This Privacy Policy explains how the website jobcen.pl collects, uses and protects personal data of visitors, persons contacting us through the form, and candidates participating in recruitment processes conducted by our employment agency. The document has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), the Polish Electronic Communications Act of 12 July 2024 (PKE; Journal of Laws 2024, item 1221), the Act of 20 April 2004 on the promotion of employment and labour market institutions, and the Act of 12 December 2013 on foreigners.
The controller of personal data collected through the website jobcen.pl and in the course of services provided under the jobcen brand is:
We act as a licensed employment agency within the meaning of Article 18(1) of the Polish Act of 20 April 2004 on the promotion of employment and labour market institutions. We provide job intermediation, temporary agency work, process outsourcing and support for the legalisation of stay and work of foreigners.
The Controller has not appointed a Data Protection Officer (DPO) because the conditions for mandatory appointment under Article 37(1) GDPR are not met. All matters concerning the processing of personal data should be sent to: michal.matysiak@matysart.pl.
The contact section of jobcen.pl allows you to send an inquiry as an employer, candidate or business partner.
| Data | Obligatory |
|---|---|
| First name | Required |
| E-mail address | Required |
| Phone number | Optional |
| Role (employer / candidate / partner) | Required |
| Message content | Required |
| Consent to the privacy policy (checkbox) | Required |
| Consent to future recruitment (candidate database) – period chosen by the candidate: 6, 12 or 24 months (single-option selection in the form) | Optional |
The form is submitted via HTTP POST to the Controller's server backend (PHP script contact.php), hosted on infrastructure located within the territory of the Republic of Poland (European Economic Area). Data is validated on the server, written to an operational log and forwarded by SMTP to the Controller's mailbox.
From a candidate applying for a specific position we collect only the data listed in Article 221 § 1 and § 2 of the Polish Labour Code: first name and surname, date of birth, contact details (e-mail, phone number, correspondence address), education, employment history, professional qualifications, and data necessary for the requirements of the specific position (e.g. industry permits, certificates, language skills).
For the purposes of legalising the stay and work of foreigners (work permits, residence card, declarations of entrustment of work), the Controller – as an employment agency authorised to represent the employer or candidate in administrative proceedings – additionally processes data required by the Polish Act on foreigners and implementing regulations (in particular passport number, country of passport issue, citizenship, place of stay, residence status, registration documents with Polish authorities). The scope follows directly from the official forms of the Voivodeship Office and the Office for Foreigners.
We do not require information on: health, racial or ethnic origin, political views, religious beliefs or trade union membership. If such information appears in a CV submitted voluntarily, we treat it as provided on the candidate's own initiative and process it on the basis of consent (Art. 9(2)(a) GDPR). We recommend avoiding the transfer of special category data (Art. 9 GDPR) that is not necessary for the recruitment process.
The contact form backend implements a five-layer protective mechanism against abuse:
The entire transmission path is encrypted using HTTPS/TLS. These measures implement the obligation to select "appropriate technical and organisational measures" under Art. 32 GDPR and support the accountability principle (Art. 5(2) GDPR).
The server hosting jobcen.pl automatically records technical visit data: IP address, TLS session identifier, browser and operating system type (User-Agent), date and time of the request, URL of the requested resource and referring page (Referer). This data is processed solely for purposes related to website security and technical diagnostics, on the basis of the legitimate interest of the Controller (Art. 6(1)(f) GDPR, Recital 49 GDPR).
| Purpose | Categories of data | Legal basis |
|---|---|---|
| Response to an inquiry from the contact form | First name, e-mail, phone, role, message | Art. 6(1)(b) GDPR (pre-contractual steps); Art. 6(1)(f) GDPR for logs (accountability) |
| Recruitment process for a specific position | CV data within the scope of Art. 221 Labour Code | Art. 6(1)(b) GDPR; Art. 221a Labour Code |
| Storage of CV in the candidate database | CV data | Art. 6(1)(a) GDPR (voluntary consent) |
| Employment agency obligations (KRAZ reporting, MRPiPS reports) | Statistical data | Art. 6(1)(c) GDPR (legal obligation – Art. 19f of the Employment Promotion Act) |
| Legalisation of foreigner's stay and work | Passport data, residence status | Art. 6(1)(c) GDPR (Act on foreigners, Employment Promotion Act) |
| Conclusion of employment / civil-law / temporary work contract | Full HR data | Art. 6(1)(b) GDPR; Labour Code, Civil Code, Temporary Work Act |
| Accounting and tax obligations (invoices, ZUS, tax office) | Identification data | Art. 6(1)(c) GDPR in conjunction with the Accounting Act and Tax Ordinance |
| Website security, protection against abuse | Server logs (IP, User-Agent) | Art. 6(1)(f) GDPR; Art. 32 GDPR |
| Pursuit or defence of legal claims | Correspondence and contract data | Art. 6(1)(f) GDPR |
| Special category data voluntarily provided in CV | Sensitive data | Art. 9(2)(a) GDPR |
If you choose future recruitment, for the selected period (6, 12 or 24 months) we store your contact details, CV, information about experience and licences, and basic document data (number, issuing country, validity dates) - without scans, which we delete once the current procedure ends. After the period we delete or anonymise the data; records required by law are kept only for the purpose set by those laws. Commercial information about offers is sent only via channels you choose, and each can be switched off separately.
