Raise Your Sales
Get a free consultation

Information clause for candidates


I. Personal Data Controller

RYS SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ with its registered office in Bielsko-Biała (43-300) at ul. Podwale no. 47, entered in the register of entrepreneurs kept by the District Court in Bielsko-Biała, 8th Commercial Division of the National Court Register under KRS number: 0001006923, NIP: 5472234742, REGON: 523865502, represented by Wojciech Maciej Piszczek- President of the Management Board,

in the light of the applicable provisions of law, including in particular pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), commonly referred to as the GDPR, is the controller of your personal data (hereinafter: the Personal Data Controller).

Contact with the Personal Data Controller is possible in the following ways:

by e-mail: rodo@rysagency.com,

by post: at the address Bielsko-Biała (43-300) ul. Podwale no. 47,

The Controller has not appointed a Data Protection Officer.

The person designated for contact in GDPR matters on the Controller's side is: Ms Marta Kamińska, who may be contacted using the contact details indicated above.

The Personal Data Controller is responsible for using personal data in a secure manner and in accordance with the applicable provisions of law.

II. Source of the personal data

We receive personal data directly from you – in particular from the application documents sent to us and from the information provided in the course of the recruitment.

III. Purpose of and basis for the processing of personal data

We obtain your data directly from you, and where we use the support of recruitment companies, we may also obtain data from those entities.

Your personal data is processed for the purpose of conducting the recruitment process for new Employees/Associates.

The legal basis for the personal data processed is:

  1. Article 6(1)(a) GDPR – the consent of the job applicant to the processing of their personal data for the purpose of participating in the recruitment – with regard to Job Applicants for employment under a civil-law contract (contract of mandate, B2B contract, contract for the provision of services),
  2. Article 6(1)(a) GDPR – the consent of the job applicant to the processing of their personal data for the purpose of participating in the recruitment or in a future recruitment – with regard to Job Applicants for employment under a contract of employment – with regard to data going beyond Article 22¹ of the Labour Code, if you provide it voluntarily or give your consent (e.g. image, additional information in the CV),
  3. Article 6(1)(a) GDPR – the consent of the job applicant to participate in future recruitment processes,
  4. Article 6(1)(b) GDPR – steps taken at the request of the person prior to the conclusion of a contract,
  5. Article 6(1)(c) GDPR in conjunction with Article 22a ¹ § 1 of the Labour Code – with regard to the personal data which the Employer may request from Job Applicants for employment as Employees,
  6. Article 9(2)(a) GDPR in conjunction with Article 22¹b § 1 of the Labour Code – with regard to the processing of special category data of job applicants (e.g. information on health/disability in the CV),
  7. Article 6(1)(f) GDPR (legitimate interest of the Personal Data Controller) – for the purpose of establishing, pursuing or defending against claims connected with the recruitment.

IV. Categories of personal data processed

We process the data provided by you in the application documents and in the course of the recruitment, in particular the data indicated in Article 22¹ § 1 of the Labour Code, as well as – if provided/covered by consent – additional data.

The Personal Data Controller processes the following categories of data: first name and surname, place of residence address, correspondence address, telephone number, e-mail address, professional experience, education, date of birth. Furthermore, the Personal Data Controller may process personal data resulting from the employment certificates presented, from documents confirming the professional qualifications required to perform the work offered/to provide services for the Personal Data Controller, and from other documents, if the applicant has submitted them in connection with applying for employment/cooperation.

Furthermore, the Personal Data Controller may also process special categories of personal data, i.e. data concerning health (e.g. relating to disability/state of health).

V. Information on the requirement to provide data

In the case of applicants for employment as Employees – providing the data within the scope resulting from Article 22¹ § 1 of the Labour Code is necessary in order to take part in the recruitment. Providing the remaining data is voluntary.

In the case of applicants for employment as Associates – providing personal data is not obligatory, however it is necessary in order to participate
in the recruitment process conducted by the Personal Data Controller. In the event that personal data is not provided, the Personal Data Controller may refuse participation in the recruitment, which will consequently make it impossible to take up the work.

VI. Entities to which personal data is entrusted/Recipients of personal data

Personal data is transferred to entities providing IT support to the Controller.

Furthermore, the recipients of personal data processed by the Personal Data Controller may be:

  1. entities providing recruitment, IT/hosting, e-mail, ATS systems, legal and HR services to the Personal Data Controller – on the basis of personal data processing entrustment agreements,
  2. authorised public authorities – where this follows from the provisions of law.

