Processing of personal data of job candidates

1. Who we are and how to find us

We are SOFTWARE MANSION and we process your personal data in accordance to the following Privacy Policy.

• We operate as Software Mansion spółka akcyjna based in Krakow (address: ul. Zabłocie 43b, 30-701 Kraków, Poland),

We are the administrator of your personal data.

• You can reach out to us for information, or take advantage of your other rights that are granted to you according to RODO (GDPR). We have created a dedicated point of contact for this sole purpos – email address [email protected] and phone number (+48) 518 987 184.
2. Why we process your personal data

If you are considered a good candidate, we process your personal data to enable you to take part in the recruitment process.

At every stage of the process you are fully aware of your participation. Your personal data is then subject to processing according to your consent (art. 6 par. 1 pt. a. of GDPR).

You are able to withdraw your consent anytime (without affecting the legality of the processing which was carried out on the basis of consent prior to its withdrawal) by sending an email to the address you were contacted from, or [email protected]. You can also withdraw your consent via phone by calling (+48) 518 987 184. In that case, please be aware that we maintain the line during our office hours (Mo. - Fr. 9am-5pm CET) and that we would then have to verify your identity to prevent an unauthorized persons from revoking your consent.

3. Which data is subject to processing

We process the following personal data items:

1. first name(s) and surname;
2. mailing address;
3. email address;
4. phone number;
5. education;
6. image (photo from CV);
7. previous employment (including contract type, type and amount of compensation, availability);
8. assessment of suitability for specific position derived from competence tests;
4. Who we disclose your personal data to

We process personal data in an IT system partially based on cloud computing solutions belonging to external providers. This applies to email hosting, server hosting, well as application software. Whenever such processing involves transferring your data outside EEA (Where GDPR laws do not apply), it is done in accordance with legal instruments provided for by GDPR, ensuring adequate protection of your rights and freedoms. Detailed information on this subject you can find in privacy policies posted by suppliers on their websites. If you wish, you can obtain a set of useful links from us.

5. How long your personal data will be kept and maintained

We strive to keep your data up-to-date. Therefore, we contact you at least once every 24 months in order to catch up. If for some reason we are unable to contact you during this period, your personal data will be deleted after 24 months from obtaining consent for their processing.

6. How you can take advantage of your rights

We make every effort for you to be satisfied with our cooperation. Please do remember, that you have numerous rights and privileges which enable you to influence our way of processing your data. In some cases it is possible to prevent us from processing your data whatsoever. These would be as follows:

• the right to access your personal data (regulated by Art. 15 of GDPR) Read more

Article 15

Right of access by the data subject

1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:
   1. the purposes of the processing;
   2. the categories of personal data concerned;
   3. the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
   4. where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
   5. the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
   6. the right to lodge a complaint with a supervisory authority;
   7. where the personal data are not collected from the data subject, any available information as to their source;
   8. the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
2. Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.
3. The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.
4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.
• the right to correct your data (regulated by art. 16 of GDPR) Read more

Article 16

Right to rectification

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

• the right to have your data erased (regulated by Art. 17 of GDPR) Read more

Article 17

Right to erasure (‘right to be forgotten’)

1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
   1. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
   2. the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;
   3. the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
   4. the personal data have been unlawfully processed;
   5. the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
   6. the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).
2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:
   1. for exercising the right of freedom of expression and information;
   2. for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
   3. for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3);
   4. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
   5. for the establishment, exercise or defence of legal claims.
• the right to limit processing of your data (regulated by Art. 18 of GDPR) Read more

Article 18

Right to restriction of processing

1. The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:
   1. the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
   2. the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
   3. the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
   4. the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.
2. Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
3. A data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction of processing is lifted.
• the right to raise objection against processing of your data (regulated by Art. 21 of GDPR) Read more

Article 21

Right to object

1. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
2. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
3. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
4. At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.
5. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.
6. Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
• the right to have your data transferred to another administrator (regulated by Art. 20 of GDPR) Read more

Article 20

Right to data portability

1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
   1. the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and
   2. the processing is carried out by automated means.
2. In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
3. The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
4. The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.
7. A formal complaint to supervisory authorities

According to Art. 77 of GDPR you have the right to file a complaint to a supervisory body, especially in the member country of residence, employment or the country where the alleged violation of GDPR-regulated data processing rules has occured. In Poland, the supervisory body is the President of the Office for Personal Data Protection. A complaint can be filed by traditional mail to the following address: ul. Stawki 2, 00-913 Warszawa, or by email:[email protected]. You can also obtain more detailed information (including current phone numbers) at the following web address:https://uodo.gov.pl/.

8. Is submitting personal data necessary to conclude contract with us

We do not sign any contract with you. However, entering your data is necessary for you to take part in the recruitment process.

9. How your personal data gets obtained

You have answered our posting using our web form, by sending an email or by contacting us directly. Therefore, the first bunch of data we get directly from you. We might, however, wish to supplement them with our assessment of your suitability for a specific position by means of competence tests.

