Privacy Policy

1.0 Introduction

We know that you care about your personal data and how it is used. We take the protection of your personal data very seriously and strictly adhere to the rules laid out by data protection laws and the General Data Protection Regulation (GDPR). This Privacy Notice will help you understand what personal data Talent Complete collects, why we collect it and what we do with it.

The abbreviation “Talent Complete” and the pronoun “we” and its derivatives herein refer to Talent Complete sp. z o.o., registered at ul. Bohdana Chrzanowskiego 11, 80-278 Gdańsk, Poland, entered into the Register of Entrepreneurs of the National Court Register under KRS: 0000721105, NIP: 5842768632, REGON: 369584038.

Please take a moment to familiarise yourself with our privacy practices and let us know if you have any questions, including any requests to exercise your legal rights. To contact our data protection team, please use the contact information in section 15 of this privacy notice. You have the right to object to certain uses of your personal data, including the use of your personal data for direct marketing. See what your rights are and how you can exercise them in section 8 of this privacy notice.

1.1 Data Protection Officer 
 
Talent Complete has appointed a Data Protection Officer. You may contact our DPO directly regarding any matters related to the processing of your personal data and the exercise of your rights under the GDPR:

Email: [email protected] 
Postal address: Talent Complete sp. z o.o., ul. Bohdana Chrzanowskiego 11, 80-278 Gdańsk, Polska

2.0 Why we collect your personal information

We collect, process and disclose your personal data only for specific and limited purposes, based on clearly defined legal grounds. The table below summarises the main processing purposes, legal bases and retention periods. More detailed information for specific purposes is provided in sections 2.1-2.3.

When we collect and use your personal data for purposes mentioned above or for other purposes, we will inform you before or at the time of collection. Where appropriate, we will ask for your consent. Where you have given consent for processing activities, you have the right to withdraw your consent at any time (see section 9).

2.1 Processing of personal data for recruitment purposes

Talent Complete recruits for its own needs as well as for its clients in connection with the provision of IT specialists and other services. Therefore, please be mindful that your personal data may also be processed by Talent Complete’s clients. When this is the case, we will inform you in the relevant job advertisement, including the name of the client (where contractually possible) and the basis on which we share data with them.

Legal bases for processing candidate data:

(a) Art. 6(1)(c) GDPR in connection with Art. 22¹ §1 of the Polish Labour Code – for data required by law: name, surname, date of birth, contact details, education, qualifications, employment history;

(b) Art. 6(1)(b) GDPR – for additional data necessary to take steps prior to entering into an employment or service contract (e.g. project-specific skills assessment, results of technical tests);

(c) Art. 6(1)(a) GDPR – for any data provided voluntarily by the candidate that exceeds the scope above (e.g. photograph, hobbies, languages other than required by the role);

(d) Art. 6(1)(a) GDPR – separately, for participation in future recruitment processes (talent pool);

(e) Art. 6(1)(f) GDPR – for establishing, exercising or defending legal claims.

Separation of consents. Participation in a specific recruitment process does not require consent to processing for future recruitment processes. These are two separate, independent consents which you may grant or withhold independently. Withholding consent for future processes will not affect your participation in the current recruitment.

Withdrawal of consent. You may withdraw any consent at any time without giving reasons. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. For details on how to withdraw consent, see section 9.

Active sourcing – data obtained from publicly available sources.

Where Talent Complete obtains your personal data from publicly available sources (e.g. LinkedIn, professional networking platforms, public CV databases) for the purpose of identifying potential candidates, we process the following categories of data: name, current job title, professional experience, education, technical skills, publicly available contact information, and links to professional profiles.

The legal basis for this processing is our legitimate interest (Art. 6(1)(f) GDPR) in conducting recruitment activities for our clients. We have carried out a Legitimate Interest Assessment which is available on request at [email protected].

In accordance with Art. 14 GDPR, we will inform you about this processing at the first point of contact, no later than within one month of obtaining your data. You have the right to object to this processing at any time (see section 8.1).

