DATA CONTROLLER The controller of your personal data is PROTON Tomasz Lisowski, with its registered seat at ul. Karola Dickensa 31A, lok. 26B, 02-382 Warsaw, Poland, Tax ID (NIP): 9661457646, REGON: 200342208 (hereinafter referred to as the “Controller”). For all matters relating to personal data protection, you may contact us at: t.lisowski@protonconsulting.pl.

PURPOSES AND LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA Your personal data will be processed for the following purposes:

1. Selection of candidates for vacant positions in the current recruitment process – pursuant to the provisions of the Polish Labour Code (Article 22¹ § 1 and § 2) – legal basis: Article 6(1)(c) GDPR (compliance with a legal obligation); and, where you provide data beyond the scope required by the Labour Code, on the basis of your consent – Article 6(1)(a) GDPR.
2. Conducting future recruitment processes – only if you give separate consent for your data to be processed for future recruitments – legal basis: Article 6(1)(a) GDPR.

We kindly ask you not to include information about your health or attach any medical documents in your application. Should you provide such special-category data, we will request additional explicit consent for its processing.

DATA RETENTION PERIOD Your personal data will be stored:

1. For the purpose of the current recruitment process – until the completion of the recruitment procedure, after which the data will be deleted.
2. For the purpose of future recruitments – until you withdraw your consent, but no longer than 18 months from the date consent was given. After this period, the data will be deleted even if consent has not been withdrawn.

CATEGORIES OF DATA RECIPIENTS Your personal data may be disclosed to the following categories of recipients:

• Legal advisers and other entities providing advisory or legal services to the Controller;
• IT service providers and e-mail hosting providers acting on behalf of the Controller;
• Entities on whose behalf the Controller conducts the recruitment;
• Other entities where disclosure is necessary to achieve a specific processing purpose.

YOUR RIGHTS In connection with the processing of your personal data, you have the right to:

• Access your personal data;
• Rectify your personal data;
• Erase your personal data or restrict its processing;
• Withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal (withdrawal may be made in person at the Controller’s seat, by post, or by e-mail to: t.lisowski@protonconsulting.pl).

RIGHT TO LODGE A COMPLAINT If you believe that your personal data are being processed unlawfully, you have the right to lodge a complaint with the supervisory authority: President of the Personal Data Protection Office (Urząd Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, https://www.uodo.gov.pl/.

REQUIREMENT TO PROVIDE DATA AND CONSEQUENCES OF FAILURE TO PROVIDE DATA Providing personal data to fulfil the Controller’s legal obligations is a statutory requirement. For all other purposes, providing personal data is voluntary but necessary for participation in the recruitment process and for the conclusion/execution of any future employment contract. Failure to provide the data will result in the inability to achieve the above purposes.