Widerix Privacy Notice for candidates and personnel

1. Introduction

Widerix makes sure your personal data stays secure. In this privacy policy, you will find information concerning the rights of your personal data protection. “Widerix,” “we,” and “us” refer to Widerix .

This privacy notice applies to potential candidates, current and former employees, as well as workers and contractors. It aims at revealing the way we handle your information, in particular, why and how we collect it during the interviews or communication with us on the point of your employment. It also describes how we use your personal data before, during, and after your working relationship with us, with whom we might share it, and how long we usually keep it, so you are aware of your rights. This policy is not a part of an employment contract or any other contract to provide services.

Please make sure you read and fully understand this policy, and how your personal information is controlled by Widerix. If you have any questions or concerns about how your information is handled, please direct an inquiry to hello@widerix.com.

2. Data we gather about our candidates

Widerix carefully fulfills its responsibilities to protect your personal data. That is why Widerix is devoted to making the process of collecting and using the subject's data as transparent as possible and meet its data protection obligations.

2.1. We collect the following categories of data:

Personal information gathered by Widerix includes:

your name, passport data, address, and contact details, including e-mail address, telephone number, date of birth and gender;
communication history with you regarding potential employment with Widerix and recruitment history: CV details, as well as previous work and educational experiences;
details of your qualifications, skills, experience, and employment history, including start and end dates;
information about your willing remuneration;
information about your marital status, next of kin, and dependants;
details of your preferred schedule (days of work) and attendance at work;
details of any disciplinary or grievance procedures you have been involved in, including any warnings issued to you and related correspondence, etc.;
interview results and feedbacks.

Widerix may collect personal information in different ways. We can get it directly from you or through application forms, CVs or resumes, as well as interviews, meetings, or any other assessments. Therefore, we collect information through the application and recruitment process with the help of recruitment service providers or consultants, if they are involved.

In addition, Widerix may also get personal information about you from third parties. It can be either references from former employers provided by you to us or information from employment background check providers. All these are obligatory executed under the law or our contractual obligation with customers (inter alia, out legitimate interest).

2.2. How we process the data gathered

Under data processing, we perform any operation or a set of operations, such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, usage, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, support, maintenance, etc.

Data gathered is stored in Widerix's recruitment systems and in other IT systems from the list below (including e-mail systems and services by Google (Privacy Policy) and Microsoft (Privacy Policy)).

Widerix uses the following third-party providers to collect and process your personal data. Below, you will find the sources enlisted.

Widerix may use the gathered information for any purpose that does not violate our legitimate interest or legal ground for data processing stipulated in the next chapter.

2.3. Purposes and legal basis for data processing

While processing your personal data, we put our legitimate interests (“Legitimate interests”) in the first place, which means your interests and fundamental rights do not revoke ours. Our major legitimate interest is to continue to develop our business, both qualitatively and quantitatively, and improve the performance of Widerix. Below, you will find some purposes and principles for processing your personal data:

conducting recruitment process, arranging interviews, testing labor market, and making a decision on appointment with candidates;
determining labor requirements, setting individual targets for Widerix performance, and organizing internal processes;
assessing qualifications and competences in the potential role you might be signed for, managing talent and succession, including decisions about career and promotions in accordance with our HR strategy;
potential employees development: delivering overall and individual development programs, arranging training and development activities, including on-boarding training, certification and license administration in accordance with performance and development processes at Widerix;
making decisions about your potential employment or engagement with Widerix;
conducting data analytics studies to review and better understand labor market, retention, turnover rates, etc.;

sending any updates regarding open vacancies, career opportunities, positions/openings you have shown interest in or might be interested in, as well as providing further information related to your professional interest;
contacting and communicating with you in regard to your initial interest in our job opportunity;
getting your consent to further contact you in regard to any other openings/job opportunities you might be interested in;
for maintenance and support activities of our Recruitment System and related activities.

In particular cases when we need to obey customer requirements under the contract with your consent (“Consent”), we will conduct background checks (criminal, credit history, drug tests, etc.). So, we may collect and process some sensitive information about you.

2.4. Data recipients

The subject’s personal data may be shared between in-house HR team members, as well as your potential manager, managers in the service/business area you work in, and company’s IT staff, if data access is needed to fulfill their roles.

Widerix shares your data with third parties to obtain pre-employment references from other employers, employment background checks from third-party providers, as well as necessary criminal records checks, if it is needed, under the law or under our contractual obligation with customers. In such cases, we limit the amount of personal data shared to an absolute minimum required.

2.5. Data retention period

Your personal data is stored in Widerix for 1 (one) year from the date when your information was transferred to our recruitment system.

