Processing of personal data

Information on the processing of personal data in relation to your participation in the recruitment process

 

Pursuant to Article 13 of the GDPR, please be advised that

  1. ONCOARENDI THERAPEUTICS S.A. with its registered office in Warsaw at the address: ul. Żwirki i Wigury 101, 02-089 Warszawa, entered in the register of entrepreneurs of the National Court Register in Warsaw, 12th Commercial Division of the National Court Register, KRS 0000657123, NIP 7282789248, hereinafter referred to as “ONCOARENDI”, is the Data Controller for job applicants.
  2. Contact details for the Data Controller:
    1. e-mail: contact@oncoarendi.com,
    2. or by post to the above-mentioned address.
  3. Please be advised that the Data Protection Officer has not been appointed,
  4. Please be advised that the personal data are processed or may be processed for the following purposes:
    1. to carry out the recruitment process following the publication of a job vacancy notice. The legal basis for the processing of personal data is the Act of 26 June 1974, the Labour Code, art. 22’1 (Article 6(1)(c) of the GDPR). Please be advised that providing your personal data is a statutory obligation, as laid down in Article 22’1 of the Labour Code (Journal of Laws 1974, No 24, item 141 (as amended), the Act of 26 June 1974, the Labour Code). Please be advised that if you fail to provide your personal data, you will be unable to participate in the recruitment process,
    2. in relation to the processing of personal data in (future) recruitment processes planned by the Data Controller. The legal basis for the processing of personal data is the consent of the data subject to the processing of his or her personal data in the recruitment processes planned by the Data Controller (Article 6(1)(a) of the GDPR). Please be advised that giving your consent is voluntary, and you may withdraw your consent at any time, without affecting other decisions resulting from the recruitment process. If you withdraw your consent, your personal data will not be processed in any (future) recruitment processes planned by the Data Controller. Please be advised that if you do not give your consent to participate in the future (planned) recruitment process, you will be unable to participate in the future (planned) recruitment process,
  5. Please be advised that the scope of personal data processed in the recruitment process is laid down in Article 22’1 § 1 of the Labour Code. Pursuant to Art. 22’1 § 1, the employer requires the job applicant to provide his or her personal data, including: first name (middle name) and surname, date of birth, contact details, education, professional qualifications, and employment history. The employer requests that the following personal data be provided: first name (middle name) and surname, date of birth, contact details, education – when it is necessary to perform work of a specific type or work in a specific position.
  6. The job applicant may, on his or her own initiative, provide the employer with more data than required under Art. 22’1 § 1 of the Labour Code, including:
    1. sensitive data, as referred to in Article 9 of the GDPR (the following data are regarded to be special categories of personal data/sensitive data: racial or ethnic origin, political views, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data related to health, sexuality or sexual orientation),
    2. data in the form of a link or links to information about himself or herself provided by the job applicant (including links to social media or dedicated websites),
    3. it being understood that providing more personal data is considered to be a voluntary consent to their processing given by the job applicant.
  7. Please be advised that if the job applicant provides, on his or her own initiative, more personal data than required under Article 22’1 of the Labour Code, consent to their processing may be withdrawn at any time without any adverse effect on any ongoing or future recruitment process.
  8. Please be advised that personal data are disclosed or may be disclosed to the following recipients of personal data:
    1. state authorities only under applicable law,
    2. recipients of data based under Article 28 of the GDPR – sub-processing of personal data. The categories of recipients to whom personal data are disclosed include: third-party entities providing recruitment services in the form of dedicated recruitment applications or ICT solutions, third-party companies handling the recruitment process at the request of the Data Controller, other entities providing services to support the recruitment process conducted by the Data Controller,
    3. at the request of the data subject, the Data Controller provides a list of all entities to which personal data is disclosed in the recruitment process,
  9. Please be advised that personal data are not transferred to a third country (i.e. outside the European Economic Area). If personal data are transferred outside the EEA, the provisions of Chapter V of the GDPR shall apply. Please be advised that personal data may be transferred outside the EEA by the processor providing services to the Data Controller. At the request of the data subject, the Data Controller provides a list of entities outside the EEA to which personal data are disclosed – if applicable.
  10. Please be advised that the personal data are processed or may be processed for the following purposes:
    1. to conduct an ongoing recruitment process – for a period of 6 months from the date of completion of the recruitment process,
    2. to process personal data in relation to the (future) recruitment process planned by the Data Controller – for a maximum period of 12 months from the date of completion of the recruitment process or until the consent to the processing of personal data in planned (future) recruitment processes is withdrawn.
  11. The Data Controller advises that the above-mentioned period of personal data processing may be changed (extended) depending on the circumstances that may affect the need to change the above-mentioned period. If the above-mentioned period of personal data processing changes, as stated above, the Data Controller will advise the participants in the recruitment process of the change.
  12. This is to advise the data subjects of their right to request that the Data Controller allow them to access, rectify, delete or limit the processing of their personal data, and of the right to object to the processing and the right to transfer data.
  13. This is to advise the data subjects of their right to lodge a complaint with the supervisory authority, i.e. the President of the Office for Personal Data Protection in Warsaw. Contact details for the supervisory authority: Office for Personal Data Protection, ul. Stawki 2, 00-193 Warszawa or via the contact details available on the authority’s website: https://uodo.gov.pl/pl/p/kontakt.
  14. Please be advised that your personal data processed in relation to an ongoing or future recruitment process are not subject to profiling, automated profiling or automated decision making, including profiling.
  15. Please be advised that the Data Controller does not intend to process your personal data for any purpose other than the one stated above. If other purposes emerge, the Data Controller will inform about these purposes in a separate message.
  16. Please be advised that in order to protect privacy and personal data, the Data Controller has implemented adequate technical and organizational measures to ensure the security of personal data processing.
  17. Please be advised that the recruitment process may be based on personal data coming directly from the data subject or from other sources, i.e. not directly from the data subject. If the Data Controller obtains personal data from sources other than directly from the job applicant, then, pursuant to Article 14(3) of the GDPR, the Data Controller will inform the data subject about the processing of his or her personal data within a reasonable time after obtaining the personal data – no later than within one month, and if the personal data are to be used for communication with the data subject – at the first such communication with the data subject, at the latest.
meatnetadmProcessing of personal data