Privacy Policy and Cookie Policy – ATLAS WORK

I. Privacy Policy

1. Personal data controller

The controller of your personal data is ATLAS WORK spółka z ograniczoną odpowiedzialnością (a limited liability company) with its registered office in Marki (05-270), ul. Fabryczna 89, entered in the register of entrepreneurs of the National Court Register under KRS number 0000637747 and in the register of employment agencies under KRAZ number 15010 (the “Controller” or “ATLAS WORK”).

2. Contact in matters of personal data

In matters concerning the processing of personal data and the exercise of your rights, you can contact the Controller:

  • by e-mail at: gdpr@atlaswork.pl (a dedicated address for personal data protection matters, GDPR),

  • in general matters by e-mail at: kontakt@atlaswork.pl,

  • by post at the registered office address: ATLAS WORK sp. z o.o., ul. Fabryczna 89, 05-270 Marki.

The Controller responds to requests without undue delay, and at the latest within one month of receiving the request (Article 12(3) GDPR); where necessary, this period may be extended by a further two months, of which the Controller will inform you within the first month. The Controller has not appointed a data protection officer; all matters concerning personal data can be addressed to gdpr@atlaswork.pl.

3. Legal basis and definitions

This policy has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”), the Act of 10 May 2018 on the Protection of Personal Data, the Act of 18 July 2002 on the Provision of Services by Electronic Means, and the Act of 12 July 2024 – Electronic Communications Law.

The terms used in this policy mean:

  • personal data – any information relating to an identified or identifiable natural person (e.g. name and surname, telephone number, e-mail address, IP address, social media user identifier),

  • processing – any operation performed on personal data, e.g. collection, recording, storage, use, disclosure, erasure,

  • website – the service available at atlaswork.pl,

  • social media profiles – the official ATLAS WORK profiles on Facebook and Instagram,

  • user – any person who uses the website, contacts the Controller, or comments on content on its social media profiles.

4. What data we process

Depending on how you contact us, we may process in particular:

  • telephone number, name and surname, company name, e-mail address – provided in contact forms, in messages or during telephone calls,

  • IP address and technical information about the device and browser, which may also be stored in cookies and server logs,

  • public identifier, username and the content of comments left on our Facebook and Instagram profiles (details in the section “Comments and messages on social media (Facebook and Instagram)” of this policy),

  • data contained in documents submitted in connection with recruitment or cooperation (e.g. identification and contact data, information on professional experience), if you send them to us.

Providing data is voluntary, but in some cases it is necessary to reply to you, carry out recruitment, or conclude and perform a contract. We do not ask for special categories of data (Article 9 GDPR) unless required by law; please do not provide them in forms and comments.

Purposes, legal bases and data retention periods

Below we indicate for what purposes we process data, on what legal basis (Article 6 GDPR), and how long we keep it.

5. Purposes and legal bases of processing

  • Replying to enquiries and communication about services (form, e-mail, telephone, messages on social media) – basis: for the contact form – Article 6(1)(a) GDPR (consent given by ticking the relevant box in the form), and in other communication channels – Article 6(1)(b) GDPR (taking steps at the request of the data subject prior to entering into a contract) and Article 6(1)(f) GDPR (the Controller’s legitimate interest in communicating with persons interested in the offer).

  • Recruitment and employment intermediation – basis: Article 6(1)(b) GDPR (steps prior to entering into a contract and performance of a contract) and, to the extent resulting from legal provisions, Article 6(1)(c) GDPR; for data going beyond the scope specified in labour law – Article 6(1)(a) GDPR (consent), if given. Consent to participation in future recruitment can be withdrawn at any time.

  • Performance of a contract (including service contracts and contracts with clients and contractors) – Article 6(1)(b) GDPR.