10. Automated processing and profiling

We do not process your data in an automated way and we do not conduct data profiling as understood by GDPR.

Processing personal data of contracting partners

1. Who we are and how to find us

We are SOFTWARE MANSION and we process your personal data in accordance to the following Privacy Policy.

• We operate as Software Mansion spółka akcyjna based in Krakow (address: ul. Zabłocie 43b, 30-701 Kraków, Poland),

We are the administrator of your personal data.

• You can reach out to us for information, or take advantage of your other rights that are granted to you according to RODO (GDPR). We have created a dedicated point of contact for this sole purpos – email address [email protected] and phone number (+48) 518 987 184.
2. Why we process your personal data

We process your personal data in order to perform the contract and in order to fulfill the tax obligations.

The legal basis for pr processing your data is therefore Art 6. par. 1 pt. b) of GDPR (processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;) as well as art. 6 par. 1 pt. c) of GDPR (processing is necessary for compliance with a legal obligation to which the controller is subject)

If the agreement has been made by your employer or a subject represented by you, however it is you who is in touch with us on their behalf. In such cases, processing of your personal data is based on the premise from art. 6 par. 1 pt. f of GDPR - i.e. the premise of legitimate interests pursued by the controller. The legitimate interest is our will to fulfill the contract with the subject that designated you as their representative. We assume in good faith that this entity was in agreement with you before handing your details over to us, or that the representation of this entity is among your duties.

If you are our contracting partner and you do not fulfill your contractual obligations, the legal basis for the processing of your personal data by us is also art. 6 par. 1 pt. f) of GDPR (processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child). Under this legal basis, claims might be filed against you.

3. Which data is subject to processing

We process the following personal data items:

1. first name(s) and surname,
2. email address,
3. phone number,
4. fax number,
5. address of business activity,
6. company name,
7. tax identification number,
8. company registration number (if applicable),
9. history of transactions with you,
10. history of correspondence with you (including email).
4. Who we disclose your personal data to

Your personal data is revealed within legal limitations to state authorities entitled by law (e.g. tax office).

Your data will also be disclosed to the external accounting office that services us.

We process personal data in an IT system partially based on cloud computing solutions belonging to external providers. This applies to email hosting, server hosting, well as application software. Whenever such processing involves transferring your data outside EEA (Where GDPR laws do not apply), it is done in accordance with legal instruments provided for by GDPR, ensuring adequate protection of your rights and freedoms. Detailed information on this subject you can find in privacy policies posted by suppliers on their websites. If you wish, you can obtain a set of useful links from us.

5. How long your personal data will be kept and maintained

We will process your personal data for as long as it is necessary for tax purposes, i.e. in accordance with the current provisions of Polish law - for 6 to 7 years.

If we cooperate on a permanent basis (e.g. undera framework contract), some of your data will be processsed throughout the whole cooperation period.

6. How you can take advantage of your rights

We make every effort for you to be satisfied with our cooperation. Please do remember, that you have numerous rights and privileges which enable you to influence our way of processing your data. In some cases it is possible to prevent us from processing your data whatsoever. These would be as follows:

• the right to access your personal data (regulated by Art. 15 of GDPR) Read more

Article 15

Right of access by the data subject

1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:
   1. the purposes of the processing;
   2. the categories of personal data concerned;
   3. the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
   4. where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
   5. the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
   6. the right to lodge a complaint with a supervisory authority;
   7. where the personal data are not collected from the data subject, any available information as to their source;
   8. the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
2. Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.
3. The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.
4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.
• the right to correct your data (regulated by art. 16 of GDPR) Read more

Article 16

Right to rectification

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

• the right to have your data erased (regulated by Art. 17 of GDPR) Read more

Article 17

Right to erasure (‘right to be forgotten’)

1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
   1. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
   2. the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;
   3. the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
   4. the personal data have been unlawfully processed;
   5. the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
   6. the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).
2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:
   1. for exercising the right of freedom of expression and information;
   2. for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
   3. for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3);
   4. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
   5. for the establishment, exercise or defence of legal claims.
• the right to limit processing of your data (regulated by Art. 18 of GDPR) Read more

Article 18

Right to restriction of processing

1. The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:
   1. the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
   2. the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
   3. the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
   4. the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.
2. Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
3. A data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction of processing is lifted.
• the right to raise objection against processing of your data (regulated by Art. 21 of GDPR) Read more

Article 21

Right to object

1. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
2. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
3. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
4. At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.
5. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.
6. Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
• the right to have your data transferred to another administrator (regulated by Art. 20 of GDPR) Read more

Article 20

Right to data portability

1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
   1. the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and
   2. the processing is carried out by automated means.
2. In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
3. The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
4. The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.
7. A formal complaint to supervisory authorities

According to Art. 77 of GDPR you have the right to file a complaint to a supervisory body, especially in the member country of residence, employment or the country where the alleged violation of GDPR-regulated data processing rules has occured. In Poland, the supervisory body is the President of the Office for Personal Data Protection. A complaint can be filed by traditional mail to the following address: ul. Stawki 2, 00-913 Warszawa, or by email:[email protected]. You can also obtain more detailed information (including current phone numbers) at the following web address:https://uodo.gov.pl/.

