Documents

Privacy and personal data policy

This is an English translation of the Polish original. In the event of any discrepancy, the Polish version prevails.

1. General information

This Privacy and Personal Data Policy (the “Policy”) sets out the rules for processing and protecting personal data in connection with the business activities of LET’S Hire, in particular:

providing recruitment services,
conducting recruitment processes,
providing services to individual clients,
running the online shop,
selling consultations, workshops, educational programmes and digital products,
providing digital services, including the AI Assistant,
running the newsletter,
communicating via the website, email and other communication channels.

The Policy has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”) and other applicable laws on personal data protection and privacy.

2. Personal data controller

The controller of personal data is Kaja Stefaniak-Olszanowska, conducting business under the name LET’S Hire Kaja Stefaniak-Olszanowska, with its registered office at ul. Przewóz 32G/18, 30-716 Kraków, Poland, Tax ID (NIP): 6793208051 (the “Controller”).

The Controller can be contacted:

by email: [email protected],
by phone: +48 533 356 215,
by post: ul. Przewóz 32G/18, 30-716 Kraków, Poland.

3. Whose personal data do we process?

In connection with its business, the Controller may process the data of:

candidates taking part in recruitment processes;
business clients and persons representing business clients;
prospective clients and prospective business partners;
individual clients using consultations, audits, programmes and other services;
persons making purchases in the online Shop;
participants in workshops, training courses and online programmes;
users of digital products and services, including the AI Assistant;
newsletter subscribers;
persons contacting the Controller via forms, email, telephone or other available communication channels;
website users.

4. Individual clients and Shop users

When a product or service is purchased, the Controller may process in particular:

first and last name,
email address,
phone number, if required,
billing data and data necessary to issue an accounting document,
order and payment information,
purchase history,
correspondence relating to the fulfilment of the order,
information provided to the Controller while the purchased service is being delivered.

The data are processed:

to conclude and perform the contract – on the basis of Article 6(1)(b) GDPR;
to comply with tax, accounting and other legal obligations – on the basis of Article 6(1)(c) GDPR;
to handle complaints and to establish, pursue or defend against claims – on the basis of Article 6(1)(f) GDPR, i.e. the Controller’s legitimate interest.

Providing the data necessary to fulfil an order is voluntary; however, failure to provide them may make it impossible to conclude or perform the contract.

5. Workshops and online programmes

The Controller may process the data of participants in workshops, training courses and online programmes, including the “Jak skutecznie zdobyć pracę w IT” (How to Land a Job in IT) programme.

The data may include in particular:

first and last name,
email address,
details of the purchased programme,
information provided when contacting the Controller,
data related to participation in online meetings,
the content of the participant’s questions and contributions,
image or voice – if the participant voluntarily turns on their camera or microphone during a recorded meeting.

The data are processed primarily to deliver the purchased programme, organise meetings, give the participant access to materials and communicate about the programme – on the basis of Article 6(1)(b) GDPR.

Recording of workshops

Online meetings held as part of the programme may be recorded so that participants in a given edition can replay the material later and so that those who could not attend live can access it.

Recordings are intended solely for the participants of the given edition of the programme.

Participants are not required to turn on their camera or microphone. Anyone who does not want their image or voice to be recorded may take part in the meeting with the camera and microphone turned off and use text communication, if the meeting tool provides it.

Participants are informed before recording begins.

If a participant uses their camera or microphone during a recorded meeting, their image or voice may be recorded and made available to the other participants of the given edition as part of the recording.

Recordings are not used publicly or for marketing purposes on the basis of participation in the programme alone.

Any public use of a specific participant’s image or statements requires a separate legal basis.

6. Digital products and services, including the AI Assistant

In connection with the use of digital products and services, the Controller may process data necessary to:

grant access to the product or service,
provide technical support,
contact the user,
process payments and fulfil obligations related to the purchase,
handle complaints and requests.

When using the AI Assistant, users should avoid sharing personal data of third parties, confidential information and any other data they have no appropriate basis to share.

Detailed rules for a given digital product or service may also be set out in its description or in the Shop Terms and Conditions (in Polish).

The Controller runs a newsletter through which it may send content relating in particular to:

job searching and changing jobs,
recruitment and the labour market,
career development,
the activities of LET’S Hire,
educational materials,
the Controller’s products, services, workshops and offers.

In connection with a newsletter subscription, the Controller processes primarily:

email address,
first name, if provided,
information about the subscription, its confirmation and cancellation,
technical data and information related to message delivery, to the extent made available by the system used to operate the newsletter.

The data are processed to provide the newsletter service and to send marketing communications in accordance with applicable law.

Where the processing is based on consent, the legal basis is Article 6(1)(a) GDPR.

The newsletter is operated using the MailerLite system.

Subscribing to the newsletter is voluntary and is not a condition of making a purchase in the Shop.

Subscribers may unsubscribe at any time, in particular by using the unsubscribe link included in the messages.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

Detailed rules for using the newsletter are set out in the Newsletter Terms and Conditions (in Polish).

8. Candidates taking part in recruitment processes

In connection with its recruitment activities, the Controller may process in particular:

first and last name,
contact details,
information about education,
professional experience and employment history,
information about professional specialisation,
notice period or availability,
salary expectations,
knowledge of foreign languages,
professional skills and qualifications,
information contained in the CV and other documents provided by the candidate,
image, if included by the candidate in the CV,
data available on publicly accessible professional or business profiles,
information provided during interviews and correspondence relating to the recruitment process.