Candidate recommendation system.

Personal data may also be processed when you have been recommended by another person. In such cases, the recommending person provides their own contact details, the data of the recommended person and the recommended person’s CV.

Before submitting a recommendation, the recommending person must:

• have obtained the recommended person’s prior consent to share their data with Talent Complete;

• inform the recommended person about the recommendation and the fact that their data will be processed by Talent Complete.

Upon receiving the recommendation, Talent Complete will, in accordance with Art. 14 GDPR, contact the recommended person within one month to provide a full privacy notice and confirm whether the recommended person wishes to participate in the recruitment process.

2.2 Processing of personal data for marketing purposes

By subscribing to our newsletter, signing up for a training, conference or other event organized by Talent Complete, or by checking the relevant consent box in our contact or recruitment form, you may consent to the processing of your personal data in order to receive marketing information on products and services offered by Talent Complete.

Legal basis: Art. 6(1)(a) GDPR (consent), in conjunction with:

• Art. 10 of the Polish Act on Providing Services by Electronic Means (for sending commercial information by electronic means);

• Art. 398 of the Polish Electronic Communications Law (for direct marketing using telecommunications end devices).

How consent is granted. Consent must be expressed through a clear affirmative action typically by ticking a dedicated consent box presented next to the content of the consent statement. For newsletter subscriptions, we apply the double opt-in mechanism: after submitting the subscription form, you will receive a confirmation email with an activation link; only after clicking this link will your subscription become active.

Simply providing an email address in a form, without separately confirming consent and completing the double opt-in process, is not treated as valid consent.

Withdrawal of consent. You may withdraw consent to marketing communications at any time by:

• clicking the unsubscribe link included in every marketing email;

• sending an email to [email protected];

• contacting us by post at the address provided in section 15.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

2.3 Processing of personal data for system testing and development purposes

To ensure the high quality of our services and the continuous development of our recruitment systems, Talent Complete may use pseudonymised copies of candidate databases in controlled test environments.

Safeguards applied:

(a) Pseudonymisation. Before any data is used in a test environment, direct identifiers are removed or replaced with tokens. This includes: name, surname, contact details (email, phone), photograph, exact dates of birth, exact employer names where such information could allow re-identification.

(b) Limited access. Access to pseudonymised test data is strictly limited to authorised employees involved in the system development process and is logged.

(c) Retention. Pseudonymised test data is retained only for the period necessary to carry out the tests and implement the improvements, and in any case no longer than [typically 30 days] after the completion of the test, after which it is permanently deleted.

(d) No sharing. Pseudonymised test data is not shared with any third parties or used for any purpose other than testing system improvements.

Legal basis: Art. 6(1)(f) GDPR- our legitimate interest in maintaining secure, effective and reliable recruitment systems. We have carried out a Legitimate Interest Assessment which takes into account candidate rights and the application of pseudonymisation as a safeguard. The assessment is available on request at [email protected].

Your right to object. You have the right to object to the processing of your personal data for this purpose at any time. To exercise this right, please contact us at [email protected]. Upon receiving your objection, we will cease using your data (including pseudonymised copies) for testing purposes without undue delay.

3.0 Lawful basis of processing information

We only collect and use personal information about you when the law allows us to. The legal bases on which we rely are:

• Consent – the data subject (you) has given consent to the processing activity;

• Contract – the processing is necessary for the performance of a contract with you or to take steps prior to entering into a contract;

• Legal obligation – the processing is necessary for compliance with a legal obligation to which Talent Complete is subject;

• Legitimate interest – the processing is necessary for the purposes of the legitimate interests pursued by Talent Complete or a third party, except where such interests are overridden by your interests or fundamental rights and freedoms.

The specific legal basis for each processing activity is identified in the table in section 2.0 and in sections 2.1 – 2.3.