8. Is submitting personal data necessary to conclude contract with us

We collect your personal data to the extent necessary to conclude and fulfill the contract. Part of the data is also necessary for the performance of our obligations under the law (tax regulations, accounting regulations, obligations under the provisions on sales warranties). Failure to provide your personal data will, unfortunately, prevent the conclusion and implementation of the contract.

9. How your personal data gets obtained

We get your personal data from the entity you represent.

10. Automated processing and profiling

We do not process your data in an automated way and we do not conduct data profiling as understood by GDPR.

Processing personal data on swmansion.com

1. Who we are and how to find us

We are SOFTWARE MANSION and we process your personal data in accordance to the following Privacy Policy.

• We operate as Software Mansion spółka akcyjna based in Krakow (address: ul. Zabłocie 43b, 30-701 Kraków, Poland),

We are the administrator of your personal data.

• You can reach out to us for information, or take advantage of your other rights that are granted to you according to RODO (GDPR). We have created a dedicated point of contact for this sole purpos – email address [email protected] and phone number (+48) 518 987 184.
2. How and why we process your personal data

USAGE DATA & COOKIES

For each user we process data describing the way of website usage (these are the so-called operating data). This processing includes automatic reading of a unique identification identifying the endpoint of the telecommunications network or IT system you use (ie. your IP address), as well as the date and time of the server, information about the technical parameters of the software and the device you use (eg. whether browsing our site you use from a laptop or phone), as well as the location from which you connect to our server. This information may be used by us for market research purposes and for improving the website's performance. Data stored in server logs is not associated with specific people using the website. The server logs are only auxiliary material used to administer the site.

The legal basis for usage data processing operations is Art. 6 par. 1 pt. f) of GDRP (processing is necessary for the purposes of the legitimate interests pursued by the controller). That legitimate interest is to enable error diagnostics on the site the improvement of its quality.

Like almost every other website, we utilize cookies. Cookies are small pieces of text data stored on your device (eg. computer, phone or tablet), which may be read back by an IT system.

Cookies enable us to:

• ensure proper site operation,
• improve performance performance and security of the site,
• make use of analytics tools.

The legal basis for this is also Art. 6 par. 1 pt. f) of GDRP (processing is necessary for the purposes of the legitimate interests pursued by the controller).

Own cookies. Cookies can be divided into own and third party ones. We use own cookies in order to improve our website’s performance.

Third-party cookies. Our site, just like most others, utilizes third-party functionalities. This involves utilizing third-party cookies. Here is how it works on our website:

Analysis and stats. We use cookies for tracking website statistics, such as the number of visitors, operating system, browser type, time spend on our website, visited subpages, etc. For that we use the following tools:

• Google Analytics. Data gathered using this tool are completely anonymous and do not allow to identify you. For this purpose, Google LLC cookies for Google Analytics service are used. The use of Google Analytics services involves the implementation of the tracking code provided by Google (the so-called tracking code) in the code of our website. This code is based on cookies, but may also use other tracking technologies. Detailed information about Google Analytics can be found at www.google.com/analytics

You can prevent processing of personal data in this way (block Google Analytics) by making appropriate choices on the site available here: www.tools.google.com/gaoptout

Marketing. We do not use any marketing cookies.

CONTACT FORM

Our website contains a contact form. Personal data submitted using it are processed only to be able to answer your inquiry.

The legal basis for this is therefore Art. 6 par. 1 pt. f) of GDRP (processing is necessary for the purposes of the legitimate interests pursued by the controller) or Art. 6 par. 1 pt. b) (processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;).

APPLICATION FORM

Our website also contains an application form for people aplying for job positions at SOFTWARE MANSION.

More information regarding processing personal data of our job applicants can be found in a dedicated Privacy Policy available here.

3. Which data is subject to processing

We process the following personal data items:

USAGE DATA & COOKIES

1. IP address,
2. server date & time,
3. location of end device used for accessing the website,
4. technical parameters of user’s device and software,
5. device interface language,
6. UTM tags, determining user’s network origin location,
7. online identifiers, including cookie identifiers, Internet protocol addresses, device identifiers (for cookie utilization).

CONTACT FORM

1. first name, surname,
2. email address.
4. Who we disclose your personal data to

We entrust the processing of personal data to the following entities:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany – dedicated web hosting services. Your personal data is stored on secure servers based in Germany. We use encrypted connections to access these servers.
• TYPEFORM S.L., Carrer Bac de Roda, 163, 08018 Barcelona, Spain – maintaining the contact and application form.
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – server data storage, email server. We use Google for our email services as well as cloud data storage (Gsuite), as well as for analytics and stats (Google Analytics).

