Introduction

This document is a description of the Privacy Policy of TIMSHEL Katarzyna Baczyk as a Personal Data Administrator, based in Zgorzelec, 25 Raniuszka Street,
NIP 9222608540,, Regon 529270649, (hereinafter referred to as “TIMSHEL”).

The purpose of the Privacy Policy is to define the principles, manner of processing and use of data and information coming from the users of the websites administered by TIMSHEL (http://timshel.pl, https://timshel.dolaczdonas.pl/praca), and also contains information on the rights of individuals with regard to the personal data provided by them. The legal basis for the Privacy Policy is Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free flow of such data and repealing Directive 95/46/EC (hereinafter referred to as the “Regulation”), as well as the Personal Data Protection Act of May 10, 2018. (Journal of Laws 2018 item 1000). This Privacy Policy implements Articles 12 and 13 of the Ordinance.

1.2 Please read the contents of this policy carefully. By accessing or using TIMSHEL’s websites and submitting any personal information to us through these websites, as well as by phone, email, or in person at TIMSHEL’s headquarters, you accept the terms of this Privacy Policy.

If you do not agree to the processing of personal data in the recruitment process conducted by TIMSHEL as outlined below, please do not provide documents containing such data.

1.3 The Privacy Policy applies to any website, application or service linking to this information. 1.4 TIMSHEL has appointed a Data Protection Officer (DPO), Katarzyna Baczyk, who can be contacted by emailing elektroniczną:[email protected]

Personal Data Administrator

2.1 TIMSHEL is the Data Controller of Personal Data provided by users of the websites who are potential candidates for positions advertised in the various recruitment processes conducted by TIMSHEL on behalf of or commissioned by the client, as well as personal data provided through social networks (e.g. LinkedIn). When collecting personal data, TIMSHEL records information regarding the source of its acquisition. Acquisition of candidates’ personal data may be carried out in the following ways:

directly from candidates interested in applying for the advertised positions who submit applications by email to TIMSHEL’s designated email address or via the website (https://timshel.dolaczdonas.pl/praca) or via social networks
(e.g. LinkedIn);
recommendations from third parties. If personal data are obtained by means other than from the data subject, TIMSHEL

(as Data Controller) has an information obligation to the data subject in accordance with Article 14 of the Regulation;

In specific cases, TIMSHEL contacts directly potential candidates who meet the criteria set in the ongoing projects, e.g. by telephone or email. When using the resources of the websites managed by TIMSHEL, information about users is collected through “cookies”. In order to provide services electronically in terms of providing Users with access to content collected on the Website – the legal basis is the necessity of processing for the performance of the contract (Article 6.1.b RODO), while for analytical and statistical purposes – the legal basis is the Administrator’s legitimate interest (Article 6.1 lit. f RODO) in terms of analyzing Users’ activity on the Website; Cookies – small text files transferred from the website and stored on the hard drive of the user’s computer used for customization of content and services to individual needs and interests of TIMSHEL website users. They allow the site to “remember” who the user is. The user can disable the option to accept cookies in their browser at any time, however, the effect of such a change may be the loss of the ability to use some TIMSHEL sub-sites. When the session ends, e.g. when you move to another website, the stored information is deleted. Most browsers are automatically configured to allow the transfer of cookies, but if you use Microsoft’s Internet Explorer or Netscape Navigator browsers, it is possible to configure them to limit access to cookies or block them altogether, but this may affect the quality of the pages you view. 

2.2. TIMSHEL takes special care to ensure that personal data is processed in accordance with the purpose for which it was collected and used in accordance with the premises and categories of data processed permitted by law, as well as that it is processed in accordance with the principles of personal data processing specified in Article 5 of the Regulation.

Purposes and legal basis for personal data processing

TIMSHEL processes personal data in accordance with the business profile, exclusively for the purposes indicated below. If, due to legal regulations, the nature of the service or the need to settle it, there is a need to process your other personal data, TIMSHEL may process them to the extent necessary.

