This privacy policy (hereinafter the “Privacy Policy”) specifies the principles of processing (including collecting and use) of personal data by QED Software Sp. z o. o. with registered office in Warsaw (00-052), ul. Mazowiecka 11/49, entered into the register of entrepreneurs of the National Court Register, maintained by the District Court for the capital city of Warsaw, XII Commercial Division, KRS: 0000174197, with tax identification number NIP: 5262370692 (hereinafter “we,” “us”) along with the information on the rights of private individuals. Personal data is processed by us for the purposes and in the scope indicated in this Privacy Policy.

Definitions:
Whenever this Privacy Policy mentions the following capitalised terms, they shall be construed as follows:

• Data Controller / ADO – the data controller with respect to personal data shall be QED Software Sp. z o. o. with registered office in Warsaw (00-052), ul. Mazowiecka 11/49, entered into the register of entrepreneurs of the National Court Register, maintained by the District Court for the capital city of Warsaw, XII Commercial Division, KRS: 0000174197, with tax identification number (NIP): 5262370692 and statistical number (REGON): 014909604 and with the following e-mail address: [email protected]
• Candidate – each person participating in the recruitment process conducted by the Controller;
• Customer – any person the Controller renders software services to on the principles and in the scope arising from the agreement concluded between the Parties;
• Contractor/Processor – any person cooperating with the Controller, processing personal data in relation to which the Controller is deemed an ADO, on the principles and in the scope arising from the agreement concluded between the parties;
• GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council (EU) of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“General Data Protection Regulation”);
• Website – the following Internet domain: qedsoftware.com
• User – any person using the Website and/or contacting with the Controller by telephone, e-mail or post.

Purpose and grounds for the processing of personal data:

Personal data is processed by us for the purposes and in the scope indicated in this Privacy Policy – in relation to:

• Users – for the purpose of handling the matters constituting the subject matter of correspondence. User Information is processed pursuant to Article 6 section 1 (f) of the GDPR (i.e. pursuit of the Controller’s legitimate interest in the form of communication with the users of the Website);
• Customers – for the purpose of rendering software services, subject to the principles and in the scope according to individual arrangements, pursuant to Article 6 section 1 (b) of the GDPR (i.e. it is necessary for the performance of a contract to which the data subject is party);
• Contractors – for the purpose of completion of the contract between the Parties (including the data processing agreement, pursuant to Article 28 of the GDPR), pursuant to Article 6 section 1 (f) of the GDPR (i.e. the necessity of processing arises from the Controller’s legitimate interest);
• Candidates – for the purpose of conducting the recruitment process. In the event of employment pursuant to a work contract, the Candidate’s data is processed pursuant to Article 9 section 2 (b) of the GDPR in connection with Article 221 of the Labour Code (i.e. processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller in the field of employment law). In the event of engaging in cooperation based on a civil law contract, the Candidate’s data is processed pursuant to Article 6 section 1 (a) of the GDPR (i.e. freely expressed consent);

and in the cases in which the provisions of law authorise the Controller to process personal data. If we process data for purposes other than those arising from the Privacy Policy, the data subject shall each time be informed thereof.

Categories of personal data processing:
Personal data is processed by us for in the scope indicated in this Privacy Policy – in relation to:

• Users – including: fist name, e-mail address and/or telephone number;
• Customers – in the scope arising from individual arrangements, necessary to perform software services and individually specified by the Customer;
• Contractors– in the scope necessary for the performance of the agreement between the Parties, i.e. first name and surname, official position, official telephone number and e-mail address, as well the details necessary for the issue of a VAT invoice;
• Candidates – in the following scope: in the case of employment pursuant to a work contract, pursuant to Article 221 of the Labour Code (i.e. first name and surname, birth date, contact details, education, employment history) and other details freely provided by the Candidate. In the event of engaging in cooperation based on a civil law contract, in the scope freely indicated by the Candidate. The Controller shall be entitled to process also the Candidates’ sensitive data (irrespective of the legal grounds of employment), e.g. their image. The provision of the aforementioned data depends solely on the will of the Candidate and shall not affect the outcome of the recruitment process.
  
  

If we process data in a scope other than that arising from the Privacy Policy, the data subject shall each time be informed thereof.

Period of personal data storage:

Personal data is processed for the period of User’s use of the Website or another period which is necessary for the completion of the purposes for which such data was collected. Additionally, personal data will be stored for the period of resolution of any actual claims or the period in which any potential claims could arise and have not been become subject to limitation. The period of storage of Candidates’ personal data depends on the nature of the consent given by the given Candidate. In the event of consent to the processing of personal data necessary to perform the aforementioned recruitment process – until the conclusion of such process; in the case of consent to the processing of data also for the purpose of recruitment in the future – we store the Candidates’ data also following the conclusion of the particular recruitment process (however not later than for a period of one year).

