This is an informational translation. The Polish version is the binding one.
Document
Privacy policy for candidates and employees
This document applies to people who apply for work through Back2Work and to people we already employ. It explains what data we collect, why we need it, who we share it with and what rights you can exercise.
Last updated: 1 October 2026
Looking for information about the form for companies? The processing of data of persons contacting us on behalf of employers is described in the website privacy policy.
1. Data controller
The controller of personal data of candidates and employees is:
B2W Sp. z o.o.
ul. Jana Zamoyskiego 79A lok. LU12, 30‑519 Kraków
NIP 6793235071 · KRS 0000960452 · REGON 521479611
Employment agency entered in the register under number KRAZ 31286
Contact on personal data matters:
[email protected]
+48 515 682 163
After you are assigned to work, some of the data goes to the user employer (pracodawca użytkownik), that is, the company where the work is performed. That company becomes a separate controller to the extent that it processes data for the purposes of work organisation and safety on its premises. We pass on the name and contact details of the user employer before work begins.
2. What data we collect
2.1. Recruitment stage
We accept applications through the form on the website (full name, phone number, email address if you provide it, area of interest), by email, by phone and during recruitment interviews. At this stage we process:
- full name, date of birth,
- contact details: phone number, email address, correspondence address,
- citizenship and information about any residence title held,
- education, employment history, qualifications and professional licences,
- language skills,
- expectations regarding the position, location and working conditions,
- other information contained in the submitted application documents.
Please do not include in your application documents any information we do not ask for, in particular data on health, origin, views, religion or trade union membership, or a photo. If such information appears in an application, we consider that it was provided voluntarily, and we remove it from the documentation.
2.2. Legalisation of residence and work
For people from outside the European Union, we help complete residence formalities and obtain a basis for legal work. This requires processing data that we would not otherwise collect:
- series and number of the travel document, date and place of issue, expiry date,
- details of the visa or other residence title, including the residence card,
- PESEL number, if one has been assigned,
- registered address or place of stay in Poland,
- data contained in the declaration on entrusting work to a foreigner (oświadczenie o powierzeniu wykonywania pracy cudzoziemcowi) or in the work permit (zezwolenie na pracę),
- documents confirming the qualifications required for the given position.
2.3. Employment
After the contract is signed, we additionally process the data necessary for payroll and official notifications: bank account number, data for registration for social and health insurance, details of the tax office (urząd skarbowy), information on working time and absences and, if the employee reports them, data of persons entitled to benefits.
2.4. Accommodation
If you use accommodation organised by us, we process the data necessary to assign a place and settle the costs, and we also pass your first name, surname and period of stay to the entity managing the facility.
3. Health and criminal record data
Medical examinations. Before you are admitted to work, we refer you for preventive medical examinations. We receive only the certificate of fitness to perform work in the given position. We do not receive examination results or information about diagnoses. The basis for processing the certificate is an obligation arising from labour law.
Criminal record information. We require a certificate of no criminal record only for positions for which such an obligation arises from specific regulations or from the user employer's requirements that have a basis in regulations. Outside these cases, we do not ask about criminal records.
Disability data. We process it only if it is provided voluntarily in order to exercise employee rights or to adapt the workplace.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Conducting recruitment and matching to a specific assignment | Article 6(1)(b) GDPR, steps taken at the request of the person before entering into a contract |
| Employment, payroll, employee records | Article 6(1)(b) and (c) GDPR in conjunction with the Labour Code (Kodeks pracy) and the regulations on employing temporary workers |
| Notifications to the Social Insurance Institution (Zakład Ubezpieczeń Społecznych, ZUS) and the tax office | Article 6(1)(c) GDPR, obligations arising from social insurance and tax regulations |
| Legalisation of residence and work of foreigners | Article 6(1)(c) GDPR in conjunction with the regulations on foreigners and the Act of 20 March 2025 on the conditions for permitting the entrusting of work to foreigners in the territory of the Republic of Poland (ustawa z dnia 20 marca 2025 r. o warunkach dopuszczalności powierzania pracy cudzoziemcom na terytorium Rzeczypospolitej Polskiej) |
| Medical certificates of fitness for work | Article 9(2)(b) GDPR in conjunction with the labour law provisions on preventive examinations |
| Keeping the application for future recruitment | Article 6(1)(a) GDPR, consent that can be withdrawn at any time |
| Establishing, pursuing or defending legal claims | Article 6(1)(f) GDPR, legitimate interest of the controller |
5. How long we keep data
- Applications without employment: until the end of the recruitment to which the application was submitted. With your consent, we keep them for future recruitment for 12 months, after which we delete them.
