xcactus - Privacy Policy

Personal data Administrator

The administrator of personal data (hereinafter referred to as: "Administrator") is xcactus spółka z ograniczoną odpowiedzialnością spółka komandytowa, Poznań (61-612) Rubież 46.

Contact with us is possible via e-mail: info@xcactus.com or traditional mail: xcactus sp. z o.o. sp.k., ul. Rubież 46, 61-612 Poznań.

2. Purpose for data processing

We use the personal data obtained only for specific, legitimate purposes for which the data was collected. We take care to keep them up-to-date and correct, and we promptly respond to requests for their update. All Users' rights provided for in the provisions of the GDPR are implemented by us. The storage of Personal Data in accordance with the law is limited only to the period necessary to achieve the purposes for which they are collected. We protect Users' Personal Data against loss, unauthorized access or change, and other unlawful forms of processing.

3. Principles of processing Personal data

The scope of personal data, the purpose of their processing, the legal basis for such processing, the processing period and categories are described below.

3.1. Contact form and email

Data processing takes place when you contact us using an e-mail or traditional mail address. The response to your application requires us to process your data, such as: name, surname, email address and information contained in the correspondence along with its subject. The legal basis is Art. 6 par. 1 lit. b) GDPR (taking action at your request, i.e. answering your question, contact request sent by you using the form on the website or via e-mail). Data transfer is voluntary. Personal data is stored for the period of limitation of claims resulting from legal provisions, when a complaint, demand, etc. is reported in the case (as a rule, 3 years, maximum 6 years from the date of termination of the relationship or contract), unless there is another legal basis for further processing, e.g. processing of data by us in the scope of considering possible complaints or requests and meeting the accountability principle referred to in art. 5 sec. 2 GDPR.

3.2. Communication using social networks

This includes communication via social networks (for example, responding to comments, messages, etc.). The legal basis is Art. 6 par. 1 lit. f) GDPR ("legitimate interests of the Administrator"). Data transfer is voluntary. The data is stored for the duration of the legitimate interest pursued by the Administrator (as a rule, 3 years, maximum 6 years from the date of termination of the relationship or contract).

3.3. Sending an offer and providing services

The Administrator sends information related to its offer, as well as provides services via the Website to persons who have provided their email address for this purpose and have agreed to the provision of electronic services. Providing Personal Data to receive information regarding the Administrator's offer or service performance is voluntary. The Administrator sends such information only if the User has given consent, which may be withdrawn at any time without affecting the lawfulness of the processing carried out before its withdrawal. The legal basis is Art. 10 sec. 2 of the Act of 18 July 2002 on the provision of electronic services (i.e. Journal of Laws 2020, item 344) and art. 172 sec. 1 of the Act of July 16, 2004 Telecommunications Law (i.e. Journal of Laws 2019, item 2460) and art. 6 sec. 1 lit. b GDPR and Art. 6 sec. 1 lit. f GDPR. The data is stored for the duration of the legitimate interest pursued by the Administrator, or until the objection to further processing of personal data for marketing purposes is expressed (Article 21(3) of the GDPR). The data subject will object to the processing of his data for direct marketing purposes, the Administrator will no longer process his data for this purpose.

3.4. Managing Cookies

Cookies are small files stored on your computer or mobile device (phone, tablet, etc.). They have unique identifiers assigned to your device and allow the website to remember your actions and preferences over time (for example: location or language). The legal basis is Art. 6 par. 1 lit. a) GDPR (your consent to processing). The data is stored until the data subject withdraws his consent to further processing of his personal data. Providing data is not a requirement, but the lack of consent to provide them may limit selected functionalities of the Website.

3.5 Recruitment process

As part of the recruitment processes, we will process your Personal Data provided in the application form available on our Portal, such as: name, surname, telephone number, email address, position name, as well as documents attached by you (e.g. curriculum vitae). We do this to assess your qualifications as a candidate for the position of your choice. The legal basis is Article 6 para. 1 lit. c) GDPR ("legal obligation of the administrator"), Labor Code, Article 6 para. 1 lit. a) GDPR and Article 9 para. 2 lit. a) GDPR ("consent of the data subject"). The data is stored for up to 6 months from the end of recruitment. Providing them is a statutory requirement, and failure to provide them prevents you from participating in the recruitment process.

3.6. Determining, defending and pursuing claims raised by or against the Administrator

The Administrator processes Users' Personal Data to establish, pursue or defend against claims, such as: name, surname, email address, information on consents given or other data necessary to prove the existence of a claim or the extent of the damage suffered. The legal basis for the processed Personal Data is the Administrator's legitimate interest in establishing, pursuing, or defending claims before the competent courts and state authorities (Article 6(1)(f) of the GDPR). The data is stored for the period after which the claims arising from the contract expire, for the time during which the Administrator may suffer the legal consequences of failure to perform the obligation, in the event of the Administrator pursuing claims in court proceedings.

4. Rights related to the processing of Personal Data

If consent is necessary to be able to process Personal Data for a specific purpose, the Administrator obtains such consent. The consent given may be withdrawn at any time by contacting the Administrator. In the event of withdrawal of consent, the data will no longer be processed to the extent to which the consent concerned. However, withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal. Consent to the processing of personal data is not always required. Consent to data processing is not required if any other condition legalizing their processing is met in accordance with Article 6(1) of the GDPR. On the terms set out in the GDPR, you also have the following rights: the right to request the administrator to access your personal data processed by the Administrator, the right to rectify this personal data, the right to delete personal data or to limit their processing (unless there are legally justified grounds for further processing), the right to object to processing, the right to transfer this personal data. If your personal data is processed for direct marketing purposes, you can object to the processing of this data for this purpose at any time. If you want to exercise the above rights, you should submit a request to the Administrator, who may ask for additional information confirming the identity of the submitter. The Data Administrator is obliged to provide relevant information in writing. The provisions of the GDPR specify to what extent each of these rights can be exercised. This will depend on the legal basis and purpose of personal data processing by the Administrator. You also have the right to lodge a complaint with the supervisory body, i.e., the Office for Personal Data Protection, if you believe that the processing of your Personal Data is in violation of the law.

5. Recipients of Personal Data

Personal data may be disclosed to external entities, including suppliers responsible for servicing IT systems and equipment, entities providing postal, courier and similar services, marketing agencies and selected entities acting on behalf of the Administrator in handling accounting, consulting, translation, or legal matters into the extent necessary to achieve a specific purpose of processing.

6. Amendments

If, as part of the processing, Users' Personal Data will be transferred to recipients in third countries outside the EEA (European Economic Area), such transfer will take place based on the requirements set out by the European Commission or based on the User's explicit consent. We reserve the right to make changes to this Privacy Policy. This may result from the need to adapt to changes in the law, applicable privacy standards and others, which will be properly communicated. The website may contain references (links) to other websites. They operate independently of the Administrator's Website and are not supervised by him. It is recommended after going to such a website to read its privacy policy. The Website Administrator is not responsible for the rules of handling data on these websites.