Where legitimate interest is identified as a legal basis, we conduct a Legitimate Interest Assessment (LIA)  
a three-part test covering:

• Purpose test – identifying the legitimate interest;

• Necessity test – assessing whether the processing is necessary to achieve the identified purpose;

• Balancing test – weighing the legitimate interest against the rights and freedoms of the data subject.

Our LIAs are available on request at [email protected].

4.0 What personal data we collect and where from

Personal data means any information that can be used to identify, directly or indirectly, a specific individual. You are not required to provide Talent Complete with the personal data that we request, but if you choose not to do so, we may not be able to provide you with our services, respond to your inquiries or include you in recruitment processes.

We collect personal information directly from you (when you submit a CV, fill in a form, contact us by email or telephone, register for an event) and, in the case of active sourcing, from publicly available sources (see section 2.1) or from persons recommending you (see section 2.1).

The categories of personal data that we may collect, store and use include:

• Identification data: name, surname, date of birth;

• Contact data: address, telephone number, email, links to professional profiles (e.g. LinkedIn);

• Professional data from CV: work experience history, education, technical skills, languages, certificates, courses, training, references;

• Recruitment process data: results of technical tests, notes from interviews, recruiter assessments, candidate scores, professional references provided by you;

• Financial expectations: expected salary or rate, preferred form of employment;

• Data from publicly available sources (in active sourcing – see section 2.1);

• Data provided by recommending persons (in the recommendation system – see section 2.1);

• Technical data: IP address, browser type, operating system, device identifiers, cookie identifiers (see our Cookies Policy);

• Marketing preferences (for newsletter subscribers and event participants).

We may share your personal information between Talent Complete’s affiliated companies and use it in a manner consistent with this privacy notice.

4.1 Special category data

Certain categories of personal data, such as racial or ethnic origin, religious or philosophical beliefs, health, sexual orientation or biometric data, are classified as “special categories of data” under Art. 9 GDPR and benefit from additional protection.

We do not collect special category data, and we request that you do not provide any special category data in your CV, applications or other communications with us. If we still receive such data, we will delete it without undue delay upon identification.

If, in exceptional circumstances, we need to process special category data, we will inform the data subject and identify an applicable exception under Art. 9(2) GDPR.

4.2 Third-party collection of personal data

We may also collect your data through third parties — for example, from your employer in the case of contracted services, or from your references during a recruitment process (with your knowledge and consent).

5.0 How long we keep your information

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable laws and professional obligations. We actively review the personal data we hold and delete it securely, or anonymise it, when there is no longer a legal, business or consumer need for it to be retained.

The specific retention periods for each processing purpose are set out in the table in section 2.0. Where retention is determined by legal obligation (e.g. tax or accounting law), the period required by the relevant law applies.

If you would like further information about the retention of your specific data, please contact us at [email protected].

6.0 Security of personal information

We take the responsibility for protecting your privacy very seriously and ensure your data is secured in accordance with our obligations under data protection laws.

We have implemented technical and organisational measures to prevent unauthorised access, alteration or disclosure of personal data. These measures include:

• a robust access control policy limiting access to personal data to employees, contractors and third parties on a need-to-know basis;

• encryption of data in transit (SSL/TLS certificates) and at rest where appropriate;

• regular information security and data protection training for all employees;

• documented procedures for handling potential data security breaches, including notification to data subjects and supervisory authorities where required by law;

• regular reviews and updates of security measures.

7.0 Children’s information

We do not knowingly collect personal data of children. Our services are directed at adults candidates, clients and business partners. If you become aware that we have collected personal data of a child, please contact us immediately at [email protected] so we can remove this information without undue delay.

8.0 Your individual rights

You have the following rights under the GDPR (Articles 15–22):

• Right to be informed;

• Right of access;

• Right to rectification;

• Right to erasure (“right to be forgotten”);

• Right to restrict processing;

• Right to data portability;

• Right to object;

• Rights related to automated decision-making.

You may exercise any of these rights by contacting us at [email protected] or by post at the address provided in section 15. We will respond to your request within one month of receipt. Where the request is particularly complex or where we have received a large number of requests, we may extend this period by up to two further months, in which case we will inform you of the extension and the reasons for it within the original one-month period.

