Processing of (personal) data by the entity in charge of the online application process
INFORMATION CLAUSE (PRIVACY POLICY)
1. The controller of your personal data processed as part of the recruitment process is UniCredit NV/SA with its registered office in Brussels (Belgium), at: Sq. Victoria Régina 1, 1210 Saint-Josse-ten-Noode, registered in the Crossroads Bank for Enterprises under number 403.199.306, operating through its branch UniCredit S.A. Spółka Akcyjna Branch in Poland, with its registered office in Warsaw, at: ul. Dobra 40, 00-344 Warsaw (hereinafter referred to as the “Bank” or the “Controller”). You may contact the Controller by post at the address above or via email at: privacy@unicredit.pl.
2. Providing personal data specified by applicable law (in particular Article 22¹ of the Polish Labor Code in the case of employment contracts) is necessary to participate in the recruitment process. Failure to provide this mandatory data will prevent the Bank from considering your application.
Providing any data beyond the scope required by law (or data required for initiating a B2B/civil-law contract) is entirely voluntary. The provision of such voluntary data, or a refusal to provide it, will not affect your participation in the recruitment process or its outcome.
3. The Controller has appointed a Data Protection Officer (DPO), whom you may contact in all matters relating to the processing of personal data and the exercise of your rights:
by post at: ul. Dobra 40, 00-344 Warsaw,
by email at: dpo@unicredit.be or dpo@unicredit.pl.
4. Your personal data will be processed for the following purposes and on the following legal bases:
conducting the current recruitment process:
for candidates applying for an employment contract, the legal basis for processing data required by law (Art. 22¹ of the Polish Labor Code) is Article 6(1)(c) of the GDPR (compliance with a legal obligation);
for candidates applying for a B2B or civil-law contract, the legal basis is Article 6(1)(b) of the GDPR (taking steps at the request of the data subject prior to entering into a contract);
with regard to additional data provided by you voluntarily (e.g., a photograph, hobbies), the legal basis for processing is Article 6(1)(a) of the GDPR (your consent, which may be withdrawn at any time).
future recruitment processes: provided that you give separate, explicit consent (Article 6(1)(a) of the GDPR);
defense against claims or the pursuit of claims: which constitutes the Controller’s legitimate interest (Article 6(1)(f) of the GDPR).
5. Special categories of data (as defined in Article 9(1) of the GDPR, e.g., health data, political opinions, religious beliefs). The Bank does not request, require, or encourage candidates to provide special categories of data during the recruitment process. If such data are provided by you on your own initiative, they will not be processed unless a specific legal provision requires it. Otherwise, such data will be immediately deleted or disregarded by the Bank.
6. You have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal.
7. Recipients of your personal data will include the Controller’s authorized subcontractors (e.g. IT and recruitment system & service providers), entities authorized to receive personal data under applicable law, as well as entities affiliated with the Controller within the corporate group to which the Controller belongs (e.g. UniCredit Group), insofar as personal data are processed for the internal administrative purposes of that corporate group.
8. Personal data will be stored for a period of 12 months from the end of the current recruitment process. If you consent to the processing of data for future recruitment purposes, the data will be processed for a period of 12 months from submission, unless the consent is withdrawn earlier. Data processed for the defense or pursuit of claims will be stored until the expiry of the limitation period for such claims under applicable law.
9. You are entitled to the following rights under the conditions set out in the GDPR:
access to your data and to receive a copy thereof;
rectification (correction) of data;
erasure of data (the right to be forgotten);
restriction of processing;
data portability (to receive the data in a structured format);
to object to processing (where the legal basis is legitimate interest);
to withdraw consent at any time (without affecting the lawfulness of processing prior to its withdrawal).
10. To exercise your rights, please contact the Controller electronically or by post. Correspondence should include your first name, last name, and contact details (telephone/email).
11. You have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO) - contact details available at: https://uodo.gov.pl/p/kontakt.
12. Data processing does not involve automated decision-making, including profiling.
13. International Transfers: As a rule, your personal data are processed within the European Economic Area (EEA). In the event that recruitment data must be transferred outside the EEA, the Controller will ensure an adequate level of protection by applying Standard Contractual Clauses approved by the European Commission or by relying on European Commission adequacy decisions. You have the right to obtain a copy of these safeguards.
*Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”).