3.1. In order to conduct the recruitment process, we process the following personal data of potential candidates: identification data: first name, last name, date of birth, place of birth, citizenship/nationality, gender, marital status, contact data: address, telephone number, e-mail address and other data: , education, photograph, employment history, professional qualifications, knowledge of languages, personality and character traits, hobbies, information on the driving license held (if required by the employer), immigration status (in situations where a work permit is required), information on criminal record (if required by the employer), information on interests in future employment, information on current and required remuneration.

The above list of personal data is not exhaustive and in the event that the candidate provides additional information to TIMSHEL, it will be subject to processing. Therefore, we ask you to provide only the necessary information necessary to conduct the recruitment process for the selected position, listed in the advertisement posted by TIMSHEL. As a rule, the Administrator does not obtain particularly protected information, except when it is required by law for recruitment purposes.

In order to conduct the recruitment process, we also process contact details, professional information or the way in which reference persons are connected to the candidate or feedback on the candidate. We may obtain such information directly from reference persons, from the candidate or from publicly available sources. We may make the data of the reference person provided by the candidate available to our Clients in order to assess the suitability of a given candidate for a specific position.

Your personal data are processed for the following purposes and based on the following legal bases: necessity for the performance of the contract (Article 6, paragraph 1, letter b of the GDPR), legitimate interest (Article 6, paragraph 1, letter f of the GDPR) and the candidate’s consent (Article 6, paragraph 1, letter a of the GDPR), which is necessary to achieve the purpose of processing personal data in the recruitment process and possibly present your candidacy to a potential employer (TIMSHEL Client).

In accordance with the content of Article 221 §1 of the Labor Code, you are required to provide the employer for whom TIMSHEL is conducting recruitment with the following data: first name(s) and last name, date of birth, contact details, education, professional qualifications and course of previous employment.

The recruitment process consists of several stages, during which the personal data of candidates are processed:

initial selection of received applications,
contact with selected candidates,
presentation of selected candidates to the potential employer.

3.2. In order to contact candidates by phone and e-mail in matters related to the implementation of the current project, the following personal data are processed: first name and last name, telephone number, e-mail address.

The legal basis for such data processing is art. 6 sec. 1 letter b of the Regulation, which allows for the processing of personal data if they are necessary to take actions aimed at the performance of the contract. Providing the above personal data is necessary to achieve the purpose of personal data processing.

3.3. In order to contact candidates by phone and e-mail in matters related to the implementation of future projects, the following personal data are processed: name and surname, telephone number, e-mail address.

The legal basis for such data processing is art. 6 sec. 1 letter a of the Regulation, which allows for the processing of personal data based on voluntary consent. Providing personal data and expressing consent to their processing is voluntary, however, the lack of consent prevents TIMSHEL from contacting you during the implementation of subsequent projects.

3.4. In order to contact us via the contact form on the website administered by TIMSHEL, we process the data necessary to establish contact, accept and respond to the inquiry. The scope of the required data is: name and e-mail address.

Your personal data will be processed for the following purposes and based on the following legal grounds:

in order to respond to a message sent via the contact form – the legal basis is the legitimate interest in establishing and maintaining contact with the addressee of the question (art. 6 par. 1 lit. f RODO);
in order to present the details of the offer in connection with the inquiry sent – the legal basis is the legitimate interest in responding to the inquiry received (art. 6.1.f RODO);
in order to learn about the opinions on the services provided – the legal basis is the legitimate interest in improving the quality of the services provided (art. 6.1.f RODO);
in terms of data provided optionally, the legal basis is consent (art. 6.1.a RODO).3.5 In order to conduct competency and professional qualification tests AC/DC (Assessment Centre and Development Centre), personal data such as name, phone number, -email address are processed.

The legal basis for such data processing is Article 6(1)(a) of the Regulation, which allows processing of personal data on the basis of voluntarily given consent. Providing personal data, as well as giving consent to their processing is voluntary, however, lack of consent prevents TIMSHEL from conducting the above competence tests.

3.6 In order to provide coaching and personal development services, personal data such as name, phone number, address -email are processed.The legal basis for such data processing is Article 6(1)(b) of the Regulation, which allows for the processing of personal data if they are necessary to take actions aimed
at the performance of the contract.Provision of the aforementioned personal data is necessary to realize the purpose of personal data processing, which is to conduct coaching.

