Write to us, and our staff will contact you as soon as possible.

Privacy Policy of the HSS Work Sp. z o.o. Website

Date of last update: 01.03.2026

This Privacy Policy describes the rules for processing personal data in connection with the use of the website operated by HSS Work Sp. z o.o. (the „Website”), including browsing content, contacting us, and applying for job offers.

This Policy applies to the entire Website in all language versions (PL/UA/EN/RU) – the data processing rules are the same; only the language of the presented content differs.

1. Data Controller

The controller of your personal data is:

HSS Work Sp. z o.o.
ul. Piotrkowska 270,
KRS: 0000805288;
NIP: 72728389956;
REGON: 384439511.

Contact regarding personal data matters:
kancelaria@adwjacekbernal.pl

1. Scope of the Website

The Website may include, among other things:

• information about us / the company,
• information for employers and employees,
• job offer listings and job search tools,
• the possibility to apply for job offers (with a CV / cover letter),
• news / posts,
• podcasts (including embedded content or links),
• a contact page.

1. What data we process

3.1. Data of persons visiting the Website

We may process technical and operational data such as:

• IP address,
• identifiers in server logs, date and time,
• information about the device and browser,
• URLs of the visited subpages.

Purpose: maintaining the operation of the Website, security, diagnostics, prevention of abuse.

3.2. Data of persons contacting us

If you contact us (e.g. via a contact form, e-mail, or telephone), we process the data you provide, usually:

• first name and surname,
• e-mail address, telephone number,
• the content of the message and data contained in any attachments.

3.3. Data of candidates applying for job offers

Depending on the method of application (application form on the website / manual entry by us in the panel), we may process:

• first name and surname,
• e-mail address, telephone number,
• information about the offer (e.g. position, location, offer ID),
• salary expectations and the content of messages/notes,
• CV and cover letter (PDF files),
• information about consents (GDPR/current recruitment, future recruitments, marketing) together with the date and time the consent was given,
• optionally: gender (if provided/selected).

1. Purposes and legal bases of processing

4.1. Operation of the Website and security

Purpose: maintaining the Website, protection against abuse, error diagnostics, continuity of the service.
Legal basis: the legitimate interest of the Controller (security and operation of the Website).

4.2. Contact and handling of inquiries

Purpose: responding to the inquiry, conducting correspondence, handling the matter.
Legal basis: the legitimate interest of the Controller or actions taken at your request before entering into a contract – depending on the nature of the matter.

4.3. Recruitment – current recruitment for the indicated position

Purpose: conducting the recruitment process and selecting a candidate.
Legal basis: actions taken at your request before entering into a contract and/or (when you provide data exceeding the required scope) your consent – depending on the recruitment model and the scope of data.

4.4. Future recruitments (only if you give your consent)

Purpose: contact regarding future recruitment processes.
Legal basis: consent – you may withdraw it at any time. Without this consent, the data should not be processed for this purpose.

4.5. Marketing (only if you give your consent)

Purpose: marketing contact (e.g. newsletter/telephone/e-mail) – if such activities are carried out.
Legal basis: consent – you may withdraw it at any time.

1. Recipients of data

Your data may be disclosed to:

1. processors acting on our behalf (e.g. hosting, IT maintenance, mail services, support tools – if used), on the basis of data processing agreements;
2. employers/companies for whom the recruitment is conducted – i.e. entities where the work will ultimately be performed, if you apply for an offer related to such an entity or the process is conducted for a client; in such a case, we transfer the data necessary to assess the application;
3. public authorities – if the obligation results from provisions of law.

1. Transfers of data outside the EEA

We do not transfer personal data outside the European Economic Area (EEA).

If this changes in the future (e.g. in connection with the selection of an IT provider outside the EEA), we will update the Policy and ensure appropriate safeguards required by the GDPR.

1. Data retention periods (retention)

Below we describe maximum retention periods resulting from the adopted retention logic:

7.1. Recruitment documents (CV / cover letter)

• CV and cover letter files are deleted automatically:
• immediately after the application is accepted or rejected, or
• no later than approx. 37 days after submission, if the process is not resolved earlier.

7.2. Candidate data – without consent for future recruitments and without marketing consent

If a candidate does not give consent for future recruitments and does not give marketing consent:

• the data are processed as part of the current recruitment process, and then
• after the retention path is completed, identifying data are deleted/anonymised.

7.3. Candidate data – where there is consent for future recruitments or marketing

If a candidate gives consent for future recruitments and/or marketing, after archiving:

• CV/letter files are deleted, while
• selected candidate data and information about consents may remain in the system until consent is withdrawn or the retention period for such data and documents expires.

7.4. Contact data and correspondence

We store correspondence data for the time needed to handle the matter, and then for the period necessary to secure any potential claims – depending on the nature of the matter.

1. Consents and withdrawal of consent

If processing is based on consent, you may withdraw it at any time.

Withdrawal:

• does not affect the lawfulness of processing carried out before withdrawal,
• results in the cessation of processing for purposes based on consent (e.g. future recruitments/marketing).

To withdraw consent, contact us:
pracodawca@hssgroup.pl

1. Your rights

You have the right to:

• access to data,
• rectification of data,
• erasure of data,
• restriction of processing,
• data portability (where applicable),
• object to processing (where we process data based on legitimate interest),
• withdraw consent at any time (where applicable),
• lodge a complaint with the supervisory authority.

Supervisory authority in Poland: President of the Personal Data Protection Office (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw

1. Data security

We apply technical and organisational measures appropriate to the risks, including in particular:

• access control (authorisations),
• separation and protection of application files (CVs/letters) in a dedicated secured directory,
• retention mechanisms and automatic data cleanup and file deletion,
• administrative safeguards for systems.

1. Cookies and similar technologies

As of the date of drafting this Policy:
no analytical or marketing cookies have been identified on the Website.

However, the Website may use technical (necessary) cookies required for operation and server logs. If analytical or marketing tools are implemented in the future, we will provide additional information and – if required – a mechanism for obtaining consent. At the same time, if the Website uses „cookies”: Cookies are small files that enable the device used to browse the Internet (e.g. a computer, smartphone, etc.) to remember specific information about the device used. Information recorded in cookies is used, among other things, for advertising and statistical purposes and to adapt our services to the individual needs of users. Cookie settings, if cookies are used, may be changed by the user in their web browser. If these settings remain unchanged, cookies will be stored in the device’s memory. Changing cookie settings may limit the functionality of the Website.

1. Embedded content and external services (e.g. podcasts)

If the Website embeds content from external services (e.g. podcast players), the providers of those services may independently process data (e.g. IP address, identifiers). Their privacy policies may also apply.

1. Changes to the Privacy Policy

We may update the Policy, in particular in connection with changes to the Website’s functionality, service providers, or legal regulations. The current version is published on the Website.

1. Contact

For matters related to personal data, contact us:
pracodawca@hssgroup.pl