Some of the operations described above involve transmission of your personal data to the so-called third countries (outside the European Economic Area), where the GDPR is not applicable. However, this always happens on the basis of legal instruments provided for in GDPR, guaranteeing adequate protection of your rights and freedoms. Detailed information in this regard can be found in privacy policies posted by suppliers on their websites. If you like, we would provide you with a list of useful links (email us for this purpose at the following address [email protected]).

5. How long your personal data will be kept and maintained

We will process your personal (usage) data for 26 months. The data we collect from you is stored anonymously.

The effects of cookies in your browser will be maintained for 24 months since the last visit on our website (unless you manually delete our cookies from your browser earlier).

We do not store the data from the contact form for longer than necessary to respond to you and keep in touch with you (if you wish so).

6. How you can take advantage of your rights

We make every effort for you to be satisfied with our cooperation. Please do remember, that you have numerous rights and privileges which enable you to influence our way of processing your data. In some cases it is possible to prevent us from processing your data whatsoever. These would be as follows:

• the right to access your personal data (regulated by Art. 15 of GDPR) Read more

Article 15

Right of access by the data subject

1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:
   1. the purposes of the processing;
   2. the categories of personal data concerned;
   3. the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
   4. where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
   5. the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
   6. the right to lodge a complaint with a supervisory authority;
   7. where the personal data are not collected from the data subject, any available information as to their source;
   8. the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
2. Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.
3. The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.
4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.
• the right to correct your data (regulated by art. 16 of GDPR) Read more

Article 16

Right to rectification

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

• the right to have your data erased (regulated by Art. 17 of GDPR) Read more

Article 17

Right to erasure (‘right to be forgotten’)

1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
   1. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
   2. the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;
   3. the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
   4. the personal data have been unlawfully processed;
   5. the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
   6. the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).
2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:
   1. for exercising the right of freedom of expression and information;
   2. for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
   3. for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3);
   4. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
   5. for the establishment, exercise or defence of legal claims.
• the right to limit processing of your data (regulated by Art. 18 of GDPR) Read more

Article 18

Right to restriction of processing

1. The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:
   1. the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
   2. the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
   3. the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
   4. the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.
2. Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
3. A data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction of processing is lifted.
• the right to raise objection against processing of your data (regulated by Art. 21 of GDPR) Read more

Article 21

Right to object

1. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
2. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
3. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
4. At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.
5. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.
6. Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
• the right to have your data transferred to another administrator (regulated by Art. 20 of GDPR) Read more

Article 20

Right to data portability

1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
   1. the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and
   2. the processing is carried out by automated means.
2. In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
3. The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
4. The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.
7. A formal complaint to supervisory authorities

According to Art. 77 of GDPR you have the right to file a complaint to a supervisory body, especially in the member country of residence, employment or the country where the alleged violation of GDPR-regulated data processing rules has occured. In Poland, the supervisory body is the President of the Office for Personal Data Protection. A complaint can be filed by traditional mail to the following address: ul. Stawki 2, 00-913 Warszawa, or by email:[email protected]. You can also obtain more detailed information (including current phone numbers) at the following web address:https://uodo.gov.pl/.

8. Is submitting personal data necessary to conclude contract with us

The data is not collected in order to conclude a contract.

9. How your personal data gets obtained

We obtain your personal data from you. However, it might happen also in an automated way.

10. Automated processing and profiling

Exploitation data and data related to the use of cookies are processed by automated means (not subject to data profiling as understood by GDPR). The remaining personal data are not processed in this way.

Processing personal data for marketing and commercial purposes

1. Who we are and how to find us

We are SOFTWARE MANSION and we process your personal data in accordance to the following Privacy Policy.

• We operate as Software Mansion spółka akcyjna based in Krakow (address: ul. Zabłocie 43b, 30-701 Kraków, Poland),

We are the administrator of your personal data.

• You can reach out to us for information, or take advantage of your other rights that are granted to you according to RODO (GDPR). We have created a dedicated point of contact for this sole purpos – email address [email protected] and phone number (+48) 518 987 184.
2. Why we process your personal data

We process your personal data for direct marketing and commercial purposes, including providing you with commercial information relating to our offer and events we organize.

Your personal data is then subject to processing according to your consent (art. 6 par. 1 pt. a. of GDPR).

The legal basis for contacting you via email is the Act of 18 July 2002 on the provision of services by electronic means (Journal of Laws of 2002, No. 144 pos. 104).

You are able to withdraw your consent anytime (without affecting the legality of the processing which was carried out on the basis of consent prior to its withdrawal) by sending an email to the address you were contacted from, or [email protected]. You can also withdraw your consent via phone by calling (+48) 518 987 184. In that case, please be aware that we maintain the line during our office hours (Mo. - Fr. 9am-5pm CET) and that we would then have to verify your identity to prevent an unauthorized persons from revoking your consent.