Recipients of data:

The personal data of Users and Customers may be provided to authorised institutions specified in the relevant provisions of law as well as processing entities which render services for the benefit of the Controller. The personal data collected by the Controller may be directly accessed only by the Controller’s authorised employees or contractors.

Rights of data subjects:

A data subject is entitled to:

1. access the contents of their personal data and receive copies thereof;
2. rectify their personal data;
3. demand the erasure of their personal data; however, if the given data subject has expressed consent to the processing of their personal data, a demand for the erasure of their personal data shall have the same effect as withdrawal of the consent;
4. demand a restriction of processing of their personal data;
5. transfer their personal data;
6. object the processing of their personal data;
7. withdraw their consent (in the event that the Controller processes data based on such consent) at any time and without prejudice to the lawfulness of processing carried out pursuant to the consent prior to its withdrawal;
8. lodge a complaint with the supervisory authority regarding the violation of their right of data protection by the Controller or other rights granted pursuant to the provisions of the GDPR. The supervisory authority in Poland shall be the President of the Personal Data Protection Office.

In order to exercise the aforementioned rights, a data subject should send us an e-mail at [email protected] indicating: a) which right they wish to exercise, b) in what scope and c) in what manner. Please provide your contact details which will enable us to contact you quickly during the handling of your request – in particular where it may be necessary to confirm the identity of the applicant or the exact right the applicant wishes to exercise as well as the scope in which they wish to exercise it (telephone contact is preferred, although it is not obligatory).

Processing of personal data outside the territory of the EU:

We hereby declare that we will not transfer any personal data entrusted to us outside the territory of the European Economic Area unless subject to a prior written consent of the given data subject. At the same time, we would like to emphasise that in the aforementioned situation we will comply with all the obligations arising from the GDPR in relation to the transfer of personal data to third countries.

Profiling:

The controller decides on behalf of the data subjects based on automated processing, including profiling.

Cookie policy:

In order to improve the functionality of the Website, the Controller may utilise cookies. Cookies are files saved on the device with the browser used to access the websites by the User.
We hereby declare we use the following cookies:

• cookies necessary for the proper functioning of the website;
• cookies verifying website visits.
• The cookies we use do not store any personal data of the User.

According to the applicable regulations, the User shall be entitled to decide on the scope in which cookies will have access to their computer by making the appropriate choices in their browser settings. The handling of cookies depends on the browser configuration and may be modified independently by the User.
Cookies originating from the websites of third parties, in particular LinkedIn, Google or Twitter, may also be stored on the User’s device. Information regarding cookies from these websites can be found on the website of their respective owners.

Miscellaneous provisions

The Controller reserves the right to amend this Privacy Policy if it is required by the applicable law or changes introduced in the Website. The Controller shall notify any changes as well as their date of entry into force by means of an appropriate message on the Website.

Information by the data controller (recruitment process)

QED Software Sp. z o.o., with its registered office in Warsaw (00-052) at ul. Mazowiecka 11/49 will be the Controller of your personal data submitted in this recruitment process.
Providing us with your personal data as specified in Article 22 (1) of the Labour Code is necessary for you to take part in the recruitment. Providing other personal data is voluntary and does not have any impact on the outcome of the recruitment process.
Your personal data will be processed in accordance with the provisions of the labour law in order to conduct the current recruitment procedure (thus it will be processed on the basis of Article 6 (1) (c) of the GDPR in connection with Article 22 (1) of the Labour Code), and other personal data (such as your image for example) if you want to provide us with it, will be processed on the basis of your consent (that is, on the basis of (Article 6 (1) (a) of the GDPR)). We will consider your sending the application to us as the act of confirming that such consent has been given (so if you forgot to put the consent clause in your CV, we can still read the CV). However, if you want us to consider you (your data) for further recruitment, we need your explicit consent to process for this purpose (see the example consent phrase provided above).
You will not be subject to automated decision making in the process of recruitment to QED Software based on your data provided to us.
In the recruitment process, the data will not be disclosed to other entities, but in the event of employment, it may be disclosed to entities providing IT services, providing hosting or accounting services for us.
Your data will be processed for the time necessary to complete the recruitment process (maximum 60 days). If you gave your consent to participate in future recruitment processes, your data will be processed until it is withdrawn, but no longer than for 2 years from the time we receive your application.
You have the right to request access to your personal data, to correct it, delete it or restrict its processing of your personal data, to object to the processing and the right to transfer the data . Regarding the data we process based on your consent, you have the right to withdraw the consent. You also have the right to file a complaint against the processing of your data to the President of the Personal Data Protection Office.
If you have any questions related to your data processing, please contact us at [email protected].