CX Engineering sp. z o.o., ul. Przemysłowa 17, 32-083 Balice, NIP 513 02 61 026, hereinafter jointly referred to as Controller, is the Controller of your personal data, as applicable. 

How much personal data does the Controller process? 
The Controller, as a data controller for the purposes of the GDPR, processes in particular the following: 

• Applicants’ personal data (data provided by applicants to the Controller in connection with their application processes – in particular data contained in CVs) 
• Personal data of contractors and their representatives (data of companies* and their contacts – basic data for invoicing and accounting (name, NIP, business address) as well as for contact (name, surname, company name, position, e-mail address, telephone number)) 
• For enquiries sent via contact forms, e-mail and telephone (basic contact details (name, surname, e-mail address) provided by enquiries sent to the Controller)

Corporations’ data are considered personal data only if they allow identification of the subjects of the data. Data of limited liability companies is not considered as personal data. 

Under what conditions does the Controller process my personal data?  
The following presents the principles of the processing of your personal data (in particular, who holds access to it, how long it is stored and the basis for its processing). 

Personal data of the job applicants 

• Subject purposes and basis for data processing: Your personal data will be processed for the purposes of the recruitment process and/or for the purposes of future recruitment processes in the event of your consent (The basis for the processing of this data is the applicable legal regulations (in particular the Labour Code) and the consent you have given) 
• Data recipients: The data provided may be provided to entities authorised on the basis of legal regulations. Access to the data on the basis of relevant contracts may also be held by entities supporting the Controller in the field of services and IT infrastructure.
• Duration of data keeping: The personal data processed by the Controller will be stored until the end of the recruitment process or until the consent you have given is withdrawn in the case of processing for future recruitment processes. 
• Transfer of data outside the EEA: CX Engineering sp. z o.o. generally does not transfer data outside the European Economic Area (hereinafter EEA) , however, there may be situations where CX Engineering sp. z o.o. will use IT service providers whose servers may be located outside the EEA. In that case, the basis for data transfer will be the standard contractual clauses approved by the European Commission.
• Automated decision making / profiling: CX Engineering sp. z o.o. does not make decisions based on automated processing, including profiling (in relation to the purposes of data processing described above). 
• Voluntary / obligatory provision of data: The provision of personal data to the extent required by law, in particular the Labour Code, is mandatory, otherwise it is voluntary.

Personal data of contractors and their representatives 

• Data processing purposes and grounds: The personal data of contractors will be processed for the purpose of performing the agreements concluded between the parties (based on Article 6(1)(b) of the GDPR – processing is necessary for the performance of the agreements to which you are a party) and for the fulfilment of the obligations imposed on the controller under the applicable legal provisions (Based on Article 6(1)(c) of the GDPR – processing is necessary for the fulfilment of the legal obligation imposed on the Controller (in particular with regard to issuing and storing VAT invoices), resulting, i.a., from the Accounting Act and the VAT Act.
• The personal data of contractor representatives will be processed for contact purposes, including establishing and conducting business contacts (on the basis of Article 6(1)(f) GDPR – the legitimate interest of the controller to ensure contact with the contractor and to ensure the performance of contracts concluded with contractors) and also for the purposes of fulfilling the obligations imposed on the controller under the applicable legislation (Article 6(1)(c) GDPR).
• Personal data of contractors and their representatives may also be processed for the purpose of possible investigation and defence of claims (The basis for data processing is Article 6(1)(f) GDPR – the legitimate interest of the data controller to investigate and defend against claims). 
• Recipients of the data: The data may be made available to entities authorised by law. CX Engineering sp. z o.o. entities in the field of IT services (in particular hosting providers) may also have access to the data on the basis of relevant contracts.
• Holding period: Personal data of contractors and their representatives will be held for the period required by applicable law. Contact data of contractors’ representatives processed for the purpose of conducting business contacts will be stored until an objection to the processing of such data is raised.
• Transfers of data outside the EEA: CX Engineering sp. z o.o. generally does not transfer data outside the European Economic Area (hereinafter EEA) , however, there may be situations where CX Engineering sp. z o.o. uses IT service providers whose servers may be located outside the EEA. In that case, the basis for data transfer will be the standard contractual clauses approved by the European Commission.
• Automated decision-making / profiling: CX Engineering sp. z o.o. does not make decisions based on automated processing, including profiling (in relation to the purposes of data processing described above). 
• Voluntary/ obligatory provision of data: The provision of personal data is voluntary, however it is necessary to conduct business relations with CX Engineering sp. z o.o. and to perform the contracts between the parties.

