Privacy and Cookie Policy

1. general information.

This Privacy and Cookie Policy sets forth the rules governing the collection, processing, and protection of the personal data of users of the website available at https://stalwart-manacus.pl/ (hereinafter: “the Website”). The Policy also contains information about cookies and similar technologies used on the Website.

We are committed to protecting the privacy of our users and ensuring the security of the personal data we process. We process data in accordance with applicable laws, in particular:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”),
• the Act of July 12, 2024—Electronic Communications Law (“PKE”),
• other regulations concerning the protection of personal data and the provision of electronic services.

This policy applies to data processed in connection with the use of the Website, in particular when contacting us, subscribing to the newsletter, and using the features and links available on the Website.

For recruitment processes, additional, detailed information regarding the processing of candidates’ data is provided directly on the application form.

2. Personal Data Controller

The controller of personal data is STALWART MANACUS Sp. z o.o., with its registered office at ul. Mieszczańska 27/66, 50-201 Wrocław, registered in the National Court Register under KRS number 001102808, NIP 8982307111, REGON: 528471736, hereinafter referred to as the “Controller” or “Stalwart Manacus.”

The Data Controller has appointed a Data Protection Officer, who can be contacted regarding matters related to the protection of personal data via email at: biuro@stalwart-manacus.pl or via the contact form available on the Website, by including “DPO” in the message body.

3. Sources of Personal Data

Personal data may be collected:

the use of statistical or marketing tools—if such tools are used and the user has given the appropriate consent.

1. directly from the user, particularly when:
   • uses the contact form,
   • contacts us by phone or email,
   • contacts us via WhatsApp,
   • signs up for the newsletter,
   • contacts us regarding an offer or collaboration;
2. for applicants—through the application forms available in the Recruitify system, to which the user may be redirected from our Website;
3. automatically while using the Website, in particular in connection with:
   • server operation and the recording of technical logs,
   • the use of cookies and similar technologies,
   • the use of statistical or marketing tools—if such tools are used and the user has given the appropriate consent.

4. Contact Form and Correspondence

Through the contact form, users can provide, in particular:

• email address,
• phone number—if they choose to provide it,
• Subject of the message,
• data and information contained in the message.

Data may be processed for the following purposes:

a) Handling inquiries and maintaining correspondence

If the contact is not directly related to the intention to enter into a contract, the basis for data processing is Article 6(1)(f) of the GDPR, namely the Controller’s legitimate interest in conducting correspondence, providing responses, and handling inquiries addressed to the Controller.

b) Submitting an offer or taking action prior to the conclusion of a contract

If the inquiry concerns a quote, a service order, or the initiation of a business relationship, the data may be processed pursuant to Article 6(1)(b) of the GDPR, i.e., to take steps at the request of the data subject prior to entering into a contract.

c) Establishing, pursuing, or defending claims

Data may also be stored if it is necessary to establish, pursue, or defend against claims. The legal basis for such processing is Article 6(1)(f) of the GDPR.

Providing the information requested on the form is voluntary, but necessary to submit your inquiry and receive a response.

The data will be stored for the period necessary to handle the inquiry and conclude the correspondence, and if the contact leads to the establishment of a business relationship, for the period appropriate for the documentation related to the relevant contract.

The data may then be retained for the period necessary to establish, investigate, or defend against potential claims.

5. Contact via WhatsApp

The website allows you to contact the Administrator via WhatsApp.

If you choose to use this method of contact, we may process, in particular:

• phone number,
• the user’s name or other identifier,
• information displayed in a user’s profile,
• the content of the correspondence,
• other information voluntarily provided by the user.

Depending on the nature of the contact, the basis for processing is:

• Article 6(1)(b) of the GDPR —if the contact relates to taking steps prior to entering into a contract, or
• Article 6(1)(f) of the GDPR —in other cases, based on the Controller’s legitimate interest in communicating with data subjects and handling inquiries.

