1. You are a candidate in a client recruitment process

Why and on what basis we process your data

• To run the recruitment process, assess your candidacy and — after informing you about the client — present your profile, based on your consent under Art. 6(1)(a) GDPR.
• To consider you for future opportunities only where you give separate consent under Art. 6(1)(a) GDPR.
• To establish, exercise or defend possible claims, based on legitimate interest under Art. 6(1)(f) GDPR.
• If you voluntarily provide special-category data, it is processed only on the basis of explicit consent under Art. 9(2)(a) GDPR.

Data involved: identity and contact details, education, qualifications, employment history, compensation expectations and information you provide in your CV, LinkedIn profile or conversation.

Recipients: the client for whom the search is being conducted — you will know the client before your profile is shared — and trusted IT or recruitment-service providers.

Retention: until the recruitment process ends. If you consent to future opportunities, up to 24 months or until you withdraw consent.

2. We contacted you first — direct sourcing

If we approach you through LinkedIn, email or another channel about a professional opportunity:

• We process your name, professional information, publicly available contact details and relevant career data based on our legitimate interest in contacting potentially suitable people about a role, Art. 6(1)(f) GDPR.
• The data may come from LinkedIn, company websites, professional platforms, public industry sources or a referral.
• If you decline or do not wish to be contacted, you can object at any time. A short reply such as “please do not contact me” is enough.
• If you enter the process, further processing follows Notice 1 above.

3. You are a client or business contact

• Business contact and service information — legitimate interest, Art. 6(1)(f) GDPR.
• Entering into and performing a recruitment-services agreement — Art. 6(1)(b) GDPR.
• Accounting and tax documentation — legal obligation, Art. 6(1)(c) GDPR.
• Establishing, exercising or defending claims — legitimate interest, Art. 6(1)(f) GDPR.

Business and contract data is retained for the duration of the relationship and afterwards for statutory accounting periods or until relevant claims expire.

4. Your rights

You have the right to access and receive a copy of your data, correct it, request deletion or restriction, request portability where applicable, object to processing based on legitimate interest and withdraw consent at any time. Withdrawal does not affect processing that was lawful before it.

You may lodge a complaint with the President of the Polish Personal Data Protection Office at uodo.gov.pl .

5. Additional information

• Voluntary provision: providing data is voluntary but may be necessary to participate in a recruitment process or enter into an agreement.
• No solely automated decisions: candidate decisions are made by people. We do not use automated decisions producing legal or similarly significant effects.
• International transfers: where a provider processes data outside the EEA, appropriate safeguards such as Standard Contractual Clauses are used where required.

For any request or objection, contact info@talentholo.com .