Privacy Policy

This Privacy Policy sets out the rules for processing the personal data of users of the
hrwork.pl website, in particular persons who contact HR WORK Sp. z o.o. through contact forms,
job application forms, email, telephone, or other available communication channels.

We care about the privacy of users and the security of the personal data entrusted to us. Data
is processed in accordance with applicable laws, including Regulation (EU) 2016/679 of the European Parliament
and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data
and on the free movement of such data, and repealing Directive 95/46/EC, hereinafter referred to as the “RODO” or “GDPR”.

1. Data Controller

The controller of your personal data is:

HR WORK Sp. z o.o.
ul. Wojciechowska 9A, 2nd floor
20-704 Lublin
KRS: 0001043343
NIP: 9462729680
REGON: 525642315
e-mail: [biuro@hrwork.pl](mailto:biuro@hrwork.pl)

For matters related to the protection of personal data, you can contact the Data Controller at: [biuro@hrwork.pl](mailto:biuro@hrwork.pl).

2. What Personal Data We Process

The Data Controller may process personal data voluntarily provided by the user through the website
or other communication channels, including:

• first and last name,
• email address,
• telephone number,
• content of the message sent via the contact form,
• data provided in a job application form,
• data contained in a CV or other employment-related documents,
• information about work experience, qualifications, education, and availability for work,
• data necessary to conduct the recruitment process or legalize employment, if voluntarily provided by the candidate.

When using the website, technical data may also be processed, such as the IP address, browser data,
operating system, time of website visit, source of referral to the website, and user activity on the page.

3. Purposes of Processing Personal Data

Personal data may be processed for the following purposes:

• responding to an inquiry submitted via a contact form, email, or telephone,
• communicating with users, candidates, or clients,
• conducting recruitment processes,
• providing job offers that match the candidate’s profile,
• handling applications from candidates interested in working in Poland,
• providing services related to employment, temporary work, or employee secondment,
• taking steps aimed at entering into a contract,
• fulfilling legal obligations imposed on the Data Controller,
• establishing, pursuing, or defending against potential claims,
• conducting statistics, analyzing website performance, and improving the quality of services,
• conducting marketing activities if the user has provided the relevant consent or another appropriate legal basis exists.

4. Legal Bases for Processing Personal Data

Personal data is processed on the basis of:

• Article 6(1)(a) GDPR — the consent of the data subject, for example when voluntarily submitting a form, CV, or providing marketing consent;
• Article 6(1)(b) GDPR — when processing is necessary to take steps prior to entering into a contract or to perform a contract;
• Article 6(1)(c) GDPR — when processing is necessary to comply with a legal obligation imposed on the Data Controller;
• Article 6(1)(f) GDPR — when processing is necessary for the purposes of the legitimate interests pursued by the Data Controller, in particular for communicating with users, handling inquiries, protecting against claims, ensuring website security, and maintaining basic statistics.

Where special categories of personal data are processed, if such data has been voluntarily provided by the candidate,
the legal basis may be the explicit consent of the data subject in accordance with Article 9(2)(a) GDPR,
if such consent is required.

5. Contact Forms and Job Application Forms

The website may provide contact forms and job application forms, operated in particular
using the Contact Form 7 plugin. By using a form, the user voluntarily provides personal data
necessary to process an inquiry, provide feedback, or participate in a recruitment process.

The forms may process, in particular: first and last name, email address, telephone number, message content,
information about work experience, data from a CV or other employment-related documents, as well as other
data voluntarily provided by the user.

Data submitted via a form is processed for the purpose of responding to an inquiry, handling an application,
conducting a recruitment process, or presenting a job offer. The legal basis for processing is
Article 6(1)(a) GDPR, Article 6(1)(b) GDPR, or Article 6(1)(f) GDPR — depending on the nature of the inquiry.

The forms on the website may be protected using Cloudflare Turnstile, which helps protect the website against spam,
bots, and automated form submissions.

6. Recipients of Personal Data

Personal data may be transferred to entities cooperating with the Data Controller, solely to the extent
necessary to achieve the purposes of processing. Recipients of data may include:

• hosting and IT service providers,
• email and communication tool providers,
• entities providing website maintenance services,
• entities providing accounting, legal, or administrative services,
• employer-users or contractors interested in employing candidates,
• entities authorized to receive data under applicable law.

The Data Controller does not sell users’ personal data.

7. Transfer of Data Outside the European Economic Area

Due to the use of external tools such as Google Tag Manager, Meta Pixel, Cloudflare Turnstile,
or CookieYes, personal data may be transferred outside the European Economic Area,
in particular to the United States or other countries where the providers of these services operate
or use technical infrastructure.

When transferring data outside the EEA, appropriate safeguards provided for by the GDPR are applied,
in particular standard contractual clauses, adequacy decisions, or other legal mechanisms provided for
under applicable law.

8. Retention Period of Personal Data

Personal data is stored for the period necessary to achieve the purpose for which it was collected,
and thereafter for the period required by law or the period necessary to protect against potential claims.

In particular:

• data submitted via a contact form is stored for the time necessary to process the inquiry and conduct further correspondence,
• candidate data collected as part of a specific recruitment process is stored for the duration of the recruitment process,
• data processed on the basis of consent may be stored until the consent is withdrawn,
• data related to entering into or performing a contract is stored for the period required by law,
• data necessary to establish, pursue, or defend against claims may be stored until the applicable limitation period expires.

