Privacy and Cookies Policy

1. General information

This Privacy and Cookies Policy sets out the rules for the collection, processing and protection of personal data of Users of the website available at https://stalwart-manacus.pl/ (the “Website”), as well as of persons we contact for business purposes. The Policy also contains information on cookies and similar technologies used on the Website.

We care about the privacy of Website users and the security of the personal data we process. We process data in accordance with applicable law, in particular:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”),
• the Polish Electronic Communications Law of 12 July 2024 (Prawo komunikacji elektronicznej, the “PKE”),
• other regulations concerning the protection of personal data and the provision of electronic services.

This Policy applies to data processed in connection with the use of the Website, in particular contacting us, subscribing to the newsletter and using the features and links available on the Website, as well as to data of representatives of potential clients with whom we establish business contact (section 7).

In the case of recruitment processes, additional detailed information on the processing of candidates’ data is provided directly with the recruitment form.

2. Personal data controller

The controller of personal data is STALWART MANACUS Sp. z o.o., with its registered office at ul. Mieszczańska 27/66, 50-201 Wrocław, Poland, entered in the National Court Register (KRS) under number 0001102808, tax ID (NIP) 8982307111, REGON: 528471736, hereinafter referred to as the “Controller” or “Stalwart Manacus”.

The Controller has appointed a Data Protection Officer, who may be contacted on matters relating to personal data protection electronically – at biuro@stalwart-manacus.pl or via the contact form available on the Website, adding the note “Personal data” to the message.

3. Sources of personal data

Personal data may be obtained:

• directly from the user, in particular when they:
  • use the contact form,
  • contact us by phone or e-mail,
  • contact us via WhatsApp,
  • subscribe to the newsletter,
  • contact us regarding our offer or cooperation;
• in the case of candidates – via recruitment forms provided in the Recruitify system, to which the user may be redirected from our Website;
• in the case of representatives of potential clients – from publicly available sources (details in section 7);
• automatically while using the Website, in particular in connection with:
  • the operation of the server and the recording of technical logs,
  • the use of cookies and similar technologies,
  • the use of statistical or marketing tools – if such tools are used and the user has given the appropriate consent.

4. Contact form and correspondence

Via the contact form, the user may provide in particular:

• e-mail address,
• phone number – if they choose to provide it,
• subject of the enquiry,
• data and information contained in the message.

The data may be processed for the following purposes:

a) Handling the enquiry and conducting correspondence

If the contact is not directly related to the intention to conclude a contract, the legal basis for processing is Article 6(1)(f) GDPR, i.e. the Controller’s legitimate interest in conducting correspondence, responding to and handling enquiries addressed to the Controller.

b) Presenting an offer or taking steps prior to entering into a contract

If the enquiry concerns an offer, ordering a service or starting cooperation, the data may be processed on the basis of Article 6(1)(b) GDPR, i.e. in order to take steps at the request of the data subject prior to entering into a contract.

c) Establishment, exercise or defence of legal claims

The data may also be stored where necessary for the establishment, exercise or defence of legal claims. The legal basis for such processing is Article 6(1)(f) GDPR.

Providing the data required in the form is voluntary, but necessary to send an enquiry and receive a reply.

The data will be stored for the period necessary to handle the enquiry and complete the correspondence, and if the contact leads to cooperation – for the period applicable to the documentation relating to the given contract.

The data may then be stored for the period necessary to establish, exercise or defend any legal claims.

5. Contact via WhatsApp

The Website makes it possible to contact the Controller via the WhatsApp messenger.

If the user chooses this form of contact, we may process in particular:

• phone number,
• user name or other identifier,
• information visible in the user’s profile,
• the content of the correspondence,
• other data voluntarily provided by the user.

Depending on the nature of the contact, the legal basis for processing is:

• Article 6(1)(b) GDPR – if the contact concerns taking steps prior to entering into a contract, or
• Article 6(1)(f) GDPR – in other cases, in connection with the Controller’s legitimate interest in communicating and handling enquiries.

WhatsApp is a third-party service. The provider of this service may also process the user’s data as a separate controller, in accordance with its own privacy rules.

Using WhatsApp is voluntary. The Controller can also be contacted by phone or e-mail.

6. Newsletter

Users may subscribe to the Stalwart Manacus newsletter.

The newsletter may contain in particular:

• market analyses,
• case studies,
• expert commentary,
• information and materials on Executive Search, Interim Management and Business Consulting,
• information about the activities and services of Stalwart Manacus,
• other informational or marketing content related to the Controller’s business.