3. Which data is subject to processing

We process the following personal data items:

1. first name(s) and surname;
2. mailing address;
3. email address;
4. phone number;
5. other personal data that you made available to Software Mansion in documents provided for registering for our events or our newsletter service.
4. Who we disclose your personal data to

We process personal data in an IT system partially based on cloud computing solutions belonging to external providers. This applies to email hosting, server hosting, well as application software. Whenever such processing involves transferring your data outside EEA (Where GDPR laws do not apply), it is done in accordance with legal instruments provided for by GDPR, ensuring adequate protection of your rights and freedoms. Detailed information on this subject you can find in privacy policies posted by suppliers on their websites. If you wish, you can obtain a set of useful links from us.

5. How long your personal data will be kept and maintained

We strive to keep your data up-to-date. Therefore, we contact you at least once every 12 months in order to catch up. If for some reason we are unable to contact you during this period, your personal data will be deleted after 12 months from obtaining consent for their processing.

6. How you can take advantage of your rights

We make every effort for you to be satisfied with our cooperation. Please do remember, that you have numerous rights and privileges which enable you to influence our way of processing your data. In some cases it is possible to prevent us from processing your data whatsoever. These would be as follows:

• the right to access your personal data (regulated by Art. 15 of GDPR) Read more

Article 15

Right of access by the data subject

1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:
   1. the purposes of the processing;
   2. the categories of personal data concerned;
   3. the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
   4. where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
   5. the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
   6. the right to lodge a complaint with a supervisory authority;
   7. where the personal data are not collected from the data subject, any available information as to their source;
   8. the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
2. Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.
3. The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.
4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.
• the right to correct your data (regulated by art. 16 of GDPR) Read more

Article 16

Right to rectification

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

• the right to have your data erased (regulated by Art. 17 of GDPR) Read more

Article 17

Right to erasure (‘right to be forgotten’)

1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
   1. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
   2. the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;
   3. the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
   4. the personal data have been unlawfully processed;
   5. the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
   6. the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).
2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:
   1. for exercising the right of freedom of expression and information;
   2. for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
   3. for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3);
   4. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
   5. for the establishment, exercise or defence of legal claims.
• the right to limit processing of your data (regulated by Art. 18 of GDPR) Read more

Article 18

Right to restriction of processing

1. The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:
   1. the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
   2. the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
   3. the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
   4. the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.
2. Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
3. A data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction of processing is lifted.
• the right to raise objection against processing of your data (regulated by Art. 21 of GDPR) Read more

Article 21

Right to object

1. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
2. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
3. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
4. At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.
5. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.
6. Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
• the right to have your data transferred to another administrator (regulated by Art. 20 of GDPR) Read more

Article 20

Right to data portability

1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
   1. the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and
   2. the processing is carried out by automated means.
2. In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
3. The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
4. The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.
7. A formal complaint to supervisory authorities

According to Art. 77 of GDPR you have the right to file a complaint to a supervisory body, especially in the member country of residence, employment or the country where the alleged violation of GDPR-regulated data processing rules has occured. In Poland, the supervisory body is the President of the Office for Personal Data Protection. A complaint can be filed by traditional mail to the following address: ul. Stawki 2, 00-913 Warszawa, or by email:[email protected]. You can also obtain more detailed information (including current phone numbers) at the following web address:https://uodo.gov.pl/.

8. How your personal data gets obtained

You have answered our posting using our web form, by sending an email or by contacting us directly. Therefore, the first bunch of data we get directly from you. We might, however, wish to supplement them with our assessment of your suitability for a specific position by means of competence tests.

9. Automated processing and profiling

We process your data by profiling. Profiling shall means any form of automated processing of personal data by the Software Mansion, which involves the use of personal data to assess certain personal factors, in particular to analyse or forecast preferences, interests, credibility, behaviour, location or movement of the Client.

Processing personal data for marketing and commercial purposes

1. Who we are and how to find us

We are SOFTWARE MANSION and we process your personal data in accordance to the following Privacy Policy.

• We operate as Software Mansion spółka akcyjna based in Krakow (address: ul. Zabłocie 43b, 30-701 Kraków, Poland),

We are the administrator of your personal data.

• You can reach out to us for information, or take advantage of your other rights that are granted to you according to RODO (GDPR). We have created a dedicated point of contact for this sole purpos – email address [email protected] and phone number (+48) 518 987 184.
2. Why we process your personal data

We process your personal data for direct marketing and commercial purposes, including providing you with commercial information relating to our offer and events we organize.

Your personal data is then subject to processing according to your consent (art. 6 par. 1 pt. a. of GDPR).

The legal basis for contacting you via email is the Act of 18 July 2002 on the provision of services by electronic means (Journal of Laws of 2002, No. 144 pos. 104).

