INFORMATION ON THE PROCESSING OF PERSONAL DATA BY ORDER GROUP SP. Z O.O. WITH ITS REGISTERED OFFICE IN WARSAW

Pursuant to Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, (OJ L 119, p. 1) (hereinafter "GDPR"), we inform you that:

I. Data controller

The controller of your personal data is Order Group sp. z o.o. with its registered office in Warsaw, ul. Chmielna 25 00-021 Warszawa, entered in the Register of Entrepreneurs maintained by the District Court for the Capital City of Warsaw in Warsaw under KRS number 0000489590, NIP: 5223011641, REGON: 147025032.

You can contact the data controller as follows:

1. by post, sending correspondence to: ul. Chmielna 25 00-021 Warszawa,
2. by sending an e-mail to: rodo@ordergroup.pl.

We have not appointed a Data Protection Officer (DPO); therefore, in all matters concerning the protection of your personal data and the exercise of your rights, please contact the controller directly.

II. Categories and scope of personal data processing

The controller processes only the personal data necessary to achieve the purposes indicated in point III, in particular for the negotiation, conclusion and performance of a contract [cooperation agreement (B2B), contract of mandate].

The data processed include the following categories:

1. identification and contact data, in particular: first name and surname, telephone number, e-mail address,
2. data concerning education, professional qualifications, professional experience and previous cooperation or employment,
3. in the case of candidates who are sole traders - data related to their business activity, in particular: business name, NIP (tax identification number), registered office and business address, as well as other personal data disclosed in public registers, including the Central Register and Information on Economic Activity (CEIDG),
4. other personal data that you have voluntarily included in your application documents (CV), in particular your image or other information not required by law or by the controller.

In the process of recruiting collaborators, the controller does not process special categories of data referred to in Article 9(1) GDPR.

If the recruitment process was conducted with the involvement of intermediaries, such as recruitment agencies, job portals or other platforms that enable the publication of job offers and the submission of applications, the controller may also have received your personal data through such entities, including through application forms made available on those platforms.

III. Purpose, legal basis and period of processing of your data

We use your data for the following purposes:

1. conclusion and performance of a cooperation agreement / service agreement with a contractor (including verification of the person's identity and authorisations before the conclusion of the contract) - legal basis: Article 6(1)(b) GDPR, processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. Your data will be processed by us for the duration of the recruitment process and, after its completion, for a period not exceeding 6 months, in order to enable the controller to defend itself against any claims related to the recruitment process, unless a cooperation agreement is concluded earlier,
2. contact via the telephone number/e-mail address provided for purposes related to the performance of the cooperation agreement / service agreement - legal basis: Article 6(1)(b) GDPR - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. Personal data will be processed for the duration of the contract and then until the limitation period for claims has expired,
3. archiving CVs and cover letters of candidates for cooperation for the purposes of future recruitment (if consent has been given) - legal basis: Article 6(1)(a) GDPR - only if you have consented to the processing of your data for this purpose (solely where consent has been given for the purposes of future recruitment). Personal data will be processed until the end of the recruitment procedure or until the candidate withdraws from applying for the position, unless you consent to the processing of your personal data also for the purposes of possible future recruitment. Giving consent is voluntary, and consent so given may be withdrawn at any time (which does not affect the lawfulness of actions taken before its withdrawal). The data are deleted without undue delay if consent to the processing is withdrawn; in any case, the data are processed for no longer than 12 months from the date on which consent was given,
4. handling requests / exercise of data subjects' rights, and fulfilment of obligations imposed on the controller by law - legal basis: Article 6(1)(c) GDPR in conjunction with Articles 13-21 GDPR - processing is necessary for compliance with a legal obligation to which the controller is subject. Data processed for the purpose of handling requests / exercising data subjects' rights are processed by the controller until the request has been fulfilled in accordance with the legal obligation arising from generally applicable law, but no longer than until the expiry of the limitation period for claims that may arise from the processing of personal data for the purposes indicated above, in accordance with Article 118 of the Act of 23 April 1964 - Civil Code.

IV. Categories of data recipients

In order to comply with the controller's legal obligations and to ensure proper organisation within the controller's entity, your personal data may be disclosed to the following categories of recipients: service providers supplying the controller with technical and organisational solutions or IT infrastructure that enable us to manage our organisation (in particular providers of e-mail, hosting and cloud services, courier companies and service technicians), entities providing advisory, legal, tax or accounting services to the controller, to the extent necessary to provide those services, and entities authorised under applicable law, in particular courts and public authorities - where required by the relevant provisions of law,

Your data will always be shared only to the extent necessary - both in terms of the scope of the data shared and the duration of sharing.

V. Transfer of data to third countries or international organisations

As a rule, we do not transfer your personal data outside the European Economic Area (EEA) or to international organisations. However, data may be transferred outside the EEA where the controller uses the services of IT tool providers (e.g. e-mail services, communication support systems or hosting) that may store or process data on servers located outside the EEA, in particular in the United States of America. In such cases, data are transferred only where one of the safeguards provided for in the GDPR is in place, in particular: where the provider participates in the EU-US Data Privacy Framework (DPF), which confirms its compliance with the principles of adequate protection of personal data, or on the basis of standard contractual clauses (SCC) adopted by the European Commission together with supplementary security measures applied by the provider. The list of entities certified under the DPF is available at: https://www.dataprivacyframework.gov

VI. Your rights in relation to data processing

The controller guarantees you the right to:

1. access your data,
2. rectification of your data,
3. request erasure of your data ("right to be forgotten"),
4. restriction of data processing,
5. data portability (to the extent that processing is based on consent or a contract and is carried out by automated means).

VII. Right to object

In particular situations, you may object to the processing of your data if the processing is based on the legitimate interest of the controller or on the public interest.

In such a case, after considering your request, we will no longer be able to process your data covered by

the objection, unless we demonstrate that there are:

1. compelling legitimate grounds for the processing which override your rights and freedoms, or
2. grounds for the establishment, exercise or defence of legal claims.

VIII. Right to withdraw consent

If your data are processed on the basis of your consent, you have the right to withdraw your consent to the processing of your personal data at any time. Withdrawal of consent will not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal. You can withdraw your consent by sending a request by post or by sending an e-mail (the number and addresses are given in point I above).

IX. How to exercise your rights

You can exercise the rights referred to in points VI-VIII by sending a request by post or by e-mail (the addresses are given in point I above). To make sure that you are entitled to submit the request, the controller may ask you to provide additional information enabling your identity to be verified. The scope of each of the above rights and the situations in which they can be exercised are set out in the law, and whether you can exercise a given right will depend, for example, on the legal basis for using the data and on the purpose of their processing.

X. Complaint

You have the right to lodge a complaint with the supervisory authority competent for personal data protection (currently the President of the Personal Data Protection Office, ul. Stawki 2 00-193 Warszawa) if you believe that the processing of your personal data infringes the law.

XI. Automated decision-making

In the course of processing your data, there will be no automated decision-making that could produce legal effects concerning you or similarly significantly affect you.

XII. Information on whether providing data is required or voluntary

Providing personal data in the form of your first name, surname, contact details, data on education and professional qualifications, and previous employment and professional experience is necessary to take part in the recruitment procedure. Providing other data is voluntary and does not affect your ability to take part in the recruitment process.