To send the newsletter, we process the e-mail address provided by the user when subscribing.

The legal basis for processing personal data is the user’s consent – Article 6(1)(a) GDPR.

To the extent that the newsletter contains commercial information or direct marketing, it is sent after obtaining the prior consent required under Article 398 PKE.

Consent is voluntary.

The user may unsubscribe from the newsletter and withdraw consent at any time, in particular:

• using the unsubscribe link included in the message, or
• by contacting the Controller.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

The data will be processed until consent is withdrawn or the user unsubscribes from the newsletter.

After the user unsubscribes, the Controller may retain, to a limited extent, information confirming that consent was given and withdrawn, where necessary to demonstrate compliance with the law or to protect against possible claims. The legal basis for such processing is Article 6(1)(f) GDPR.

7. Contacting representatives of potential clients

Stalwart Manacus may contact persons representing companies that may be interested in our services – in particular business consulting, interim management, executive search and HR services – in order to present our business and establish cooperation. We send commercial or marketing messages by e-mail after obtaining the recipient’s prior consent.

7.1. Scope of data

We may process in particular:

• first name and surname,
• job title or position held,
• company name and details,
• business e-mail address and business phone number,
• professional profile address, e.g. on LinkedIn,
• the source and date of obtaining the data,
• the history and content of correspondence,
• information on the granting, scope and withdrawal of consent,
• information on an objection or opt-out from further contact.

7.2. Source of data

We may obtain contact details and professional information from publicly available sources, in particular company websites, public registers (KRS, CEIDG, REGON) and publicly available professional profiles (e.g. LinkedIn).

We provide information about the source of your data at the first contact, and no later than within the time limit required by the GDPR. We also receive data directly from you, e.g. when you contact us, give consent or opt out.

7.3. Purpose and legal basis of processing

We process professional and contact data in order to identify potential business partners and to organise activities aimed at establishing cooperation, on the basis of Article 6(1)(f) GDPR, i.e. the Controller’s legitimate interest in developing its business and building business relationships, taking into account your rights and reasonable expectations. On this basis, we obtain and verify only the data necessary for this purpose. Data used to send commercial information and to market our services by e-mail is processed on the basis of your consent – Article 6(1)(a) GDPR. Messages are sent after obtaining prior consent that also meets the requirements of Article 398 of the Polish Electronic Communications Law.

We also process the necessary data in order to handle objections and opt-outs and to prevent repeated contact, on the basis of Article 6(1)(f) GDPR – our legitimate interest in respecting your choices.

We fulfil our obligations to provide information on data processing and to give effect to your rights on the basis of Article 6(1)(c) GDPR in conjunction with the relevant provisions of Articles 12–22 GDPR. For this purpose, we process only the data necessary to fulfil and document the given obligation.

The data may also be processed for the establishment, exercise or defence of legal claims (Article 6(1)(f) GDPR).

7.4. Recipients of data

The data may be transferred to entities that provide IT services to us on our behalf, including e-mail and data storage services, and that support us in organising business contacts.

To the extent that service providers process data on our behalf, they act under data processing agreements concluded with us or as sub-processors approved by us, in accordance with our instructions. The rules for transferring data outside the European Economic Area are described in section 19.

7.5. Retention period

We store the data until the contact ends, but no longer than 12 months from the last correspondence. If the contact leads to discussions about cooperation, we apply the periods described in section 4. In the event of an objection, we retain only the e-mail address together with information about the objection, so that we do not contact you again.

7.6. Right to object

You may at any time withdraw your consent to receiving marketing messages and object to the processing of your data for direct marketing purposes, including related profiling. You do not need to give reasons for your decision.

Simply reply to the message you received or write to biuro@stalwart-manacus.pl. Once we receive your opt-out, we will promptly stop contacting you for marketing purposes. Your other rights are described in section 21.

8. Candidates and recruitment processes

Stalwart Manacus conducts recruitment processes and maintains databases of candidates and experts.

The Website contains links that allow users in particular to:

• view current job offers,
• apply for selected positions,
• join the candidate database,
• join the database of Interim Managers and experts,
• submit their profile or CV.

After selecting the relevant option, the user may be redirected from the Website to a recruitment form operated in the Recruitify system, available, among others, at the domain stalwart-manacus.recruitify.ai.

