Privacy Policy - House of Skills

The terms used in this Privacy Policy have the same meaning as in the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119 of 4 May 2016, p. 1, as amended by OJ L 127 of 23 May 2018, p. 2), unless defined otherwise in this Privacy Policy.

Personal data controller

The personal data controller is Konsorcjum Doradczo-Szkoleniowe S.A., the owner of the “House of Skills” brand, ul. Równoległa 4A, 02-235 Warsaw.

Data protection officer

The controller has designated a data protection officer. The person fulfilling this function is Damian Grodziński. In any matters related to the processing of personal data, including for the purpose of exercising the rights related to the processing, please contact us at: twojedane@houseofskills.pl.

Purposes of the processing of personal data and legal grounds for the processing

Processing of personal data for training purposes

If you are a training participant or if you register a training participant, we shall process your data for the purpose of entering into or performing a contract (Article 6(1)(b) of the GDPR) and, in certain cases, for purposes arising from legitimate interests (Article 6(1)(f) of the GDPR).

The categories of the processed personal data may include identification data, address details, contact details, financial data, business data (function/title).

In relation to processing, you shall have the right of access to and rectification of the data, the right of restriction of processing, the right to object to processing, the right to lodge a complaint with the President of the Personal Data Protection Office.

The provision of data shall be a contractual requirement and the refusal to provide them may prevent the entry into or performance of a contract.

Processing of personal data of customers, suppliers

If you are our customer, supplier, or partner, we shall process your data for the purpose of entering into or performing a contract (Article 6(1)(b) of the GDPR) and, in certain cases, for purposes arising from legitimate interests (Article 6(1)(f) of the GDPR).

The categories of the processed personal data may include identification data, address details, contact details, financial data, business data (function/title).

The provision of data shall be a contractual requirement and the refusal to provide them may prevent the entry into or performance of a contract.

Processing of personal data of newsletter subscribers, persons using the contact and training registration forms

We may provide specific services to you by means of electronic communication, in particular the Internet or other electronic networks in a broader sense, where the provision of such services is to a large extent automated and does not require substantial human participation and would not be possible without applying telecommunications technologies.

The services shall include:

if you have provided your email address to us in order to receive business information as defined in Article 2 par. 2 of the Act of 18 July 2002 on the Provision of Services by Electronic Means from us, your data shall be processed based on your consent (Article 10 par. 2 of the Act of 18 July 2002 on the Provision of Services by Electronic Means in conjunction with Article 6(1)(a) of the GDPR) with respect to the newsletters transmitted by electronic mail,
you may use a service provided electronically by registering to a one-time classroom or remote thematic training session or a cycle of classroom or remote training sessions (Article 6(1)(b) of the GDPR); the training registration form enables also registration on behalf of other persons,
where an account is created on the website based on the data provided when registering for training, the data shall be processed for the purpose of facilitating the placement of future orders and communicating with the controller (Article 6(1)(f) of the GDPR),
the data may also be processed for contact purposes via an electronic contact form (Article 6(1)(f) of the GDPR).

The categories of the processed personal data may include identification data, address details, contact details, financial data, business data (function/title).

In relation to processing, you shall have the right of access to and rectification of the data, the right of restriction of processing, the right to withdraw consent at any time (without affecting the lawfulness of processing based on consent before the withdrawal thereof), the right to object to processing, the right to lodge a complaint with the President of the Personal Data Protection Office.

Your personal data may be processed in the form of analytical, sale, and marketing profiling for the purpose of tailoring our materials to your needs and interests and for the purpose of making the measurements enabling the improvement of our services.

If a service contract is entered into electronically, the provision of data shall be a contractual requirement and the refusal to provide them may prevent the entry into or performance of the contract.

Processing of personal data for contact purposes

Your personal data may be processed also for contact purposes (Article 6(1)(f) of the GDPR).

The categories of the processed personal data may include identification data, contact details.