9. Rights of Data Subjects

The data subject has the right to:

• access their personal data,
• rectify inaccurate or incomplete data,
• erase their data,
• restrict processing,
• data portability,
• object to the processing of their data,
• withdraw consent at any time if the data is processed on the basis of consent,
• lodge a complaint with the President of the Personal Data Protection Office in Poland.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

To exercise your rights, you can contact the Data Controller at: [biuro@hrwork.pl](mailto:biuro@hrwork.pl).

10. Voluntary Provision of Data

Providing personal data is voluntary; however, in some cases it may be necessary
to use certain website features, receive a response to an inquiry, participate in a recruitment process,
or begin cooperation.

11. Automated Decision-Making and Profiling

Users’ personal data is not used to make decisions based solely on automated processing
that could produce legal effects for the user or similarly significantly affect them.

The Data Controller may use analytical or advertising tools that help assess the effectiveness
of the website and marketing activities. Such activities may involve analyzing user activity on the website
if the user has provided the relevant consent to cookies or similar technologies.

12. Cookies and Consent Management

The website uses cookies and similar technologies. Cookies are small text files that are stored
on the user’s device while using the website. They may be used to ensure the proper functioning
of the website, remember user preferences, collect statistics, analyze traffic, and carry out marketing activities.

The website uses CookieYes, a tool for managing users’ consent to the use of cookies and similar technologies.
Using the cookie banner, the user can accept all cookies, reject cookies that are not necessary
for the operation of the website, or configure their preferences by category.

CookieYes may store information about the user’s consent choices so that the website can take these settings
into account during subsequent visits. Consent can be changed at any time using the settings available on the website.

The website may use the following categories of cookies:

• Necessary cookies — required for the proper functioning of the website, operation of forms, ensuring security,
  and remembering the user’s privacy settings. Such cookies may be used without the user’s separate consent.
• Analytics cookies — used to analyze how the website is used, measure traffic,
  and improve website performance. They are used after consent has been provided, where such consent is required.
• Marketing cookies — used for advertising and remarketing activities and to measure the effectiveness
  of advertising campaigns. They are used after obtaining the user’s consent.
• Functional cookies — allow the website to remember selected user settings or provide additional website features.

The user may also manage cookies in their browser settings. Restricting the use of certain cookies
may affect the proper functioning of some website features.

13. External Tools Used on the Website

The website may use external tools provided by third parties. These tools may process technical data,
user activity data on the website, cookie identifiers, IP address, device information, browser,
operating system, and other data related to the use of the website.

13.1. Google Tag Manager

The website may use Google Tag Manager — a Google tool that allows tags
and scripts used on the website to be managed. Google Tag Manager itself is used to organize and launch other
tools, such as analytics or marketing tools.

Google Tag Manager may be used to launch scripts that require user consent, such as analytics
or advertising tools. Such scripts should only be activated after the user has provided the relevant consent
through the cookie banner.

13.2. Meta Pixel

The website may use Meta Pixel — a tool provided by Meta Platforms that allows advertising effectiveness
to be measured, user actions on the website to be analyzed, and remarketing activities to be carried out
within platforms such as Facebook and Instagram.

Meta Pixel may collect information about user activity on the website, such as visited subpages,
clicks, form submissions, the source of referral to the website, technical device data, and cookie identifiers.
This data may be combined by Meta with the user’s account on Meta services if the user uses such services.

Meta Pixel is used only after obtaining the user’s consent to marketing cookies, where such consent
is required by applicable law. The user may change their cookie settings at any time using the consent management
tool available on the website.

13.3. Cloudflare Turnstile

The website may use Cloudflare Turnstile — a tool that protects forms and the website against spam, bots,
and automated submissions. Turnstile helps verify whether a form is being submitted by a human
without the need to use traditional CAPTCHA tests.

In connection with the operation of Turnstile, technical data may be processed, such as the IP address,
browser, device, operating system information, visit time, and data necessary to assess connection security.
This data is processed for the purpose of ensuring website security and protecting forms against abuse.

The legal basis for using this tool is the legitimate interest of the Data Controller in protecting
the website, forms, and communication systems against spam, bots, and other abuse — Article 6(1)(f) GDPR.

13.4. Contact Form 7

The website may use the Contact Form 7 plugin, which enables the operation of contact forms and job application forms.
Data entered into the form is transferred to the Data Controller for the purpose of processing an inquiry,
application, or recruitment process.

The scope of processed data depends on the form fields and information provided by the user. This may include,
in particular: first name, last name, email address, telephone number, message content, attached CV,
and other voluntarily provided data.

13.5. CookieYes

The website uses CookieYes to operate the cookie banner, record user consent, and provide
the ability to manage cookie settings. CookieYes helps block or activate individual categories
of cookies in accordance with the user’s choices.

CookieYes may process information about the user’s consent, such as selected cookie categories,
the date and time consent was provided, a consent identifier, and basic technical data necessary
for the proper functioning of the consent management mechanism.

14. Security of Personal Data

The Data Controller applies appropriate technical and organizational measures to protect personal data
against unauthorized access, loss, alteration, destruction, or unlawful processing.

Access to personal data is granted only to those persons and entities for whom it is necessary
to achieve specific processing purposes.

15. Links to Other Websites

The website may contain links to other websites, in particular social media platforms or partner websites.
The Data Controller is not responsible for the privacy policies applicable to external websites.
We recommend reviewing the privacy policy of each website you visit.

16. Changes to the Privacy Policy

The Data Controller reserves the right to amend this Privacy Policy, in particular in the event
of changes in legislation, the scope of data processing, website functionality, or the technological tools used.

The current version of the Privacy Policy is always available on the hrwork.pl website.

Date of last update: 21 May 2026.