  • Own marketing and analytics (visit statistics, improving content and offer, direct marketing of our own services) – Article 6(1)(f) GDPR (the Controller’s legitimate interest); as regards cookies and similar technologies necessary for the website to function – without consent (Article 399(3) of the Electronic Communications Law), whereas analytical and marketing cookies require your consent (Article 6(1)(a) GDPR in conjunction with Article 399(1) of the Electronic Communications Law). We carry out direct marketing by means of telecommunications terminal equipment (including e-mail, telephone, SMS) only with your prior consent (Article 398 of the Electronic Communications Law).

  • Security of the website and systems, preventing abuse and spam – Article 6(1)(f) GDPR.

  • Handling comments on social media, including automatic replies and moderation – Article 6(1)(f) GDPR (see the section “Comments and messages on social media” below).

  • Archiving, accounting, fulfilment of legal obligations (tax, accounting, and obligations arising from the Act of 20 March 2025 on the Conditions for Permitting the Entrusting of Work to Foreigners in the Territory of the Republic of Poland and the Act of 20 March 2025 on the Labour Market and Employment Services) – Article 6(1)(c) GDPR.

  • Establishing, pursuing and defending against claims – Article 6(1)(f) GDPR.

Where the basis for processing is the Controller’s legitimate interest, you have the right to object (see the section on data subjects’ rights).

6. Data retention periods

We keep data for the period necessary to achieve the purposes for which it was collected, and afterwards for the period resulting from legal provisions or the limitation period for claims:

  • enquiries and correspondence (contact form, e-mail) – until a reply has been given and the correspondence has ended; if cooperation follows – for the duration of the contract and then until the limitation period for claims expires,

  • contract and cooperation data – for the duration of the contract and the limitation period for claims under the Civil Code (as a rule 3 or 6 years, and for employment-law claims – in accordance with the Labour Code),

  • accounting and tax documents – for the period required by law (as a rule 5 years counted from the end of the calendar year in which the tax obligation arose),

  • recruitment documents – until the recruitment process is completed, and where consent to future recruitment has been given – until it is withdrawn, but no longer than 12 months from the collection of the data,

  • comments on social media – technical data relating to the handling of a comment (comment and user identifier, information about the reply given) is kept for up to 90 days from the processing of the comment; the application’s technical log (which contains, among other things, the username) covers a limited number of the most recent events and is continuously overwritten; the content of the comment itself remains available for as long as it remains published on the platform,

  • server logs and technical data – for no longer than 12 months,

  • data processed on the basis of consent – until the consent is withdrawn,

  • data processed on the basis of a legitimate interest – until an effective objection is lodged or the interest ceases.

After the indicated periods have elapsed, data is deleted or anonymised.

Data recipients and transfers outside the EEA

7. Data recipients

Your data may be entrusted or disclosed to entities providing services to the Controller, in particular in the following areas: IT support and hosting, e-mail and communications, courier and postal services, accounting, banking, legal and advisory services, and administration. Data may also be disclosed to public authorities where such an obligation arises from legal provisions.

Entities processing data on our instructions (processors) act under a data processing agreement in accordance with Article 28 GDPR (including standard data processing agreements offered by providers); providers acting as separate controllers (e.g. Meta) process data under their own terms and privacy policies. In connection with our activities we use, in particular, the following providers:

  • Meta Platforms Ireland Limited (Facebook and Instagram) – the platform on which we run our profiles and from which we handle comments; Meta is also a separate controller of its users’ data, and the principles of its processing are described in Meta’s privacy policy,

  • Mindee SAS (France) – an automatic document content recognition (OCR) service used to read data from documents submitted to us in the recruitment and work legalisation process,

  • OpenAI (OpenAI Ireland Ltd. / OpenAI, L.L.C., USA) – the provider of the language model used for automatic assessment of the content of comments on social media (detecting hostile, offensive or unwanted comments); only the content of the comment is passed to OpenAI, without the username,

  • Vercel Inc. (USA) – hosting and infrastructure of the application handling comments and of the website,

  • Upstash, Inc. – the database (Redis) storing technical data necessary for the automatic handling of comments to work,

  • Zoho Corporation / Zoho Corporation B.V. – a CRM system and system for managing relations with candidates and clients,

  • Make (Celonis, Inc. / Celonis s.r.o.) – a process automation platform that we use to transfer data between systems,

  • providers of e-mail, website hosting, analytical and marketing tools, and accounting offices and law firms – to the extent necessary for them to provide their services.

