Recruitment Information Clause

By Article 13(1) and (2) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons about the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC (OJ L 119/1, 4.5.2016), hereinafter referred to as GDPR, we inform you that:

1. PERSONAL DATA ADMINISTRATOR
   1. The administrator of your Personal Data is EMBS GROUP Spółka z ograniczoną odpowiedzialnością Spółka komandytowa, located at Aleja Sosnowa 2a, 30-224 Kraków, Poland, KRS 0000524180 NIP 6772383145 REGON 123231543 (hereinafter referred to as the “Administrator”).
   2. For matters related to the protection of your Personal Data, you can contact the Data Protection Officer appointed by the Administrator at the email address: gdpr@embs-group.com or in writing to the Administrator’s registered office address.
   3. As part of the recruitment process for positions involving employment under an employment contract (Labor Code), the Administrator expects the provision of Personal Data (e.g., in a CV or resume) only to the extent specified in labor law regulations (Article 22, Section 1, KP). If the candidate provides other data not required by the Administrator, it is considered that they have given implied consent for the processing of this data, which can be withdrawn at any time without affecting the legality of the processing carried out before its withdrawal.
   4. If the candidate voluntarily includes special category data in their application documents, such as information about their nationality, health, or degree of disability, for the consideration of their candidacy and thus the processing of these Personal Data, their explicit consent will be required based on Article 9(2)(a) GDPR.
   5. Providing data within the scope specified in the Labor Code or other specific laws (according to the requirements of the announcement) is necessary to participate in the recruitment process. Failure to provide these data may result in the candidate being excluded from the recruitment process. Providing additional data is voluntary and does not affect the possibility of participating in the recruitment, except for special category data (as specified in point 4 above).
2. PURPOSES AND BASES OF PERSONAL DATA PROCESSING
   1. The data collected by the Administrator in recruitment processes, obtained directly from you, will be processed:
      
      1. To fulfill obligations arising from legal regulations related to the employment process under an employment contract, based on Article 6(1)(c) GDPR – legal obligation incumbent on the Administrator specified in the Labor Code (Article 22, 1 KP), or
      2. To fulfill obligations arising from legal regulations related to the employment process under an employment contract and civil law contract, based on Article 6(1)(b) GDPR – conclusion of a contract and taking actions at the request of the data subject before the conclusion of the contract,
         and
      3. To establish or pursue potential claims or defend against such claims based on the legitimate interest of the Administrator under Article 6(1)(f) GDPR, e.g., protecting the Administrator’s rights in connection with potential allegations of unequal treatment during the employment process,
      4. In case of additional implied consent based on Article 6(1)(a) GDPR (consent) to conduct the recruitment process in the scope of data not required by law (e.g., image) or to express the willingness to participate in future recruitment processes of the Administrator, and Article 9(2)(a) GDPR (explicit written consent for processing special category Personal Data), e.g., voluntarily provided information about disability.
3. RECIPIENTS OF PERSONAL DATA
   1. Personal Data may be disclosed to employees or collaborators of the Administrator, as well as entities providing support to the Administrator by data processing agreements (compliant with Article 28 GDPR), including providers of websites, software, electronic services (email, cloud services, internet communicators) used by the Administrator, entities auditing the Administrator’s activities, advisory entities, and other entities cooperating with the Administrator.
   2. The Administrator does not transfer data outside the European Economic Area (EEA).
4. PERIOD OF PERSONAL DATA STORAGE AND PROCESSING
   1. Personal Data will be processed for the period necessary to achieve the above-described purposes, i.e.:
      
      1. Until the end of the recruitment process for the specified position.
      2. In case of consent to process data for future recruitment processes conducted by the Administrator, until the withdrawal of this consent, no longer than 12 months from the end of the given recruitment process.
      3. Each time, after the recruitment process is completed, for the periods of limitation of civil law claims to enable defense against potential claims or pursue claims, if there is a risk of such claims being made by or against the Administrator, for a period not longer than 3 years from the end of the recruitment process.
5. RIGHTS REGARDING PERSONAL DATA
   1. In connection with the processing of Personal Data, you have the following rights:
      
      1. The right to access Personal Data.
      2. The right to rectify Personal Data.
      3. The right to request the deletion of Personal Data (unless specific regulations require the Administrator to retain the data).
      4. The right to restrict the processing of Personal Data.
      5. The right to data portability (in case of processing based on a contract or consent, provided the processing is automated).
      6. The right to object to the processing of Personal Data (based on Article 6(1)(e) or (f), including profiling).
      7. The right not to be subject to a decision based on automated processing; the Administrator indicates that it does not process data based on automated decision-making.
      8. If the processing of Personal Data is based on your consent, you have the right to withdraw consent at any time without affecting the legality of the processing carried out based on consent before its withdrawal.
      9. In case of improper processing of Personal Data, you have the right to complain to the national supervisory authority for data protection, i.e., the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).

1.