HAVI Service Hub Sp. z o.o. with its registered office at 30-347 Kraków, ul. Wadowicka 3A (“HAVI Service Hub”) will be the controller of your personal data submitted in your application for a job and employment contract.

Whose information is being collected and processed?

HAVI Service Hub processes personal data of candidates, employees employed under a contract of employment and persons employed under a civil law contract, collectively referred to as „Employee/Candidate” and „Employees/Candidates”, respectively.
What information is being collected and processed?

HAVI Service Hub may collect the following information:

• Personal details, such as name, date of birth, gender, age, address, telephone numbers, email address, number of children, citizenship, ID details, visa details, work permit details, emergency contact details, dependents details, marital status, life insurance beneficiaries, pictures or images;
• Financial information relating to compensation, benefits and pension arrangements, such as details of salary, bank account, tax codes, travel expenses, stock options, stock purchase plan;
• Recruitment information, such as CV, application form, notes of interviews, applicant references (if recorded), qualifications, test results (if applicable);
• Employment administration information, such as employment and career history, grades, managers, employment contract details, absence records, safety records, health and sickness records if the applicable laws allow to collect such personal data, accident reports, personal development reviews, driving license details and associated documents, skills records, government issued identification numbers;
• Professional experience information, such as professional resume, qualifications, details of projects Employee/Candidate has worked on, training records, mobility records;
• Details of where Employee/Candidate is located in HAVI Service Hub location to the extent recorded by HAVI Service Hub electronic card access systems
• Details of IT and connection data to the HAVI Service Hub IT systems;
• Photos

(in the scope compliant with labour law regulations).

How data is it collected?

HAVI Service Hub collects certain information provided directly from Employee/Candidate. HAVI Service Hub gets part of the personal data by recording how Employee/Candidate interacts with Human Resources electronic platforms and via electronic card access systems.

HAVI Service Hub may also collect certain information indirectly, in particular from/or on the basis of:

• Global database managed by the Affiliates of HAVI Service Hub;
• Its agents, representatives and service providers, for example recruitment agency;
• Third parties who you have asked to provide your personal information to HAVI Service Hub, including via referral process;
• Insurance Companies to settle an insurance event;
• Law enforcement, dispute resolution, statutory and regulatory bodies;
• Marketing or event organisations, to the extent that personal data is required for conducting the recruitment processes;
• Industry databases such as Pracuj.pl, LinkedIn, or other and publicly available sources such as the Internet and telephone directories.

For what purposes does HAVI Service Hub collect, hold and use your personal information?

• Typically, purposes for which HAVI Service Hub processes Employee/Candidate Personal Data will include but are not limited to the following activities:
• Recruitment, including future recruitment and background checks subject to local laws;
• Performance assessment and training;
• Pay-roll and administration of other employment-related benefits (including stock options, stock purchase plan, or other corporate plans or benefits);
• Day-to-day management activities, such as deployment on projects, promotion, disciplinary activities, grievance procedure handling;
• Marketing the professional services of consultants to potential HAVI Service Hub clients (e.g., by providing details of experience on previous projects);
• Administration of current benefits, including the HAVI Service Hub personal pension plan, life insurance scheme, private health insurance scheme;
• Employment analysis, for example, comparing the success of various recruitment and/or Employee retention programs;
• Compliance with health & safety rules and other legal obligations placed on HAVI Service Hub as an employer;
• Where necessary, processing designed to enable HAVI Service Hub to exercise its legal rights, and/or perform its legal obligations, as an employer, in so far as it is required by local law of the country where the Data Controller is established;
• IT, security, cybersecurity and access control;
• Human Resource Management, Career management and mobility, also via automated processing, including profiling;
• Internal and external communication;
• Company resources management;
• Preventive activities in the area of HAVI Service Hub property security by, for example, theft or destruction as well as data leakage and breach of confidentiality, or access to data by unauthorized persons;
• Audit and statistics.

What is the legal basis for collection of personal data?