WhatsApp is a third-party service. The provider of this service may also process user data as a separate data controller, in accordance with its own privacy policy.

Use of WhatsApp is voluntary. You can also contact the Administrator by phone or email.

6. Newsletter

Users can subscribe to the Stalwart Manacus newsletter.

The newsletter may include, in particular:

• market analyses,
• case studies,
• expert commentary,
• information and resources related to Executive Search, Interim Management, and Business Consulting,
• Information about Stalwart Manacus’s business and services,
• other informational or marketing content related to the Administrator’s activities.

In order to send the newsletter, we process the email address provided by the user during registration.

The legal basis for the processing of personal data is the user’s consent—Article 6(1)(a) of the GDPR.

To the extent that the newsletter contains commercial information or direct marketing, it is sent only after obtaining the prior consent required under Article 398 of the PKE.

Consent is voluntary.

The user may unsubscribe from the newsletter and withdraw consent at any time, specifically:

• by using the unsubscribe link in the email you received, or
• by contacting the Administrator.

Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal.

The data will be processed until you withdraw your consent or unsubscribe from the newsletter.

After withdrawal, the Controller may retain, to a limited extent, information confirming the granting and withdrawal of consent, if this is necessary to demonstrate compliance with regulations or to protect against potential claims. The legal basis for such processing is Article 6(1)(f) of the GDPR.

7. Candidates and Recruitment Processes

Stalwart Manacus conducts recruitment processes and builds databases of candidates and experts.

The Website contains links that allow users, in particular, to:

• to review current job openings,
• applying for selected positions,
• addition to the candidate database,
• joining the database of interim managers and experts,
• submit your profile or resume.

After selecting the appropriate option, the user may be redirected from the Website to a recruitment form hosted on the Recruitify system, which operates, among other places, at the domain stalwart-manacus.recruitify.ai.

7.1. Scope of Candidate Data

In particular, the following information may be collected through recruitment forms:

• first and last name,
• email address,
• phone number,
• address or place of residence,
• information regarding education,
• information regarding work experience and qualifications,
• Resume and other application documents,
• information regarding the competencies and authorizations held,
• a link to a professional profile, such as LinkedIn,
• information regarding career preferences,
• information regarding your current place of employment or willingness to relocate,
• expectations related to a specific position or recruitment process,
• other information provided by the candidate in connection with the recruitment process.

The scope of the data may vary depending on the specific recruitment process.

Please do not include in your application documents any information that is not necessary for the recruitment process, particularly special categories of personal data, unless providing such information is justified and there is an appropriate legal basis for processing it.

7.2. Purposes of Processing Candidate Data

Candidates’ data may be processed, in particular, for the following purposes:

• conducting a specific recruitment process,
• contacting the candidate,
• assessments of a candidate’s qualifications, experience, and suitability for a specific position,
• to present the candidate with suitable job offers,
• maintaining a database of candidates,
• maintaining a database of interim managers and experts,
• conducting future recruitment processes—if there is an appropriate legal basis, in particular the candidate’s consent,
• presenting the candidate’s profile to Stalwart Manacus, the client on whose behalf the recruitment process is being conducted—in accordance with the terms specified in the information provided to the candidate,
• findings, investigations, or defense against claims.

The specific purposes, legal basis, and duration of data processing are disclosed to the candidate in the notice regarding the processing of personal data, which is available directly next to the application form.

7.3. Future recruitment processes

If a candidate provides separate consent to the processing of their data for the purposes of future recruitment processes, their profile may be retained after the conclusion of a specific recruitment process and used to contact them in connection with subsequent processes conducted by Stalwart Manacus.

Consent to participate in future recruitment processes is voluntary and may be withdrawn at any time.

Withdrawal of such consent does not affect the lawfulness of the processing carried out prior to its withdrawal.

7.4. Sharing Data with Stalwart Manacus Customers

Stalwart Manacus also conducts recruitment processes on behalf of its clients.

