Open positions

Weliant – the personal data controller – makes every effort to protect the privacy of people using the weliant.com website and the Controller's services.

This policy sets out how the Controller processes personal data (what data it processes, for what purpose, on what legal basis and for how long) and what rights the people whose data is processed have.

Definitions

• GDPR (in Polish: RODO) – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);
• Personal data controller/Controller – the person responsible for the lawful and secure processing of personal data: Xxxxxxx Xxxxxxxxshow, conducting business activity under the business name Xxxxxxx Xxxxxxxxshow, operating under the Weliant brand, NIP (tax ID): 0000000000show, REGON: 000000000show;
• Candidate – a natural person seeking work in the IT sector;
• Client – an entity, regardless of its legal form, wishing to hire an employee in the IT sector, regardless of the basis of employment;
• Work – any form of paid cooperation between a natural person and a Client, in particular, but not limited to, under an employment contract or a civil-law contract, by a natural person conducting business activity or by a natural person not conducting business activity;
• Agreement – an agreement for the provision of recruitment services concluded between the Controller and a Client.

If you have any questions about the processing of your personal data, you can contact us throught the form of the website

The scope, legal basis and period of processing of your data depend on the purpose for which the Controller processes it.

1. Candidates

If you use the Controller's recruitment services as a Candidate, the Controller processes your data as follows:

• scope of data: first name and surname, contact details (email address, phone number), town or city of residence, information about your education, professional experience, qualifications and skills (including foreign languages), salary expectations and availability, as well as other data contained in the CV you provide or in your public professional profile,
• source of data: directly from you or from publicly available websites and professional networks (e.g. LinkedIn),
• purpose and legal basis of processing:
  • finding and assessing your profile for ongoing recruitment processes and contacting you for the first time – based on the Controller's legitimate interest in matching candidates with ongoing recruitment processes and presenting them with job offers (Art. 6(1)(f) GDPR). For this purpose, we use only professional data that you have made publicly available for professional purposes (e.g. in your LinkedIn profile), and we contact you only about offers that match your profile. The Controller has assessed whether your interests, rights and freedoms override this interest (balancing test); information about this assessment is available on request,
  • taking part in a specific recruitment process, including sharing your data with a potential employer (Client) – based on your consent (Art. 6(1)(a) GDPR),
  • considering your application in future recruitment processes – based on your separate consent (Art. 6(1)(a) GDPR),
• retention period:
  • for finding and assessing your profile and first contact – if we do not contact you, no longer than one month from obtaining the data; after contact – until we receive your reply, but no longer than 3 months from first contact. If you do not consent to further processing or you object, your data will be deleted,
  • for taking part in a recruitment process and in future recruitment processes – until you withdraw your consent, but no longer than 12 months from when it was given.

If your data was not obtained directly from you, the Controller will inform you of this and of how it is processed at the first contact with you, and no later than one month after obtaining it.

Please do not include special categories of data (e.g. health data, including disability) in your CV unless this is necessary. Sending a CV containing such data does not in itself constitute consent to its processing. If we receive a CV containing such data, we will remove that information from it or ask you to send a CV without it. We may process such data (e.g. share it with a potential employer) only if you give your explicit consent in a separate statement, e.g. by email (Art. 9(2)(a) GDPR).

2. Prospective Clients

If you are a prospective client or its representative, the Controller processes your data as follows:

• scope of data: first name, surname, business mailing address, business email, business phone number, position/role,
• source of data: directly from you or from publicly available websites,
• purpose of processing: establishing cooperation, concluding an agreement,
• legal basis: the Controller's legitimate interest in establishing business cooperation and holding talks with prospective Clients (Art. 6(1)(f) GDPR); if we are in talks directly with you as a sole trader – also taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR),
• retention period: for the duration of talks aimed at establishing cooperation; if cooperation is not established (no agreement is concluded), the data is deleted no later than 12 months after the last contact, or earlier if you object.

3. Clients

If you use the Controller's services as a Client or its representative, the Controller processes your data as follows:

• scope of data:
  • if you are a Client: first name, surname, business mailing address, business email, business phone number, position/role, NIP (tax ID), sometimes REGON,
  • if you are a Client's representative: first name, surname, business mailing address, business email, business phone number, position/role,
• source of data: directly from you or from publicly available websites,
• purpose of processing:
  • concluding, performing and settling the Agreement,
  • fulfilling tax and accounting obligations related to the proper performance of the Agreement, including issuing and delivering invoices,
  • collecting amounts due under the Agreement, and
  • establishing, pursuing or defending claims arising from non-performance or improper performance of the Agreement,
• legal basis: legitimate interest (Art. 6(1)(f) GDPR) in establishing and maintaining business relations with Clients acting through their representatives, including correctly determining the fees for services, collecting amounts due under concluded agreements, and establishing, pursuing or defending claims in proceedings before courts or other public authorities related to the conclusion and performance of agreements; as well as compliance with legal obligations (Art. 6(1)(c) GDPR) under tax law (including the Polish Tax Ordinance Act of 29 August 1997). If you are a sole trader and a Client of the Controller, the Controller also processes your personal data to conclude, perform and settle the Agreement (Art. 6(1)(b) GDPR),
• retention period:
  • 3 years from the expiry or termination of the Agreement, where the purpose is concluding and performing the Agreement, including collecting amounts due and establishing, pursuing or defending claims related to the Agreement, and, if proceedings are initiated, until they are finally concluded,
  • 5 years from the end of the calendar year in which the tax payment deadline expired, or longer if the limitation period for the tax liability is suspended or interrupted, or where required by specific legal provisions.

