This is a courtesy translation. In the event of any discrepancy, the Polish version of this policy prevails.
01
Who is the Controller of my personal data?
The controller of personal data is Medapp S.A., with its registered office in Kraków, 30-150 Kraków, ul. Armii Krajowej 25, tax ID (NIP): 7010264750, statistical number (REGON): 142641690, entered in the register under KRS number 0000365157, whose registration documents are kept by the District Court for Kraków-Śródmieście in Kraków, 11th Commercial Division of the National Court Register, with a share capital of PLN 25,003,220.40 paid up in full, hereinafter referred to as Medapp.
As a controller of personal data within the meaning of the GDPR, Medapp processes in particular the following personal data:
- Personal data of job candidates — the data candidates provide to the controller in connection with recruitment processes, in particular the data contained in a CV.
- Personal data of contractors and their representatives — company and contact person data: the basic data used to issue and account for invoices (name, tax ID, business address) and to make contact (first name, surname, company name, job title, business e-mail address, business telephone number).
- Data of people sending enquiries through contact forms, by e-mail and by telephone — the basic contact data (first name, surname, e-mail address) provided together with the questions sent to the controller.
- Data of people who subscribed to the Newsletter — e-mail address.
- Personal data processed in connection with running profiles on the LinkedIn, Facebook and YouTube social platforms.
GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). Company data is treated as personal data only where it allows the identification of the individuals concerned. Data of capital companies is not treated as personal data.
Behavioural advertising
In addition to the data described above, Medapp processes the data of visitors to the www.medapp.pl website for behavioural advertising purposes — displaying advertisements tailored to their preferences (pursuant to Article 6(1)(f) GDPR — the legitimate interest of the controller, namely direct marketing, where consent to the use of cookies has been given). This process is described in detail in the “Information on cookies” section.
02
Personal data of job candidates
Purposes and legal bases of processing
Your personal data will be processed for the purposes of the recruitment process and, where you have given the relevant consent, also for the purposes of future recruitment processes. The basis for processing is the applicable law (in particular the Labour Code) and the consent you have given.
Recipients of the data
The data may be disclosed to entities authorised under the law. Under the relevant agreements, access may also be held by entities supporting Medapp with IT services and infrastructure.
Retention period
Personal data will be stored until the recruitment process is completed or, where the data is processed for future recruitment processes, until you withdraw the consent you have given.
Automated decision-making / profiling
Medapp does not take decisions based on automated processing, including profiling, in relation to the purposes of processing described above.
Whether providing data is voluntary or obligatory
Providing personal data to the extent required by law, in particular by the Labour Code, is obligatory; beyond that scope it is voluntary.
03
Personal data of contractors and their representatives
The personal data of contractors and their representatives, in particular the employees and associates of contractors, will be processed for the following purposes:
- Contact purposes, including establishing and maintaining business contacts and ensuring performance of the agreements concluded with contractors — pursuant to Article 6(1)(f) GDPR (the controller's legitimate interest) or Article 6(1)(a) GDPR (consent given).
- Fulfilling obligations arising from the law, in particular the Accounting Act and the VAT Act — pursuant to Article 6(1)(c) GDPR.
- Defending against claims and establishing and pursuing claims — pursuant to Article 6(1)(f) GDPR.
- Where the relevant consent has been given — sending commercial information to the indicated e-mail address or telephone number, pursuant to Article 6(1)(a) GDPR.
- Where you are a party to an agreement — taking steps prior to entering into the agreement and performing it, pursuant to Article 6(1)(b) GDPR.
Source of the data and whether providing it is voluntary
Your personal data was obtained directly from you or from your employer or principal. Where the data is obtained directly from you, providing it is voluntary but necessary in order to conclude and perform the agreement between your employer or principal and Medapp. Your data may also have been obtained from Medapp's partners where you have given the relevant consent.
Recipients of the data
The data may be disclosed to entities authorised under the law. Under the relevant agreements, access may also be held by entities supporting Medapp with IT services (in particular hosting providers) and other entities supporting Medapp in pursuing the purposes described above (in particular couriers and external auditors).
Automated decision-making / profiling
Medapp does not take decisions based on automated processing, including profiling, in relation to the purposes of processing described above.
Retention period
The personal data of contractors' representatives will be stored until the purposes set out above have been achieved, and then for the period required by law or until claims expire.
04
People sending enquiries through contact forms, by e-mail and by telephone
Purposes and legal bases of processing
Personal data will be processed in order to conduct electronic correspondence and to carry out the steps taken at your request. The basis for processing is the legitimate interest of the controller, namely conducting electronic correspondence and carrying out steps taken at the request of the data subjects.
Recipients of the data
The data may be disclosed to entities authorised under the law. Under the relevant agreements, access may also be held by providers of IT infrastructure and services processing data on Medapp's behalf.
Retention period
Personal data will be stored for the period of the electronic correspondence and then, for archiving purposes, for the period set out in the controller's records management instructions.
Automated decision-making / profiling
Medapp does not take decisions based on automated processing, including profiling, in relation to the purposes of processing described above.
