our legitimate interests (legal basis—Article 6(1)(f) of the GDPR). The data will be processed for the period necessary to conduct the recruitment process for the position you are applying for and to select a candidate, and subsequently, in the event that we need to repeat this recruitment process. We will not process your data for these purposes for longer than 12 months from the date we receive your application for a specific recruitment process.

• Data contained in references from previous employers or obtained during our conversations with employers (e.g., data regarding your skills), based on your consent (legal basis—Article 6(1)(a) of the GDPR). The data will be processed for the period necessary to conduct a reference check with the person who provided it. We will not process your data for these purposes for longer than 30 days from the date we receive the reference.

• Additional data that you choose to provide to us voluntarily, such as a photo or information about your interests, will be processed based on your consent (legal basis—Article 6(1)(a) of the GDPR). The data will be processed for the period necessary to conduct the recruitment process for the position you are applying for and to select a candidate, and subsequently, in the event that we need to repeat this recruitment process. We will not process your data for these purposes for longer than 12 months from the date we receive your application for a specific recruitment process.

• If we need to repeat the recruitment process, we will process your data collected in connection with the recruitment for this purpose based on a legitimate interest (legal basis—Article 6(1)(f) of the GDPR). We will not process your data for these purposes for longer than 12 months from the date we receive your application for a specific recruitment process.

• If a recruitment agency is involved in your recruitment process, we process your identifying information and details regarding your financial expectations or compensation based on a legitimate interest for the purpose of performing the contract with that agency (legal basis: Article 6(1)(f) of the GDPR). We will not process your data for these purposes for longer than 12 months from the date we receive your application for a specific recruitment process.

• Future recruitment processes for positions at the Company that match your qualifications, based on your consent (legal basis—Article 6(1)(a) of the GDPR). If you have participated or will participate in several recruitment processes and you consent to our use of the collected data for future recruitment processes as well, then—when conducting such a future recruitment process—we may use all data collected about you, provided that the data processing period based on your consent has not expired. Your data will be processed for this purpose for a period of 24 months from the date you give your consent.

• In the event that entities belonging to the Benefit Systems capital group (list of entities: www.benefitsystems.pl/o-nas/lista-spolek-grupy-kapitalowej-benefit-systems/) conduct a recruitment process similar to the one carried out at our company, we may transfer candidate data from our database to them (legal basis—Article 6(1)(a) of the GDPR). We may use all data collected about you for this purpose—provided that the data processing period based on your consent has not expired. Your data will be processed for this purpose for a period of 24 months from the date you provided your consent. The entities to which the data is disclosed will become separate data controllers and will process your data in accordance with their own policies.

• Exceptionally, in the event of any disputes between you and the Company, for the purpose of asserting claims and defending against claims, based on our legitimate interest (legal basis—Article 6(1)(f) of the GDPR). Your data will generally be processed for a period of 3 years following the conclusion of the recruitment process, or longer if required by law.

Providing the personal data specified in the Labor Code or other legal regulations (if indicated in the job posting) is mandatory in order to participate in the recruitment process. Similarly, providing the data necessary to take action at your request prior to entering into a contract and necessary for our legitimate interests is mandatory. Providing any other data is voluntary.

As a general rule, we ask that you not provide us with sensitive data as defined in Article 9(1) of the GDPR, including health-related data. If you have a disability and believe that informing us of this is relevant to the recruitment process, we will process this data in accordance with applicable law. In other situations, if you decide to provide us with sensitive data — for example, due to your specific circumstances — we will only be able to process it if you give your explicit consent for us to process such sensitive data. Providing such data is voluntary.

5. Recipients of the Data

Your personal data may be disclosed to the following entities: entities within the Benefit Systems group (list of entities: www.benefitsystems.pl/o-nas/lista-spolek-grupy-kapitalowej-benefit-systems/), entities providing hosting and maintenance services for our websites and applications, entities providing ICT services and IT support and security services, entities providing data storage and destruction services, recruitment agencies, reference providers, entities providing services related to the support of our customers and other stakeholders (e.g., couriers), legal advisors, and audit firms.

Your data may also be transferred to public authorities in cases provided for by law.

6. Transfer of Data Outside the EEA

As a general rule, your personal data is not transferred outside the European Economic Area (EEA). Some entities to which we may transfer data are located outside the EEA. We take reasonable measures to ensure that data transfers are lawful and that appropriate safeguards are in place. This includes, in particular, the use of standard contractual clauses approved by the Commission. You may contact us to obtain a copy of the safeguards in place. You can find our contact information in the “Data Controller” or “Data Protection Officer” section above.

7. Automated Decision-Making

We do not make decisions regarding you based solely on the automated processing of information about you that would produce legal effects on you or similarly significantly affect you.

8. Your Rights Regarding the Processing of Personal Data

You have the following rights regarding the processing of your personal data: the right to request access to your data, the right to request rectification of your data, the right to request erasure of your data, the right to request restriction of processing, the right to object to processing, the right to request portability of the data you have provided, and the right to withdraw your consent to the processing of your personal data at any time.

To exercise these rights, please contact us or our Data Protection Officer. You can find our contact information above.

You also have the right to file a complaint with the President of the Personal Data Protection Office.