8.1 The right to object

You can exercise this right if:

• Processing relies on legitimate interest (Art. 6(1)(f) GDPR), including profiling based on that legal basis;

• Processing is for direct marketing purposes in this case, the objection is absolute and we will stop processing immediately;

• Processing is for scientific or historical research.

8.2 The right of access

You, or any third party acting on your behalf with your authority, may request a copy of the personal data we hold about you. The first copy is provided free of charge. For any further copies, we may charge a reasonable fee based on administrative costs, which will be communicated to you in advance.

We will ask to verify your identity, or request evidence from the third party that they are acting on your behalf, before releasing any personal data.

8.3 The right to be informed

We are required to provide clear and transparent information about how we process your personal data. This privacy notice fulfils this obligation. Additional information is provided at the point of data collection (e.g. in contact forms, job advertisements, marketing forms).

8.4 The right to rectification

If you believe the personal data we hold about you is incorrect or incomplete, you have the right to request correction. You may exercise this right along with the right to restrict processing until the corrections are made.

8.5 The right to erasure

You may request that we erase your personal data if:

• the data is no longer necessary for the purposes for which it was collected;

• you withdraw consent and there is no other legal basis for processing;

• you object to the processing and there are no overriding legitimate grounds;

• the data has been unlawfully processed;

• erasure is required for compliance with a legal obligation.

This right is not absolute we may refuse erasure where processing is necessary for compliance with a legal obligation, for the establishment, exercise or defence of legal claims, or for other reasons set out in Art. 17(3) GDPR.

8.6 The right to restrict processing

You may ask us to restrict the processing of your personal data meaning we will continue to hold it but not process it further. This right applies when:

• you contest the accuracy of the data (during verification);

• processing is unlawful but you oppose erasure;

• we no longer need the data, but you require it for the establishment, exercise or defence of legal claims;

• you have objected to processing pending verification of overriding legitimate grounds.

8.7 The right to data portability

You may request that your personal data be transferred to you or to another controller in a structured, commonly used, machine-readable format, where:

• processing is based on consent or on a contract; and

• processing is carried out by automated means.

8.8 Rights related to automated decision-making

You have the right not to be subject to a decision based solely on automated processing including profiling which produces legal effects concerning you or similarly significantly affects you.

In particular, you have the right:

• to obtain human intervention;

• to express your point of view;

• to obtain an explanation of the decision reached after an assessment;

• to challenge such a decision.

For details on how we use automated processing, see section 12.

9.0 Consent

Where you have given consent for processing of your personal data, you have the right to withdraw this consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out based on consent before its withdrawal.

You may withdraw consent by:

• sending an email to [email protected];

• clicking the unsubscribe link in any marketing email;

• adjusting your cookie preferences via the cookie consent banner / settings on our website;

• contacting us by post at the address provided in section 15.

Withdrawal of consent is as easy as granting it.

10.0 Failure to provide personal information

Where we need to collect personal data by law or in order to perform a contract with you, and you fail to provide that data when requested, we may not be able to perform the contract or provide the service. In such cases, we will inform you of the consequences at the time of collection.

For data that is provided voluntarily (e.g. data exceeding the scope required by the Polish Labour Code in recruitment), failure to provide it has no negative consequences for your participation in the process.

11.0 Cookies

Our website uses cookies. Please see our Cookies Policy for full details of the cookies used, their purposes, retention periods and how to manage your preferences.

12.0 Automated processing of personal data

Talent Complete uses automated tools to support the recruitment process and the management of candidate profiles. These tools are used for:

• screening and ranking candidates’ CVs based on declared skills, experience and other professional information;

• matching candidates with relevant job offers;

• supporting career path recommendations.

The tools process data provided by the candidate in the CV, such as: name, contact details, educational history, employment history, skills, courses, certificates and training.