The current list of recipients is available on request at gdpr@atlaswork.pl.

8. Transfers of data outside the European Economic Area

Some of the providers listed above (in particular Vercel, Upstash, OpenAI, Zoho, Make and Meta) process or may process data outside the European Economic Area, in particular in the United States.

Such a transfer takes place with appropriate safeguards in place, i.e. on the basis of:

  • a decision of the European Commission finding an adequate level of protection (Article 45 GDPR), including the Transatlantic Data Privacy Framework (EU–U.S. Data Privacy Framework) in respect of U.S. entities participating in that programme, or

  • standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR), supplemented where necessary by additional measures.

You have the right to obtain a copy of the safeguards applied and information on where they are made available by contacting us at gdpr@atlaswork.pl.

Comments and messages on social media (Facebook and Instagram)

9. Rules for handling comments on ATLAS WORK profiles

We run ATLAS WORK profiles on Facebook and Instagram, where we publish content and advertisements (including sponsored ones) concerning work. When you comment on our posts, we process your data as follows:

  • scope of data: user identifier and username, content and date of the comment, post identifier, and information on whether and when we replied to the comment,

  • automatic replies: to respond quickly to people interested in the offer, we give automatic replies to comments using our own software. The reply is linked solely to the fact that a comment was published and has no legal or similarly significant effects on you within the meaning of Article 22 GDPR. As a rule, we reply to a given user once per post,

  • moderation and security: comments are automatically checked for spam, profanity and hostile or offensive content. For the assessment we use a language model (AI) supplied by OpenAI – the content of the comment is passed on, without the username. The result of the analysis may lead to the comment being hidden or deleted. If you believe that your comment was hidden or deleted without justification, write to gdpr@atlaswork.pl – the matter will be considered by a human,

  • legal basis: Article 6(1)(f) GDPR – the Controller’s legitimate interest in efficient communication with persons interested in the offer, in protecting the profiles against spam and content that infringes the law or platform rules, and in ensuring security,

  • retention period: see the section “Data retention periods” above.

Meta Platforms Ireland Limited is a separate controller to the extent that it processes data within its own services (Facebook, Instagram). As regards data related to the operation of our profiles (statistics, activity indicators), the Controller and Meta may be joint controllers (so-called Page Insights) – you will find information on this in Meta’s documentation. Please read Meta’s privacy policy in relation to your use of Facebook and Instagram.

10. Private messages

If you send us a private message on Facebook or Instagram, we use its content solely to reply and to handle your matter (Article 6(1)(b) and (f) GDPR). Private messages are not handled by the automatic replies to comments described above.

Rights of data subjects

11. Your rights

Under the GDPR you have:

  • the right of access to data (Article 15 GDPR) – to obtain confirmation of whether we process your data, and a copy of that data together with information on the purposes, recipients and retention period,

  • the right to rectification of data (Article 16 GDPR),

  • the right to erasure of data (“right to be forgotten”, Article 17 GDPR), where there are no grounds for further processing,

  • the right to restriction of processing (Article 18 GDPR),

  • the right to data portability (Article 20 GDPR) – where we process data on the basis of consent or a contract and by automated means,

  • the right to object (Article 21 GDPR) to processing based on a legitimate interest, including to direct marketing – at any time, and in the case of direct marketing without having to give reasons,

  • the right to withdraw consent at any time, where processing is based on it – without affecting the lawfulness of processing carried out before the withdrawal of consent (Article 7(3) GDPR),

  • the right to lodge a complaint with a supervisory authority – the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), if you consider that the processing infringes the GDPR.

12. How to exercise your rights and how to have data deleted

To exercise your rights, including to ask for the deletion of data collected in connection with comments on social media, write to gdpr@atlaswork.pl. So that we can identify your data, give your username or a link to the comment, together with the information needed to verify your identity (we do not ask for identity documents unless necessary). We handle requests without undue delay, and at the latest within one month.

