Processing of (personal) data by the entity in charge of the online application process
INFORMATION CLAUSE (PRIVACY POLICY)
1. The controller of your personal data processed as part of the recruitment process is UniCredit NV/SA with its registered office in Brussels (Belgium), at: Sq. Victoria Régina 1, 1210 Saint-Josse-ten-Noode, registered in the Crossroads Bank for Enterprises under number 403.199.306, operating through its branch UniCredit S.A. Spółka Akcyjna Branch in Poland, with its registered office in Warsaw, at: ul. Dobra 40, 00-344 Warsaw (hereinafter referred to as the “Bank” or the “Controller”).
2. Providing personal data is necessary to carry out the recruitment process. Providing data other than those specified by labour law provisions, including special categories of data**, is voluntary.
3. The Controller has appointed a Data Protection Officer, whom you may contact in all matters relating to the processing of personal data and the exercise of your rights:
- by post at: ul. Dobra 40, 00-344 Warsaw,
- by email at: privacy@unicredit.pl.
4. Your personal data will be processed for the following purposes:
a) conducting the current recruitment process:
- the legal basis for processing is Article 6(1)(b) of the GDPR*;
- with regard to data other than those indicated by labour law, the legal basis for processing is Article 6(1)(a) of the GDPR*, i.e. your consent, which may be withdrawn at any time;b) future recruitment processes: provided that you give separate consent (Article 6(1)(a) of the GDPR*);
c) defence against claims or the pursuit of claims: which constitutes the Controller’s legitimate interest (Article 6(1)(f) of the GDPR*);
d) processing of special categories of data (e.g. health data): if such data are submitted by you – solely on the basis of your explicit consent (Article 9(2)(a) of the GDPR*).
5. If the documents submitted to the Controller contain data referred to in Article 9(1) of the GDPR** (personal data belonging to special categories, e.g. data concerning health, political opinions, religious beliefs), we will require your explicit consent for their processing; such consent may be withdrawn at any time.
6. You have the right to withdraw your consent at any time without affecting the lawfulness of processing carried out on the basis of consent prior to its withdrawal.
7. Recipients of your personal data will include the Controller’s subcontractors and other entities authorised to receive personal data under applicable law (e.g. the Police, the public prosecutor’s office, courts), as well as entities affiliated with the Controller within the group of undertakings to which the Controller belongs, insofar as personal data are processed for the internal administrative purposes of that corporate group.
8. Personal data will be stored for a period of 12 months from the end of the current recruitment process. If you consent to the processing of data for future recruitment purposes, the data will be processed for a period of 12 months, unless the consent is withdrawn earlier.
9. You are entitled to the following rights:
a) access to your data and to receive a copy thereof;
b) rectification (correction) of data;
c) erasure of data (the right to be forgotten);
d) restriction of processing;
e) data portability (to receive the data in a structured format);
f) to object to processing (where the legal basis is legitimate interest);
g) to withdraw consent at any time (without affecting the lawfulness of processing prior to its withdrawal).
10. To exercise your rights, please contact the Controller electronically or by post. Correspondence should include your first name, last name, and contact details (telephone/email).
11. You have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO) – contact details available at: https://uodo.gov.pl/p/kontakt.
12. Your data may be transferred outside the European Economic Area. In such cases, the Controller ensures an adequate level of protection by applying Standard Contractual Clauses approved by the European Commission or relies on European Commission adequacy decisions. You have the right to obtain a copy of these safeguards.
13. Data processing does not involve automated decision-making, including profiling.
* Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”).
** Special categories of personal data – personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, or data concerning health, sex life or sexual orientation.