You shall have the right of access to and rectification of your data, the right to data portability and erasure, as well as the right of restriction of processing and the right to lodge a complaint with the President of the Personal Data Protection Office.

Processing of personal data for employment purposes

If you are interested in our job/collaboration offers, we shall process your data under the job application you have submitted voluntarily (Article 6(1)(a) of the GDPR). To achieve this purpose, we shall process the data to the extent specified by you – based on the information included voluntarily in your resumes, application documents (Article 6(1)(a) of the GDPR). We shall process your personal data also for purposes of legitimate interests (Article 6(1)(f) of the GDPR). If you wish to participate in future recruitment processes or projects, or if the information included in the application documents might be considered sensitive data, the data shall be processed based on your consent given freely (Article 6(1)(a) or Article 9(2)(a) of the GDPR).

The categories of the processed data shall include: full name, date of birth, contact details, education, professional qualifications, employment history, business name (for sole traders), and other data you have provided in application documents and/or resumes.

The data shall be stored for the duration of a given recruitment process, unless you give your consent for their further storage for the purpose of future recruitment processes.

In relation to processing, you shall have the right of access to and rectification of the data, the right of restriction of processing, the right to withdraw consent at any time (without affecting the lawfulness of processing based on consent before the withdrawal thereof), the right to object to processing, the right to erasure of the data, the right to lodge a complaint with a supervisory authority.

Provision of the data for the purpose of participation in the recruitment process shall be voluntary. The application documents shall, however, contain at least the following information: full name, date of birth, contact details, education, professional qualifications, employment history. The scope arises from Article 22(1) § 1 of the Act of 26 June 1974 Labour Code (Article 6(1)(c) of the GDPR). The provision of other personal data shall be voluntary.

Other purposes and legal grounds for the processing of personal data

In specific cases, we may process your data also for other purposes. This may involve the extension of the storage period of your data. For the purposes required for compliance with the legal obligations to which we are subject (Article 6(1)(c) of the GDPR), we shall process your data:

for the time of complying with the legal obligations imposed on us under relevant laws, including without limitation tax laws,
for the time for which specific laws require that we store the data (the laws may provide for various data storage periods).

If we process your personal data for achieving the purposes arising from our legitimate interests (Article 6(1)(f) of the GDPR), we shall do it for the purpose of:

establishing, defending, or exercising claims, which includes selling our claims to another entity,
promoting our products and services,
preparing compilations, analyses, and statistics,

Recipients of personal data

Recipients of your personal data may be separate personal data controllers or processors. If we commission the operations consisting in processing personal data to another entity, this shall take place in compliance with Article 28 and Article 32 of the GDPR, that is as part of entrusting the personal data for processing. Your personal data shall be entrusted exclusively for the operations where the processing of the data is the main, primary, activity rather than an effect of other, secondary, processes.

Your personal data may be accessed also by the so-called third parties. As defined in the GDPR, the data subject, controller, or processor, or representative of the controller or processor is not a third party. These are mainly public authorities, which are not deemed recipients under the GDPR, but which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law.

Data recipients may be providers of IT, technical, and organisational solutions, which enable service and management of the organisation (accounting, postal operators and couriers, providers of Internet services, including electronic mail, software, hosting), law firms and companies providing legal services.

Transfer of personal data

Personal data may be transferred:

on the basis of an adequacy decision (Article 45 of the GDPR),
subject to suitable safeguards, including standard data protection clauses, an approved code of conduct, an approved certification mechanism (Article 46 of the GDPR),
in compliance with binding corporate rules (Article 47 of the GDPR),
taking into account derogations for specific situations (Article 49 of the GDPR).

Personal data storage period

The personal data processed based on consent given freely shall be stored until the withdrawal thereof. The withdrawal of consent shall not affect the lawfulness of processing based on consent before the withdrawal thereof.

The personal data required for performing a contract or taking actions prior to the entry into the contract shall be stored for 5 years counting from the end of the calendar year in which the tax payment deadline elapses.