4. Contact form and email correspondence

If you contact the Controller using the contact form on the website or by email, the Controller processes your data as follows:

• scope of data: first name, surname, email address, the content of your message and any other data you include in it, as well as the IP address of the device from which the form was sent and the date and time it was sent,
• source of data: directly from you,
• purpose of processing: responding to your enquiry and further correspondence, as well as protecting the form against spam and abuse (verifying that the form is sent by a human and limiting the number of messages sent),
• legal basis: the Controller's legitimate interest in responding to enquiries addressed to it and ensuring the security of the website (Art. 6(1)(f) GDPR); if your enquiry concerns concluding a contract with you – taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR),
• retention period: for as long as necessary to handle the enquiry, and then no longer than 12 months from the last message, unless you object earlier. If the correspondence leads to cooperation or participation in a recruitment process, the data will continue to be processed under the rules described for Clients or Candidates, respectively. The IP address sent with the message is kept for as long as the message itself; the IP address used to limit the number of messages sent is stored only in the server's memory, for no longer than 10 minutes.

5. Cookies and technical data

The website does not use analytics or marketing cookies.

To protect the contact form against spam, the Controller uses Cloudflare Turnstile. To verify that the form is sent by a human, this service processes your IP address and technical information about your browser and device, and may store on your device information necessary for it to work. This is strictly necessary to provide the service you request (sending a message) and does not require your consent. The Controller does not keep this data after the verification is completed; how long Cloudflare keeps it is set out in Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/

To limit the number of messages sent from a single device, your browser stores in its local storage (localStorage) only the dates and times the form was sent, with no other data. Entries older than 10 minutes are disregarded and are overwritten the next time the form is sent; you can delete them at any time by clearing the site data in your browser settings. This is strictly necessary for the form to work and does not require your consent.

The server hosting the website may automatically record basic technical information in its logs (IP address, date and time, requested page address, browser type) to ensure the security and proper operation of the website (Art. 6(1)(f) GDPR). Logs are kept for the period set by the Vercel hosting service, no longer than 30 days, and are then deleted automatically.

6. Recipients of data

Your data may be disclosed to the following categories of recipients:

• entities processing data on behalf of the Controller, to the extent necessary to provide the services: the website hosting provider (Vercel Inc.), the provider of the service that sends messages from the contact form (Resend), the spam protection provider (Cloudflare, Inc.) and the email and office tools provider (Microsoft – Microsoft 365),
• if you are a Client – the accounting firm (to the extent of the data shown on invoices) and, in the event of a dispute, the law firm and courts,
• if you are a Candidate – potential employers (Clients), with your consent, to carry out the recruitment process,
• authorised public authorities – at their request and to the extent required by law.

7. Transfers of data outside the European Economic Area

Some of the providers listed above (Vercel, Resend, Cloudflare, Microsoft) are based in or process data in the United States or other countries outside the European Economic Area (EEA). In such cases, data is transferred on the basis of a European Commission adequacy decision (including for entities certified under the EU-U.S. Data Privacy Framework) or on the basis of standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR). You can obtain a copy of the safeguards applied by contacting the Controller.

If you are a Candidate and the potential employer is based in a country outside the EEA, your data will be transferred to them (always within your consent to take part in the given recruitment process):

• where the European Commission has decided that the country ensures an adequate level of data protection (e.g. the United Kingdom, Switzerland, Canada, Japan, and in the case of the USA – for employers certified under the EU-U.S. Data Privacy Framework) – on the basis of that decision (Art. 45 GDPR),
• in other cases – on the basis of standard contractual clauses adopted by the European Commission, concluded between the Controller and the employer (Art. 46(2)(c) GDPR),
• exceptionally, where none of the above bases can be used in a given case – only with your explicit consent to that specific transfer (Art. 49(1)(a) GDPR), given after you have been informed of the recipient's country and of the risks arising from the absence in that country of data protection equivalent to that in the EU.

8. Your rights

You have the following rights:

• right of access (Art. 15 GDPR) – you can find out whether and what data of yours we process, and obtain a copy of it,
• right to rectification (Art. 16 GDPR) – you can request that inaccurate data be corrected or incomplete data be completed,
• right to erasure (Art. 17 GDPR) – you can request that your data be deleted, among other things where it is no longer necessary for the purposes for which it was collected, after you withdraw consent, after you successfully object, or where the data is processed unlawfully,
• right to restriction of processing (Art. 18 GDPR) – you can request restriction of processing, among other things where you contest the accuracy of the data, where the processing is unlawful but you do not want the data deleted, where you need the data to establish, pursue or defend claims, or until your objection is considered,
• right to data portability (Art. 20 GDPR) – for data processed by automated means on the basis of consent or a contract,
• right to object (Art. 21 GDPR) – for data processed on the basis of legitimate interest, you can object at any time on grounds relating to your particular situation. We will then no longer process that data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

Where data is processed on the basis of your consent, you can withdraw that consent at any time; withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

You can exercise these rights by sending a request, including your first name and surname, through the contact form on the website. We will respond without undue delay, and no later than one month after receiving the request.

You have the right to lodge a complaint with the competent supervisory authority – the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) in Poland.

Providing data is voluntary; however, without it you will not be able to use the Controller's services (for Candidates – to take part in a recruitment process; for the contact form – to receive a reply). For Clients, providing data is a condition of concluding the Agreement, and providing the data required to issue an invoice is a statutory requirement.

Your data will not be subject to automated decision-making, including profiling (Art. 22 GDPR).

9. Changes to this Privacy Policy

The Controller may update this Privacy Policy. The current version, together with the date from which it applies, is always available at weliant.com.

This Privacy Policy is available in Polish and English. In the event of any discrepancies, the Polish version prevails.