3.7 In order to provide vocational reorientation services for laid-off employees
(so-called outplacement), personal data such as name, telephone number, address -email are processed.The legal basis for such data processing is Article 6(1)(b) of the Ordinance, which allows for the processing of personal data if it is necessary to take actions aimed
at the performance of the contract.

3.8 For the purpose of issuing an invoice and fulfilling other obligations under tax law (e.g., keeping accounting records for 5 years), personal data such as: name and surname, company, residential or business address, Tax Identification Number are processed.

The legal basis for such data processing is Article 6(1)(c) of the Ordinance, which allows for the processing of personal data if such processing is necessary for
fulfillment by the Personal Data Administrator of its obligations under the law. Provision of the aforementioned personal data is necessary
to realize the purpose of personal data processing.

3.9 In order to process a complaint, such data as name, e-mail address, address of residence or registered office, bank account number (if a refund is made) are processed.The legal basis for such data processing is Article 6(1)(b) of the Regulation, which allows for the processing of personal data if they are necessary to take actions aimed
to perform the contract. Provision of the aforementioned personal data is necessary to realize the purpose of personal data processing.

3.10. In order to assert claims under the contract, such data as name, surname, date of birth, address of residence or registered office, PESEL, telephone number, e-mail address are processed.

The legal basis for such data processing is Article 6(1)(f) of the Regulation, which allows for the processing of personal data if by doing so the Personal Data Controller pursues its legitimate interests. Provision of the aforementioned personal data is necessary to realize the purpose of personal data processing.

3.11. If candidates provide personal data that may qualify as special categories of data, TIMSHEL shall process such personal data on the basis of the data subject’s consent pursuant to Article 9(2)(a) of the Regulation.

Recipients of personal data

The recipients of personal data entrusted to TIMSHEL by candidates are the following entities, to which personal data are transferred to the minimum extent necessary to achieve the purpose of conducting the recruitment process:

Clients of TIMSHEL, i.e. employers commissioning TIMSHEL to recruit employees.
In each case of making your personal data available to the Client, you will be informed about it, in accordance with art. 13 or 14 of the Regulation.
Persons authorized by TIMSHEL (e.g. TIMSHEL employees);

Entities processing personal data on behalf of TIMSHEL (e.g. accounting office, technical service providers, suppliers of professional tools supporting employee recruitment processes, hosting service providers);

TIMSHEL may also disclose to cooperating websites or advertising agencies developed collective, general statistical summaries. Such summaries mainly concern: website viewership and do not allow for the identification of individual users (anonymized data). Such information may be used for the purpose of: monitoring network traffic on the website or monitoring website viewership.

TIMSHEL declares that it does not sell, share or transfer the collected
personal data of users to other persons or institutions for processing, unless this is done with the express consent or at the request of the user, or at the request of state authorities authorized under the law for the purposes of proceedings conducted by them or activities related to
security or defense, for tasks specified by law carried out for the public good, when it is necessary to fulfill legally justified purposes of TIMSHEL.

TIMSHEL processes information about Customers in order to develop business cooperation. The collected data usually includes contact details (e.g. name and surname, telephone number, e-mail address, professional title and business history).

Transfer of personal data to countries outside the European Economic Area

Personal data within the European Union is protected under the common legislation on the protection of personal data. In other countries, this data may not be protected to the same extent. TIMSHEL is obliged to ensure, before transferring information about the user to a country located outside the European Economic Area (EEA), that that country will provide adequate protection for his rights. The European Economic Area includes the countries of the European Union and Norway, Iceland and Liechtenstein. TIMSHEL does not transfer your personal data to any entities located in third countries located outside the European Economic Area.

Period of processing personal data

TIMSHEL processes personal data of candidates for the period necessary to achieve the purposes for which they are collected and used. Depending on the legal basis, this will be:

the duration of the project – in relation to personal data of candidates processed
for the purpose of implementing the project, or during the provision of other services in the TIMSHEL portfolio;
after the termination of cooperation – for the period necessary to achieve current or future business purposes (e.g. storing documentation) or to enforce statutory rights or defend them;
the period of performance of legal obligations – 5 years in relation to personal data related to the fulfillment of tax law obligations;
time until consent is withdrawn or the purpose of processing is achievedtime until an effective objection is raised – in relation to personal data processed on the basis of the legitimate interest of the Personal Data Administrator or for marketing purposes;
until they become outdated or lose their usefulness,
– in relation to personal data processed mainly for analytical purposes, use of cookies and administration of the website.