3. Data we gather from our personnel

Widerix collects and processes personal data of its personnel to manage the employment relationship or for any other purpose. Widerix carefully treats this information and is committed to meet its data protection obligations.

3.1. We collect the following categories of data

Below, you will find the categories of data collected by Widerix:

your name, passport data, address, contact details, including e-mail address, telephone number, date of birth and gender
the terms and conditions of your employment: type of contract, contract details, title, position description, working history and records, working location, and years of service
details of your qualifications, skills, experience, employment history, including start and end dates with previous employers and Widerix
information about your remuneration, including entitlement to benefits, such as pensions or insurance cover
details of your bank account
information about your marital status, next of kin, dependants, and emergency contacts
information about your citizenship and entitlement to work with Widerix
Information about training, educational events attendance, as well as participation in conferences and meetups
information about social networks, emergency contacts submitted by you, as well as details of FLSA code, SSN, ethnicity, veteran status, and employment status
information about trial period results and exit interview details, as well as performance review information
information about company benefits usage, such as health insurance, sports compensation, etc.
details of your schedule (days of work and working hours) and attendance at work
details of leave periods taken, including holiday, sickness leave, family leave, vacations, remote work requests, and any other absence reasons
details of any disciplinary or grievance procedures you have been involved in, including any warnings issued to you and related correspondence
assessments of your performance, including appraisals, performance reviews and ratings, performance improvement plans, and related correspondence
user logs and access control related information, including physical access to Widerix premises
information about your use of our data and communication systems, as well as other Widerix assets, for example, computers, servers, etc.

From your consent, we may also collect, store, and use the following “special categories” of your personal information, which will be collected and used in accordance with local legislation or the contractual obligations with customers. Sensitive data we may collect about you includes information about medical or health conditions (drug tests) or information about any criminal records, in particular, for employment screening.

3.2. How we process the data gathered

When processing your personal information, we perform any operation or set of operations on your personal data or set of personal data, which may include collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, usage, disclosure by transmission, dissemination, alignment or combination, restriction, erasure or destruction, support, maintenance, etc.

The data gathered is stored in Widerix's HR management system and other IT systems, including the services by Google (Privacy Policy) and Microsoft (Privacy Policy) and our corporate e-mail system, hosted on Gmail.com (Privacy Policy).

Widerix uses the following third-party providers to collect and process your personal data. Below, you will find the sources enlisted.

Widerix may use the gathered information for any purpose that does not violate our legitimate interest or legal ground for data processing stipulated in the next chapter.

3.3. Purposes and legal basis for data processing

For some cases we are obliged to process your personal data under our contract with you or under legal obligations as an employer (“Contractual or Legal obligations”).

While processing your personal data, we put our legitimate interests (“Legitimate interests”) in place, which means your interests and fundamental rights do not revoke ours. Our major legitimate interest is to continue to develop our business, both qualitatively and quantitatively, and improve the performance of Widerix.

For some cases we use your consent (“Consent”) to process sensitive data about you. In the table below, you will find some purposes and principles for processing your personal data.

Contractual or legal obligations

Entering or performing employment contract, determining the terms of your employment with Widerix, managing an employment contract, as well as amending agreements, appendixes, and other contracts related to an employment relation.
Paying out agreed compensations (salary, bonuses) and, if applicable, deducting tax, mandatory social contributions and national insurance contributions in accordance with local legislation.
Making decisions about salary reviews and compensation packages based on Widerix salary review processes and best practices.
Providing the contractually agreed bonuses and benefits or complementary benefits awarded to you according to the company’s policy.
Enrolling you in a pension arrangement in accordance with statutory automatic enrollment duties.
Checking if you are legally entitled to work in the country where we operate and your resident status.
Monitoring attendance, vacation, absence, and sick leaves.
Managing health and safety (H&S) activities: training on H&S, distribution of individual protective equipment, monitoring safety behavior, administrating the related records.In case of any accidents at work, investigation and reporting to the relevant authorities, arrangement of health examinations, if applicable, and complying with other health and safety obligations will be conducted in accordance with local legislation.
Ensuring equal opportunities to monitor and prevent discrimination.
Carrying out our contractual obligations with customers and suppliers. For instance, personal data included in purchase orders, quality documentations, e-mail correspondences, and contracts between us and a customer.
Managing traveling activities: arranging accommodation and flights, managing travel expenses reports and payments, arranging visa invitations and/or visas, etc.
Keeping records of employees data, etc.