You are able to withdraw your consent anytime (without affecting the legality of the processing which was carried out on the basis of consent prior to its withdrawal) by sending an email to the address you were contacted from, or [email protected]. You can also withdraw your consent via phone by calling (+48) 518 987 184. In that case, please be aware that we maintain the line during our office hours (Mo. - Fr. 9am-5pm CET) and that we would then have to verify your identity to prevent an unauthorized persons from revoking your consent.

3. Which data is subject to processing

We process the following personal data items:

1. first name(s) and surname;
2. mailing address;
3. email address;
4. phone number;
5. other personal data that you made available to Software Mansion in documents provided for registering for our events or our newsletter service.
4. Who we disclose your personal data to

We process personal data in an IT system partially based on cloud computing solutions belonging to external providers. This applies to email hosting, server hosting, well as application software. Whenever such processing involves transferring your data outside EEA (Where GDPR laws do not apply), it is done in accordance with legal instruments provided for by GDPR, ensuring adequate protection of your rights and freedoms. Detailed information on this subject you can find in privacy policies posted by suppliers on their websites. If you wish, you can obtain a set of useful links from us.

5. How long your personal data will be kept and maintained

We strive to keep your data up-to-date. Therefore, we contact you at least once every 12 months in order to catch up. If for some reason we are unable to contact you during this period, your personal data will be deleted after 12 months from obtaining consent for their processing.

6. How you can take advantage of your rights

We make every effort for you to be satisfied with our cooperation. Please do remember, that you have numerous rights and privileges which enable you to influence our way of processing your data. In some cases it is possible to prevent us from processing your data whatsoever. These would be as follows:

• prawo dostępu do danych osobowych (uregulowane w art. 15 RODO) Read more

Artykuł 15

Prawo dostępu przysługujące osobie, której dane dotyczą

1. Osoba, której dane dotyczą, jest uprawniona do uzyskania od administratora potwierdzenia, czy przetwarzane są dane osobowe jej dotyczące, a jeżeli ma to miejsce, jest uprawniona do uzyskania dostępu do nich oraz następujących informacji:
   1. cele przetwarzania;
   2. kategorie odnośnych danych osobowych;
   3. informacje o odbiorcach lub kategoriach odbiorców, którym dane osobowe zostały lub zostaną ujawnione, w szczególności o odbiorcach w państwach trzecich lub organizacjach międzynarodowych;
   4. w miarę możliwości planowany okres przechowywania danych osobowych, a gdy nie jest to możliwe, kryteria ustalania tego okresu;
   5. informacje o prawie do żądania od administratora sprostowania, usunięcia lub ograniczenia przetwarzania danych osobowych dotyczącego osoby, której dane dotyczą, oraz do wniesienia sprzeciwu wobec takiego przetwarzania;
   6. informacje o prawie wniesienia skargi do organu nadzorczego;
   7. jeżeli dane osobowe nie zostały zebrane od osoby, której dane dotyczą – wszelkie dostępne informacje o ich źródle;
   8. informacje o zautomatyzowanym podejmowaniu decyzji, w tym o profilowaniu, o którym mowa w art. 22 ust. 1 i 4, oraz – przynajmniej w tych przypadkach – istotne informacje o zasadach ich podejmowania, a także o znaczeniu i przewidywanych konsekwencjach takiego przetwarzania dla osoby, której dane dotyczą.
2. Jeżeli dane osobowe są przekazywane do państwa trzeciego lub organizacji międzynarodowej, osoba, której dane dotyczą, ma prawo zostać poinformowana o odpowiednich zabezpieczeniach, o których mowa w art. 46, związanych z przekazaniem.
3. Administrator dostarcza osobie, której dane dotyczą, kopię danych osobowych podlegających przetwarzaniu. Za wszelkie kolejne kopie, o które zwróci się osoba, której dane dotyczą, administrator może pobrać opłatę w rozsądnej wysokości wynikającej z kosztów administracyjnych. Jeżeli osoba, której dane dotyczą, zwraca się o kopię drogą elektroniczną i jeżeli nie zaznaczy inaczej, informacji udziela się powszechnie stosowaną drogą elektroniczną.
4. Prawo do uzyskania kopii, o której mowa w ust. 3, nie może niekorzystnie wpływać na prawa i wolności innych.
• prawo do sprostowania danych (uregulowane w art. 16 RODO) Read more

Artykuł 16

Prawo do sprostowania danych

Osoba, której dane dotyczą, ma prawo żądania od administratora niezwłocznego sprostowania dotyczących jej danych osobowych, które są nieprawidłowe. Z uwzględnieniem celów przetwarzania, osoba, której dane dotyczą, ma prawo żądania uzupełnienia niekompletnych danych osobowych, w tym poprzez przedstawienie dodatkowego oświadczenia.