8.1. Scope of candidates’ data

The recruitment forms may collect in particular:

• first name and surname,
• e-mail address,
• phone number,
• address or place of residence,
• information on education,
• information on professional experience and qualifications,
• CV and other application documents,
• information on competences and licences/certifications held,
• a link to a professional profile, e.g. LinkedIn,
• information on professional preferences,
• information on place of work or willingness to relocate,
• expectations relating to a specific position or recruitment process,
• other information provided by the candidate in connection with the recruitment process.

The scope of data may vary depending on the specific recruitment.

Please do not include in your application documents any data that is not needed to conduct the recruitment process, in particular special categories of data, unless providing such data is justified and there is an appropriate legal basis for processing it.

8.2. Purposes of processing candidates’ data

Candidates’ data may be processed in particular for the purpose of:

• conducting a specific recruitment process,
• contacting the candidate,
• assessing the candidate’s qualifications, experience and fit for a specific position,
• presenting suitable job opportunities to the candidate,
• maintaining the candidate database,
• maintaining the database of Interim Managers and experts,
• conducting future recruitment processes – if there is an appropriate legal basis, in particular the candidate’s consent,
• presenting the candidate’s profile to the Stalwart Manacus client for whom the given recruitment process is being conducted – on the terms set out in the information provided to the candidate,
• establishing, exercising or defending legal claims.

The specific purposes, legal bases and period of data processing are indicated to the candidate in the personal data processing notice available directly with the recruitment form.

8.3. Future recruitment processes

If the candidate gives separate consent to the processing of their data for future recruitment processes, their profile may be stored after the specific recruitment has ended and used to contact them in connection with subsequent processes conducted by Stalwart Manacus.

Consent to participate in future recruitment processes is voluntary and may be withdrawn at any time.

Withdrawal of such consent does not affect the lawfulness of processing carried out before its withdrawal.

8.4. Sharing data with Stalwart Manacus clients

Stalwart Manacus also conducts recruitment processes on behalf of its clients.

In connection with such a process, the candidate’s profile or data may be shared with the client for whom the specific recruitment is being conducted, if this is necessary to carry out the process and there is an appropriate legal basis for such sharing.

Detailed information on the rules for sharing the candidate’s profile, including the recipient of the data and the legal basis for processing, is provided to the candidate as part of the information concerning the specific recruitment process.

9. Recruitify recruitment system

Stalwart Manacus uses the Recruitify system to handle recruitment processes.

With regard to candidates’ data processed in the system on behalf of Stalwart Manacus:

• Stalwart Manacus remains the controller of the personal data, while
• the provider of Recruitify acts as a processor within the meaning of Article 28 GDPR.

Recruitify provides the infrastructure and technical functionalities that enable, among other things, receiving applications, storing candidate profiles and conducting recruitment processes.

Using the website owned by Recruitify may at the same time involve its provider processing certain data relating to the use of its own website, in accordance with that provider’s privacy rules.

Detailed information on data processing in a specific recruitment process is made available to the candidate with the relevant form.

10. Links to external websites

The Website contains links to external websites or services, in particular:

• LinkedIn,
• Facebook,
• WhatsApp,
• Recruitify,
• other websites referred to in published materials.

The mere placement of a standard link to an external website does not automatically mean that Stalwart Manacus transfers the user’s personal data to that website.

However, after clicking the link, the user may leave the Website and go to a service operated by another entity.

From that moment, the provider of the external service may process the user’s data on the terms set out in its own privacy policy and cookies policy.

The Controller does not have full control over how independent providers of external services process data.

11. Technical data and server logs

While the Website is being used, technical information about the connection may be recorded automatically, in particular:

• IP address,
• date and time of the connection,
• information about the requested page or subpage,
• information about the device, browser or operating system,
• information about errors and technical events,
• other technical information necessary for the proper functioning of the Website.

This data may be used to:

• ensure the proper functioning of the Website,
• ensure the security of systems and information,
• diagnose errors,
• prevent abuse and cyberattacks,
• carry out security-related technical analyses.

The legal basis for processing is Article 6(1)(f) GDPR, i.e. the Controller’s legitimate interest in ensuring the proper and secure functioning of the Website.

Logs are stored for a period justified by technical and security considerations. In the event of an incident, they may be stored for the period necessary to investigate it and to establish, exercise or defend legal claims.

12. Use of cookies and similar technologies

Cookies are small pieces of information stored on or read from the user’s device while using the Website.

The Website may also use other technologies that work in a similar way, in particular mechanisms for storing information in the user’s browser.

Cookies may be:

• session cookies – deleted at the end of the session or when the browser is closed,
• persistent cookies – remaining on the device for a specified period or until deleted,
• first-party cookies – directly related to the Website,
• third-party cookies – related to solutions provided by third parties.