Legitimate interests

Making decisions about your continued employment or engagement.
Perform HR activities and procedures, such as career planning, setting goals, conducting educational events, and creating greater employee engagement.
Sending newsletter and other information related to the employment with Widerix.
Processing analytics and organizational data.
Post the data on Widerix corporate websites.
Carrying out our contractual obligations with customers and suppliers. For example, personal data included in purchase orders, quality documentations, e-mail correspondences, as well as contracts between us and a customer.
Inviting you to participate in long-term incentives provided by Widerix, if applicable.
Determining performance requirements, setting individual targets, conducting regular performance reviews and assessments, managing performance records and analytics in accordance with the performance and development processes at Widerix.
Assessing qualifications and competences in the role you are signed for, as well as managing talent and succession, including decisions about career and promotions according to our HR routines.
Employees development: composition of overall and individual development programs, arrangement of training and development activities, including on-boarding training and administration according to the performance and development processes at Widerix.
Travel management: arrangement of accommodation and flights, managing travel expenses reports and payments, as well as arranging visa invitations and/or visas.
Assurance of network and information security, including access management to prevent unauthorized access to our computers and electronic communications systems, as well as preventing malicious software distribution.
Monitoring your use of our information and communication systems, as well as other Widerix assets to ensure compliance with our IT policies.
Ensuring security of facilities and assets at Widerix and employees personal belongings via monitoring swipe card records (or biometric data readers) and surveillance cameras (CCTV).
Сonducting data analytics studies to review and better understand employee retention and turnover rates.

Consent

Сonducting background checks (criminal records, credit history, drug tests, etc.), which are obligatory under contracts with our customers.

Some of the above-mentioned reasons for processing your personal data may overlap.

We will only use your personal information for the purposes mentioned in this policy, unless we reasonably consider that we need to use it for any other reason, which is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and explain the legal basis, which allows us to do so. Please note that we may process your personal information without your knowledge or consent, in compliance with the above-mentioned rules, when this is required or permitted by law.

3.4. Data recipients

Furthermore, Widerix shares your data with third parties that process data on their behalf. This data is related to payroll, pension providers, insurance provider/broker, absence management system, HR consultants, the provision of benefits,occupational health services, etc.

In addition, we share your personal information with other entities in the Widerix group as part of our regular reporting activities on company performance regarding business reorganization or restructuring exercise for system maintenance support and hosting of data.

We also share your personal information with different governmental authorities, institutions or agencies (or similar), as well as insurance companies when required by law for the purpose of their regulatory tasks. We may also transfer your personal information to a regulator or any other legal body.

We may share your personal data with other third parties, e.g., service providers, suppliers, customers, and business partners to fulfill our contractual obligations. In such cases, we limit personal data shared to the absolute minimum required.

3.5. Data retention period

Widerix will hold your personal data for the duration of your employment, as well as during obligatory personnel record-keeping in accordance with the legislation. After your employment with Widerix comes to an end, the period for storing and processing your personal information will be set in accordance with the law.

4. Your rights

Below, you will find a list of the rights you are subject to. Please note that some of the enlisted rights may be limited for the requests, which expose personal information of another individual, who is subject to the very same rights of privacy. In such a case, we will not be able to satisfy your request for data deletion, if it contains information we are eligible to keep by law.

The right to be informed and to access information. You have legal rights to access your personal data, as well as request it, if we use this data for any purpose. Complying with our general policy, we will provide you with a free copy of your personal information in use within a month, after we receive your request. We will send your information in use via a password-protected PDF file. For excessive or repeated requests, we are eligible to charge a fee. In case of numerous or complex requests, we are eligible to prolong our response time by as much as two additional months. Under such circumstances, you will be informed about the reasons for these extensions. In case we refuse to address a particular request, we will explain why it happens and provide you with a list of further actions you are eligible to proceed. If you will take any further action, we will require two trusted IDs from you to prove your identity. You may forward your requests to hello@widerix.com. Please provide information about the nature of your request to help us to process your enquiry.

The right for rectification. In case you believe we store any of your personal data, which is incorrect or incomplete, you may request us to correct or supplement it. You also have the right to introduce changes to your information by logging into your account with us.

The right to erase, or "the right to be forgotten". Under this principle, you may request us to delete or remove your personal data, if there is no solid reason for your data to continue processing. If you would like us to remove you from our database, please email to hello@widerix.com. The right to be forgotten may be brought into force under the following reasons:

Data, which no longer has a relation to its original purpose of collection.
You withdraw consent with respect to the original reason data was processed under, and there is no other reason for us to continue to store and process your personal data.
You have objections to processing your personal data, and there are no overriding legitimate reasons for us to continue processing it.
Your personal data has been unlawfully processed.
Your personal data has to be deleted to comply with a legal obligation in the European Union or Member State law to which Widerix is subject.
Your personal data has been collected in relation to the offer of information society services.