The Personal Data Controller uses, in particular, the services of the following entities:

  1. Google LLC 1600 Amphitheatre Parkway Mountain View, CA 94043, United States,
  2. Microsoft Corporation, One Microsoft Way Redmond, WA 98052-7329 USA,
  3. Smarthost sp. z o.o. with its registered office in Częstochowa (42-217) at ul. Partyzantów 1, KRS: 0000656356, NIP: 5732874847, REGON: 366194822,
  4. Grupa Pracuj S.A., with its registered office in Warsaw (00-838) at ul. Prosta 68, KRS 0000913770, NIP 527-274-96-31, REGON: 36297030100000,

The Personal Data Controller uses artificial intelligence systems in the form of the Gemini tool, whose provider is the company Google LLC, for the purpose of conducting e-mail communication, creating summaries of online meetings and of electronic correspondence, and preparing notes from the aforementioned meetings.

VII. Duration of the processing of personal data

Personal data is erased by the Personal Data Controller after the recruitment process has been completed, whereby, should a given job applicant assert claims – the personal data may be processed until any claims expire (i.e. as a rule for a period of 3 years). Where consent has been given to the processing of personal data for the purposes of future recruitment processes, such data will be processed until the day on which consent to its processing is withdrawn, but no longer than for a period of 1 year from the day on which it was collected.

VIII. Rights available in connection with the processing of personal data by the Personal Data Controller

You have the right to request from the Personal Data Controller:

  1. access to the processed data,
  2. rectification of the processed personal data,
  3. erasure of the processed personal data
  4. restriction of the processing of personal data,
  5. the right to lodge an objection to personal data processing activities.

To the extent that the processing of personal data takes place on the basis of the consent granted, the person whose data is processed is entitled to withdraw consent to the processing of personal data by the Personal Data Controller, whereby this will not affect the lawfulness of the processing with regard to activities carried out before the withdrawal of consent.

The above rights may be exercised by submitting an appropriate request to the Personal Data Controller using the details indicated in point I.

Furthermore, you are entitled to request that personal data be transferred to another controller, however only on condition that the processing takes place by automated means and that this is technically possible. The processing of your personal data will not take place on the basis of consent to the processing of personal data.

IX. Transfer of personal data outside the European Economic Area, including outside the European Union,

The Personal Data Controller may potentially transfer personal data to a recipient in a third country or to an international organisation, in particular in connection with the use of IT tools whose providers have their registered office in third countries.

In the case of the Personal Data Controller, the aforementioned entities are:

  1. Google LLC 1600 Amphitheatre Parkway Mountain View, CA 94043, United States – mechanism legalising the transfer EU–US DPF (Google LLC is a participant in the DPF)
  2. Microsoft Corporation, One Microsoft Way Redmond, WA 98052-7329 USA – mechanism legalising the transfer – Article 45 GDPR – EU–US DPF; Microsoft has an active certification, and in addition LinkedIn Corporation maintains its own certification. Additionally, Microsoft makes SCC available in the DPA,
  3. Hotjar Limited Dragonara Business Centre, 5th Floor Dragonara Road, Paceville St Julian’s STJ 3141 Malta (potential transfers) – as a rule no transfer outside the EEA; for incidental transfers outside the EU – Article 46(2)(c) GDPR (SCC),
  4. Meta Platforms Inc. 1 Meta Way Menlo Park, California 94025 USA – mechanism legalising the transfer Article 45 GDPR – EU–US DPF for Meta Platforms, Inc.

Personal data is, as a rule, processed on servers located within the territory of the EU (depending on the configuration of the services). At the same time, in connection with administrative access and technical support, an incidental transfer of data to third countries (including the USA) may occur.

With regard to personal data transferred to the United States, the Personal Data Controller, when making data available to third parties, makes every effort to ensure that this takes place, in accordance with the decision of the European Commission of 10 July 2023, only to entities and organisations in the USA which ensure compliance with the new “EU – US Data Privacy Framework” (EU-US Data Privacy Framework). The list of these organisations has been published by the US Department of Commerce. The transfer of personal data from the EEA to organisations which have joined the “EU – US Data Privacy Framework” programme and are included on that list is possible without the need to obtain additional authorisations or to apply such legal instruments as standard contractual clauses or binding corporate rules. However, where a given data importer in the USA has not joined the “EU-US Data Privacy Framework” programme, the transfer of personal data to it is possible and will take place once the conditions set out in Article 46 or 49 GDPR have been fulfilled. In such cases, the Personal Data Controller will rely on EU standard contractual clauses, binding corporate rules or other safeguards in order to enable transfers outside the EEA.

The data subject has the right to obtain information about the safeguards applied, including to obtain a copy of those safeguards or information about the place where they are made available – by contacting the following address: rodo@rysagency.com.

X. Automated decision-making, including profiling

The personal data of job applicants is not processed for the purpose of automated decision-making, including profiling.

XI. Right to lodge a complaint with the supervisory authority

If the processing of personal data infringes the provisions of law, you have the right to lodge a complaint with the supervisory authority about the processing of personal data by the Personal Data Controller.

A complaint may be lodged with the President of the Personal Data Protection Office (the Office of the President of the Personal Data Protection Office is currently located in Warsaw 00-014, at ulica Stanisława Moniuszki 1a).