Candidate Privacy Policy –
Poland Addendum

1. Introduction and scope

This addendum applies to you if you apply for, or are considered for, a role located in Poland through Instant Impact Ltd ("Instant Impact", "we", "us"). It supplements our Candidate Privacy Policy. Where the two differ, this addendum applies to you.

We are the controller of your personal data from the moment you apply until your details are passed to our client, as explained in section 6. In some recruitment campaigns we cannot name our client at the start, for confidentiality reasons. In those cases, we will tell you who the client is before we share any of your data with them.

If you have questions, contact our Data Protection Officer, Amy Campbell, at amy.campbell@instant-impact.com.

2. Data we collect under the Labour Code

For the recruitment process itself, we collect only the information Polish law allows to be requested from a job candidate under Article 22¹ § 1 of the Polish Labour Code:

• first name(s) and surname
• date of birth
• contact details you choose to give us
• education
• professional qualifications
• employment history

We process this data so that we can consider your application and take steps you have asked for before any contract is entered into (Article 6(1)(b) GDPR, read with Article 22¹ of the Labour Code). You do not have to provide it, but without it we cannot consider you for the role.

If we contact you about a role without you having applied, for example after finding your profile on LinkedIn, we process this data because we have a legitimate interest in identifying suitable candidates for our clients' roles (Article 6(1)(f) GDPR). You can object to this at any time, and we will stop.

3. Additional information and consent

Any information beyond the list in section 2 is processed only with your consent (Article 6(1)(a) GDPR and Article 22¹a of the Labour Code). This includes extra details in your CV, cover letter, video interview or other materials, such as a photo, hobbies or family information.

Giving consent is voluntary. If you refuse or withdraw it, this will not count against you and will not affect how your application is assessed. You can withdraw consent at any time by emailing amy.campbell@instant-impact.com. Withdrawal does not affect processing that took place before it.

We ask you to keep your CV to the information in section 2 where you can.

4. Special category and criminal record data

We never ask for special category data, such as health, ethnic origin, religion, sexual orientation or trade union membership. If you choose to share it on your own initiative, we process it only with your explicit consent (Article 9(2)(a) GDPR and Article 22¹b of the Labour Code). If you do not consent, we will delete it.

We process information about criminal convictions or offences only where a specific Polish law requires it for the role you are applying for. If that applies, we will tell you which law and why before we collect anything.

If you share health information so that we can make adjustments to the recruitment process, we use it only for that purpose.

Our main Candidate Privacy Policy describes equal opportunities monitoring. We do not carry out equal opportunities monitoring for candidates in Poland.

5. Future recruitment (talent pool)

We will keep your details for future roles only if you give separate consent for this. This consent is optional and is separate from your application for the current role. Saying no has no effect on your current application.

If you agree, we will keep your data in our talent pool for 12 months from the date of your consent, then delete it unless you renew your consent. You can withdraw it at any time by emailing amy.campbell@instant-impact.com.

If you are in our talent pool, Instant Impact is the sole controller of your data and may consider you for roles with any of our clients.

Our main Candidate Privacy Policy says that unsuccessful applicants are moved into our general talent pool unless they opt out within 7 days. This does not apply to candidates in Poland. We will only add you to our talent pool if you give the separate consent described above.

6. Sharing with our client

We do not share your data with our client until you have signed a non-disclosure agreement, been told who the client is, and confirmed you are happy to proceed. The steps are:

1. You sign the client’s non-disclosure agreement.
2. We send you a short questionnaire that tells you the client’s name, links to the client’s privacy policy, and asks whether you’re happy for us to submit your application to them.
3. If you answer yes, we pass your application and personal data to the client.
4. From that point, the client is the controller of the data it receives and its privacy policy applies to its use of that data.

You can withdraw at any stage by telling your Instant Impact recruiter. If you answer no, or do not reply to the questionnaire, your data stays with us and is not shared with the client.

7. Retention

We keep your data only as long as we need it for the purpose it was collected. For candidates in Poland, the periods below replace the retention period in section 2 of our main Candidate Privacy Policy.

8. Your rights and the supervisory authority

You have the rights set out in our main Candidate Privacy Policy: access, correction, deletion, restriction, objection, data portability and withdrawal of consent. To use any of them, email amy.campbell@instant-impact.com.

If you think we have handled your data unlawfully, you can complain to the Polish supervisory authority:

President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO) ul. Stawki 2, 00-193 Warszawa, Poland uodo.gov.pl

We would welcome the chance to resolve any concern with you first.