This Privacy Policy explains how the jobcen.pl website collects, uses, and protects personal data of individuals visiting the website, contacting us via the form, and candidates participating in recruitment processes conducted by our employment agency. The document has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), the Polish Electronic Communications Act of 12 July 2024 (PKE; Journal of Laws 2024, item 1221), the Act of 20 March 2025 on the Labour Market and Employment Services (Journal of Laws 2025, item 620), the Act of 20 March 2025 on the Conditions for the Admissibility of Entrusting Work to Foreigners in the Territory of the Republic of Poland (Journal of Laws 2025, item 621), and the Act of 12 December 2013 on Foreigners.
The data controller of personal data collected through the jobcen.pl website and in the course of services provided under the jobcen brand is:
We operate as an employment agency entered into the register of employment agencies under the Act of 20 March 2025 on the Labour Market and Employment Services (Journal of Laws 2025, item 620). We provide job placement, temporary work, process outsourcing, and support in the legalisation of stay and work of foreigners.
The data controller has not appointed a Data Protection Officer (DPO), as the conditions for mandatory appointment set out in Art. 37(1) GDPR are not met. Please direct all matters related to the protection of personal data to: office@jobcen.pl.
The contact section of the jobcen.pl website allows you to submit an inquiry as an employer, candidate or business partner.
| Data | Requirement |
|---|---|
| First name | Required |
| Email address | Required |
| Phone number | Optional |
| Role (employer / candidate / partner) | Required |
| Message content | Required |
| Declaration of having read the Privacy Policy (contact form) | Required |
An application to the candidate database is submitted via the application wizard available at jobcen.pl/en/apply/. When submitting an application, the candidate:
The Privacy Policy appears with the application as an informational reference (Art. 13 GDPR), and not as the subject of consent.
The contact form is sent using the HTTP POST method to the Data Controller's server backend (PHP script contact.php), running on hosting infrastructure located in the territory of the Republic of Poland (European Economic Area). The data are subject to server-side validation, are saved in an operational log and sent to the Data Controller's mailbox via the SMTP protocol.
From a person applying for job search, we collect the data indicated in the application form: first name and surname, date of birth, citizenship, passport details, contact details (email address, phone number), professional work history and documents confirming qualifications, including scans of these documents. The documents are optional; the application will also be accepted without them and they can be sent later (§ 3(1) of the Terms of Service).
For the purposes of the process of legalising the stay and work of foreigners (work permits, residence card, declarations of entrusting work), the Data Controller additionally processes data required by the provisions of the Act of 12 December 2013 on Foreigners and the Act of 20 March 2025 on the conditions for the admissibility of entrusting work to foreigners in the territory of the Republic of Poland (Journal of Laws 2025, item 621) and implementing provisions (including passport number, country of passport issuance, citizenship, place of stay, residence status, documents of registration with Polish offices). This scope results directly from the official forms of the Voivodeship Office and the Office for Foreigners.
We do not collect data concerning health, religion or criminal record. If such information appears in a submitted document (for example, a note in a document confirming qualifications), we treat it solely as an element of the candidate's entitlements; a document submitted on one's own initiative that concerns health, religion or criminal record is deleted.
Full information on the processing of the candidate's data, prepared in accordance with Art. 13 and Art. 14 GDPR, is versioned and available at apply.jobcen.pl/informacja/jobcen/en, and for applications submitted by a recruitment partner at apply.jobcen.pl/informacja/jobcen/partner/en.
The backend of the contact form implements a five-layer protection mechanism preventing abuse:
The entire transmission path is encrypted using the HTTPS/TLS protocol. The indicated measures implement the obligation to select "appropriate technical and organisational measures" under Art. 32 GDPR and support the principle of accountability (Art. 5(2) GDPR).
The server hosting the jobcen.pl website automatically records technical data about the visit: IP address, TLS session identifier, browser and operating system type (User-Agent), date and time of the request, URL of the requested resource and referring page (Referer). These data are processed solely for purposes related to the security of the website and technical diagnostics, on the basis of the Data Controller's legitimate interest (Art. 6(1)(f) GDPR, Recital 49 of the GDPR).
