Information on the Processing of Personal Data for job applicants in companies from the USP Group

In connection with the implementation of the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”), we inform you about the principles of processing your personal data and your rights.

The following rules apply from 25 May 2018.

I. Administrator’s instructions

The administrator of your personal data is the company from the USP Group to which recruitment for the given position is conducted, i.e., USP Zdrowie sp. z o.o., US Pharmacia sp. z o.o., EU Pharmacia sp. z o.o., Spark and Mortar sp. o.o., or Healthily sp. z o.o.:

USP Zdrowie sp. z o.o. in Warsaw, 02-822 Warsaw, ul. Poleczki 35, registered in the register of entrepreneurs kept by the District Court for the Capital City of Warsaw in Warsaw, XIII Commercial Division of the National Court Register under the number KRS 0000347815, NIP 7010219241.

US Pharmacia sp. z o.o. in Wrocław, 50-507 Wrocław, ul. Ziębicka 40, registered in the Register of Entrepreneurs conducted by the District Court for Wrocław Fabryczna, 6th Commercial Division of the National Court Register under the number KRS 46646, NIP 899 14 32 896.

EU Pharmacia sp. z o.o. in Warsaw, 02-822 Warsaw, ul. Poleczki 35, entered in the register of entrepreneurs of the National Court Register kept by the District Court for the capital city of Warsaw in Warsaw, XIII Commercial Division of the National Court Register under KRS number 146899, NIP 951 20 68 112.

Spark and Mortar sp. z o.o. with its registered office in Warsaw at ul. Poleczki 35, postal code 02-822, entered into the register of entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register, under KRS number 286429, share capital of 250,000 PLN, NIP 101 00 03 928

Healthily sp. z o.o. with its registered office in Warsaw at Poleczki 35, postal code 02-822, entered into the register of entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, XIII Commercial Division of the National Court Register, under KRS number 806081, share capital of PLN 6,005,000, NIP 9512491164.

If you want to contact us regarding matters related to personal data processing, please:

  1. sending an email to the address: [email protected];
  2. sending a letter to the address: USP Zdrowie sp. z o.o., ul. Poleczki 35, 02-822 Warsaw.

II. Purposes and Legal Basis for Processing Your Personal Data

We process your personal data for the following purposes:

  1. conducting recruitment, and upon its successful completion, concluding an employment contract with you (legal basis for processing: Art. 6(1)(b) GDPR);
  2. fulfilling the legal obligations incumbent upon the Administrator as an employer in connection with the recruitment process, arising, among others, from the provisions of the Labor Code (legal basis: Art. 6(1)(c) GDPR), including for the purpose of:
    a. preventing discrimination in employment;
    b. (if applicable in your case) meeting the requirements specific to the chosen position;
    c. conducting an explanatory procedure following a report of irregularities in the recruitment process, after the entry into force of the whistleblower protection regulations.
  3. resulting from the legitimate interests pursued by the administrator (legal basis for processing: art. 6 sec. 1 lit. f. GDPR), including for the purpose of:
    a. verifying your professional qualifications;
    b. (if you are invited to a recruitment interview) ensuring physical security at the Administrator’s facilities, including internal and external video monitoring and logging people entering and leaving the Administrator’s facilities;
    c. monitoring and improving the quality of recruitment processes, including monitoring phone calls and meetings;
    d. (if applicable in your case) conducting contentious proceedings, as well as proceedings before public authorities and other proceedings, including for defense against claims;
    e. implementing a candidate referral program for employment;
    f. conducting an investigation resulting from a report of irregularities in the recruitment process, until the entry into force of whistleblower protection regulations.

    If you have given us consent to process personal data, we will process your data to the extent and for the purpose specified in the content of the consent.

III. Categories of Processed Personal Data

In the case where we have not obtained personal data directly from you, we process the following categories of data:

  1. identification data;
  2. address and contact details;
  3. education;
  4. course of employment to date;
  5. other data you provided us in your CV and other application documents;
  6. other data related to your skills and competencies, which we obtained through competency tests, language tests, or substantive tasks you were asked to perform and agreed to do so.

IV. Source of Acquisition of Personal Data

In the event that we have not obtained personal data directly from you, we inform you that the personal data has been obtained from companies within the USP Group, recruitment agencies, or HR consulting firms with which we cooperate, or from our employees as part of the referral program.

V. Obligation to Provide Personal Data and Consent to Provide Personal Data

The obligation to provide your personal data arises from Article 221 of the Labor Code or other labor law provisions. This includes, among others, personal data: first name(s) and surname, parents’ names, date of birth, place of residence (correspondence address), education, previous employment history.

If you send us additional personal data in your recruitment application beyond those indicated by law (e.g., phone number, email address, image, hobbies, interests, language proficiency, etc.), we process such personal data based on your consent (Article 6(1)(a) of GDPR). You express this consent by sending us your recruitment application via, for example, the Pracuj.pl portal, email, or traditional mail.

