Privacy policy
If you are interested in cooperating with Techstack and you contact us for further information or have already applied for a vacancy in our organization, we process your personal data. We approach all information about you responsibly and in accordance with the law - in particular with the GDPR.
This Privacy Policy presents detailed information about who we are in accordance with the above regulations, and what obligations we have in respect of your personal data, what is their scope, the purpose and duration of processing. If anything in this Policy seems unclear, please contact us at gdpr-pl@tech-stack.io.
Glossary - Basic concepts
Data controller
Techstack sp. z o.o. with its registered office in Wrocław, at Rybacka 9, 53-656 Wrocław, Poland, registered with the Register of Entrepreneurs of the National Court Register maintained by the District Court for Wrocław-Fabryczna in Wrocław, 6th Commercial Division of the National Court Register, under entry number KRS 0000980748, NIP [taxpayer ID] 8992930113, share capital 60,000 PLN, contact email: gdpr-pl@tech-stack.io.
Personal data
All information that we process related to you. For example: first name, last name, e-mail address, telephone number, education, information about your professional experience, etc.
Labour code
The Act of 26 June 1974 – Labour code.
Processing
All activities performed relating to your personal data. For example: gathering, retaining, updating, sending messages to you, deleting data.
GDPR
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
What personal data do we process?
The scope of personal data we process depends on what information you provide in your application, in particular this includes the data indicted in all documents sent by you, as well as the content of our possible communication inter alia:
- First name(s) and last name;
- Date of birth;
- Contact data;
- Education;
- Occupational qualifications;
- The employment history;
- Curriculum vitae.
In addition to the above-mentioned data, we can also process other personal data if this is necessary for the purpose of carrying out work of a given type or at a given post or if it is necessary to exercise a right or fulfilment of an obligation laid down under a provision of law.
If the basis for our cooperation is an employment contract, providing your personal data required by the provisions of the Labour Code and other data necessary to perform work of a given type or at a given post or necessary to exercise a right or fulfilment of an obligation laid down under a provision of law, is necessary in order to perform the recruitment process with your participation. Refusal to provide them leads to the inability to consider your candidacy for a given position.
Providing other data (not required by law) is voluntary, but if you choose not to provide us with some of them, we may not be able to evaluate your application and, as a consequence, you may be excluded from the recruitment process.
Processing of personal data may also include information that we collect directly or through professional networking sites (e.g. Linkedin, DOU.EU) or from a third party such as a recruitment agency, in order to verify that you are a suitable candidate for a specific position.
In every case, the purposes for which we are processing data are:
- Assessment of your candidacy in respect of requirements for the position indicated in the job offer for which you have submitted your application, and/or for future recruitments for similar positions; this may also include background check, i.e. verification of your professional profile within the limits permitted by law;
- If you meet the requirements for a position – to present you an offer of employment and to conclude a contract;
- Demonstrating that the recruitment process is compliant with the law.
Where legally permitted some of the personal data you provided, e.g. your first name, last name and contact address, may be used by us for operational and promotional purposes, e.g. to send you occasional correspondence (e.g. thank you notes or seasonal greetings, satisfaction surveys etc.).
We may also process your personal data for statistical purposes and to defend against claims.
Legal grounds for processing of your personal data
We process your personal data in accordance with applicable privacy requirements, including when legally required, based on appropriate legal grounds. Such legal ground may be, for example, your consent, our legitimate interest to which we are subject or another legal ground resulting from applicable law.
Legal grounds for the processing of your personal data are as follows:
- In the case of recruitment for a position, when the basis for cooperation is an employment contract:
- With regard to the categories of data required in accordance with Article 22¹ § 1, 2 and 4 of the Labour Code - fulfilment of legal obligations incumbent on Techstack in connection with the recruitment process (Article 6(1)(c) of GDPR) and taking action at your request before concluding the employment contract (Article 6(1)(b) of GDPR);
- With regard to any other data – your consent (Article 6(1)(a) of GDPR) and taking action at your request before concluding the employment contract (Article 6(1)(b) of GDPR);
- In the case of recruitment for a position, when the basis for cooperation is other civil law contract (e.g. contract of mandate or B2B) – your consent (Article 6(1)(a) of GDPR) and taking action at your request before concluding the contract (Article 6(1)(b) of GDPR);
- If you have agreed to participate in future recruitment processes - your consent (Article 6(1)(a) of GDPR);
- In case we have obtained your personal data from professional networking sites (e.g. Linkedin) or from recruitment agencies – our legitimate interest i.e. identification and acquisition of highly qualified employees (Article 6(1)(f) of GDPR);
- When we process your personal data for operational and marketing purposes - our legitimate interest i.e. maintaining our relationship and promoting Techstack brand, or, if we have received your consent for processing your personal data for operational and marketing purposes – your consent (Article 6(1)(a) of GDPR);
- When we process your personal data for statistical purposes or to defend against claims - our legitimate interest (Article 6(1)(f) of GDPR).