A basis for lawful processing by HAVI Service Hub are:

• consent of the person whose data are processed – Article 6 (1)(a) GDPR,
• legal obligation – Article 6 (1) (c) GDPR,
• conclusion and implementation of the agreement of Article 6 (1)(b) GDPR,
• legitimate interests in regards to:– Article 6 (1)(f) GDPR

Employee/Candidate rights:

• Reasonable Expectations of the individual that their personal data are to be processed;
• Management of Individual Right Requests ( ex. Continued processing when an individual requested erasure);
• Suppression (holding data on a suppressed file);
• Profiling for analytical reasons;
• Some Employee relations (to ensure that the employees receive benefits and trainings);
• Keeping the Human Resources records for the event of employee claims;
• Keeping the Records including records of monitoring:
• Lawful monitoring.

Compliance and fraud cases:

• Prevention activities within HAVI Service Hub and its Affiliates, implemented on the basis of internal policies of HAVI Service Hub
• Risk management

IT Network, IT Security:

• IT Network and Information Security regarding the management of Employee/Candidate profiles, the access rights, employees’ passwords;
• Application of the Artificial Intelligence in the analytical processes and related to automated decision-making processes.

The provision of Employees’ personal data is a statutory requirement or contractual requirement or a requirement necessary to perform contractual obligations. In the event of failure to provide such personal data HAVI Service Hub shall not :

• Performing the obligations of the Data Controller for benefit of the Employees in the field of employment and social security and social protection law;
• Sending marketing communication, and/or commercial information (including the information relates to recruitment process) and evaluation of employment applications;
• Profiling of Employees or Candidates in order to prepare an appropriate recruitment offer;
• Detecting, investigating and preventing fraud;
• Verifying and provision an adequate level of protection of Employee/Candidate and property of HAVI Service Hub.

How long does HAVI Service Hub keep the personal information?

HAVI Service Hub will retain personal information for the period required by applicable laws or for the period necessary to fulfil the purposes outlined in this Privacy Notice not longer than 10 years from date of the termination or expiration of the employment relation.

Regarding recruitment data HAVI Service Hub will retain for period not longer than 3 years since its collection.

Regarding monitoring: HAVI Service Hub will usually retain personal information for the period of 30 days from the recording date, and when the recording shall constitute an evidence of a prohibited act which may be used before any court or other formal proceeding, not longer than until the end of a final and valid proceeding.

After the expiration of the above period, personal data shall be anonymised or deleted from any electronic devices and/or the copies of such Personal Information will be destroyed as well. Within the scope of the Employer’s obligations, regarding the archiving of employee files, HAVI Service Hub shall comply with all mandatorily applicable laws.

Who will it be shared with?

HAVI Service Hub shall not share Employees’/Candidates’ personal data to third parties unless HAVI Service Hub has Employees’ permission or it is required by law to do so.

• Affiliates of HAVI Service Hub and/or strategic partners
  HAVI Service Hub shall only share the personal data with Affiliates of HAVI (entities controlled directly or indirectly by HAVI) or/and strategic partners that work with HAVI to provide products and services.
• Service Providers – HAVI Service Hub does share the personal data with companies who provide services to HAVI Service Hub such as information processing, fulfilling orders, providing customer service, assessing interest in products and services, and conducting customer research or satisfaction surveys. These companies are obligated to protect personal data and keep confidentiality.
• Public and governmental authorities
  It may be necessary − by law, legal process, litigation, and/or requests from public and governmental authorities for HAVI Service Hub to disclose Employees’ personal data. HAVI Service Hub may also disclose information about Employees if HAVI Service Hub determines that for purposes of national security, law enforcement, or other issues of public importance, disclosure is necessary or appropriate.

Please note that some of the above mentioned entities may be located outside the European Economic Area. HAVI Service Hub will ensure that the transfer of personal data to a third country located outside the European Economic Area is conducted in compliance with the appropriate and/or suitable safeguards. Employees shall has the right at any time to obtain a copy of their personal data processed by such companies and to obtain the list of companies to which their personal data has been made available by sending a request to the e-mail address hlc-dpc@havi.com.