13. What types of cookies may be used?

13.1. Necessary cookies

Necessary cookies are required for the proper or secure functioning of the Website or to provide a function expressly requested by the user.

They may be used in particular to:

• ensure the proper functioning of the website,
• ensure security,
• handle forms,
• maintain the session,
• remember the user’s decisions regarding the use of cookies,
• operate the consent management mechanism.

Necessary cookies may be used without the user’s consent to the extent permitted by applicable law.

13.2. Preference cookies

Preference cookies make it possible to remember certain choices or settings of the user that are not strictly necessary for the basic functioning of the Website.

They may be used only after obtaining the user’s consent, unless their use falls within the exemption for necessary technologies.

13.3. Statistics cookies

Statistics and analytics cookies make it possible to determine how users use the Website.

They may be used in particular to analyse:

• the number of visits,
• the popularity of individual subpages,
• traffic sources,
• time spent on the website,
• how users navigate the Website,
• errors or problems occurring while using the website.

If their use requires consent, they are activated only after consent has been given.

13.4. Marketing cookies

Marketing cookies may be used to:

• measure the effectiveness of marketing activities,
• measure conversions,
• create audiences,
• carry out remarketing,
• personalise advertisements,
• analyse user activity for marketing purposes.

Marketing cookies are used only after the user has given the appropriate prior consent.

14. Legal basis for the use of cookies

The rules for storing information or gaining access to information stored on the user’s device are set out in particular in Article 399 PKE.

Cookies and similar technologies other than necessary ones may be used after the user has been provided with the required information and has given their consent.

Consent to cookies should be voluntary and may be withdrawn at any time.

Consent is not required to the extent that storing information or gaining access to information is necessary for:

• the transmission of an electronic communication, or
• the provision of an electronically supplied service expressly requested by the user.

If information obtained through cookies constitutes personal data, it is also processed in accordance with the GDPR.

15. Managing cookie consent

On the first visit to the Website, the user is given the opportunity to set their cookie preferences.

In particular, the user may:

• accept all optional cookies,
• refuse the use of optional cookies,
• select individual categories.

Not consenting to statistics or marketing cookies does not affect the ability to use the basic functions of the Website.

The user may change or withdraw their consent at any time using the “Manage consent” function available on the Website.

Withdrawal of consent does not affect the lawfulness of activities carried out before its withdrawal.

Cookies can also be deleted using the web browser settings.

16. Detailed list of cookies

The Website may be developed further, and the tools and cookies used may change.

Up-to-date information on the cookies and similar technologies used, including their purpose, provider and storage period, is available in the “Manage cookie consent” panel, in the “Manage services” section. This list may change as the Website develops and new functionalities are introduced.

The information available in the consent management panel supplements this Policy.

17. Analytics and marketing tools

The Website may use external tools designed for:

• compiling statistics,
• traffic analysis,
• measuring the effectiveness of marketing activities,
• measuring conversions,
• optimising the Website,
• carrying out advertising or remarketing activities.

If the use of a given tool requires storing information on the user’s device or accessing information already stored there, the tool is activated after obtaining the appropriate consent, unless the conditions for a statutory exemption are met.

Up-to-date information on the tools used on the Website is available in the consent management panel.

18. Recipients of data

Personal data may be transferred to entities supporting the Controller in conducting its business, to the extent necessary for them to provide their services.

These may be in particular:

• hosting and IT infrastructure providers,
• entities administering and maintaining the website,
• e-mail and communication service providers,
• providers of systems used to operate the newsletter,
• entities supporting the Controller in organising business contacts,
• IT security solution providers,
• the provider of the Recruitify recruitment system,
• analytics and marketing service providers – if such services are used and the user has given the appropriate consent,
• providers of legal, accounting or other advisory services,
• entities authorised to obtain data under the law.

Entities processing data on behalf of the Controller may process it only to the extent resulting from the agreements concluded and the Controller’s instructions.

In the case of recruitment processes, the recipients of data may also include Stalwart Manacus clients for whom the given recruitment process is being conducted, on the terms presented to the candidate in the information concerning the specific process.

19. Transfer of data outside the European Economic Area

Some of the services or technology solutions used may be provided by entities operating globally.