After the retention period has expired, data is deleted or anonymised in a way that prevents its recovery.
Personal data may be shared only with the following categories of recipients:
The Controller does not sell personal data to third parties. We do not use analytics tools (Google Analytics), marketing tools (Meta Pixel) or run remarketing. Web fonts (Inter, Space Grotesk) are hosted directly on the Controller's server (self-hosting) – there is no transfer of data to Google LLC or other CDN font providers.
We accept candidate applications from various countries – including Asia (Philippines, Indonesia, Vietnam, India, Bangladesh, Nepal), Africa (Kenya, Egypt), Moldova and Eastern Europe (Ukraine, Belarus, Georgia). We receive them through the website form, by e-mail, or from our recruitment partners in the candidate's country of origin.
We do not transfer your data outside the European Economic Area (EEA). Data is processed in Poland and the European Union – our servers, hosting and processors are located within the EEA. Access is limited to our staff in Poland and trusted Polish/EU processors (hosting, accounting, HR services).
Situation of a candidate located outside the EEA. A situation in which you – as a candidate from a country outside the EEA – send us your data directly (form, e-mail) from a device located in your country of residence does not constitute a transfer of data outside the EEA within the meaning of Chapter V GDPR. As the data subject, you transmit information to a controller in Poland, and we receive it within the EEA. This position is confirmed by the European Data Protection Board Guidelines 05/2021 on the interplay between Article 3 and Chapter V GDPR.
Foreign partner. If a candidate submits data through a foreign recruitment partner, that partner is a separate controller of its own records and is responsible for them under the law of its own country. Only applications from candidates who agreed to be contacted by a Polish agency reach us.
Exceptional situations – limited transfer of data outside the EEA. As part of coordinating the recruitment process, there may be a need to transfer a limited scope of data (e.g. process status, candidate identity confirmation, planned arrival dates) to a recruitment partner in the candidate's country. In such cases we apply appropriate safeguards under Art. 46 GDPR – Standard Contractual Clauses of the European Commission (implementing decision 2021/914 of 4 June 2021) – or we act on the basis of the derogation in Art. 49(1)(a) GDPR (your informed consent after being fully informed of the risks). The relationship with the foreign partner is a controller–controller relationship, with each entity responsible for its own processing activities. In cases where Standard Contractual Clauses constitute the sole basis for the transfer, we carry out a Transfer Impact Assessment (TIA) in accordance with EDPB Recommendations 01/2020 issued in connection with the CJEU judgment in case C-311/18 Schrems II.
Under the GDPR, the data subject has the following rights:
To exercise these rights please contact: michal.matysiak@matysart.pl. We will respond without undue delay and no later than within one month of receiving the request (Art. 12(3) GDPR). In particularly complex cases, the deadline may be extended by a further two months, of which you will be informed with reasons.
If we received your data from a third party (e.g. a recruitment partner, employer, job offer portal) – within one month of receiving it we will send you information in accordance with Art. 14 GDPR, unless you have already received the necessary information from the disclosing entity.
The Controller uses appropriate technical and organisational measures to ensure the security of personal data, in particular (Art. 32 GDPR):
In the event of a personal data breach that may result in a risk to the rights and freedoms of natural persons, the Controller will notify the President of UODO within 72 hours (Art. 33 GDPR). In the case of a high risk – it will also inform the data subject (Art. 34 GDPR).
The Controller does not use automated decision-making or profiling within the meaning of Art. 22 GDPR that would produce legal effects or similarly significantly affect the data subject. Every decision to present a candidate to an end employer is taken by a human – a recruitment consultant of the Controller. We do not conduct remarketing, retargeting or analytical scoring of users.
The jobcen.pl website is addressed to adults – job candidates and employers. The Controller does not knowingly collect data of persons under 18 years of age. Employment of underage foreigners in Poland is subject to special restrictions under the Polish Labour Code (Chapter IX) and the Act on foreigners. If we find that data of a minor has been transmitted without the required consent of the legal guardian, it will be immediately deleted.
Providing personal data in the contact form is voluntary but necessary to respond to your inquiry. Failure to provide mandatory data (first name, e-mail, message content) will prevent us from contacting you back.
In the recruitment process for a specific position, providing the data listed in Art. 221 of the Polish Labour Code is necessary to carry out the recruitment process. In the legalisation of stay and work of a foreigner, providing the data required by the Polish Act on foreigners and the Employment Promotion Act is necessary to file an application with the relevant authority – failure to provide them prevents the service from being delivered.
The jobcen.pl website uses only strictly necessary data in the browser's localStorage (recording the user's acknowledgement of the cookie banner). No analytics, marketing or profiling cookies are used. Detailed information in a separate document: Cookie Policy.
The Controller reserves the right to update this Privacy Policy in the event of changes in legislation, technologies used on the site, or scope of activity. Users will be informed of material changes by a clear notice on the home page. The current version of the Policy is always available at the same URL. A historical version may be obtained upon request to the contact address.