In connection with this process, a candidate’s profile or data may be disclosed to the client for whom a specific recruitment process is being conducted, provided that such disclosure is necessary for the conduct of the process and there is an appropriate legal basis for such disclosure.

Detailed information regarding the rules for sharing a candidate’s profile—including the recipients of the data and the legal basis for processing—is provided to the candidate as part of the information regarding the specific recruitment process.

8. The Recruitify Recruitment System

Stalwart Manacus uses the Recruitify system to manage its recruitment processes.

With regard to candidate data processed in the system on behalf of Stalwart Manacus:

• Stalwart Manacus remains the controller of personal data, while
• The Recruitify provider acts as a processor within the meaning of Article 28 of the GDPR.

Recruitify provides the infrastructure and technical capabilities needed to, among other things, accept applications, store candidate profiles, and manage recruitment processes.

Using a website owned by Recruitify may also involve the processing by its provider of certain data regarding the use of that provider’s own website, in accordance with that provider’s privacy policy.

Detailed information regarding data processing in a specific recruitment process is provided to the candidate along with the relevant form.

9. Links to External Websites

This website contains links to external websites or services, in particular:

• LinkedIn,
• Facebook,
• WhatsApp,
• Recruitify,
• other websites referenced in the published materials.

Simply posting a regular link to an external website does not automatically mean that Stalwart Manacus is transferring the user’s personal data to that website.

However, by clicking on the link, the user may leave the Website and be redirected to a service operated by another entity.

From that point on, the third-party service provider may process the user’s data in accordance with the terms set forth in its own privacy policy and cookie policy.

The administrator does not have full control over how independent third-party service providers process data.

10. Technical Data and Server Logs

While using the Website, technical information regarding the connection may be automatically recorded, in particular:

• IP address,
• date and time of the call,
• information about the requested page or subpage,
• information about your device, browser, or operating system,
• information about errors and technical incidents,
• other technical information necessary for the proper operation of the Website.

This data may be used for the following purposes:

• to ensure the proper functioning of the Website,
• ensuring the security of systems and information,
• error diagnosis,
• preventing fraud and cyberattacks,
• conducting technical analyses related to safety.

The legal basis for the processing is Article 6(1)(f) of the GDPR, i.e., the Controller’s legitimate interest in ensuring the proper and secure operation of the Website.

Logs are retained for a period justified by technical and security considerations. In the event of an incident, they may be retained for the period necessary to investigate the incident and to establish, investigate, or defend against claims.

11. Use of Cookies and Similar Technologies

Cookies are small pieces of information that are stored on or read from a user’s device while using the Website.

The website may also use other technologies that function in a similar way, particularly mechanisms for storing information in the user’s browser.

Cookies can be:

• external —related to solutions provided by third parties.
• session cookies —deleted when the session ends or the browser is closed,
• persistent – remaining on the device for a specified period of time or until they are deleted,
• proprietary – directly related to the Website,
• external —related to solutions provided by third parties.

12. What types of cookies may be used?

12.1. Essential Cookies

Essential cookies are necessary for the proper or secure operation of the Website or to perform a function explicitly requested by the user.

In particular, they can be used for:

• the proper functioning of the website,
• to ensure safety,
• form processing,
• maintaining the session,
• to remember the user’s preferences regarding the use of cookies,
• operating the consent management mechanism.

Essential cookies may be used without the user’s consent to the extent permitted by applicable law.

12.2. Preference cookies

Preference cookies allow the Website to remember specific user choices or settings that are not strictly necessary for the Website’s basic functionality.

They may be used only with the user’s consent if their use does not fall under the exception for essential technologies.

12.3. Statistical cookies

Statistical and analytical cookies help us determine how users interact with the Website.

In particular, they can be used to analyze:

• number of visits,
• the popularity of individual subpages,
• sources of traffic,
• time spent on the website,
• how to navigate the Website,
• errors or problems encountered while using the website.

If their use requires consent, they are activated only after consent is given.

