Privacy Policy Regarding the Processing of Personal Data in the Recruitment Process

1. Data Controller

The controller of your personal data is Velis RET Sp. z o.o., with its registered office in Kraków (ul. Podole 60, 30-394 Kraków), entered in the register of entrepreneurs of the National Court Register under KRS number 0001035946, NIP 6772333578 (hereinafter: “SINGU”, “we”, “us”, “our”).

For matters related to the processing of personal data, you may contact us at:

– e-mail: recruitment@singu.com

– postal address: Podole 60, 30-394 Kraków, Poland

Velis RET Sp. z o.o. has appointed a Data Protection Officer (DPO) – Oliwia Duda, whom you may contact in matters relating to the processing of your personal data:

– e-mail: dpo@singu.com

– postal address: Podole 60, 30-394 Kraków, Poland, marked “Data Protection Officer”

2. Scope of Application

This notice concerns the processing of personal data of all candidates applying for employment or cooperation within SINGU, including full-time employees, interns and trainees, B2B contractors, and individuals who have consented to participate in future recruitment processes.

3. Purposes and Legal Bases for Data Processing

We process your personal data for the purpose of conducting the recruitment process (i.e. selecting or identifying candidates for employment and agreeing on the terms of employment with them, as well as – potentially – pursuing or defending against related claims). The legal bases for our activities in this regard are:

Article 6(1)(a) of the GDPR (consent of the data subject) – in every case where the candidate applies for employment on their own initiative; expresses a wish to participate in recruitment processes other than the specific process initiated by the job posting to which the candidate responded; expresses a wish to receive information about ongoing recruitment processes; or provides information and data (including, for example, a photograph) whose provision is not required by law and is not necessary when applying for the position in question;

Article 6(1)(b) of the GDPR (taking steps at the request of the data subject prior to entering into a contract) – in every case where the candidate responds to a job posting for a given position;

Article 6(1)(c) of the GDPR (compliance with a legal obligation under employment law) – in every case where the candidate is applying (even potentially) for employment under the provisions of labour law;

Article 6(1)(f) of the GDPR (legitimate interests) – in every case where we analyse information publicly disclosed by candidates (e.g. on social media platforms, in particular LinkedIn) in order to assess their application and tailor offers to their profile and experience; where we carry out promotional and marketing activities directed at candidates (in particular via social media platforms, especially LinkedIn); or where we pursue or defend against claims.

4. Categories of Personal Data Processed

As part of the recruitment process, we collect the following mandatory data: full name, e-mail address, phone number, CV (curriculum vitae), and location (city, country). Depending on the nature of the position, we may also collect additional data such as: proficiency level in required languages, right to work in a given country, availability to work in a specific model (e.g. hybrid or on-site), notice period, and expected salary.

Optional data, provided (or made publicly available) voluntarily, includes additional application documents (e.g. cover letter, portfolio, references) and other information voluntarily included in application documents or publicly shared in accordance with the terms of social media platforms (in particular LinkedIn) that you use.

Providing mandatory data is necessary in order to participate in the recruitment process.

Providing data beyond the scope set out in Article 22¹ of the Labour Code or beyond the scope necessary to assess an application is voluntary.

5. Recipients of Personal Data

Your personal data may be disclosed to the following categories of recipients:

SINGU group affiliated companies – to the extent necessary for administrative purposes and for coordinating recruitment processes conducted within the group.

Recruitment agencies collaborating with SINGU in sourcing candidates, acting as data processors under a data processing agreement.

Ashby Inc. – the provider of the ATS (Applicant Tracking System) used to manage the recruitment process, acting as a data processor under a data processing agreement.

Other external IT service providers, including providers of hosting, data security, and backup services, to the extent necessary for managing the recruitment process.

Public authorities – courts, regulatory bodies, or law enforcement authorities, where the obligation to disclose data arises from applicable law.

6. Use of Artificial Intelligence

In our recruitment process, we use the Ashby system, which offers features based on artificial intelligence. These features may be used by our recruiters as a supporting tool – for example, to analyse the context of a candidate’s profile, summarise application history, or facilitate the review of application documents.

The Ashby system does not assign candidates automated numerical scores or rankings. We do not make employment decisions based solely on automated processing. The final recruitment decision is always made by a human – a recruiter or hiring manager.

7. Transfer of Data Outside the EEA

Your personal data may be transferred to the United Kingdom (a SINGU affiliated company) and to the United States (Ashby Inc., the ATS provider). Such transfers comply with the requirements of the GDPR – the United Kingdom has been recognised by the European Commission as providing an adequate level of data protection, while transfers to the United States are carried out on the basis of Standard Contractual Clauses approved by the European Commission. You may obtain a copy of the applicable safeguards by contacting us at the address provided in Section 1.

8. Data Retention Period

Data processed in the context of an ongoing recruitment process is retained for the purposes described above for the duration of the recruitment.

If you consent to participation in future recruitment processes, your data will be retained until you withdraw your consent, for no longer than 24 months from the date it was received.

If you consent to receiving job offers or recruitment communications, your data will be retained for 24 months from the date of your last activity.

If you have provided us with your data solely for the purposes of a specific recruitment process and that process has concluded, we will retain your data for a period of 3 years from the date the recruitment ended, for the purpose of pursuing or defending against potential claims – unless, based on an assessment of the particular case, we determine that retaining data for such a period is not necessary for that purpose.

If you publicly disclose your professional data as a potential candidate on social media platforms (in particular LinkedIn) or recruitment portals, we will process your data for as long as this is permitted under the terms of use of those platforms and in accordance with the conditions arising therefrom.

Upon expiry of the above-mentioned periods, data is deleted or anonymised.

9. Your Rights

In connection with the processing of your personal data, you have the following rights: the right of access to your data and to obtain a copy thereof; the right to rectification (updating) of inaccurate or incomplete data; the right to erasure of data (“the right to be forgotten”); the right to restriction of processing; the right to data portability; the right to object to processing based on legitimate interests, including profiling; the right to withdraw consent at any time without affecting the lawfulness of processing carried out prior to such withdrawal; and the right to lodge a complaint with the President of the Personal Data Protection Office if you consider that the processing of your data infringes the provisions of the GDPR.

You also have the right to obtain a clear and substantive explanation of the role of the AI system in the recruitment decision-making process.

To exercise the above rights, please contact us at: Podole 60, 30-394 Kraków, Poland, or directly with the Data Protection Officer at: dpo@singu.com

10. Sources of Data

In certain recruitment processes, we obtain candidate data from external sources, such as a SINGU employee or associate in connection with our employee referral programme, social media platforms (in particular LinkedIn), and other similar platforms.

In such cases, the source of data is, respectively, a SINGU employee or associate, or – within the limits arising from the terms of use of social media platforms – other users of those platforms (in particular LinkedIn, specifically in relation to recommendations for a given individual, comments about a given individual, etc.)..