The data may come directly from the candidate or from publicly available professional or business sources.

Candidates’ data may be processed:

to conduct a specific recruitment process;
to search for candidates who meet the requirements of the Controller’s client;
to contact the candidate;
to conduct future recruitment processes, where there is an appropriate legal basis;
to share the candidate’s data with the client conducting the recruitment, where there is an appropriate basis for such sharing;
to establish, pursue or defend against possible claims.

Depending on how the data were obtained and the purpose of processing, the legal basis may be the consent of the data subject – Article 6(1)(a) GDPR – or the Controller’s legitimate interest – Article 6(1)(f) GDPR.

Where the Controller obtains a candidate’s data from a source other than the candidate, it fulfils the information obligation in accordance with Article 14 GDPR.

The data of selected candidates may be passed on to the Controller’s client who is a potential employer or principal as part of the recruitment process.

9. Business clients and partners

In connection with business cooperation, the Controller may process in particular:

first and last name,
job title,
company name,
email address,
phone number,
company details,
Tax ID (NIP), REGON or KRS number, where applicable,
address or registered office,
correspondence history,
information about concluded contracts and transactions.

The data may be processed in order to:

take steps prior to entering into a contract and perform the contract – Article 6(1)(b) GDPR, where the data subject is a party to the contract;
maintain contact and manage day-to-day cooperation – Article 6(1)(f) GDPR;
comply with tax and accounting obligations – Article 6(1)(c) GDPR;
establish, pursue or defend against claims – Article 6(1)(f) GDPR.

10. Prospective clients and contacting the Controller

The Controller may process the data of persons contacting LET’S Hire or of prospective clients, in particular:

first and last name,
job title,
company name,
email address,
phone number,
content of correspondence,
information publicly available on websites and professional business profiles.

The data may be processed in order to:

respond to a message or enquiry,
conduct correspondence,
take steps towards starting cooperation,
carry out direct marketing to the extent permitted by applicable law,
secure or pursue possible claims.

The legal basis may be Article 6(1)(b) GDPR, where processing is necessary to take steps at the request of the data subject prior to entering into a contract, or Article 6(1)(f) GDPR – the Controller’s legitimate interest.

For marketing communications sent by electronic means, the Controller additionally takes into account the requirements of the laws on electronic communications.

11. Recipients of data

In connection with its business, personal data may be transferred to entities supporting the Controller in its activities, in particular:

hosting and IT service providers,
email service providers,
providers of newsletter systems, including MailerLite,
payment operators,
providers of online meeting tools,
providers of tools used to operate the Shop and the website,
providers of digital and technology tools used to deliver products and services,
entities providing accounting, legal or administrative services,
the Controller’s clients conducting recruitment processes – in the case of candidates’ data, where this is necessary to carry out the process and there is an appropriate legal basis.

Data are transferred only to the extent necessary to achieve the specific purpose.

Some of the services used may involve transferring data outside the European Economic Area. Where such a transfer takes place, the Controller applies the mechanisms provided for by the GDPR, in particular adequacy decisions or standard contractual clauses, where applicable.

12. Data retention period

Personal data are stored for a period appropriate to the purpose of processing.

In particular:

data related to the performance of contracts and purchases – for the duration of the contract and then for the period required by law or necessary to establish, pursue or defend against claims;
accounting and tax data – for the period required by law;
newsletter data – until the subscriber unsubscribes or withdraws consent, with the possibility of retaining a limited set of data where necessary to demonstrate that consent was validly obtained or to defend against claims;
data processed on the basis of consent – as a rule, until consent is withdrawn, unless there is another basis for further processing;
data related to workshops and recordings – for the period necessary to deliver the programme and provide participants with the promised access to recordings, and then for the period necessary to fulfil legal obligations or secure claims, where applicable;
candidates’ data – for the period resulting from the purpose and legal basis of the given recruitment process, and in the case of data processed for future recruitment processes – for the period indicated in the information provided to the candidate or until consent is withdrawn earlier, if the processing is based on consent;
correspondence data – for the period necessary to handle the matter and then for the period justified by the possibility of pursuing or defending against claims.

13. Rights of data subjects

Depending on the basis and nature of the processing, data subjects may have the following rights:

the right of access to data – Article 15 GDPR;
the right to rectification – Article 16 GDPR;
the right to erasure – Article 17 GDPR;
the right to restriction of processing – Article 18 GDPR;
the right to data portability – Article 20 GDPR;
the right to object to processing – Article 21 GDPR;
the right to withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before its withdrawal;
the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) in Poland.

To exercise your rights, please contact the Controller at [email protected].

14. Automated decision-making and profiling

The Controller does not make decisions that produce legal effects concerning individuals or similarly significantly affect them based solely on automated processing, including profiling, within the meaning of Article 22 GDPR, unless the individual is appropriately informed of such processing in a specific case.

15. Data security

The Controller applies appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Access to data is granted only to persons and entities for whom it is necessary to perform specific tasks or provide services to the Controller.

16. Changes to the Policy

The Policy may be updated in particular in the event of changes in the law, in the way the Controller conducts its business, in the tools used or in the range of products and services offered.

The current version of the Policy is published on the LET’S Hire website.

Last updated: 13 August 2026 (Polish version). English translation: 10 September 2026.