Please read the information on the processing of your personal data by Airly sp. z o.o. (Airly) for the recruitment process.

Providing personal data to the extent stipulated in Article 22¹ § 1 of the Act of June 26 1974, the labour code [hereinafter: “labour code”] is necessary for the recruitment process and the requirement to provide this data arises from the law, which means that failure to provide this data may prevent you from participating in the recruitment process. The provision of the remaining data is voluntary and entirely at the discretion of the job applicant.

Airly sp. z o.o. with its registered office in Cracow, ul. Mogilska 43, 31-545 Cracow

• postal address: ul. Mogilska 43, 31-545 Cracow
• e-mail address: rodo@airly.org

Your personal data may be processed for the purpose of:

1. conducting the current recruitment procedure, assessing the applicants’ qualifications and selecting the person who presents a suitable aptitude for working with the company:
   • in the case of data specified in Article 22¹ § 1 point 1-3 of the labour code, i.e. name (names) and surname, date of birth, contact details provided by the applicant – the legal basis for data processing is Article 6(1)(c) GDPR in conjunction with Article 22¹ § 1 point 1-3 of the labour code;
   • in the case of data specified in Article 22¹ § 1 point 4-6 of the labour code, i.e. data on education, professional qualifications and previous employment history (excluding information about remuneration in the current employment relationship and in previous employment relationships) – the legal basis for data processing is Article 6(1)(c) GDPR in in conjunction with Article 22¹ § 1 point 4-6 of the labour code and Article 6(1)(b) GDPR;
   • in the case of data other than those indicated in Article 22¹ § 1 of the labour code (except for the data referred to in Article 10 GDPR), the legal basis for processing is your consent [Article 6(1)(a) GDPR], whereby the provision of such data by you is considered by Airly as consent to the processing. Your consent is voluntary and your consent can be revoked at any time;
   • in the case of recruitment conducted in order to establish cooperation based on a basis other than an employment contract – the basis for the processing of your data is Airly’s legitimate interest, which is establishing cooperation with you [Article 6(1)(f) GDPR];
2. conducting further recruitments, provided that you have given your consent, which may be revoked at any time [Article 6(1)(a) GDPR];
3. protection against your claims related to the recruitment process, where in the opinion of Airly there is a reasonable probability of you making such claims. Then, the basis for the processing of your data will be Airly’s legitimate interest, consisting in protection against claims [Article 6(1)(f) GDPR].

If the documents sent by you contain the data referred to in Article 9(1) GDPR [the so-called “special categories of personal data”, e.g. data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership] your consent will be required to process such data [Article 9(1)(a) GDPR], which may be revoked at any time.

Your personal data may be processed by entities such as:

• Airly’s employees and/or contractors;
• legal and/or accounting services providers;
• hosting and/or cloud computing services providers;
• e-mail service providers;
• Software as a Service providers enabling Airly internal communication, project and task management related to recruitment;
• Software as a Service providers, enabling contact with you.

Airly transfers personal data to recipients outside the European Economic Area (so-called recipients from a third country) under the terms of Chapter V of the GDPR.

In connection with the fulfilment of the purposes mentioned above, Airly may share your personal data with its trusted Partners such as:

• Hubspot, Inc. with headquarters in Cambridge, Massachusetts, USA, whose services, in terms of providing the Hubspot tool (i.e. a CRM-type tool used to store information about concluded contracts, counterparties, current sales, mailing and managing the shipment of Arily products, etc.), are used by Airly, and (possibly) other entities to which Hubspot, Inc. transfers data in connection with the provision of the Hubspot tool. A full list of entities that may be recipients of data processed in connection with Airly’s use of the Hubspot tool can be accessed at the following link: https://legal.hubspot.com/sub-processors-page;
• Slack Technologies Limited, based in Dublin, Ireland, which provides Airly with services consisting of access to the Slack tool (i.e. an internal communication and project management tool). In connection with the provision of the Slack tool, Slack Technologies Limited may transfer data to its partners outside the EEA, including, in particular, companies affiliated with Slack Technologies Limited. A full list of entities that may be recipients of data processed in connection with Airly’s use of the Slack tool can be accessed at the following link: https://www.salesforce.com/company/legal/trust-and-compliance-documentation.

Therefore, the transfer of your personal data to a third country may be based on the following legal mechanisms:

• the European Commission’s decision finding adequate protection of personal data by a third country – Airly transfers your personal data to entities based in the United Kingdom, where, in accordance with the mentioned European Commission’s decision, an adequate level of protection of personal data is ensured. The European Commission’s decision finding adequate protection of personal data by the United Kingdom, i.e. Decision 2021/1772 of June 28, 2021, is currently in force. The aforementioned decision is available in the database of European Union legislation (Access to European Union Law) at http://eur-lex.europa.eu;
• the European Commission’s decision finding adequacy of protection for safe and trusted data flows between the EU and the US – Airly transfers personal data to entities, based in the US, that have committed to participate in the EU-US Data Privacy Framework. According to the European Commission’s decision, personal data can safely flow from the EU to entities participating in the Data Privacy Framework, and no additional data protection safeguards are required. The European Commission’s Implementing Decision of July 10, 2023, issued on the basis of the Regulation (EU) 2016/679 of the European Parliament and of the Council, stating the adequate level of personal data protection provided by the EU-US Data Protection Framework, is currently in force. The text of the decision is available in the Database of European Union legislation at http://eur-lex.europa.eu. A list of entities enrolled in the Data Protection Framework can be found at https://www.dataprivacyframework.gov/s/participant-search;
• standard contractual clauses – Airly transfers personal data to entities outside the EEA that have committed themselves to use standard contractual clauses and provide an adequate level of security for the personal data received. The standard contract clauses indicated in European Commission decision 2021/914 of June 4, 2021, shall apply.
  The aforementioned decision is available in the database of European Union legislation (Access to European Union Law) at http://eur-lex.europa.eu;
• performance of the contract – in certain exceptional cases where a data recipient from a third country has not committed itself to the application of standard contractual clauses, your data may be transferred where this is necessary to perform the contract between you and Airly or to implement pre-contractual measures taken at your request;
• your consent – if none of the above grounds for data transfer to a recipient outside the EEA apply, Airly will only transfer your data to a recipient from a third provided you have given your explicit consent. Nevertheless, we would like to inform you that in such a case there is a risk that your personal data will not be adequately protected when transferred to a recipient outside the EEA.

Your personal data will be processed until the recruitment process is completed and, if you have consented to the use of personal data for the purposes of future recruitment – your data will be stored for 6 months, unless you consent to the processing of your data in further recruitment processes for another specified period before the end of this period.

If, in Airly’s opinion, there is a reasonable probability of you making claims related to the recruitment process, your data will be processed until the limitation of claims, which is generally 3 years from the end of the recruitment.

You have the right to request from the controller:

• access to your personal data;
• rectification and completion of your personal data;
• erasure of your personal data;
• restriction of processing of your personal data;
• object to processing of your personal data;
• data portability
• to lodge a complaint to the president of the office for the protection of personal data [prezes urzędu ochrony danych osobowych]

Your personal data will not be used for automated decision making, including profiling.