Such entities and business partners have implemented HAVI Service Hub privacy standards with respect to the use of this data and are bound by appropriate confidentiality agreements.

How will the personal data be secured?

In order to prevent unauthorised access or disclosure, HAVI Service Hub has put in place suitable physical, electronic and managerial procedures to safeguard and secure the information HAVI Service Hub collects and HAVI Service Hub follows industry practices and standards in adopting procedures and implementing systems designed to prevent unauthorized access to personal data and to avoid its accidental loss, damage or destruction.

All Affiliates of HAVI Service Hub have the obligation to abide the security standards established by the HAVI Service Hub and adequately monitored.

In accordance with article 33 and 34 GDPR and taking into account the level of risk for the rights and freedom of Employees, HAVI Service Hub shall report personal data breaches to the authorities and/or the Employees/Candidates if it becomes aware that the security, confidentiality or integrity of the personal data has been compromised.

How will Employee/Candidate control their personal information?

HAVI Service Hub is committed to keep personal data accurate. HAVI Service Hub shall provide Employees/Candidates with access to theirs personal data to view, update or correct this information directly in ADP platform or via request through email: HLC-DPC@havi.com.

Employee/Candidate may request by email deletion of the their personal data, the provision of details of their personal information which HAVI Service Hub hold about them and/or copy of the personal data in a standard format.

Employee/Candidate may choose to restrict the collection or use of their personal data. Employee/Candidate have a right at any time to restrict processing or to object to processing of personal data or sharing their personal data to other Affiliates of HAVI Service Hub.

Personal data may have undergone automated processing, including profiling. Please note that Employee/Candidate have a right at any time to object to such making automated decision, including profiling.

If Employees consider that processing of their personal data infringes data protection laws, they have a legal right to lodge a complaint with a supervisory authority responsible for data protection.

Fulfilling the obligations according to the “GDPR” HAVI Service Hub informs that:

1. HAVI Service Hub Sp. z o.o. with registered office at 30-347 Kraków, ul. Wadowicka 3A (“HAVI Service Hub”, “we”) will be the controller of your personal data.
2. HAVI Service Hub processes your personal data for the following purposes:

• Establishing cooperation with a corporate Client, Supplier or Subcontractor;
• Enabling the provision of professional services to Clients;
• Ordering and receiving services from Suppliers and Subcontractors;
• Using financial security measures with regard to Customers and Beneficial Owners;
• Fulfilling tax obligations;
• Clients, Suppliers and Subcontractors relationship management;
• Developing our businesses and services;
• HAVI Service Hub’s administration and management, in particular the website, IT systems and business applications;
• Direct marketing;
• Exercising legal claims in particular by documenting completed or received services.

3. Legal basis for processing your information:

• 6 sec. 1 let. b) of the GDPR – the performance of a contract or to take steps at the request of the data subject prior to entering into a contract;
• 6 sec. 1 let. c) of the GDPR – compliance with a legal obligation to which HAVI Service Hub is subject;
• 6 sec. 1 let. f) of the GDPR – legitimate interests pursued by the HAVI Service Hub.

4. Your personal data will not be disclosed to third parties except the following recipients:

• other HAVI member firms. We may share personal data with other HAVI member firms where necessary for administrative purposes and purposes of processing referred to in pt 2;
• service providers that aren’t members of the HAVI network (“third party service providers”) to process on a HAVI Service Hub’s behalf. Third party service providers may include providers of IT services, including identity management, website hosting, CRM, data analysis, data back-up, security and storage services in so far as it refers to the relation with HAVI Service Hub;
• governmental or regulatory authorities, courts and law enforcement authorities or agencies as required by and/or in accordance with applicable law or regulation.

