Who are we?

The Controller of your personal data is MEDOS Paweł Buławka spółka komandytowa, with its registered office at 86-200 Chełmno, ul. Magazynowa 3. We have appointed a Data Protection Officer whom you can contact by writing to our registered office address marked "IDO" or by email: medos@serwisiod.pl

Processing purpose

We will process your data, depending on the relationship between us, for the following purposes:
  • to perform the contract between us, or to take action at your request even before the conclusion of the contract (as referred to in Article 6(1)(b) of the GDPR;
  • performance of a legal obligation incumbent upon us, such as the collection of employee data in a personnel file, the issuance and storage of an invoice (as referred to in Article 6(1)(c) of the GDPR);
  • fulfilment of our legitimate purpose, which may be the handling of correspondence, the compilation of summaries and statistics, the marketing of our services, the establishment, defence or assertion of claims (as referred to in Article 6(1)(f) of the GDPR;
  • processing your job application, or storing it at your request as stated in Article 6(1)(a) of the GDPR.

Do we share your data with anyone?

Your data may be shared with other entities in three specific cases:
  • we are obliged to do so by law (public administration authorities, NFZ, ZUS, etc.),
  • we have entered into an entrustment agreement (with entities that provide various services and support to us),
  • transfer is based on our legitimate purpose (e.g.: establishing, defending or pursuing a claim).

How long do we keep your data?

Depending on the relationship between us your data may be stored as long as it is necessary for the purpose for which it was collected and so, for documentation of contracts and orders for 5 years, for employee data for 50 years from the termination of employment, for the establishment, investigation or defense of claims it will be the period until the statute of limitations of claims (usually 5 years), when we issued an invoice to you or we received it from you - for a period of 5 years, counting from 1st January f the year following the year in which the invoice was issued.

What rights do you have?

You have the right to submit a request to us, demanding:
  • access to and rectification of your data,
  • erasure, but in the cases referred to in Article 17 of the GDPR,
  • in the cases specified in Article 18 of the GDPR, to restrict the processing of your data,
  • recognition of your objection to the processing referred to in Article 21 of the GDPR,
  • transfer your data we process in information systems in connection with the performance of a contract.

Filing a complaint

If you believe that our processing of your personal data violates your rights and freedoms, you may file a complaint with the President of the Data Protection Authority.

Why do we want to process your data?

In some cases (fulfillment of a contract), the provision your data is voluntary, but necessary to fulfill the purpose. In others (employment, issuance or storage of invoices), the provision of personal data is required by law and failure to provide such data will result in a refusal to perform an action on our part. When you write to us - you give us your data voluntarily, and their processing is in our legitimate interest; if you expect a response, failure to provide data will result in no response. For all other purposes, processing is based on data already obtained.

Are you subject to profiling based on the data you provide?

We do not undertake profiling activities through our information systems. Information systems do not make decisions based on the data you provide to us.

Consent-based processing

If we process your personal data based on your consent, please note that you may withdraw your consent at any time, but with effect from the time of withdrawal.

Do we obtain data from sources other than the data subject?

In some cases, we obtain data from sources other than the data subject. These are situations where we obtain data from publicly available databases or from other people.

What consent clauses to include in my CV?

If you send us your CV in response to a specific recruitment that we are currently conducting, we do not require from you additional consent to the processing of personal data, but we also ask that your CV should not contain anything more than: first name, surname, date of birth, place of residence (correspondence address), education (the highest level, and when it may be relevant to the recruitment process also additional education), previous employment history (preferably including the actual duties performed).

If you would like us to retain your resume for the long term, please include the following clause: "I consent to the processing of my personal data provided in this CV for inclusion in the database of potential job candidates."