In the case of personal data processed on the basis of consent granted, they will be processed only until it is withdrawn or the purpose for which the data was collected ceases to exist. The consent granted may be withdrawn at any time without affecting the lawfulness of the processing carried out on the basis of consent before its withdrawal.

Rights of data subjects

TIMSHEL respects the rights of each person related to the processing of their personal data. In particular, each person whose data is processed has the right to:

access their personal data,
correct their personal data,
delete their data (“the right to be forgotten”),
limit the processing of personal data,
object to the processing of personal data,
transfer personal data;
the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

the right to lodge a complaint with the supervisory authority (President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw), if it is found that the processing of personal data violates the provisions of the GDPR. As regards the right to object, you have the right to object at any time to the processing of personal data on the basis of a legitimate interest, for the purpose of direct marketing, profiling, or for statistical purposes. TIMSHEL informs that there is no obligation to delete data (i.e. to exercise the “right to be forgotten”) in the event that processing is necessary for:

exercising the rights and freedoms of expression and information,
fulfilling the legal obligation to process under European Union law
or Polish law, or performing a task carried out in the public interest,
archiving purposes in the public interest, scientific or historical research purposes or statistical purposes,
to establish, pursue or defend claims.

If personal data are processed on the basis of the consent of the data subject
or on the basis of a concluded contract, and the processing is carried out in an automated manner, the data subject has the right to receive, at their request, personal data concerning them
in a structured, commonly used machine-readable format, as well as to request the transfer of their data in such format to the designated Data Controller. When submitting a request for the transfer of personal data, the data subject must specify whether the personal data concerning them are to be simultaneously deleted (“right to be forgotten”) by TIMSHEL and submit an appropriate request in this respect.

In the event that TIMSHEL receives a request to delete personal data from the database, TIMSHEL as the Personal Data Controller may leave a minimum amount of data identifying the natural person in the database solely for the purpose of avoiding further contact, e.g. maintaining a record of deleted data.

The above rights, as well as the intention to withdraw consent to the processing of personal data, can be exercised in one of the following ways:

sending an e-mail to the Personal Data Protection Inspector at the address: [email protected]
Automated decision-making and profiling

TIMSHEL carries out automated decision-making, including based on profiling, and makes decisions with respect to data subjects that produce legal effects or otherwise affect such persons. An example of profiling is the selection of candidates based on an agreement concluded with the LinkedIn social networking site.

In connection with the above, TIMSHEL provides data subjects with the right to obtain human intervention on the part of the Personal Data Controller, to express their own position and to challenge this decision, unless such automatic decision:

is necessary for the conclusion or performance of a contract between the data subject
and TIMSHEL,
is expressly permitted by the provisions of the law to which the Personal Data Controller is subject,
is based on the express consent of the data subject.
Security and storage of information

TIMSHEL ensures the security of personal data against unlawful disclosure to unauthorized persons, data takeover by unauthorized persons, destruction, loss, damage or change and processing of personal data incompatible with the provisions of the Regulation. In order to secure the entrusted personal data, TIMSHEL takes technical and organizational measures that meet the requirements of the Regulation, in particular the measures listed in art. 24 and 32 of the Regulation, ensuring confidentiality, integrity and availability of services for processing your personal data.

Social plugins

The Personal Data Administrator’s websites may use so-called social plugins for social media (for example, such as: Facebook, Instagram, Twitter, Pinterest, Google+ or YouTube). Using the functionalities provided by these plugins, you can share individual content or share it on social media. The legal basis for the processing of personal data by the Administrator is its legitimate interest (art. 6 sec. 1 letter f of the GDPR). However, we would like to point out that when using these plugins, data is exchanged between you and the given social networking site or website. TIMSHEL does not process this data and has no knowledge of what user data is being collected. Therefore, we encourage you to familiarize yourself with the regulations and privacy policies of these social networking sites before using a given plugin.

Final provisions

To the extent not regulated by this Privacy Policy, the provisions on personal data protection apply.