12.4. Marketing cookies

Marketing cookies may be used for the following purposes:

• measuring the effectiveness of marketing activities,
• conversion tracking,
• creating audience groups,
• conducting remarketing,
• ad targeting,
• analysis of user activity for marketing purposes.

Marketing cookies are used only after the user has given their prior consent.

13. Legal Basis for the Use of Cookies

The rules governing the storage of information or access to information stored on a user’s device are set forth, in particular , in Article 399 of the PKE.

Cookies and similar technologies other than those that are strictly necessary may be used after the required information has been provided to the user and the user’s consent has been obtained.

Consent to the use of cookies should be voluntary and may be withdrawn at any time.

Consent is not required to the extent that the storage of information or access to information is necessary to:

• the transmission of an electronic message, or
• the provision of an electronic service expressly requested by the user.

If the information collected through cookies constitutes personal data, the processing is also carried out in accordance with the GDPR.

14. Managing Cookie Consent

During their first visit to the Website, users are given the opportunity to specify their cookie preferences.

In particular, the user may:

• accept all optional cookies,
• opt out of optional cookies,
• select individual categories on your own.

Not consenting to statistical or marketing cookies does not affect your ability to use the Website’s basic features.

Users may change or withdraw their consent at any time using the “Manage Consent” feature available on the Website.

Withdrawal of consent does not affect the lawfulness of actions taken prior to such withdrawal.

Cookies can also be deleted through your web browser settings.

15. Detailed List of Cookies

The website may be expanded, and the tools and cookies used may change.

Up-to-date information about the cookies and similar technologies used, including their purpose, provider, and retention period, is available in the “Manage Cookie Consents” panel under the “Manage Services” section . This list may change as the Website evolves and new features are implemented.

The information available in the consent management dashboard supplements this Policy.

16. Analytics and Marketing Tools

The website may use third-party tools designed to:

• maintaining statistics,
• traffic analysis,
• measuring the effectiveness of marketing activities,
• conversion tracking,
• optimization of the Website,
• conducting advertising or remarketing activities.

If the use of a given tool requires storing information on the user’s device or accessing information already stored there, the tool is launched only after the appropriate consent has been obtained, unless the conditions for a statutory exception are met.

Up-to-date information about the tools used on the Website can be found in the consent management panel.

17. Data Recipients

Personal data may be transferred to entities that assist the Controller in conducting its business, to the extent necessary for those entities to provide their services.

These may include, in particular:

• hosting and IT infrastructure providers,
• entities that manage and maintain the website,
• email and communications service providers,
• providers of systems used to manage newsletters,
• providers of IT security solutions,
• the provider of the Recruitify recruitment system,
• analytics and marketing service providers—if such services are used and the user has given the appropriate consent,
• providers of legal, accounting, or other advisory services,
• entities authorized to obtain data pursuant to applicable law.

Entities that process data on behalf of the Controller may process such data only to the extent specified in the agreements entered into and in accordance with the Controller’s instructions.

In the case of recruitment processes , the recipients of the data may also include Stalwart Manacus’s clients on whose behalf the recruitment process is being conducted, in accordance with the terms explained to the candidate in the information regarding that specific process.

18. Transfer of Data Outside the European Economic Area

Some of the services or technological solutions we use may be provided by entities operating globally.

If, in connection with the use of a specific service provider, personal data is transferred outside the European Economic Area, the Data Controller ensures that the appropriate legal basis for the transfer required by the GDPR is applied, in particular:

• a decision by the European Commission determining an adequate level of protection,
• the appropriate mechanism established for data transfers between the European Union and the United States—provided that the recipient in question meets the required conditions,
• standard contractual clauses approved by the European Commission, along with additional safeguards, if required,
• another mechanism provided for in Chapter V of the GDPR.

19. How long do we retain data?

The data retention period depends on the purpose and legal basis for processing the data.