Applicants sending enquiries via contact forms, e-mail and telephone 

• Data processing purposes and grounds: Personal data will be processed to carry out electronic correspondence and to execute actions taken at your request (The basis of processing is the legitimate interest of the data controller to carry out electronic correspondence and to execute actions taken at the request of data subjects).
• Recipients of the data: The data may be provided to entities authorised by law. Access to the data on the basis of relevant contracts may also be provided to the providers of infrastructure and IT services processing the data on behalf of CX Engineering sp. z o.o.
• Holding period: The personal data processed by the controller will be held for the duration of the electronic correspondence and thereafter, for archival purposes, for the period specified in the controller’s administrative instructions.  
• Transfer of data outside the EEA: CX Engineering sp. z o.o. generally does not transfer data outside the European Economic Area (hereinafter EEA) , however, there may be situations where CX Engineering sp. z o.o. will use IT service providers whose servers may be located outside the EEA. In this case, the basis for data transfer will be the standard contractual clauses approved by the European Commission.
• Automated decision-making / profiling: CX Engineering sp. z o.o. does not make decisions based on automated processing, including profiling (in relation to the purposes of data processing described above). 
• Voluntary/ obligatory provision of data: The provision of personal data is voluntary, however necessary for email correspondence or to undertake actions taken at your request.

When the Controller processes my personal data, what rights do I have? 
You have the right, as applicable, to: 

• exercise your right to access, rectification, erasure and restriction of processing of your personal data and to the carrying forward of your personal data (data portability);  
• withdraw your consent at any time. The withdrawal of consent, does not affect the lawfulness of the processing carried out on the basis of consent before its withdrawal. 
• object to the processing of your personal data   
• file a complaint to the supervisory authority (PUODO – President of the Office for Personal Data Protection)

For questions concerning the processing of my personal data and the exercise of my rights, who can I speak to? 
All enquiries and representations regarding the aforementioned rights should be addressed to the following:  

Contact details of the data controller:   
CX Engineering sp. z o.o.,
ul. Przemysłowa 17, 32-083 Balice,
NIP 513 02 61 026.  
E-mail address:  rodo@cxsa.pl 

Information about cookies 
Cookies: Our website https://www.cxe.pl/ uses cookies. These are small files stored in your web browser used for the following purposes:

• Optimisation – to facilitate the use of the Website (e.g. remembering to mark messages displayed on the Website)  
• Analytical – to create statistics based on which our Website may better adapt its content to the preferences of Users 
• Marketing – displaying advertisements to users which are tailored to their preferences (based on Article 6(1)(f) of the GDPR – the data controller’s legitimate interest in direct marketing – in the event that consent is given for the use of cookies)

In case you do not agree to the storing of cookies on your device, please change the setting of your Internet browser and/or block the operation of external cookies as described in the paragraph „External cookies” below.  

Restricting the use of cookies may affect some of the functionality available on https://www.cxe.pl/ 
External cookies: CX Engineering uses cookie/analogue technology solutions from the following third parties: 

• Google Ireland Limited – Google Adwords, Google Analytics – for analytical purposes. The user can block the use of their data in Google Analytics at any time here 
• Hotjar Ltd – HotJar – used for analytics purposes (anonymous analysis of user behaviour on the Website). The user can block the use of his/her data by HotJar at any time here. 
• Linkedin – for analytical and marketing purposes. The user can block the use of their Linkedin data at any time here.

Aforementioned solutions are used to tailor advertising to users’ preferences and for analytical purposes. Actions of Users within the website (e.g. the display of a specific subpage within the website) can be tracked by these solutions. On this basis, CX Engineering advertisements may be displayed to the User within the Linekdin advertising network.  

You can find more information about cookies in the „Help” section of your browser menu.