Whether providing data is voluntary or obligatory
Providing personal data is voluntary, but it is necessary in order to exchange electronic correspondence or to take steps at your request.
05
Data of people who subscribed to the Newsletter
Purposes and legal bases of processing
Your personal data will be processed for marketing purposes — sending commercial information to the indicated e-mail address, pursuant to Article 6(1)(f) GDPR (the controller's legitimate interest, namely direct marketing, in connection with the consent given to receive commercial information). Sending commercial information involves the use of your telecommunications terminal equipment (for example a telephone or a computer) and automated calling systems within the meaning of the Telecommunications Law.
Recipients of the data
The data may be disclosed to entities authorised under the law. Under the relevant agreements, access may also be held by entities supporting Medapp with IT services and infrastructure, in particular providers of e-mail marketing solutions.
Retention period
Your personal data will be stored until you object to its processing or withdraw your consent to receive commercial information.
Transfers of data outside the EEA
As a rule Medapp does not transfer data outside the European Economic Area (EEA); there may, however, be situations in which Medapp uses IT service providers whose servers are located outside the EEA. In such cases the basis for the transfer will be the standard contractual clauses approved by the European Commission.
Automated decision-making / profiling
Medapp does not take decisions based on automated processing, including profiling, in relation to the purposes of processing described above.
Whether providing data is voluntary or obligatory
Providing personal data is voluntary, but it is necessary in order to subscribe to the Newsletter service.
06
Data processed in connection with running social media profiles
Controllers of personal data
The controllers of personal data processed on the LinkedIn, Facebook and YouTube platforms also include the entities operating those platforms: LinkedIn Ireland Unlimited Company, Facebook Ireland Ltd and the operator of the YouTube platform. Each of them processes your personal data on the terms described in its own privacy policy. These entities are referred to jointly below as the “Platforms”.
Purposes and legal bases of processing
Medapp processes your personal data in order to run its profiles on the Platforms, in particular to publish posts, hold discussions in comments, conduct correspondence in the form of private messages, and for statistical purposes as well as — in justified cases — to defend and pursue claims. These activities constitute the legitimate interest of Medapp (Article 6(1)(f) GDPR).
Recipients of the data
Where posts are published and discussions are held, the data is accessible to authorised Medapp employees, to the Platforms, and to other people and entities described in the Platforms' privacy policies.
Retention period
Your personal data will be stored for the period defined in the Platforms' privacy policies.
Transfers of data to a third country
As a rule Medapp does not transfer data outside the European Economic Area (EEA); there may, however, be situations in which Medapp uses IT service providers whose servers are located outside the EEA. In such cases the basis for the transfer will be the standard contractual clauses approved by the European Commission.
Automated decision-making / profiling
Medapp does not take decisions based on automated processing, including profiling, in relation to the purposes of processing described above.
Whether providing data is voluntary or obligatory
Providing personal data is voluntary, but it is necessary in order to post comments, send private messages to Medapp and use other functionalities of the Platforms.
07
What rights do I have in connection with the processing of my personal data?
Depending on the situation, you have the right to:
- Request access to your personal data, its rectification, erasure and the restriction of its processing, and to data portability.
- Withdraw the consent given at any time (where consent was given). Withdrawing consent does not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal.
- Object to the processing of your personal data.
- Lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office in Poland.
08
Where can I get in touch about my personal data?
All enquiries and statements concerning the rights listed above should be sent to the contact details below.
Contact details of the controller
Medapp Spółka Akcyjna, with its registered office in Kraków, 31-514 Kraków, ul. Władysława Beliny-Prażmowskiego 60, e-mail address: biuro@medapp.pl
Contact details of the data protection officer
E-mail address: iodo@medapp.pl
09
Information on cookies
The www.medapp.pl website uses cookies. These are small files saved in your web browser, used for the following purposes:
- Optimisation — they make the website easier to use, for example by remembering that a message displayed on the site has been dismissed.
- Analytics — creating statistics on the basis of which the website can better tailor its content to users' preferences.
- Marketing — displaying advertisements tailored to users' preferences, pursuant to Article 6(1)(f) GDPR (the controller's legitimate interest, namely direct marketing), where consent to the use of cookies has been given.
If you do not agree to cookies being saved on your device, please change your browser settings or block third-party cookies in the manner described below. Restricting the use of cookies may affect some of the functionalities available on www.medapp.pl.
Third-party cookies
Medapp uses cookies and similar technologies from the following third parties: Google Ireland Limited (Google Ads, Google Analytics) — for analytics and advertising purposes, where the user may at any time block the use of their data in Google Analytics; and Facebook Inc. (Facebook Pixel) — for analytics and advertising purposes, where the user may review the rules on the processing of their data and block its use by Facebook.
These solutions are used to tailor advertisements to users' preferences and for analytics purposes. They make it possible to track users' activity on the website, for example a visit to a particular subpage. On that basis, Medapp advertisements may be displayed to the user within the Google or Facebook advertising networks. More information about cookies can be found in the “Help” section of your browser's menu.