The right to restrict processing. Under this right, you may request us to limit processing your personal data. In this regard, we are eligible to store information that is sufficient to identify which data you want to be blocked, but cannot process it further. The right to restrict processing applies to the following cases:

Where you contest the accuracy of your personal data, we will restrict data processing until we have verified the accuracy of your personal data.
Where you have objected to data processing under legitimate interests, we will consider whether our legitimate interests override yours.
When data processing is unlawful, and you oppose data deletion and request restriction instead.
If we no longer need your personal data, but you require this data to establish, exercise, or defend a legal claim.

If we have disclosed your personal data in question to third parties, we will inform them about the restriction on data processing, unless it is impossible or involves disproportionate effort to do so. We will inform you, if we decide to lift a restriction on data processing.

The right to object. You are eligible to object to processing your personal data based on legitimate interests (including profiling) and direct marketing (including profiling). The objection must be on “grounds relating to his or her particular situation.” We will inform you of your right to object in the first communication you receive from us. We will stop processing your personal data for direct marketing purposes, as soon as we receive an objection.

The right to data portability. You are eligible to obtain your personal data, which is processed by Widerix, to use it for your own purposes. It means you have the right to receive your personal data—that you have shared with us—in a structured machine readable format, so you can further transfer the data to a different data controller. This right applies in the following circumstances:

Where you have provided the data to Widerix.
Where data processing is carried out, because you have given Widerix your consent to do so.
Where data processing is carried out to develop a contract between you and Widerix.
Where data processing is carried out automatically. (No membership data is processed using automated means, so this right does not apply.)

Withdrawal of consent. If we process your personal data based on your consent (as indicated at the time of collection of such data), you have the right to withdraw your consent at any point in time. Please note that if you exercise this right, you may have to provide your consent on a case-by-case basis for the use or disclosure of certain personal data, if such use or disclosure is necessary to enable you to utilize some or all of our services.

Right to file a complaint. You have the right to file a complaint about manipulations applied to your data by Widerix with the supervisory authority of your country or a European Union Member State.

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.

5. Data security and protection

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, altered, disclosed, or accessed in an unauthorised way.

We limit access to your personal data to those employees, agents, contractors, and other third parties on a need-to-know basis, i.e., who need the access in order to fulfill the tasks and duties relating to a service provision. All service providers are permitted to process your personal data based on our instructions, they are subject to a duty of confidentiality, and they are required to be compliant and demonstrate the compliance with personal data protection and secuгity.

Our IT systems are protected against unauthorised access with various levels of controlled and password-protected access rights.
When transferring or disclosing your personal data, the safety measures vary based on the sensitivity of data and may include, e.g., strong identification of the recipient and encryption of the transferred information.

Any sensitive information (such as health-related information or any sensitive data required by local legislation) will usually be used separately from other personal data, and access rights to such sensitive personal data are granted only with weighty reasons to persons making decisions, usually HR representatives, as well as direct manager and direct manager’s manager.

We have implemented procedures to deal with any actual or suspected data security breach and will notify you and any applicable authority about breach, when we are legally required to do so.

We are avoiding personal data collection and usage in a paper format. If required, paper documents and copies will always be stored in locked-up premises. Our IT organization together with our DPO and Information Security Manager monitor the safety and integrity of personal data protection on a regular basis and have implemented technical measures to prevent and detect any safety breaches that may threaten your personal data.

6. Data we gather if you are our customer

As an international company, if necessary, we will transfer the personal information we collect about you to the Widerix entities.

We ensure that appropriate safeguards are in place to provide adequate levels of protection of your personal data as required by applicable data protection laws. The data collected by Widerix may be transferred across our offices. Headquartered in the USA, Widerix is an international company with an office in Poland. If you have questions about the transfer, please contact us by hello@widerix.com.

If you are part of our management team, sales organization, or sourcing organisation, we will transfer name, e-mail address, telephone number, job position, place of work, country, and other business-related data, such as personal data included in purchase orders, quality documentations, e-mail correspondences, contracts, and other agreements between a customer/supplier and Widerix. In addition, we will transfer business-related documentation to a Widerix site or to customers or suppliers, strictly in order to perform our contract with such customers or suppliers.

7. General description

We may supplement or amend this policy by additional policies and guidelines from time to time. We will post any privacy policy changes on this page. We encourage you to review our privacy policy, whenever you use our services to stay informed about our data practices and the ways you can help to protect your privacy.

We do not knowingly collect personal information from individuals under 16. If we become aware that an individual under 16 has provided us with personal information, we will take measures to delete such information.

Contact us

Your information is controlled by Widerix. If you have questions or concerns about how your information is handled, please contact us at hello@widerix.com, or

Widerix Privacy Mailbox

8 The Green STE A

Dover, DE 19901

Widerix LLC.