• prawo do usunięcia danych (uregulowane w art. 17 RODO) Read more

Artykuł 17

Prawo do usunięcia danych („prawo do bycia zapomnianym”)

1. Osoba, której dane dotyczą, ma prawo żądania od administratora niezwłocznego usunięcia dotyczących jej danych osobowych, a administrator ma obowiązek bez zbędnej zwłoki usunąć dane osobowe, jeżeli zachodzi jedna z następujących okoliczności:
   1. dane osobowe nie są już niezbędne do celów, w których zostały zebrane lub w inny sposób przetwarzane;
   2. osoba, której dane dotyczą, cofnęła zgodę, na której opiera się przetwarzanie zgodnie z art. 6 ust. 1 lit. a) lub art. 9 ust. 2 lit. a), i nie ma innej podstawy prawnej przetwarzania;
   3. osoba, której dane dotyczą, wnosi sprzeciw na mocy art. 21 ust. 1 wobec przetwarzania i nie występują nadrzędne prawnie uzasadnione podstawy przetwarzania lub osoba, której dane dotyczą, wnosi sprzeciw na mocy art. 21 ust. 2 wobec przetwarzania;
   4. dane osobowe były przetwarzane niezgodnie z prawem;
   5. dane osobowe muszą zostać usunięte w celu wywiązania się z obowiązku prawnego przewidzianego w prawie Unii lub prawie państwa członkowskiego, któremu podlega administrator;
   6. dane osobowe zostały zebrane w związku z oferowaniem usług społeczeństwa informacyjnego, o których mowa w art. 8 ust. 1.
2. Jeżeli administrator upublicznił dane osobowe, a na mocy ust. 1 ma obowiązek usunąć te dane osobowe, to – biorąc pod uwagę dostępną technologię i koszt realizacji – podejmuje rozsądne działania, w tym środki techniczne, by poinformować administratorów przetwarzających te dane osobowe, że osoba, której dane dotyczą, żąda, by administratorzy ci usunęli wszelkie łącza do tych danych, kopie tych danych osobowych lub ich replikację.
3. Ust. 1 i 2 nie mają zastosowania, w zakresie w jakim przetwarzanie jest niezbędne:
   1. do korzystania z prawa do wolności wypowiedzi i informacji;
   2. do wywiązania się z prawnego obowiązku wymagającego przetwarzania na mocy prawa Unii lub prawa państwa członkowskiego, któremu podlega administrator, lub do wykonania zadania realizowanego w interesie publicznym lub w ramach sprawowania władzy publicznej powierzonej administratorowi;
   3. z uwagi na względy interesu publicznego w dziedzinie zdrowia publicznego zgodnie z art. 9 ust. 2 lit. h) oraz i) i art. 9 ust. 3;
   4. do celów archiwalnych w interesie publicznym, do celów badań naukowych lub historycznych lub do celów statystycznych zgodnie z art. 89 ust. 1, o ile prawdopodobne jest, że prawo, o którym mowa w ust. 1, uniemożliwi lub poważnie utrudni realizację celów takiego przetwarzania; lub
   5. do ustalenia, dochodzenia lub obrony roszczeń.
• prawo do ograniczenia przetwarzania (uregulowane w art. 18 RODO) Read more

Artykuł 18

Prawo do ograniczenia przetwarzania

1. Osoba, której dane dotyczą, ma prawo żądania od administratora ograniczenia przetwarzania w następujących przypadkach:
   1. osoba, której dane dotyczą, kwestionuje prawidłowość danych osobowych – na okres pozwalający administratorowi sprawdzić prawidłowość tych danych;
   2. przetwarzanie jest niezgodne z prawem, a osoba, której dane dotyczą, sprzeciwia się usunięciu danych osobowych, żądając w zamian ograniczenia ich wykorzystywania;
   3. administrator nie potrzebuje już danych osobowych do celów przetwarzania, ale są one potrzebne osobie, której dane dotyczą, do ustalenia, dochodzenia lub obrony roszczeń;
   4. osoba, której dane dotyczą, wniosła sprzeciw na mocy art. 21 ust. 1 wobec przetwarzania – do czasu stwierdzenia, czy prawnie uzasadnione podstawy po stronie administratora są nadrzędne wobec podstaw sprzeciwu osoby, której dane dotyczą.
2. Jeżeli na mocy ust. 1 przetwarzanie zostało ograniczone, takie dane osobowe można przetwarzać, z wyjątkiem przechowywania, wyłącznie za zgodą osoby, której dane dotyczą, lub w celu ustalenia, dochodzenia lub obrony roszczeń, lub w celu ochrony praw innej osoby fizycznej lub prawnej, lub z uwagi na ważne względy interesu publicznego Unii lub państwa członkowskiego.
3. Przed uchyleniem ograniczenia przetwarzania administrator informuje o tym osobę, której dane dotyczą, która żądała ograniczenia na mocy ust. 1.
• prawo do wniesienia sprzeciwu wobec przetwarzania (uregulowane w art. 21 RODO) Read more