In the case of data processing on the ground of consent, we remind you that you can withdraw your consent at any time, without affecting the lawfulness of processing that has already been done on the basis of that consent.
How long do we process personal data for?
We process your personal data in connection with the recruitment process until the consent is withdrawn or until the purpose for which such consent was given (employment, cooperation) is achieved.
Personal data processed by us in connection with a single recruitment process, will be deleted after 2 years from the end of the recruitment process understood as the conclusion of a contract with another candidate. This time allows to complete the trial period and confirm that the position has been effectively filled in.
Data processed based on a consent to participate in future recruitment processes (this includes also recruitment processes for positions that are constantly open), is processed until withdrawal of the consent or until the purpose for which such consent was expressed (hiring you) is fulfilled, but usually for no longer than 3 years from the time you granted the consent.
If we conclude a contract with you, we will continue to process your data for its duration, or longer if needed - in accordance with our Privacy Policy for employees and associates, effective at the time.
The periods described above may be extended as appropriate in the event of any claims and court proceedings – for the duration of such proceedings and their settlement – and if the law obliges us in certain cases to process such data for a longer period.
Who has access to your personal data?
Access to your personal data will be given exclusively to appropriately authorized employees or associates of Techstack, advisers (including those providing ongoing legal services) or auditors – to the extent necessary to perform their duties.
Your data may be transferred to providers of hosting services or ICT services (e.g. data storage), other entities providing us with technical or organizational assistance in recruitment process, including communication with candidates (e.g. recruitment agencies) or distribution of invitations/ documentation etc. (e.g. couriers).
Techstack may also be required – if there is a legal basis to do so – to provide certain information to public authorities, for purposes related to proceedings they are conducting.
As part of the use of tools supporting our ongoing operations, your personal data may be transferred to a country outside the European Economic Area, in particular to a country where the entity cooperating with us maintains tools for the processing of your personal data.
In each case of data transfer outside the EEA, we apply the required safeguards, including standard data protection clauses adopted pursuant to a decision of the European Commission. Additionally, in order to protect personal data, both during its transfer and after its receipt, we apply generally accepted standards that meet the requirements of the GDPR and the jurisprudence of the Court of Justice of the European Union.
You have the right to obtain a copy of the safeguards we use regarding the transfer of personal data to a third country by contacting us at the email address [mail].
Your rights related to processing of your personal data
You have the following rights:
Access to your personal data
You may ask us to provide detailed information regarding inter alia:
- Whether we are processing your personal data;
- For what purpose;
- What categories of data we are processing;
- Who is the recipient of your data;
- What is the planned duration of processing (if possible), and if we are not able to say, the criteria for determining that duration;
- If the personal data has not been given by you – all available information about the source of the data.
You can also receive access to all of your personal data that we are processing (data copy).
Data rectification
If information about you is or has become inaccurate or incomplete, you have the right to demand that data is rectified or made complete.
Consent withdrawal
You may withdraw your consent to the processing of your personal data at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Erasure of data
In certain situations, GDPR gives you the “right to be forgotten.” You can invoke this right if we are still processing your personal data, particularly in the following cases:
- The data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
- You withdraw consent to the processing of personal data and there is no other legal ground for continuing to process it;
- You object to the processing of your personal data when there are no overriding legitimate grounds for processing;
- You object to the processing of your personal data for marketing purposes;
- Your data is processed unlawfully;
- Your data has to be erased for compliance with a legal obligation.
Restriction of processing
You can demand that we limit our activities in principle only to storing information about you when:
- You question the accuracy of personal data we are processing – for a period of time that allows us to verify the accuracy of that data;
- The processing of your personal data is unlawful, but you prefer that processing be restricted rather than the data be erased;
- We no longer need your personal data for the purposes of processing, but you need it for the establishment, exercise, or defence of legal claims;
- You have objected to the processing of your personal data – only until such time as it is determined whether our legitimate grounds override yours.
Data portability
You have the right to receive your data in a commonly-used format that can be read by a computer, and also to have your data sent to another data controller, if:
- The processing is based on your consent or on a contract;
- The processing is carried out by automated means.
Objection
You have the right to object to some operations we perform on your personal data for special reasons related to your personal situation, particularly in the following cases:
- When our processing is based on our legitimate interest;
- When we process your personal data for purposes related to scientific or historical studies, or for statistical purposes.
Remember, however, that when despite your objection we find that there are compelling legitimate grounds for the processing which override your interests, rights and freedoms, or basis for the establishment, exercise or defense of legal claims, we will continue to process your personal data covered by the objection to the extent necessary.
Complaints to the relevant public authority
Of course, if you have any comments, we encourage you to first contact us at gdpr-pl@tech-stack.io.
For effective exercise of your rights, please send any requests to gdpr-pl@tech-stack.io with subject “GDPR Request”, and please specify which right(s) you wish to invoke (this will speed up the implementation of your right, but you can also submit inquiries in a different form, including in writing).
Last update: 25.03.2025