| Purpose | Categories of data | Legal basis |
|---|---|---|
| Response to an inquiry submitted via the contact form | First name, email, telephone, role, content | Art. 6(1)(b) GDPR (steps prior to entering into a contract at the data subject's request); Art. 6(1)(f) GDPR (response to an inquiry not aimed at concluding a contract and the inquiry log - accountability and security) |
| Assessment of the application, completion of documents and presentation of the candidacy to employers | Data from the application (qualifications, documents) | Art. 6(1)(b) GDPR (performance of the job search contract concluded by submitting the application or, where the application is submitted by a recruitment partner, upon its acceptance - Terms of Service § 3) |
| Job search and storage of the application in the candidate database for the selected period (6, 12 or 24 months) | Data from the application | Art. 6(1)(b) GDPR (the period is a service parameter, not consent) |
| Contact regarding the application (missing documents, deadlines, decisions) | Contact data | Art. 6(1)(b) GDPR |
| Matching and sending job offers matching the application | Contact data | Art. 6(1)(b) GDPR; consent to the contact channel – Art. 398(2) PKE |
| Obligations of the employment agency (annual information for the marshal of the voivodeship – aggregate data only) | Aggregated data (without identifying data): citizenship and occupation of persons who took up employment | Art. 6(1)(c) GDPR in conjunction with Art. 323 of the Act of 20 March 2025 on the Labour Market and Employment Services |
| Tax, accounting and insurance obligations (invoices, tax office, ZUS) | Identification data | Art. 6(1)(c) GDPR in conjunction with the Accounting Act, the Tax Ordinance Act and the Act of 13 October 1998 on the social insurance system |
| Establishing the candidate's travel history and previous visa cases | Passport data | Art. 6(1)(f) GDPR (reliable assessment of the chances of the visa case and protection against an allegation of misleading the authority) |
| Conclusion and performance of a cooperation agreement with an employer | Contact data of the employer's representative | Art. 6(1)(f) GDPR (legitimate interest: conclusion and performance of a contract with the employer represented by that person); where the employer is a natural person - Art. 6(1)(b) GDPR |
| Website security, protection against abuse | Server logs (IP, User-Agent) | Art. 6(1)(f) GDPR (legitimate interest: security and diagnostics of the website; measures under Art. 32 GDPR described in sections 3.3 and 9) |
| Pursuing or defending against claims | Data from correspondence and contracts | Art. 6(1)(f) GDPR (legitimate interest: defence against claims and pursuit of own claims) |
We send job offers matching the application to the provided email address and the provided telephone number (by phone or SMS). Providing the email address and telephone number in the application constitutes consent to receive matched job offers via these channels (Art. 398(2) of the Polish Electronic Communications Act); the matching and presentation of offers itself constitutes the content of the service and is carried out on the basis of Art. 6(1)(b) GDPR. Consent to the channel may be withdrawn at any time by writing to office@jobcen.pl or by replying STOP to an SMS; withdrawal does not stop messages concerning your own application, but it prevents the presentation of job offers. Commercial information about other services requires separate consent. If you submitted the application through a recruitment partner, we collect consent to the contact channel through that partner and confirm it in the first message to you.
For the selected period (6, 12 or 24 months), we retain the application together with contact data, information on experience and qualifications, and basic document data (number, country of issue, expiry dates) – without scans, which we delete earlier, under the rules described above. After the period expires, we delete or anonymise the data; documentation that legal provisions require to be retained is retained solely for the purpose arising from them.
After the retention period expires, the data is deleted or anonymised in a manner preventing its reconstruction.
Personal data may be disclosed only to the following categories of recipients:
The data controller does not sell personal data to third parties. It does not use analytics tools (Google Analytics) or marketing tools (Meta Pixel), nor does it conduct remarketing. Web fonts (Inter, Space Grotesk) are hosted on the data controller's server (self-hosting), so the mere display of the website does not transfer data to font providers or CDN networks.
We accept candidate applications from various countries - including Asia (among others, the Philippines, Indonesia, Vietnam, India, Bangladesh, Nepal), Africa (among others, Kenya, Egypt), Moldova and Eastern Europe (Ukraine, Belarus, Georgia). We receive them through the form on the website, e-mail or from our recruitment partners in the candidate's country of origin.
We process data in Poland and in the European Union - the servers, hosting and the Data Controller's recruitment system (apply.jobcen.pl) are located in the EEA. Access to data is held exclusively by our employees and processors acting on our instructions.
Backups outside the EEA. We store backups of the mailbox and document scans in the Google Workspace service (Google Drive), whose provider is Google LLC with its registered office in the United States. Google LLC is covered by a European Commission adequacy decision (EU-US Data Privacy Framework, Art. 45 GDPR).
Providers outside the EEA. Some providers of electronic mail, IT services and artificial intelligence services that we use are established outside the European Economic Area or may store data there - in particular in the United States. We transfer data to them only where the provider is covered by a European Commission adequacy decision (EU-US Data Privacy Framework, Art. 45 GDPR) or where we are bound to that provider by Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR). A copy of these clauses may be obtained by writing to office@jobcen.pl. In a country not covered by an adequacy decision, the exercise of data-related rights may be more difficult than in the EEA.
Situation of a candidate located outside the EEA. The situation in which you - as a candidate from a country outside the EEA - send us your data directly (form, e-mail) from a device located in your country of residence, does not constitute a transfer of data outside the EEA within the meaning of Chapter V of the GDPR. As a data subject, you provide the information to the data controller in Poland, and we receive it in the EEA. This position is confirmed by the Guidelines 05/2021 of the European Data Protection Board on the interplay between Art. 3 and Chapter V of the GDPR.
Foreign partner. If a candidate provides data through a recruitment partner abroad, that partner is a separate data controller of its own records and is responsible for them in accordance with the law of its country. Only applications of candidates who have consented to contact with a Polish employment agency reach us. We provide the partner's name and the country in which it operates in the first message to the candidate.