Artykuł 21

Prawo do sprzeciwu

1. Osoba, której dane dotyczą, ma prawo w dowolnym momencie wnieść sprzeciw – z przyczyn związanych z jej szczególną sytuacją – wobec przetwarzania dotyczących jej danych osobowych opartego na art. 6 ust. 1 lit. e) lub f), w tym profilowania na podstawie tych przepisów. Administratorowi nie wolno już przetwarzać tych danych osobowych, chyba że wykaże on istnienie ważnych prawnie uzasadnionych podstaw do przetwarzania, nadrzędnych wobec interesów, praw i wolności osoby, której dane dotyczą, lub podstaw do ustalenia, dochodzenia lub obrony roszczeń.
2. Jeżeli dane osobowe są przetwarzane na potrzeby marketingu bezpośredniego, osoba, której dane dotyczą, ma prawo w dowolnym momencie wnieść sprzeciw wobec przetwarzania dotyczących jej danych osobowych na potrzeby takiego marketingu, w tym profilowania, w zakresie, w jakim przetwarzanie jest związane z takim marketingiem bezpośrednim.
3. Jeżeli osoba, której dane dotyczą, wniesie sprzeciw wobec przetwarzania do celów marketingu bezpośredniego, danych osobowych nie wolno już przetwarzać do takich celów.
4. Najpóźniej przy okazji pierwszej komunikacji z osobą, której dane dotyczą, wyraźnie informuje się ją o prawie, o którym mowa w ust. 1 i 2, oraz przedstawia się je jasno i odrębnie od wszelkich innych informacji.
5. W związku z korzystaniem z usług społeczeństwa informacyjnego i bez uszczerbku dla dyrektywy 2002/58/WE osoba, której dane dotyczą, może wykonać prawo do sprzeciwu za pośrednictwem zautomatyzowanych środków wykorzystujących specyfikacje techniczne.
6. Jeżeli dane osobowe są przetwarzane do celów badań naukowych lub historycznych lub do celów statystycznych na mocy art. 89 ust. 1, osoba, której dane dotyczą, ma prawo wnieść sprzeciw – z przyczyn związanych z jej szczególną sytuacją – wobec przetwarzania dotyczących jej danych osobowych, chyba że przetwarzanie jest niezbędne do wykonania zadania realizowanego w interesie publicznym.
• prawo do przenoszenia danych (uregulowane w art. 20 RODO) Read more

Artykuł 20

Prawo do przenoszenia danych

1. Osoba, której dane dotyczą, ma prawo otrzymać w ustrukturyzowanym, powszechnie używanym formacie nadającym się do odczytu maszynowego dane osobowe jej dotyczące, które dostarczyła administratorowi, oraz ma prawo przesłać te dane osobowe innemu administratorowi bez przeszkód ze strony administratora, któremu dostarczono te dane osobowe, jeżeli:
   1. przetwarzanie odbywa się na podstawie zgody w myśl art. 6 ust. 1 lit. a) lub art. 9 ust. 2 lit. a) lub na podstawie umowy w myśl art. 6 ust. 1 lit. b); oraz
   2. przetwarzanie odbywa się w sposób zautomatyzowany.
2. Wykonując prawo do przenoszenia danych na mocy ust. 1, osoba, której dane dotyczą, ma prawo żądania, by dane osobowe zostały przesłane przez administratora bezpośrednio innemu administratorowi, o ile jest to technicznie możliwe.
3. Wykonanie prawa, o którym mowa w ust. 1 niniejszego artykułu, pozostaje bez uszczerbku dla art. 17. Prawo to nie ma zastosowania do przetwarzania, które jest niezbędne do wykonania zadania realizowanego w interesie publicznym lub w ramach sprawowania władzy publicznej powierzonej administratorowi.
4. Prawo, o którym mowa w ust. 1, nie może niekorzystnie wpływać na prawa i wolności innych.
7. A formal complaint to supervisory authorities

According to Art. 77 of GDPR you have the right to file a complaint to a supervisory body, especially in the member country of residence, employment or the country where the alleged violation of GDPR-regulated data processing rules has occured. In Poland, the supervisory body is the President of the Office for Personal Data Protection. A complaint can be filed by traditional mail to the following address: ul. Stawki 2, 00-913 Warszawa, or by email:[email protected]. You can also obtain more detailed information (including current phone numbers) at the following web address:https://uodo.gov.pl/.

8. How your personal data gets obtained

You have answered our posting using our web form, by sending an email or by contacting us directly. Therefore, the first bunch of data we get directly from you. We might, however, wish to supplement them with our assessment of your suitability for a specific position by means of competence tests.

9. Automated processing and profiling

We process your data by profiling. Profiling shall means any form of automated processing of personal data by the Software Mansion, which involves the use of personal data to assess certain personal factors, in particular to analyse or forecast preferences, interests, credibility, behaviour, location or movement of the Client.