An enquiry with no follow-up
12 months from the last contact
- Name, phone number, the message itself
- Applies to every copy of the enquiry: e-mail, messenger and spreadsheet
- Deleted earlier at your request
Document · in force from 23.09.2026
Privacy policy
Written so that it can be read without a lawyer. If anything is still unclear afterwards, write to us — you will get an answer to your question, not a quotation from the regulation.
Who is responsible for your data
Controller
The data controller is WNR Group sp. z o.o., registered office at ul. Albatrosów 24A, 05-500 Piaseczno, entered in the court register under KRS 0001031454, tax number 1231532016, REGON 525071870, employment agency register entry KRAZ 29795. The office where we meet: Żurawia 6/12 in Warsaw.
On data matters we write and reply at [email protected] or on +48 574 679 797 during office hours.
Where your data comes from
From you alone: the form on this site, a WhatsApp message, an e-mail or a phone call. We do not buy databases and we do not collect data from other services.
Giving us your data is voluntary, but without a phone number or an e-mail address there is no way for us to reply. When a contract is concluded, giving the data required by law is a condition of concluding it.
For what purpose and on what basis
Each purpose has its own legal basis under article 6 GDPR and its own retention period. Data gathered for one purpose is not used for another.
Answering your enquiryBasis: steps before entering a contract (art. 6(1)(b) GDPR) and our legitimate interest in replying (point f). We keep the data until the matter is closed.
RecruitmentAn application for a specific offer is handled at your request before a contract is concluded (art. 6(1)(b) GDPR). For an employment contract, the data listed in art. 22¹ § 1 of the Labour Code are processed because the statute requires it (point c). We keep a CV for future openings only with your consent from the form (point a). You may withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.
The contract and its performanceOnce we start working together the basis is the contract (art. 6(1)(b) GDPR), and the scope of data follows from what the case requires.
Legal obligationsAccounting and personnel documents are kept for as long as tax and social security law requires (art. 6(1)(c) GDPR).
Defence against claimsAfter a case closes some data remains until limitation periods expire. That is our legitimate interest (art. 6(1)(f) GDPR).
What we do not doWe do not profile, we make no automated decisions, and we send no marketing you did not sign up for separately.
How long we keep data
Candidate documents
until consent is withdrawn 12 months at most
- A CV and the data needed to present an offer
- After that we delete the file and the record
Accounting documents
as long as the statute requires no shortening
Invoices and books: until the tax liability is time-barred, that is 5 years from the end of the year in which the tax fell due (art. 70 and 86 of the Tax Ordinance). Personnel files: 10 years from the end of the year in which the employment ended (art. 94 point 9b of the Labour Code). We cannot shorten that even on request, because the duty comes from statute.
Who else sees the data
The services that support us
The site hosting provider (Cloudflare), the e-mail delivery provider (Resend) and the accounting office act under a processing agreement and only as far as the service needs. Google also receives the data, because we record enquiries in a Google spreadsheet, and so does Telegram, through which we are notified of enquiries.
The site runs on Cloudflare infrastructure: the hosting provider processes your IP address on our behalf. No page contacts any other server: no analytics, no advertising, no external fonts. Your IP address never reaches advertising or analytics companies. The basis is our legitimate interest in running the site and keeping it secure (art. 6(1)(f) GDPR).
Some of these services process data outside the European Economic Area:
- Cloudflare, Resend and Google (USA): the European Commission decision of 10 July 2023 finding an adequate level of protection (Data Privacy Framework). All three companies are on the list of participants at dataprivacyframework.gov. Cloudflare and Resend also include standard data protection clauses in their agreements.
- Telegram (outside the EEA, with group companies in the British Virgin Islands and Dubai): the Commission has not adopted an adequacy decision for these places, and we have no standard clauses with Telegram.
Where a statute requires it, public authorities also receive the data, for example ZUS, the tax office, the voivode, the district labour office, the National Labour Inspectorate or the Border Guard.
We will send a copy of the safeguards on request to [email protected]. If you would rather your data stayed inside the EEA, call us and we will take your request by phone.
Employers during recruitment
Candidate data reaches an employer only once you agree to a specific offer. We never send CVs out “just in case”: that is the most common practice in this trade and one of those we do not follow.
What you can ask for
Access and a copyYou may ask what data we hold about you and receive a copy of it.
Correction and erasureWe will correct wrong data and erase what is no longer needed, unless a statute requires us to keep it.
Restriction and objectionYou may object to processing based on our legitimate interest and ask for it to be restricted.
Data portabilityData you gave us on the basis of consent or a contract can be handed to you in a structured, commonly used and machine-readable format. You may also ask us to send it directly to another controller where technically feasible.
ComplaintIf you believe we process your data unlawfully, you may complain to the President of the Personal Data Protection Office.uodo.gov.pl
We answer every request within a month. A message to [email protected] is enough — no template and no qualified signature needed.
A question about your data
Write in one sentence what the matter concerns. We reply during office hours.
Phone+48 574 679 797
E-mail[email protected]
AddressŻurawia 6/12 lok. 749, 00-503 Warsaw
HoursMonday – Friday, 9:00 – 17:00
Supervisory authorityPresident of the Personal Data Protection Office, Warsaw uodo.gov.pl
ChangesA new version appears on this page with its date of effect