If the use of a particular provider involves the transfer of personal data outside the European Economic Area, the Controller ensures that an appropriate legal basis for the transfer, as required by the GDPR, is applied, in particular:

• a European Commission decision finding an adequate level of protection,
• the relevant mechanism provided for data transfers between the European Union and the United States – if the recipient meets the required conditions,
• standard contractual clauses approved by the European Commission, together with supplementary safeguards where required,
• another mechanism provided for in Chapter V GDPR.

20. How long do we store data?

The data retention period depends on the purpose and legal basis of processing.

As a rule:

• contact form and correspondence data – until the contact ends or the matter is resolved, and thereafter for the period necessary to secure any claims;
• data related to the conclusion or performance of a contract – for the duration of the cooperation and for the period required by law or justified by the need to secure claims;
• newsletter data – until the user unsubscribes from the newsletter or withdraws consent;
• information confirming the granting or withdrawal of consent – for the period necessary to demonstrate compliance with legal obligations or to secure claims;
• data of representatives of potential clients – until the contact ends, but no longer than 12 months from the last correspondence, and in the event of an objection – only the information necessary to exclude the person from further contact;
• data of candidates participating in a specific recruitment – in accordance with the period indicated in the information provided to the candidate for the given process;
• candidates’ data processed for future recruitments or in the candidate and expert databases – for the period indicated to the candidate, and no longer than permitted by the relevant legal basis for processing;
• technical data and logs – for the period necessary to ensure the security and proper functioning of the Website, and in the event of an incident – until it has been investigated and any claims have been secured;
• data processed using optional cookies – for the period resulting from the configuration of the given cookie or until consent is withdrawn, depending on the nature of the solution used.

21. Rights of data subjects

Under the terms set out in the GDPR, the data subject may have the right to:

• access their data,
• obtain a copy of their data,
• rectify their data,
• have their data erased,
• restrict processing,
• data portability – if the conditions set out in the GDPR are met,
• object to the processing of data based on Article 6(1)(f) GDPR,
• withdraw consent at any time, where processing is based on consent.

If data is processed on the basis of the Controller’s legitimate interest, the person may object on grounds relating to their particular situation.

If data is processed for direct marketing purposes, an objection to such processing may be raised at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

To exercise your rights, please contact the Controller or the Data Protection Officer.

22. Right to lodge a complaint

Any person who believes that their personal data is being processed unlawfully has the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych – UODO) in Poland.

23. Is providing data mandatory?

Providing personal data is, as a rule, voluntary.

Failure to provide the required data:

• in the contact form – may make it impossible to send an enquiry and receive a reply;
• when subscribing to the newsletter – will make it impossible to subscribe and receive the newsletter;
• in the recruitment form – may make it impossible to take part in the given recruitment process, if certain data is necessary to conduct it.

Providing additional data not required in the recruitment form is voluntary.

If the candidate is given the option of giving separate consent to participate in future recruitment processes, giving such consent is voluntary and does not affect the possibility of participating in the current process.

Not consenting to optional cookies does not restrict access to the basic functions of the Website.

Data of representatives of potential clients is not obtained directly from those persons – its sources are described in section 7.

24. Automated decision-making and profiling

As part of the basic functionalities of the Website, the Controller does not make decisions concerning users that produce legal effects or similarly significantly affect them based solely on automated processing.

If the user consents to the use of marketing tools, information about their activity on the Website may be used by the providers of these tools, among other things, to:

• analyse interests,
• create audiences,
• measure advertising effectiveness,
• personalise advertising content.

Such activities may constitute marketing profiling and are carried out to the extent resulting from the consent given by the user.

The use of tools supporting recruiters’ work in recruitment processes does not in itself mean that decisions concerning the candidate are made solely by automated means.

If the nature of processing changes and automated decision-making within the meaning of Article 22 GDPR takes place, the data subject will receive the information required by law.

25. Data security

The Controller applies appropriate technical and organisational measures to ensure the security of the data processed, taking into account the nature of the processing and the associated risk.

These measures are intended to protect the data in particular against:

• access by unauthorised persons,
• unauthorised disclosure,
• accidental loss,
• destruction,
• unauthorised alteration,
• other forms of unlawful processing.

Access to the data is granted only to persons or entities for whom it is necessary in connection with the tasks they perform or the services they provide.

26. Changes to the Privacy and Cookies Policy

This Policy may be updated periodically, in particular in the event of:

• changes in the law,
• changes in the way data is processed,
• the introduction of new Website functionalities,
• the introduction of new analytics or marketing tools,
• changes of service providers,
• changes in the way recruitment processes are conducted.

The current version of the Policy is published on the Website together with the date of its last update.