Privacy Policy

Data controller – Monterail Sp. z o.o. with its registered office in Wrocław, at 27-29 Oławska Street, 50-123 Wrocław, Poland, registered with the Register of Entrepreneurs of the National Court Register maintained by the District Court in Wrocław-Fabryczna, VI Commercial Division of the National Court Register, under entry number KRS 0000357415, NIP [taxpayer ID] 778-147-18-20, REGON [enterprise ID] 301447685, share capital 5.000 PLN, contact email: [email protected].

Personal data – all information that we process related to you. For example: first name, last name, e-mail address, telephone number, education, information about your professional experience, etc.

Labour code – the Act of 26 June 1974 – Labour code.

Processing – all activities performed relating to your personal data. For example: gathering, retaining, updating, sending messages to you, and deleting data.

GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

The scope of personal data we process depends on what information you provide in your application, in particular this includes the data indicated in all documents sent by you, as well as the content of our possible communication inter alia:

1. first and last name, 

2. date of birth, 

3. contact data,

4. education,

5. occupational qualifications;

6. employment record.

In addition to the above-mentioned data, we can also process other personal data if this is necessary for the purpose of carrying out work of a given type, at a given post, or if it is necessary to exercise a right or fulfilment of an obligation laid down under a provision of law.

If the basis for our cooperation is an employment contract, providing your personal data required by the provisions of the Labour Code and other data necessary to perform work of a given type or at a given post or necessary to exercise a right or fulfilment of an obligation laid down under a provision of law, is necessary in order to perform the recruitment process with your participation. Refusal to provide them leads to the inability to consider your candidacy for a given position.

Providing other data (not required by law) is voluntary, but if you choose not to provide us with some of them, we may not be able to evaluate your application and, as a consequence, you may be excluded from the recruitment process.

Processing of personal data may also include information that we collect directly or through professional networking sites (e.g. Linkedin) or from a third party such as a recruitment agency, in order to verify that you are a suitable candidate for a specific position.

In every case, the purposes for which we are processing data are:

1. assessment of your candidacy in respect of requirements for the position indicated in the job offer for which you have submitted your application, and/or for future recruitments for similar positions; this may also include background check, i.e. verification of your professional profile within the limits permitted by law;

2. if you meet the requirements for a position – to present you an offer of employment and to conclude a contract;

3. demonstrating that the recruitment process is compliant with the law.

Where legally permitted, some of the personal data you provided, e.g. your first name, last name and contact address, may be used by us for operational and promotional purposes, e.g. to send you occasional correspondence (e.g. thank you notes or seasonal greetings, satisfaction surveys etc.). 

We may also process your personal data for statistical purposes and to defend against claims.

We process your personal data in accordance with applicable privacy requirements, including when legally required, based on appropriate legal grounds. Such legal ground may be, for example, your consent, our legitimate interest to which we are subject or another legal ground resulting from applicable law.

Legal grounds for the processing of your personal data are as follows:

1. in the case of recruitment for a position, when the basis for cooperation is an employment contract:

   1. with regard to the categories of data required in accordance with Article  22¹ § 1, 2 and 4 of the Labour Code - fulfilment of legal obligations incumbent on Monterail in connection with the recruitment process (Article 6(1)(c) of GDPR) and taking action at your request before concluding the employment contract (Article 6(1)(b) of GDPR);

   2. with regard to any other data – your consent (Article 6(1)(a) of GDPR) and taking action at your request before concluding the employment contract (Article 6(1)(b) of GDPR);

2. in the case of recruitment for a position, when the basis for cooperation is other civil law contract (e.g. contract of mandate or B2B) – your consent (Article 6(1)(a) of GDPR) and taking action at your request before concluding the contract (Article 6(1)(b) of GDPR);

3. if you have agreed to participate in future recruitment processes - your consent (Article 6(1)(a) of GDPR);

4. in case we have obtained your personal data from professional networking sites (e.g. Linkedin) or from recruitment agencies – our legitimate interest i.e. identification and acquisition of highly qualified employees (Article 6(1)(f) of GDPR);

5. when we process your personal data for operational and marketing purposes - our legitimate interest i.e. maintaining our relationship and promoting Monterail brand, or, if we have received your consent for processing your personal data for operational and marketing purposes – your consent (Article 6(1)(a) of GDPR);

6. when we process your personal data for statistical purposes or to defend against claims — our legitimate interest (Article 6(1)(f) of GDPR).

In the case of data processing on the ground of consent, we remind you that you can withdraw your consent at any time, without affecting the lawfulness of processing that has already been done on the basis of that consent. 

