Data Controller
We inform you that the administrator of your personal data is the entity from the eSky Group indicated in the recruitment announcement, i.e. eSky.pl S.A. with its registered office in Katowice 40-265, ul. Murckowska 14a (hereinafter also referred to as the "Employer" or "Administrator"). Contact with the administrator is possible via email: iod@esky.com or Thomas Cook Tourism (UK) Limited, a company registered in England and Wales under company number 12211539 with its registered office at: Units 21 & 26, The Royal Exchange, London, United Kingdom, EC3V 3LN. Contact with the administrator is possible via email: dataprotection@thomascook.com. It is also possible to contact the provided registered address of the Administrator, which is also the correspondence address.
Purposes and Legal Basis of Data Processing
The personal data you provide will be processed by the administrator for recruitment purposes, based on:
-
A specific legal provision regulating the collection of data from a person applying for employment under an employment contract (in the case of Poland: Article 6(1)(c) of the GDPR* in conjunction with Article 22(1) § 1 of the Labour Code; in the case of the United Kingdom: Article 6(1)(c) of the UK GDPR**) and the Employment Rights Act 1996, meaning when offering employment under an employment contract and providing only the data covered by this provision, i.e., name(s) and surname, date of birth, contact details provided by you, as well as education, professional qualifications, and employment history if they are necessary for the Employer to perform work of a specified type or in a specified position; or
-
Based on your consent - in accordance with Article 6(1)(a) of the GDPR or Article 6(1)(a) of the UK GDPR (as applicable) - which applies in cases where:
-
In the case of the current recruitment process: an employment contract is offered, and for recruitment purposes, you provide in your CV or application documents other data than those the Employer can process based on the Labour Code, i.e., other than: name(s) and surname, date of birth, contact details provided by you, education, professional qualifications, and employment history if they are necessary for the Employer to perform work of a specified type or in a specified position; or
-
In the case of the current recruitment process: a contract other than an employment contract (e.g., a contract for services) is offered, and data processing concerns all data you provide in your CV or application documents for the purpose of the recruitment process; or
-
You wish to participate in future recruitment processes with the Employer (processing concerns all data you provide in your CV or application documents for future recruitment processes).
Due to the nature of conducting recruitment processes via the electronic elevato system, your email address will be processed to identify you in the elevato system. This identifying function helps properly exercise your rights under applicable law, such as withdrawing consent, updating data, obtaining its content, etc. This constitutes the legitimate interest of the data controller, and the legal basis for processing is Article 6(1)(f) of the GDPR or Article 6(1)(f) of the UK GDPR (as applicable).
A legitimate interest of the data controller also includes archiving data after the recruitment process has ended or after consent for future recruitment processes has been withdrawn. Such archiving serves as evidence for defense, establishing, or pursuing claims, based on Article 6(1)(f) of the GDPR or Article 6(1)(f) of the UK GDPR (as applicable).
Data Recipients
Personal data may be disclosed to employees or collaborators of the data controller, as well as entities providing support services under commissioned services agreements and in accordance with data processing agreements, particularly in the area of recruitment support.
A data recipient is, among others, Elevato S.A. with its registered office in Bielsko-Biała, ul. Michałowicza 12, 43-300 Bielsko-Biała, as the entity providing and maintaining the Elevato system used for recruitment support conducted for the data controller.
Data recipients may also include entities from the eSky Capital Group mentioned at the beginning to support recruitment conducted for the data controller.
Data Retention Period
Your personal data will be processed for the duration of the current recruitment process, and if additional consent is given, your personal data will also be processed for future recruitment needs until consent is withdrawn, but no longer than 2 years. If the recruitment process ends and no additional consent for future recruitment processes was given, or if consent for processing data for future recruitment purposes is withdrawn, your personal data will be processed solely in the form of archiving, for evidentiary purposes, for the period applicable to the statute of limitations for claims, which will be a maximum of 5 years.
Rights
You have the right to request access to your personal data, the right to rectify, delete, or restrict processing, as well as the right to object to processing and the right to data portability. You may withdraw your consent at any time. Withdrawal of consent does not affect the legality of processing carried out based on consent before its withdrawal. Please direct such requests to the email address provided in the "Administrator Data" section.
Additionally, you have the right to lodge a complaint with the supervisory authority.
Necessity of Providing Data and Consequences of Non-Provision
For recruitment concerning employment under an employment contract, the Employer may require the provision of data specified in the Labour Code, i.e., name(s) and surname, date of birth, contact details provided by the Candidate, education, professional qualifications, and employment history if they are necessary for the Employer to perform work of a specified type or in a specified position. If the Employer marks these data as necessary, providing them is a requirement to participate in recruitment, and refusal to provide them will result in the inability to take part in recruitment. For data not required by the Labour Code, providing them is voluntary and their absence does not affect participation in recruitment.
For recruitment for a position where a civil law contract is offered, providing data is not required by law (it is voluntary), but providing the data designated by the Employer as adequate is necessary to properly proceed with recruitment. Refusal to provide such data will result in your application being omitted from the recruitment procedure. For data other than those marked as necessary, their absence does not affect participation in recruitment.
In the case of an email address marked as mandatory (an identifying data point allowing correct identification in the system), failure to provide an email address prevents participation in recruitment conducted via the recruitment system. The candidate has alternative methods to submit their application via email:talent@esky.com.
We inform you that recruitment decisions will not be made in an automated manner.
Information Clause for Job Candidates Regarding the Internal Reporting Procedure
In connection with the recruitment process/entering negotiations for an agreement with eSky.pl S.A., we inform you that our company has an internal whistleblower reporting procedure designed to ensure transparency and compliance with the Whistleblower Protection Act of June 14, 2024.
The internal reporting procedure at eSky.pl S.A. allows job candidates to report irregularities or legal violations discovered during the recruitment process.
Reports can be made anonymously or publicly, depending on your choice, using the following reporting channels:
-
By traditional mail to the address: eSky.pl S.A. ul. Murckowska 14a, 40-265 Katowice, with the necessary note: "WHISTLEBLOWER - DO NOT OPEN!"
-
Through the SygnaApp portal at: https://app.sygnaapp.pl/system-zgloszen-wewnetrznych/esky-pl-s-a/.
We guarantee that all reports will be treated with the highest confidentiality and that whistleblowers will be protected from negative consequences.
* RODO – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR).
** UK RODO – The GDPR as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018.