Exceptional situations - transfer of a limited scope of data outside the EEA. If a candidate has applied through a recruitment partner cooperating with us, we provide that partner - for onward transmission to the candidate - only with information on the status of their case and on deficiencies in documents. If the country in which the partner operates is outside the European Economic Area and the European Commission has not found an adequate level of data protection for it, the exercise of data-related rights may be more difficult there than in the EEA, and we provide information on the status of the case to such partner only with the candidate's explicit consent (Art. 49(1)(a) GDPR): we collect consent through the partner upon application and confirm it in the first message to the candidate. The candidate may withdraw it at any time by writing to office@jobcen.pl; in that case, in the recruitment matter we contact only the candidate directly, and we do not transfer anything further to the partner. If the partner's country belongs to the European Economic Area or is covered by a European Commission adequacy decision, the transfer of the case status takes place on that basis, without additional consent for the transfer. The relationship with the foreign partner is controller-to-controller; each entity is responsible for its own processing activities. When we conclude with the partner Standard Contractual Clauses adopted by the European Commission (European Commission Implementing Decision 2021/914 of 4 June 2021), we will carry out a transfer impact assessment (Transfer Impact Assessment) in accordance with EDPB Recommendations 01/2020 issued in connection with the CJEU judgment in Case C-311/18 Schrems II.
Under the GDPR, the data subject whose data are processed has the following rights:
Some of these rights may be exercised only in the situations described in the GDPR – for example, we do not delete documents that we must retain under legal provisions; if we are unable to comply with a request, we will explain why.
To exercise the above rights, please contact: office@jobcen.pl (address for personal data matters) or michal.matysiak@matysart.pl. A response will be provided without undue delay, no later than within one month of receipt of the request (Art. 12(3) GDPR). In particularly complex cases, the period may be extended by a further two months, of which the user will be informed together with the reasons.
If we received your data from a third party (e.g. a recruitment partner, employer, job offer portal) – we will send you information in accordance with Art. 14 GDPR at the latest within one month of receiving the data, upon first contact with you or upon first disclosure of the data to another recipient, whichever occurs first.
The Data Controller applies appropriate technical and organisational measures ensuring the security of personal data, in particular (Art. 32 GDPR):
In the event of a personal data breach which may result in a risk to the rights or freedoms of natural persons, the Data Controller shall report the breach to the President of the Personal Data Protection Office (UODO) within 72 hours (Art. 33 GDPR). In the event of a high risk – it shall also inform the data subject (Art. 34 GDPR).
In our work on applications, we are assisted by artificial intelligence tools: they read the content of documents, compare it with the requirements of the position (required qualifications, completeness and validity of documents) and identify deficiencies. Such automated comparison constitutes profiling within the meaning of the GDPR, but it serves exclusively to prepare the matter for a human and does not determine anything. We use only services whose terms exclude the use of the data provided for training models and which process data on our instructions.
Any decision concerning a candidate – whether the application is complete and whether we present the candidacy to the employer – is made by a human; an indication by the tool is a suggestion and does not by itself produce any effects for the candidate. We do not make decisions concerning a candidate solely by automated means within the meaning of Art. 22 GDPR. The tools are not intended for biometric identification and do not analyse emotions, voice or personality traits. We do not carry out remarketing, retargeting or analytical scoring of users.
The jobcen.pl service is addressed to adults – job candidates and employers. The data controller does not knowingly collect data of persons under 18 years of age. An application submitted by a person who has not reached the age of 18 is not accepted; if we determine that we have received data of a minor, we promptly delete it.
The provision of personal data in the contact form is voluntary, but necessary to respond to an inquiry. Failure to provide mandatory data (first name, e-mail, role, message content) will make return contact impossible.
The provision of data in an application is not a statutory obligation, but is a condition for the conclusion and performance of a job search contract: without the data marked in the form as required, we will not assess the application or present the candidacy; the remaining data are optional. Documents required for a work permit depend on the candidate's situation and the position. Data required in proceedings for a work or residence permit arise from the Act of 12 December 2013 on Foreigners and the Act of 20 March 2025 on the conditions for the admissibility of entrusting work to foreigners in the territory of the Republic of Poland (Journal of Laws 2025, item 621) – failure to provide them makes it impossible to submit an application to the competent office.
The jobcen.pl website uses only strictly necessary data in the browser's localStorage mechanism (recording the user's decision regarding acknowledgement of the cookie information). Analytical, marketing or profiling cookies are not used. Detailed information is provided in a separate document: Cookie Policy.
The data controller reserves the right to update this Privacy Policy in the event of changes to legal provisions, technologies used on the website, or the scope of its activities. Users will be informed of material changes by means of a clear notice on the Home page. The current version of the Policy is always available at the same URL. Version 1.0 of 31.08.2026 remains available at the archival address polityka-prywatnosci-1.0-2026-08-31.html; earlier historical versions may be obtained upon a request sent to the contact address.