The personal data required for the purposed of legitimate interests pursued by the controller and consisting in the establishment, exercise, or defence of claims shall be stored until the expiry of the limitation period. The general limitation period for claims shall be 6 years. For claims related to periodic benefits, it shall be three years. The end of the limitation period shall fall on the last day of a calendar year.

Rights vested in connection with the processing

In relation to our processing of personal data, in certain cases, you may exercise the rights described below.

We shall provide you with the information about the measures taken in response to your request without any undue delay, within one month of receiving the request. This period may be extended by two months if need be, depending on the level of complexity of the request or the number of requests. In such an event, we shall inform you about the necessity to extend the request processing time-limit and provide the causes of the delay.

Right to withdrawal of consent at any time (Article 7(3) of the GDPR)

If your data are processed based on consent given freely, you may resign from the performance of operations on the data on this ground at any time. In such an event, we shall immediately discontinue the processing of data in order to achieve the purpose for which consent has been taken. However, we would like to indicate that the withdrawal of consent shall not affect the lawfulness of processing based on consent before the withdrawal thereof.

Right of access to personal data and to obtain a copy thereof (Article 15 of the GDPR)

You may obtain the information concerning our processing of your personal data and a copy thereof from us. It shall be provided to you in a popular computer file format. The first copy shall be provided free of charge, but any further ones may be charged with a fee we shall specify in accordance with the conditions arising from the GDPR.

Right to rectification of data (Article 16 of the GDPR)

We are obliged to ensure accuracy of the data we process. You may demand that your data be rectified or erased if they are inaccurate, incomplete, or have been collected unlawfully. The burden of proof of the inaccuracies shall, however, lie with the data subject.

Right to erasure of data, including the “right to be forgotten” (Article 17 of the GDPR)

At your request, we are obliged to erase the personal data concerning you. We shall do so if:

the purposes for which the data were collected have already been achieved,
the only legal ground for the processing of your personal data was consent, which was subsequently withdrawn, and there are no other legal grounds for the further processing of your personal data,
the only legal ground for the processing was consent expressed by a person under the age of thirteen,
pursuant to Article 21 of the GDPR, you have objected to the processing and you believe that we have no overriding legal grounds for the processing permitting the further processing of your personal data,
your personal data have been processed unlawfully, i.e. for unlawful purposes or without any ground for the processing of personal data.

The “right to be forgotten” is a special form of right to erasure of data. If your data have been published, for example on this website, and you have the right to request erasure of such data, we are obliged to erase any copies thereof and links thereto. We shall also take actions to have other entities which have processed your personal data erase them from their resources. However, this right is not absolute – when taking actions to have it exercised, we shall take into account the available technology and costs, which may limit the application of the right.

Right to restriction of processing (Article 18 of the GDPR)

We are obliged to restrict the processing of your personal data at your request. In such an event, we shall refrain from making any operations on the data other than storage thereof. If you have any doubts about the accuracy of the data, we shall restrict their processing for a period enabling verification thereof. We shall restrict the processing also when you object thereto.

Right to data portability (Article 20 of the GDPR)

You shall have the right to receive the personal data and to transmit those data to another personal data controller of your choosing. The right to data portability shall apply when the controller processes your personal data based on your consent (Article 6(1)(a) of the GDPR) or when the processing is necessary for the performance of a contract (Article 6(1)(b) of the GDPR) and the operations on the data are carried out by automated means, i.e. without human involvement.

Right to object to the processing (Article 21 of the GDPR)

You may require that the processing of your personal data be discontinued, in particular for reasons related to your particular situation.

However, the objection shall be inapplicable if you have given your consent to the processing. In such a situation, you should withdraw the relevant consent; the effect shall be the same, but – from the legal point of view – objection and withdrawal of consent are two different institutions applicable in different cases.

