Information on the Processing of Personal Data of Job Candidates

This information describes the rules for processing personal data of persons applying for employment at STERNET sp. z o.o. It applies to recruitment processes conducted directly by STERNET, as well as recruitment processes carried out using external companies, recruitment portals, social media platforms, press advertisements and the employee referral system.

1. Data Controller

The controller of personal data of job candidates is STERNET sp. z o.o. with its registered office at ul. Chemiczna 110, 33-101 Tarnów, Poland.

The Controller may be contacted at the e-mail address indicated in the privacy policy available at www.sternet.pl/polityka-prywatnosci/.

2. What data we process

As part of the recruitment process, we process personal data provided by the candidate in a CV, cover letter, recruitment form, correspondence or during recruitment interviews.

This may include in particular: first and last name, contact details, date of birth, information about education, professional qualifications, employment history, experience, skills and other data voluntarily provided by the candidate.

Please do not include in application documents any data that is not necessary for participation in the recruitment process, in particular special categories of data, such as information concerning health, political opinions, religious or philosophical beliefs, trade union membership, ethnic origin, biometric data or data concerning sex life. If the candidate nevertheless provides such data on their own initiative, it will be processed only to the extent permitted by law or will be disregarded or deleted if it is not necessary for conducting the recruitment process.

Candidates should also not provide information concerning criminal convictions, violations of law or related security measures, unless the obligation to provide such information results from legal provisions applicable to a given position.

3. Purposes and legal bases of processing

We process candidates’ personal data for the following purposes:

  1. conducting the current recruitment process within the scope of data that an employer may request under the Labour Code — based on Article 6(1)(c) GDPR;
  2. assessing the candidate’s qualifications, skills and suitability for the position — based on the Controller’s legitimate interest, Article 6(1)(f) GDPR;
  3. contacting the candidate regarding the recruitment process — based on Article 6(1)(f) GDPR;
  4. conducting future recruitment processes — only if the candidate gives consent, based on Article 6(1)(a) GDPR;
  5. establishing, pursuing or defending against claims — based on the Controller’s legitimate interest, Article 6(1)(f) GDPR.

If a candidate provides data exceeding the scope of data that an employer may request under the Labour Code, providing such data is voluntary. We process such data only when it is necessary to conduct the recruitment process and there is an appropriate legal basis for doing so. As a rule, we do not expect or require special categories of data referred to in Article 9 GDPR. If the candidate provides such data on their own initiative, it will be processed only to the extent permitted by law or will be disregarded or deleted.

4. Sources of data

We obtain candidates’ data directly from candidates or through the recruitment channels we use, in particular:

  1. external recruitment companies;
  2. recruitment portals;
  3. social media platforms;
  4. responses to job advertisements published by STERNET;
  5. the employee referral system.

If a candidate uses an external recruitment portal or platform, their data may also be processed by the operator of that platform under the terms set out in its regulations or privacy policy. The candidate should read these rules before using a given platform.

5. Who has access to the data

Access to candidates’ documents and data is granted only to persons authorised by STERNET, in particular the person responsible for HR processes, the Management Board and department managers participating in a given recruitment process.

Data may also be disclosed to entities supporting us in the recruitment process or in the operation of IT tools, in particular recruitment companies, operators of recruitment portals, providers of e-mail, hosting, IT systems and legal services — only to the extent necessary to achieve these purposes.

6. Data retention period

We process the data of candidates who are not hired for the duration of the recruitment process, and after its completion we store it for no longer than 24 months, solely for the purpose of securing possible claims related to the recruitment process.

If a candidate is hired, documents and data from the recruitment process, to the extent necessary to establish and carry out the employment relationship, may be included in employee documentation and will be stored for the period required by labour law.

If the candidate gives consent to participate in future recruitment processes, the data will be stored for the period indicated in the consent, but no longer than 24 months from the date of granting the consent, unless the consent is withdrawn earlier.

After the applicable retention period expires, the data is deleted or anonymised.

7. Voluntary provision of data

Providing data that an employer may request under the Labour Code is necessary to participate in the recruitment process to the extent that such data is needed to assess the application for a given position. Providing other data is voluntary.

Failure to provide data necessary to assess the application may prevent participation in the recruitment process.

8. Candidate’s rights

The candidate has the right to:

  1. access their data;
  2. rectify their data;
  3. delete their data;
  4. restrict processing;
  5. data portability — where applicable;
  6. object to data processing;
  7. withdraw consent at any time if processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

The candidate also has the right to lodge a complaint with the President of the Personal Data Protection Office if they consider that the processing of their personal data violates GDPR provisions.

9. Automated decision-making

In the recruitment process, STERNET may use technical tools supporting the handling of recruitment applications, such as forms, recruitment systems or filters organising applications. However, STERNET does not make decisions concerning candidates solely by automated means, including profiling, that would produce legal effects concerning them or similarly significantly affect them.

10. Transfer of data outside the European Economic Area

As a rule, we do not intend to transfer candidates’ data outside the European Economic Area. However, if such a transfer takes place in connection with the use of specific tools or service providers, it will take place only in accordance with GDPR provisions, in particular with the application of appropriate safeguards required by GDPR.

11. Consent to participate in future recruitment processes

Submitting application documents means that the candidate wishes to participate in the current recruitment process. STERNET processes the candidate’s personal data for the purpose of conducting this recruitment process on the legal bases indicated in this notice. To the extent that the candidate provides, on their own initiative, data exceeding the scope of data required by the Labour Code, providing such data is voluntary.

If the candidate wants their data to be considered also in future recruitment processes, they may include the following consent in their application documents:

“I consent to the processing by STERNET sp. z o.o., with its registered office in Tarnów at ul. Chemiczna 110, of my personal data contained in my application documents for the purpose of participating in future recruitment processes for a period of 24 months from the date of submission of the application documents.”