Personal Data Protection Policy (GDPR) – MAJESTIC GROUP LIMITED LIABILITY COMPANY
On 25 May 2018, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”) entered into force. In connection with this, MAJESTIC GROUP LIMITED LIABILITY COMPANY informs about the principles of personal data processing.
1. Personal data administrator
The personal data administrator is MAJESTIC GROUP LIMITED LIABILITY COMPANY, with its registered office in Warsaw, ul. Konstantego Ildefonsa Gałczyńskiego 4/901, 00-362 Warsaw, NIP: 5253035971 (hereinafter: "Administrator").
2. Contact with the Administrator
You can contact the Administrator:
3. Data Protection Officer
In matters concerning the processing of personal data and the implementation of rights related to data processing, you can contact the Data Protection Officer: e-mail: catering@majesticfeast.pl, in writing to the address of the Administrator's registered office.
4. Purposes and legal basis of data processing
Personal data may be processed for the following purposes:
Direct marketing of the Administrator's products and services, including sending offers electronically - based on art. 6 sec. 1 letter f) of the GDPR (legitimate interest of the Administrator consisting in the promotion of services and products).
Fulfillment of legal obligations resulting from tax and accounting regulations – based on art. 6 sec. 1 letter c) of the GDPR.
Handling user notifications, e.g. via the contact form – based on art. 6 sec. 1 letter f) of the GDPR (improving communication and adapting activities to customer needs).
Pursuing claims related to concluded contracts – based on art. 6 sec. 1 letter f) of the GDPR (protection of the Administrator's legal interests).
Maintaining evidence records regarding contracts being implemented – based on art. 6 sec. 1 letter f) of the GDPR (ensuring compliance with applicable regulations and protection against claims).
5. Recipients of personal data
Personal data may be transferred to entities processing data on behalf of the Administrator, such as:
Data is transferred on the basis of a data processing agreement and only in accordance with the Administrator's instructions. Personal data will not be transferred outside the European Economic Area, unless required by law or the user's consent.
6. Period of storing personal data
Personal data is stored for the duration of the business relationship, and then for a period enabling the pursuit of potential claims, but no longer than 5 years. Data used for marketing purposes will be processed until the objection to their processing is expressed.
Personal data collected during the ongoing recruitment process will be stored only for the time necessary to achieve its objectives, i.e. until the recruitment process is completed and a candidate for the position is selected.
In the case of persons who are employed, their application documents will be attached to personal files and stored in accordance with the provisions of the law on employee documentation. The currently applicable regulations require archiving such documents for a period of 10 years, counted from the end of the calendar year in which the employment relationship ended.
The application documents of the remaining candidates who were not employed will be kept for the period necessary for evidential and archiving purposes, but no longer than 6 months from the end of the recruitment process, and will then be securely deleted or anonymized, unless the candidate consents to their use in future recruitment processes.
7. Rights of data subjects
The data subject has the right to:
Applications for the implementation of the above rights can be submitted to the e-mail address: catering@majesticfeast.pl.
In the event that processing is based on consent, it can be withdrawn at any time without affecting the legality of the previous processing.
8. Voluntary provision of data
Providing personal data to the extent necessary to conclude and perform the contract is voluntary, but necessary to provide services. Failure to provide data will prevent the conclusion or performance of the contract.
9. Data protection measures
The Administrator makes every effort to ensure the protection of processed personal data against unauthorized access, loss, damage or unlawful processing. For this purpose, it applies appropriate technical and organizational measures to ensure information security.
GDPR information clause in the scope of recruitment
In accordance with art. 13 and 14 of the GDPR, we inform you that in the recruitment process MAJESTIC GROUP SP. Z O.O. processes personal data of candidates.
1. Personal data administrator
The administrator of personal data of candidates is MAJESTIC GROUP SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, with its registered office in Warsaw, ul. Konstantego Ildefonsa Gałczyńskiego 4/901, 00-362 Warsaw.
2. Purposes and basis of processing
Data is processed for the purpose of current recruitment:
on the basis of art. 6 sec. 1 letters b and c of the GDPR and art. 10 of the GDPR in connection with the Labor Code (art. 221),
on the basis of the candidate's consent in the scope of data exceeding the requirements of the law (art. 6 sec. 1 letter a of the GDPR).
In the case of providing special categories of data (e.g. information on health), the candidate's express consent is necessary (art. 9 sec. 2 letter a of the GDPR).
3. Recipients of data
Personal data may be transferred to:
state authorities in accordance with the provisions of the law,
entities processing data on behalf of the Administrator.
4. Retention period
Personal data is stored until the recruitment process is completed. In the case of employment, application documents are archived in the employee's personal files for a period of 10 years. Documents of candidates who were not hired are deleted after the recruitment process is completed.
5. Candidate rights
Candidates have the right to:
access data,
correct,
delete data,
limit processing,
file a complaint with the Personal Data Protection Office.
Providing personal data to the extent required by law is mandatory. Providing additional information is voluntary and is treated as consent to their processing.