As a general rule:

• Data from the contact form and correspondence —until the interaction is concluded or the matter is resolved, and then for the period necessary to safeguard against any potential claims;
• data related to the conclusion or performance of a contract —for the duration of the cooperation and for the period required by law or justified by the need to safeguard claims;
• newsletter data —until you unsubscribe from the newsletter or withdraw your consent;
• information confirming the granting or withdrawal of consent —for the period necessary to demonstrate compliance with legal obligations or to safeguard claims;
• data on candidates participating in a specific recruitment process —in accordance with the period specified in the information provided to the candidate for that process;
• Candidate data processed for future recruitment or stored in candidate and expert databases —for the period specified to the candidate, but no longer than permitted by the applicable legal basis for processing;
• technical data and logs —for the period necessary to ensure the security and proper functioning of the Website, and in the event of an incident, until the incident is resolved and any potential claims are addressed;
• Data processed using optional cookies —for the period specified in the configuration of the respective cookie or until consent is withdrawn, depending on the nature of the solution used.

20. Rights of Data Subjects

Under the provisions of the GDPR, a data subject may have the right to:

• access to your data,
• to obtain a copy of the data,
• correction of data,
• data deletion,
• restrictions on processing,
• data portability—if the conditions set forth in the GDPR are met,
• to object to data processing based on Article 6(1)(f) of the GDPR,
• to withdraw consent at any time if the processing is based on consent.

If data is processed on the basis of the Controller’s legitimate interest, an individual may object on grounds related to his or her particular situation.

If data is processed for direct marketing purposes, you may object to such processing at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal.

To exercise your rights, please contact the Data Controller or the Data Protection Officer.

21. The Right to File a Complaint

Any person who believes that their personal data is being processed in violation of the law has the right to file a complaint with the President of the Personal Data Protection Office.

22. Is providing this information required?

As a general rule, the provision of personal data is voluntary.

Failure to provide the required information:

• in the contact form—this may prevent you from sending an inquiry and receiving a response;
• when subscribing to the newsletter—this will prevent you from subscribing and receiving the newsletter;
• on the application form—may prevent you from participating in a given recruitment process if certain information is necessary for it to proceed.

Providing additional information not required on the application form is voluntary.

If a candidate has been given the opportunity to provide separate consent to participate in future recruitment processes, such consent is voluntary and does not affect the candidate’s ability to participate in the current recruitment process.

Not consenting to optional cookies does not restrict access to the Website’s basic features.

23. Automated Decision-Making and Profiling

As part of the Website’s basic functionality, the Administrator does not make decisions regarding users that have legal effects or otherwise significantly affect them, based solely on automated processing.

If a user consents to the use of marketing tools, information regarding their activity on the Website may be used by the providers of those tools, among other things, to:

• interest analyses,
• creating audience groups,
• measuring the effectiveness of advertising,
• tailoring advertising content.

Such activities may constitute marketing profiling and are carried out to the extent permitted by the user’s consent.

The use of tools to assist recruiters in the hiring process does not, in and of itself, mean that decisions regarding a candidate are made exclusively through automated means.

If the nature of the processing changes and automated decision-making within the meaning of Article 22 of the GDPR takes place, the data subject will receive the information required by law.

24. Data Security

The controller shall implement appropriate technical and organizational measures to ensure the security of the data being processed, taking into account the nature of the processing and the associated risks.

The measures taken are intended to protect data, in particular against:

• access by unauthorized persons,
• unauthorized disclosure,
• accidental loss,
• destruction,
• an unauthorized change,
• other forms of unlawful processing.

Access to the data is limited to individuals or entities for whom it is necessary in connection with the tasks they perform or the services they provide.

25. Changes to the Privacy Policy and Cookie Policy

This policy may be updated from time to time, particularly in the following cases:

• changes in the law,
• changes to the way data is processed,
• the implementation of new features on the Website,
• the implementation of new analytical or marketing tools,
• changes in service providers,
• changes to the way recruitment processes are conducted.

The current version of the Policy is published on the Website along with the date of its most recent update.