We process your personal data in connection with the recruitment process until the consent is withdrawn or until the purpose for which such consent was given (employment, cooperation) is achieved. 

Personal data processed by us in connection with a single recruitment process, will be deleted after 6 months from the end of the recruitment process understood as the conclusion of a contract with another candidate. This time allows to complete the trial period and confirm that the position has actually been effectively filled-in.

Data processed on the basis of consent to participate in future recruitment processes (this includes also recruitment processes for positions that are constantly open), is processed until withdrawal of the consent or until the purpose for which such consent was expressed (hiring you) is fulfilled, but usually for no longer than 3 years from the time you granted the consent.

If we conclude a contract with you, we will continue to process your data for its duration, or longer if possible - in accordance with our Privacy Policy for employees and associates, effective at the time.

The periods described above may be extended as appropriate in the event of any claims and court proceedings – for the duration of such proceedings and their settlement – and if the law obliges us in certain cases to process such data for a longer period of time.

Access to your personal data will be given exclusively to appropriately authorized employees or associates of Monterail, advisers (including those providing ongoing legal services) or auditors – to the extent necessary to perform their duties.

Your data may be transferred to providers of hosting services or ICT services (e.g. data storage), other entities providing us with technical or organizational assistance in recruitment process, including communication with candidates (e.g. recruitment agencies) or distribution of invitations/ documentation etc. (e.g. couriers).

Monterail may also be required – if there is a legal basis to do so – to provide certain information to public authorities, for purposes related to proceedings they are conducting.

When data is stored outside the EEA, we use the necessary technical and legal safeguards, including model contractual clauses approved by the European Commission (you can access such safeguards and a list of data recipients) by contacting us at [email protected]).

You have the following rights:

1. Access to your personal data – you may ask us to provide detailed information regarding inter alia:

   1. whether we are processing your personal data;

   2. for what purpose;

   3. what categories of data we are processing;

   4. who is the recipient of your data;

   5. what is the planned duration of processing (if possible), and if we are not able to say, the criteria for determining that duration;

   6. if the personal data has not been given by you – all available information about the source of the data.

   You can also receive access to all of your personal data that we are processing (data copy).
   
   

2. Data rectification – if information about you is or has become inaccurate or incomplete, you have the right to demand that data is rectified or made complete.
   
   

3. Consent withdrawal – you may withdraw your consent to the processing of your personal data at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
   
   

4. Erasure of data – in certain situations, GDPR gives you the “right to be forgotten.” You can invoke this right if we are still processing your personal data, particularly in the following cases:

   1. the data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;

   2. you withdraw consent to the processing of personal data and there is no other legal ground for continuing to process it;

   3. you object to the processing of your personal data when there are no overriding legitimate grounds for processing;

   4. you object to the processing of your personal data for marketing purposes;

   5. your data is processed unlawfully;

   6. your data has to be erased for compliance with a legal obligation.
      
      

5. Restriction of processing - you can demand that we limit our activities in principle only to storing information about you when:

   1. you question the accuracy of personal data we are processing – for a period of time that allows us to verify the accuracy of that data;

   2. the processing of your personal data is unlawful, but you prefer that processing be restricted rather than the data be erased;

   3. Monterail no longer needs your personal data for the purposes of processing, but you need it for the establishment, exercise, or defence of legal claims;

   4. you have objected to the processing of your personal data – only until such time as it is determined whether our legitimate grounds override yours.
      
      

6. Data portability – you have the right to receive your data in a commonly-used format that can be read by a computer, and also to have your data sent to another data controller, if:

   1. the processing is based on your consent or on a contract; and

   2. the processing is carried out by automated means.
      
      

7. Objection – you have the right to object to some operations we perform on your personal data for special reasons related to your personal situation, particularly in the following cases:

   1. when our processing is based on our legitimate interest;

   2. when we process your personal data for purposes related to scientific or historical studies, or for statistical purposes.

   Remember, however, that when despite your objection we find that there are compelling legitimate grounds for the processing which override your interests, rights and freedoms, or basis for the establishment, exercise or defense of legal claims, we will continue to process your personal data covered by the objection to the extent necessary.
   
   

8. Complaints to the relevant public authority – in connection with our actions as the controller of your personal data, you are entitled to lodge a complaint to the relevant supervisory authority (in Poland - President of the Personal Data Protection Office). You can find list of local authorities responsible for data protection across the EU and their contact details at: https://edpb.europa.eu/about-edpb/board/members_en.

   A detailed description of the complaint procedure is available at: https://uodo.gov.pl/en/559/941. Of course, if you have any comments, we encourage you to first contact us at [email protected].