Human intervention. The output of these automated tools is used only to support our recruiters. Final decisions regarding candidate selection, presentation to clients, progression to further recruitment stages and rejection are always made by a human recruiter who reviews the algorithmic output critically and takes into account the full context of the candidate’s profile. Accordingly, this processing does not constitute a decision “based solely on automated processing” within the meaning of Art. 22 GDPR.

Your rights. You have the right to obtain human intervention, express your point of view, obtain an explanation of any decision reached and challenge such a decision. To exercise these rights, please contact us at [email protected].

For more detailed information about the automated tools we use, please contact our data protection team at [email protected].

13.0 Transfers of personal data to third parties

Talent Complete may disclose your personal data to the following categories of recipients, in each case based on a valid legal ground and, where required, under a data processing agreement compliant with Art. 28 GDPR or a joint controllership arrangement compliant with Art. 26 GDPR:

• Talent Complete’s clients – for whom we conduct recruitment processes or to whom we provide IT specialists. The role of each client (separate controller, joint controller or processor) is defined in the relevant agreement and communicated to candidates at the relevant point of the recruitment process;

• Affiliated with Talent Complete companies for administrative purposes and for the provision of shared services, where;

• IT service providers – providers of hosting, cloud services, applicant tracking systems (ATS), customer relationship management (CRM) systems, email infrastructure, marketing automation, video-conferencing tools, technical assessment platforms;

• Marketing service providers – email service providers, analytics providers;

• Professional advisors – lawyers, auditors, accountants, tax advisors;

• Public authorities – where required by law;

• Web analytics providers – for the continuous improvement and optimisation of our website (see our Cookies Policy).

All third-party processors are contractually bound to protect your personal data, to process it only on our documented instructions and to apply appropriate technical and organisational security measures.

14.0 Transfers of personal data outside the EEA

Some of the third parties listed in section 13 are located outside the European Economic Area (EEA), in particular in the United States (e.g. providers of analytics, marketing, cloud and communications services).

Where personal data is transferred to a country outside the EEA, we ensure that appropriate safeguards are in place, in accordance with Chapter V of the GDPR. These may include:

• Adequacy decisions of the European Commission in particular, for transfers to the United States under the EU–U.S. Data Privacy Framework (adequacy decision of 10 July 2023), where the recipient is certified under that framework;

• Standard Contractual Clauses (SCCs) adopted by the European Commission, supplemented where necessary by additional technical and organisational measures following the assessment required by the Schrems II judgment of the Court of Justice of the European Union;

• Binding Corporate Rules (BCRs) where applicable;

• Specific derogations set out in Art. 49 GDPR (used only in exceptional circumstances);

For more information about transfers and applicable safeguards, including the right to obtain a copy of the safeguards, please contact us at [email protected].

15.0 Contact and right to complain

If you have any questions, requests or complaints about our processing of your personal data, please contact us first so we can address your concerns:

• Email (data protection matters): [email protected]

• Email (general): [email protected]

• Post: Talent Complete sp. z o.o., ul. Bohdana Chrzanowskiego 11, 80-278 Gdańsk, Polska

We take any complaints about our collection and use of personal information very seriously.

If you are not satisfied with our response, you have the right to lodge a complaint with the Polish supervisory authority:

Urząd Ochrony Danych Osobowych (UODO) ul. Stawki 2, 00-193 Warszawa Tel.: +48 22 531 03 00 Email: [email protected] Website: https://uodo.gov.pl/

16.0 Additional information

Your trust is important to us. We are available to answer any questions concerning how your data is processed. If you have any questions that could not be answered by this privacy notice, please contact our data protection team at [email protected].

17.0 Policy review and amendments

We keep this Policy under regular review.

This Policy was last updated on: 12.05.2026

We reserve the right to update this privacy notice at any time. We will provide you with a new privacy notice when we make any substantial updates, and may also notify you in other ways from time to time about the processing of your personal information.

The latest version of this Policy is always available at: https://talentcomplete.com/privacy-policy