5. Your personal data may be transferred to countries outside the European Economic Area (EEA) – third countries, based on:

• 45 sec. 1 of the GDPR – European Commission’s adequacy decision (applies for countries, which were subject of decision);
• 46 sec. 2 let. c) of the GDPR – standard data protection clauses adopted by the European Commission.

6. Your personal data will be retained until the end of relation or cooperation with HAVI Service Hub. After that, personal data might be stored only for the period indicated by statutory provisions of law or as long as you or us may pursue legal claims towards each other.
7. In accordance with processing your personal data you have the following rights: right of access, to rectification (updating), to erasure, to restriction of processing, and to data portability and to object.
8. The provision of personal data is:

• Voluntary, but necessary in order to establish and perform cooperation with HAVI Service Hub – in the scope of processing purposes pursued within the legitimate interests of the data controller and the performance of the contract;
• Mandatory – in the scope of processing purposes pursued within the legal obligation.

Fulfilling the obligations according to the “GDPR” HAVI Service Hub informs that:

1. HAVI Service Hub Sp. z o.o. with registered office at 30-347 Kraków, ul. Wadowicka 3A (“HAVI Service Hub”, “we”) will be the controller of your personal data.
2. HAVI Service Hub processes your personal data for the purpose of answering the question which you have asked basic on Art. 6 sec. 1 let. f) of the GDPR – HAVI Service Hub’s legitimate interest.
3. Your personal data will not be disclosed to third parties except the following recipients:

• other HAVI member firms. We may share personal data with other HAVI member firms where necessary for administrative purposes and legitimate interest pursued by the HAVI Service Hub referred to in pt 2;
• service providers that aren’t members of the HAVI network (“third party service providers”) to process on a HAVI Service Hub’s behalf. Third party service providers may include providers of IT services, including identity management, website hosting, data analysis, data back-up, security and storage services in so far as it refers to the contact with HAVI Service Hub;
• governmental or regulatory authorities, courts and law enforcement authorities or agencies as required by and/or in accordance with applicable law or regulation.

4. Your personal data may be transferred to countries outside the European Economic Area (EEA) – third countries, based on:

• 45 sec. 1 of the GDPR – European Commission’s adequacy decision (applies for countries, which were subject of decision);
• 46 sec. 2 let. c) of the GDPR – standard data protection clauses adopted by the European Commission.

5. Your personal data will be retained until the end of the case which is the subject of your question or the objection of processing personal data. After that, personal data might be stored only for the period indicated by statutory provisions of law or as long as you or us may pursue legal claims towards each other.
6. In accordance with processing your personal data you have the following rights: right of access, to rectification (updating), to erasure, to restriction of processing, and to data portability and to object.
7. The provision of personal data is voluntary but necessary to answer your question.

In HAVI Service Hub sp. z o.o. we are strongly committed to conduct our business with respect for the rule of law and the rights and freedoms of our employees, associates, business partners and other stakeholders. Our aim is to respond to all occurring irregularities and misconduct as quickly and efficiently as possible. We therefore created a secure channel where anyone who became aware of any breach of law in our Company in a work-related context (a Whistleblower) can report it to us.

The Whistleblower’s report may concern all areas of law provided for in the Act on the Whistleblowers’ Protection, including in particular corruption, protection of privacy and personal data or the financial interests of the State Treasury, local authorities and the European Union. Reports may be sent to a dedicated e-mail address: ControlTower.whistleblowers@havi.com

We guarantee the confidentiality of both the identity of the Whistleblower and any information he or she provides to us. We also take all possible steps to ensure that the Whistleblower is protected from retaliation and any other negative consequences that might result from making a report.

To enable us to investigate your report, we ask that you provide possibly complete description of the breach and the persons involved. If you have evidence or documents to support your allegations, please also attach them. We kindly ask that you provide your contact details so that we can give you the necessary feedback (as a rule, we do not accept anonymous reports).

HAVI Service Hub sp. z o.o. is the controller of the personal data of the Whistleblower. Please refer to the detailed information regarding the processing of personal data.