Please do not provide us with special categories of personal data, such as information on health conditions, political views, religious or philosophical beliefs, criminal record, or other such information as indicated in Articles 9 and 10 of the GDPR. We do not require this information in the recruitment process. If for any reason you wish to provide us with any of the aforementioned information, please include separate consent for its processing in your CV for the recruitment process. Otherwise, upon determining that such information is included in the recruitment documents, we will remove it from our database or contact the candidate to resend the necessary documents without specially protected data.

During the recruitment process, you may be asked to complete various competency and language tests or substantive tasks (e.g., samples of your work). If you give separate consent for this, we will process your personal data for the purpose of conducting the competency test and verifying your aptitudes and qualifications relevant to the specified job position.

In cases where we collect your personal data based on your consent, providing personal data is voluntary.

VI. Information about the recipients of your personal data

Your personal data is shared with:

  1. entities processing personal data on behalf of the administrator, including:
    a. entities supporting us in recruitment processes, including recruitment agencies and entities recruiting employees on behalf of the administrator;
    b. external IT service providers managing our IT systems;
    c. our partners responsible for providing physical security at the administrator’s premises and video surveillance;
  2. to entities related to the administrator, including those belonging to the USP Group, if you have consented to the sharing of your personal data for recruitment purposes or in connection with the fulfillment of reporting, reporting, and administrative obligations;
  3. public administration bodies and entities performing public tasks or acting on behalf of public administration bodies, in the scope and for the purposes arising from legal regulations, e.g. the National Labour Inspectorate.

We may transfer your personal data outside the European Economic Area to the United States of America based on standard contractual clauses. You have the right to obtain standard contractual clauses from us. We only do this when the supervisor of the position we are recruiting for works for an affiliated company in the USA.

VII. Periods of Personal Data Processing

Your personal data will be processed for the purpose of the recruitment process for the duration of the recruitment and for 1 year from the moment of application in case it is necessary to repeat the recruitment process for any reason.

If you have consented to the processing of personal data for future recruitment purposes, your data will be processed for as long as you do not withdraw your consent, but no longer than 3 years from the time you gave your consent.

In the event of any disputes between you and the administrator or another company within the USP Group regarding the recruitment process, we will process your personal data to pursue or defend against claims for a period of 3 years from the end of the recruitment process or longer for the duration of the dispute.

VIII. Profiling and Automated Decision-Making

In order to effectively conduct recruitment and select candidates best suited for a specific position, we can use processes based on profiling, in particular, we can use various filters in online recruitment tools that allow us to search for candidates based on their qualifications, skills, and professional experience for a specific job position.

Profiling for this purpose is based on our legitimate interest (Article 6(1)(f) of the GDPR), which involves searching for and grouping candidates who best fit a specific position (e.g., due to professional experience or education).

Your personal data will not be used for automated decision-making.

IX. Rights of the data subject

You are entitled to a number of rights under GDPR. You can submit a request to us for:

  1. access to personal data (which means we will provide you with information on how we process your data and you will receive a copy of the data from us);
  2. rectification (i.e., correction) of personal data – in case the data is incorrect or incomplete;
  3. Removal of personal data (the so-called “right to be forgotten”). You can exercise this right, for example, when:
    a. we process your personal data unlawfully,
    b. you object to the processing of data based on USP Zdrowie’s legitimate interest and this objection is justified,
    c. the data must be deleted in order for us to comply with a legal obligation.
  4. restriction of processing of personal data (e.g. suspension of data operations or not deleting data due to certain circumstances);
  5. Transfer of personal data: to another controller, and when technically impossible, receiving a copy of the data you have provided to us.

You can exercise the right to data portability, referred to in point 5 above, only when the processing is carried out in an automated manner, and additionally: (a) based on the contract binding us, or (b) based on the consent you have given.

To exercise the above rights, you can write to the address [email protected] or send a letter to the correspondence address: USP Zdrowie sp. z o.o., ul. Poleczki 35, 02-822 Warszawa.

X. Right to object

At any time, you may object to the processing, including profiling, of your personal data by USP Zdrowie if the basis for processing is our legitimate interest or when we act in the public interest. Upon receipt of such a request, we will no longer be able to process the personal data covered by the request, unless we demonstrate: a. the existence of valid, legitimate grounds for processing that override your interests, rights, and freedoms, or b. grounds for establishing, pursuing, or defending claims.

XI. Right to withdraw consent for personal data processing

In certain situations, we may ask for your consent to process data (e.g., to store your CV for future recruitment purposes or to share your CV with other companies within the USP Group). If you have given us consent to process your personal data, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of data processing carried out on the basis of consent before its withdrawal.

XII. Right to lodge a complaint with a supervisory authority

In the event that you believe the processing of your personal data by USP Zdrowie violates the provisions of the GDPR, you have the right to file a complaint with the President of the Personal Data Protection Office.