You can also delete or edit content published on Meta platforms yourself directly on Facebook and Instagram; if you delete a comment, it ceases to be visible on the platform; technical data relating to its handling is deleted after the periods indicated in the section “Data retention periods”, and earlier on your request.

13. Automated decision-making and profiling

The Controller does not take decisions concerning you based solely on automated processing, including profiling, which would produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). The automatic assessment of comments described in the section on social media concerns only the moderation of content published on the profiles, and any disputed decision can be reviewed by a human.

II. Contact forms and server logs

14. Contact forms

Data provided in the contact forms on atlaswork.pl is used solely to reply to your enquiry (Article 6(1)(a) GDPR – consent given by ticking the box in the form – and, to the extent necessary to take steps prior to entering into a contract, Article 6(1)(b) GDPR). After a reply has been given, the data is deleted, unless you become our client or a candidate in a recruitment process – further processing then takes place on the terms described in Part I of this policy (purposes, legal bases and retention periods). Before sending a form, please read this policy; by sending a form you do not consent to marketing – any marketing consents are collected separately and voluntarily.

15. Server logs

Using the website involves sending requests to the server on which it is hosted. Every request to the server is recorded in the server logs. The logs contain, among other things, the time the request arrived, the time the response was sent, information about the web browser and operating system, the address of the page from which the user was redirected (referer), and the IP address.

The Controller does not link server log data with the data of specific persons using the website and does not use it for identification, except where this is necessary to clarify a security incident or abuse. This data serves only for server administration, diagnostics, ensuring security and detecting abuse (Article 6(1)(f) GDPR), and is kept for no longer than 12 months.

III. Cookie Policy

16. What cookies are

Cookies are small text files saved on your device (computer, phone, tablet) by the browser when you use the website. We use them to personalise content and generate statistics. Cookies may be placed by the Controller (first-party cookies) or by its partners and tool providers (third-party cookies). In connection with their use, device identifiers and the IP address, among other things, may be processed.

17. Types of cookies and legal basis

  • necessary – ensure the correct operation and security of the website (e.g. remembering your cookie choices); installed without consent on the basis of Article 399(3) of the Electronic Communications Law and Article 6(1)(f) GDPR,

  • statistical (analytical) – help us understand how visitors use the website and improve its content; installed only after you give your consent,

  • marketing and personalising – used to tailor content and advertisements; installed only after you give your consent.

When you first visit the website, we display a banner in which you can accept or reject cookies other than necessary ones; if you do not accept, such cookies are not installed. You can withdraw or change your consent at any time using the cookie settings on the website or your browser settings; withdrawal of consent does not affect the lawfulness of processing carried out before it was withdrawn.

18. Managing cookies

You can change your browser settings to block cookies or to be notified about them, and delete cookies already saved. Please remember, however, that disabling or restricting cookies may cause some website functions to stop working properly. Instructions for the most popular browsers can be found in their help sections (Chrome, Firefox, Safari, Edge).

IV. Security, changes to the policy and effective date

19. Data security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or alteration (Article 32 GDPR), including: encrypted connections (HTTPS/TLS), access control based on the principle of least privilege, securing the credentials used to access systems, and data processing agreements with providers. In the event of a personal data breach that may result in a high risk to your rights or freedoms, we will inform you without undue delay and notify the supervisory authority within the time limit set out in Article 33 GDPR.

20. Changes to the privacy policy

The policy may be updated, in particular in connection with changes in law, in the scope of processing or in the providers used. The current version is always available at atlaswork.pl/privacy-policy. We will inform you of material changes in a visible way on the website.

21. Contact

In matters of personal data protection: gdpr@atlaswork.pl. In other matters: kontakt@atlaswork.pl. Postal address: ATLAS WORK sp. z o.o., ul. Fabryczna 89, 05-270 Marki.

22. Effective date

This version of the policy applies from the date of its publication on the atlaswork.pl website. Date of last update: November 2026.