Privacy notice

The controller of your personal data is the entity providing services under the Corpshore Polska brand, whose full registration details, including the company name, registered seat and KRS, NIP and REGON numbers, are provided in the site footer. Corpshore Polska is part of the international Corpshore Solutions Corporation group, headquartered in Toronto.

If the data controller is a group entity established outside the European Economic Area that offers services to individuals in the Union or monitors their behaviour, we designate a representative in the Union under Article 27 GDPR, whose details are provided in the site footer and in this notice.

If a data protection officer has been appointed, their contact details are provided in the footer and in this notice, and you may contact them directly on all matters concerning data processing. If no officer has been appointed, please use the contact address provided on the site for data protection matters.

This notice covers the processing of data of visitors to corpshore.pl, people contacting us through forms and email, representatives of clients and prospective clients, and candidates for employment and collaboration. Processing carried out while delivering services to clients, where we act as a processor, is governed by separate data processing agreements described in the Data Processing document.

Data of clients and client-side contacts includes first and last name, job title, business email address and phone number, company name and country of registration, the content of the enquiry, and data necessary to conclude and perform a contract. Candidate data includes contact details, professional experience, language skills and level, preferences regarding the form of cooperation, and a CV. Visitor data includes technical data such as IP address, device and browser information, and cookie data collected with consent.

At the application stage we do not collect date of birth, PESEL number, a photograph or marital status information, as this data is excessive at this stage. We do not collect special category data within the meaning of Article 9 GDPR unless this is necessary and permitted on an explicit legal basis.

We process data to respond to your enquiry and to take steps at your request before entering into a contract and to perform it, under Article 6(1)(b) GDPR. For correspondence, ensuring the security of the site, establishing and defending against claims, and direct marketing of our own services, we process data on the basis of the controller's legitimate interest, Article 6(1)(f) GDPR.

Where required by law, including tax and accounting law, we process data under Article 6(1)(c) GDPR. Where the basis is consent, in particular for non-essential cookies and certain forms of marketing communication, we process data under Article 6(1)(a) GDPR.

Where processing is based on consent, you give it freely, for a specific purpose, in an informed and unambiguous way, through a clear affirmative act, without pre-ticked boxes and without bundling separate consents into one. Consent to marketing contact by email and by phone are separate.

You may withdraw consent at any time, withdrawal is as easy as giving it, and it does not affect the lawfulness of processing carried out before withdrawal. We record and retain proof of consent together with the date, the wording of the statement, and the IP address.

We send commercial information electronically and make telephone contact for marketing purposes in accordance with the Electronic Communications Law and the GDPR, only on the basis of separate, explicit consent. Every marketing message includes a simple way to opt out, and opt-outs are processed without undue delay.

Recipients of data may include processors acting on our documented instructions, under processing agreements compliant with Article 28 GDPR. These include the provider of the Zoho systems used for customer relationship management, recruitment and newsletter dispatch, the site's hosting and infrastructure provider, the provider protecting forms from abuse, and, with consent, analytics tool providers.

Data may be disclosed to entities authorised under the law and, to the necessary extent, to legal and tax advisers and auditors. We do not sell personal data.

As a rule, we do not transfer personal data outside the European Economic Area, and we keep processing carried out under services delivered from Poland within its boundaries. If a transfer outside the EEA were to occur in a specific case, it would take place only using an appropriate mechanism provided for in Chapter V GDPR, in particular an adequacy decision or standard contractual clauses together with necessary supplementary measures, of which we inform the data subject.

We keep data relating to an enquiry that did not lead to a contract for up to 24 months from the last contact. We keep data relating to a concluded contract for its duration, and then for the limitation period of claims, which under the Polish Civil Code is as a rule 3 years for claims connected with business activity and for periodic claims, and up to 6 years for other claims, as well as for the period required by tax and accounting law, as a rule 5 years counted from the end of the year in which the tax payment deadline fell.

We keep candidate data for the duration of the recruitment process, and for the talent pool for the period indicated in the consent, no longer than 24 months, after which we delete it. We keep log and security data for the period necessary for security, and proof of consent for the period during which it may be needed to demonstrate compliance.

You have the right to access your data and obtain a copy of it, the right to rectify inaccurate data and complete incomplete data, the right to erasure, the right to restrict processing, the right to data portability for data processed on the basis of consent or a contract by automated means, and the right to object to processing based on legitimate interest.

For data processed for direct marketing purposes, you have the right to object at any time, after which we cease such processing. You also have the right to withdraw consent at any time, without affecting the lawfulness of processing carried out earlier.

To exercise your rights, contact us using the details given in the site footer, or the data protection officer if one has been appointed. We respond without undue delay, no later than one month after receiving the request. In case of a complex request or a large number of requests, we may extend this period by a further two months, informing you of the reasons for the delay.

If you consider that the processing of your data infringes the law, you have the right to lodge a complaint with the supervisory authority, which in Poland is the President of the Personal Data Protection Office, based in Warsaw. This right applies regardless of other legal remedies.

We do not make decisions concerning you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you. Where we use simple lead scoring to prioritise the handling of enquiries, it is supportive in nature and does not replace human assessment, and on your request we will provide information about the rules of such processing.

We apply technical and organisational measures appropriate to the risk, including role-based access control, encryption in transit, minimisation of permissions, monitoring, and the principles of data protection by design and by default. Data is not collected to an extent broader than necessary for the stated purpose.

In the event of a personal data breach we act in accordance with the GDPR. Where required, we notify the supervisory authority without undue delay, where feasible within 72 hours of becoming aware of the breach, and if the breach is likely to result in a high risk to rights and freedoms, we also notify the affected data subjects.

The site and our services are directed at businesses and adults and are not intended for children. We do not knowingly collect data from individuals below the age at which they may lawfully consent on their own, and if we learn of such processing we take steps to end it.

The rules for using cookies and similar technologies, including file categories, purposes, retention periods and how to manage consent, are described in a separate Cookie Policy. We do not activate non-essential cookies before consent is given.

We may update this notice, in particular in connection with changes in the law, technology or the scope of processing. We inform you of material changes on the site, and the current version, together with the date of the last update, is always available on this page.