Zásady ochrany osobních údajů

This Privacy Policy sets out the rules for the processing and protection of personal data by Ferro S.A., including data provided and collected through the website https://career.ferro-group.com/

I. GENERAL PROVISIONS

1. Controller of personal data

The Controller of personal data is FERRO S.A. with its registered office in Skawina, at ul. Przemysłowa 7, entered in the register of entrepreneurs of the National Court Register under KRS number: 0000289768, which may be contacted in writing at: ul. Przemysłowa 7, 32-050 Skawina.

2. Data Protection Officer

The Controller has appointed a Data Protection Officer. If you have any questions regarding the processing of personal data or the exercise of privacy rights, please contact the Data Protection Officer in person or by correspondence at: ul. Przemysłowa 7, 32-050 Skawina, or by email at: iod@ferro.pl

3. Definitions used in this Policy:

Controller: the Controller of personal data within the meaning of the GDPR, i.e. FERRO S.A. with its registered office in Skawina, at ul. Przemysłowa 7, 32-050 Skawina, entered in the register of entrepreneurs of the National Court Register kept by the District Court for Kraków-Śródmieście in Kraków, 12th Commercial Division of the National Court Register under KRS number: 0000289768, NIP: 944-20-51-648, REGON: 356375388;

Privacy Policy: this Privacy Policy;

GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

Website: the website operated by the Controller at the following internet address: https://career.ferro-group.com

User(s): any adult natural person visiting, staying on and/or using the Website, its subpages or specific functionalities, who is a potential Candidate.

II. DETAILED INFORMATION ON THE PROCESSING OF PERSONAL DATA

1. Scope of personal data processed, purposes and legal bases of processing

This Privacy Policy applies to the processing of personal data of job candidates provided to the Controller through the recruitment form available on the Website, including data contained in application documents, in particular CVs, and data provided in the course of communication related to a given recruitment process. The Website is used exclusively to handle recruitment applications and does not include any other services or functionalities requiring the processing of personal data.

The Controller processes personal data provided by the candidate in the recruitment form and in the attached application documents, in particular: first name and surname, address, contact details, date of birth, information on education, professional qualifications and previous employment history, as well as other data voluntarily provided by the Candidate in connection with participation in the recruitment process.

In connection with the use of the recruitment form, technical information necessary for its proper operation and for handling the application may also be processed, such as the IP address and information relating to the submission of the form.

Candidates’ personal data are processed solely for the purpose of conducting the recruitment process for the position indicated in the job advertisement, and where separate consent has been given – also for the purpose of participation in future recruitment processes conducted by the Controller. The Controller processes personal data on the following legal bases and for the following purposes:

conducting the recruitment process on the basis of the employer’s entitlement under Article 22(1) of the Labour Code, with respect to: first name and surname, parents’ names, date of birth, place of residence, correspondence address, education and previous employment history. The legal basis for processing the above personal data is compliance with a legal obligation (Article 6(1)(c) GDPR);
conducting the recruitment process on the basis of your consent to the processing of personal data other than those indicated in the point above, provided in the CV, form, cover letter and other documents (Article 6(1)(a) GDPR);
pursuing the Controller’s legitimate interest with respect to data obtained from you during the recruitment process in connection with verifying your skills and abilities required for the position specified in the job advertisement. The legal basis for processing these data is the Company’s legitimate interest (Article 6(1)(f) GDPR);
conducting future recruitment processes on the basis of your consent to the processing of personal data provided in the CV, form, cover letter and other documents (Article 6(1)(a) GDPR);
transferring data to other companies within the Controller’s capital group for their recruitment purposes. The legal basis for transferring your personal data is consent (Article 6(1)(a) GDPR).
with respect to analyses, statistics and the secure operation of the Website, the Controller processes Users’ data, including, among others, IP address, other identifiers and information collected through cookies for analytical and statistical purposes, administration of the Website, and ensuring its security, efficient operation and functionalities. The legal basis for processing is the legitimate interest of the Controller (Article 6(1)(f) GDPR), consisting in managing the Website, analysing Users’ activity and preferences in order to improve the functionalities used, the services provided by the Controller and the content displayed to the User. In the case of cookies, the basis for data processing is the legitimate interest of the Controller in connection with the consent granted by you for the Controller’s use of cookies on the Website.

***

The Controller kindly requests that no information belonging to special categories of personal data be provided through the Website (e.g. information concerning race or ethnic origin, religious or philosophical beliefs, political opinions, information concerning physical or mental health, genetic data, etc.). The Website is intended

2. Recipients of personal data

Depending on the purpose of processing, the Controller may disclose personal data to:

authorised employees and collaborators of the Controller, as well as entities and employees belonging to the Controller’s capital group, in particular HR department employees, persons responsible for assessing candidates and persons making employment-related decisions;
providers of services supporting the recruitment process, in particular providers of recruitment systems, IT services, hosting, technical support for the Website and tools used to receive and handle candidates’ applications, including analytics service providers – Google Analytics (if enabled on the website – cookie settings);
supervisory authorities, courts and other public authorities or authorised entities, only to the extent that the obligation to disclose data results from legal provisions and is connected with the recruitment process conducted or with the establishment, exercise or defence of claims relating to recruitment.

3. Retention period of personal data

The Controller does not retain the User’s personal data for longer than necessary to achieve the purposes for which the data were collected. Where data are processed for the purpose of conducting a recruitment process, the data will be processed:

in the case of data collected for the purpose of carrying out the recruitment process – until the recruitment process is completed, and thereafter for a maximum period of 6 months from the completion of recruitment;
on the basis of consent to future recruitment processes – for a period of 2 years from the commencement date (announcement) of the current recruitment process;
for the period of use of the Website, until the data become outdated or lose their usefulness — with respect to personal data obtained through the Website, the use of cookies, and data processed mainly for analytical, statistical and Website administration purposes.

If consent is withdrawn – where processing is based on consent – such data will be deleted without undue delay, unless there is another basis for their processing.

Data processed for the purposes of establishing, pursuing or defending against claims related to the recruitment process, as well as for archival and evidentiary purposes in the event of a legally justified need or obligation to demonstrate facts, in particular to demonstrate compliance with obligations under the GDPR, will be processed for a maximum period of 2 years from the completion of the recruitment process in which the User participated.

4. Rights related to the processing of personal data

WIn the situations and on the terms specified in detail in Articles 15–22 GDPR, you have rights concerning the protection of personal data. You have the right to lodge a complaint with the competent supervisory authority (in Poland, the President of the Personal Data Protection Office) if you find that the processing of personal data by the Controller is unlawful. In addition, you have the right to:

request access to personal data, rectification of personal data concerning you that are inaccurate, erasure, restriction of processing, and portability of personal data;
object to processing carried out because it is necessary for the purposes of the legitimate interests pursued by the Controller – on grounds relating to your particular situation, or where processing is carried out for direct marketing purposes;
withdraw consent to the processing of personal data at any time – to the extent that processing is carried out solely on the basis of your consent (withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal).

To exercise any of the above rights, please contact the Controller.

5. Profiling

The Controller does not use personal data for automated decision-making, including profiling, which produces legal effects concerning the person or similarly significantly affects the person.

6. Transfer of personal data to third countries

As a rule, the Controller does not transfer Candidates’ personal data to third countries.

III. FINAL PROVISIONS

In matters not regulated by the Policy, generally applicable personal data protection laws shall apply.
The Policy applies from 1 July 2026 and may be subject to further amendments.