- Employee records: 10 years counted from the end of the calendar year in which the employment relationship ended. For employment before 2019, this period may be longer and result from earlier regulations.
- Legalisation documentation: for the period required by the regulations on foreigners and for the purposes of a possible inspection, for no less than the period during which the work is performed plus the limitation period.
- Settlement and tax documents: 5 years from the end of the year in which the tax obligation arose.
- Accommodation data: for the period of using the place and for the time needed to settle the costs.
6. Who we share data with
We do not sell the data of candidates and employees or use it for marketing purposes. We pass it on only where necessary:
| Recipient | Scope and reason |
|---|---|
| User employer | data necessary to admit you to work and organise tasks in the position, passed on after the candidacy is accepted |
| Social Insurance Institution (ZUS), tax office | notifications and settlements required by regulations |
| Voivode (wojewoda), district labour office (powiatowy urząd pracy), Border Guard (Straż Graniczna), National Labour Inspectorate (Państwowa Inspekcja Pracy, PIP) | legalisation proceedings and inspection activities carried out on the basis of regulations |
| Occupational medicine facilities | referral for preventive examinations |
| Entities managing accommodation facilities | first name, surname and period of stay |
| Banks | payment of remuneration |
| Accounting office, providers of HR and payroll systems, business email, website hosting (Cloudflare, Inc.) and delivery of form applications (Resend, Inc., servers in Ireland) | handling processes on our instructions, on the basis of data processing agreements |
7. Where we get data from
The data comes primarily from the person it concerns, that is, from you.
Recruitment outside Poland. We also recruit in candidates' countries of origin, in cooperation with local recruitment partners. If your application reached us this way, we receive from the partner the data that you yourself gave them: full name, contact details, citizenship, information on education and professional experience and on the licences you hold. At the first contact, we tell you from whom we received the application.
A recruitment partner operating outside the European Economic Area remains a separate controller of the data to the extent of its own activity. The rules under which it processes data are set out in its own privacy notice provided when you submit the application.
Transfers of data outside the European Economic Area. As a rule, we process data in Poland. Contact with the recruitment partner in your country of origin may involve transferring data outside this area, to the extent necessary to confirm the application and agree the terms of travel. This takes place on the basis of standard contractual clauses approved by the European Commission or, where it directly concerns performance of a contract with you, on the basis of Article 49(1)(b) GDPR. We provide a copy of the safeguards applied on request.
We also verify data in public registers and with authorities conducting legalisation proceedings, to the extent permitted by regulations.
8. Your rights
You have the right to:
- access your data and receive a copy of it,
- rectify incorrect data or complete incomplete data,
- erase data, if we have no obligation to keep it further,
- restrict processing,
- transfer data processed on the basis of a contract or consent (data portability),
- object to processing based on a legitimate interest,
- withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
We accept requests at [email protected] and by phone. We reply within one month at the latest.
Exercising your rights does not affect the course of recruitment or the terms of employment.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa. You can also lodge a complaint with the supervisory authority in the country of your habitual residence.
At your request, we will explain the content of this document in a conversation, in the language you use.
9. Is providing data mandatory?
Providing the data specified in labour law provisions and the data necessary to legalise residence and work is a condition of employment. Without it, we cannot conclude a contract or assign you to work.
You provide other information, including consent to keep your application for future recruitment, voluntarily. Not providing it has no negative consequences.
We do not make decisions solely by automated means. A recruiter decides whether a candidacy matches an assignment.
10. Security
We store documents in systems with access control, and only authorised persons have access, to the extent resulting from their duties. Business accounts are protected by two-factor authentication. We make copies of identity documents only when a legalisation procedure requires it, and we delete them once that need ceases. Data processing agreements have been concluded with the entities handling our processes.