You may not object effectively if:

the processing of personal data is necessary for the performance of a contract (Article 6(1)(b) of the GDPR),
the processing is necessary for compliance with the legal obligation to which we are subject (Article 6(1)(c) of the GDPR),
the processing is necessary in order to protect the vital interests of the data subject or of another natural person (Article 6(1)(d) of the GDPR).

Right not to be subject to automated individual decision-making, including profiling (Article 22 of the GDPR)

You shall have the right not to be subject to decisions based solely on automated processing, including profiling, if such decisions were to produce legal effects concerning you or to similarly significantly affect you.

However, automated processing of your data, including profiling, shall be allowed where:

it is necessary for entering into or performing a contract,
it is expressly authorised by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests,
is based on your explicit (not implied) consent.

Right to lodge a complaint with a supervisory authority (Article 77 of the GDPR)

If you believe that our activities related to the processing of personal data have infringed your rights, you may lodge a complaint with a supervisory authority, i.e. an independent public authority responsible for the monitoring of the application of the GDPR. In Poland, the function is performed by the President of the Personal Data Protection Office. You may contact the supervisory authority:

via mail: ul. Stawki 2, 00-193 Warsaw,
electronically, via the document exchange available at: https://www.uodo.gov.pl/pl/p/kontakt,
via telephone under hotline number: 606-950-000.

The rights mentioned above may be restricted in certain situations, e.g. when we are able to demonstrate that we are legally obliged to process your data. If you wish to exercise your rights, it is sufficient to send the relevant request using the contact details indicated in the Privacy Policy.

Sources of personal data

The majority of the data we process are the information you provide to us on your own. However, in certain cases, we may process other information we are able to develop based on your activity or in combination with other data. This concerns in particular the information collected for the purpose of the conducted analyses and measurements in the marketing context.

Where we have not obtained personal data directly from you, we hereby inform you that:

the data might have been obtained from the person or entity registering you as a training participant,
the data might have been obtained from the person or entity designating you as a representative or contact person,
the data might have been obtained from online resources, including social media, where you have published your professional profiles on your own.

Cookie files

Our website uses cookie files, i.e. the so-called cookies. Cookie files are information in the form of small text files stored on your computers by the server. They enable the server to read the information from time to time if it connects with a given computer.

The information collected using cookie files is not personal data, yet it may be used to make certain functions available to you. Such data are encrypted in a manner preventing unauthorised access thereto.

The software used for browsing websites permits storage of cookie files on your computers by default – you have given consent with your web browser settings, (Article 173 of the Act of 16 July 2004 Telecommunications Law in conjunction with Article 6(1)(a) of the GDPR).

You may configure your browser to disable automatic acceptance of cookie files or receive the information about sending such a file to the device from time to time. You may obtain more detailed information about handling cookie files and the possible configurations from your browser settings. They are available under the following links:

The level of restrictions on the use of cookie files may affect the availability of and functions offered by our website, including the possibility to obstruct the full operation thereof.

Our website uses cookie files for the purpose of proper configuration, in particular for:

tailoring the website content to your preferences,
making a proper configuration enabling in particular verification of the authenticity of a browser session,
recognising the device and displaying the website, which has been tailored to your individual needs, properly,
remembering your settings and interface personalisation, e.g. as regards the selected language or region,
remembering the history of visited webpages on the website for the purpose of recommending content, font size, layout, etc.

Amendments to the Privacy Policy

We hereby reserve the right to update our Privacy Policy. The amendments may arise from the following causes:

due to the necessity to adapt the provisions of the Privacy Policy to the applicable laws or decisions issued by competent official authorities,
as an effect of a changed interpretation of generally applicable laws (which affects the content of the Privacy Policy),
as a result of court decisions or decisions or recommendations of competent offices or authorities,
the necessity to remove typographical errors or mistakes in the Privacy Policy,
change of data, including e.g. telephone and address, names, contact details, or update of the links included in the content of the Privacy Policy.

The amendments shall come into force immediately upon the publication thereof on the website.