Privacy policy

1. General information

This policy applies to the website available at eclipsegroup.pl.

The controller of your personal data is ECLIPSE GROUP K. JARZYNA SPÓŁKA KOMANDYTOWA with its registered office in Wrocław, ul. Przyjaźni 4H/26, 53-030 Wrocław, Poland, entered in the register of entrepreneurs of the National Court Register under KRS number 0001176189, NIP (tax ID): 8993026373, REGON: 541906144 (hereinafter: the “Controller”).

In matters relating to personal data, you can contact the Controller by e-mail at contact@eclipsegroup.pl or by post at the address of its registered office.

This policy concerns the data of persons who visit the Website and contact the Controller through it, as well as candidates in the recruitment processes we conduct (point 4).

2. Purposes and legal bases of processing

The Controller processes personal data for the following purposes and on the following legal bases:

• responding to enquiries submitted via the form or by e-mail – on the basis of the Controller’s legitimate interest, namely communicating with persons who contact it (Art. 6(1)(f) GDPR);
• taking steps at your request prior to entering into a contract and providing the services ordered (Art. 6(1)(b) GDPR);
• compliance with the Controller’s legal obligations, in particular tax and accounting obligations (Art. 6(1)(c) GDPR);
• compiling statistics on visits to the Website and carrying out marketing activities using analytics and marketing cookies – on the basis of your consent (Art. 6(1)(a) GDPR);
• ensuring the security and proper functioning of the Website and establishing, pursuing or defending claims – on the basis of the Controller’s legitimate interest (Art. 6(1)(f) GDPR).

3. What data we collect

• Data you provide voluntarily in forms or messages, e.g. your first and last name, e-mail address, telephone number, company name and the content of your enquiry.
• Technical data relating to the connection, such as your IP address and the time of your visit, recorded in server logs. We use it solely to administer the Website and ensure its security. When you submit the contact form, your IP address and information about your browser and device are also checked by the Cloudflare Turnstile service, which distinguishes people from automated programs (point 10).
• Information stored by means of cookies – in accordance with points 13 and 14.

We process data provided in a form for the purpose arising from the form’s function, e.g. handling an enquiry or a business contact. The description of each form states what it is used for.

4. Recruitment – candidate data

Eclipse Group is an employment agency entered in the National Register of Employment Agencies under number 35331. As part of our recruitment services, we process the personal data of candidates for employment or cooperation with our clients.

Where we obtain your data from. We receive it directly from you (e.g. when you send your CV or respond to a job advertisement) or obtain it from publicly available professional profiles (e.g. LinkedIn) or from recommendations. In that case, we will inform you of this at the first contact, and no later than within one month of obtaining the data.

Scope of data: first and last name, contact details, education, professional qualifications, employment history, employment expectations and any other information that you provide to us yourself.

Purposes and legal bases:

• conducting the recruitment process, including assessing your candidacy and contacting you – the legitimate interest of Eclipse Group consisting in the provision of recruitment services (Art. 6(1)(f) GDPR) and taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR),
• presenting your candidacy to a specific client (potential employer) – your consent (Art. 6(1)(a) GDPR); we always inform you to which client we are transferring your data,
• processing data that you provide on your own initiative beyond the scope necessary for recruitment (e.g. your image) – your consent (Art. 6(1)(a) GDPR); we do not ask for special categories of data (e.g. concerning health) – if you provide such data on your own initiative, we will process it on the basis of your explicit consent (Art. 9(2)(a) GDPR),
• participation in future recruitment processes – your consent (Art. 6(1)(a) GDPR),
• establishing, pursuing or defending claims – the legitimate interest of Eclipse Group (Art. 6(1)(f) GDPR).

Retention period: until the end of the recruitment process in which you are taking part; if you consent to taking part in future recruitment processes – until you withdraw that consent, but no longer than 24 months from the date on which it was given. To the extent necessary to defend against claims – until the limitation period for those claims expires.

Recipients: clients of Eclipse Group to whom – with your consent – we present your candidacy (once the data has been transferred, the client becomes a separate controller of it), as well as our providers of IT services and recruitment tools.

Voluntary nature: providing your data is voluntary, but necessary to take part in the recruitment process. You may withdraw your consent at any time by writing to contact@eclipsegroup.pl – this does not affect the lawfulness of processing carried out before its withdrawal.

Automated decisions: decisions in the recruitment process are not made by automated means, including on the basis of profiling.

5. Data recipients

The Controller may transfer your personal data to other recipients where this is necessary to achieve the purposes described above or to comply with legal obligations. These are:

• persons authorised by the Controller – employees and associates who need access to the data in order to perform their duties;
• the hosting company and providers of IT and e-mail services;
• Cloudflare, Inc. – the provider of the Cloudflare Turnstile service, which protects the contact form against spam (point 10);
• providers of analytics and marketing tools: Google Ireland Limited, Meta Platforms Ireland Limited and LinkedIn Ireland Unlimited Company (points 11 and 12);
• law firms, debt collection companies and banks – to the extent necessary to handle settlements and pursue claims;
• public authorities – only where required by law.

Entities processing data on behalf of the Controller do so on the basis of data processing agreements and solely in accordance with its instructions.

6. Transfer of data outside the European Economic Area

As a rule, the Controller does not transfer personal data outside the European Economic Area. The exception is the providers whose services we use to run the Website and who may process data in the United States: Vercel Inc. – the Website’s hosting provider (point 10), Google – the provider of the e-mail and spreadsheets we use to handle form messages and the consent register (point 15), as well as the providers of the analytics and marketing tools described in points 11 and 12. Such transfers take place on the basis of a European Commission decision finding an adequate level of protection (EU-US Data Privacy Framework) or standard contractual clauses approved by the European Commission. Data processed by Cloudflare, Inc. in connection with protecting the contact form (point 10) may also be transferred to the United States – on the same terms.

7. How long we store data

• Enquiry data – until the enquiry has been handled, and thereafter until the limitation period for any claims expires.
• Contract-related data – for the duration of the contract and for the period required by law, in particular by tax and accounting regulations.
• Data processed on the basis of consent – until consent is withdrawn.
• Marketing data – no longer than 3 years.
• Cookies – for the period specified in their parameters or until they are deleted in the browser.

8. Your rights

You have the right to:

• access your personal data and obtain a copy of it;
• rectify your data;
• erase your data;
• restrict processing;
• data portability;
• object to processing based on the Controller’s legitimate interest – the Controller will stop processing the data unless it demonstrates compelling legitimate grounds which override your interests, rights and freedoms, or grounds for establishing, pursuing or defending claims;
• withdraw consent at any time – this does not affect the lawfulness of processing carried out before its withdrawal;
• lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa).

To exercise your rights, contact the Controller at the e-mail address given in point 1.

9. Voluntary provision of data and automated decisions

Providing personal data is voluntary, but without it we will not be able to respond to your enquiry or provide the service.

The Controller does not make decisions about you based solely on automated processing of data, including profiling, that would produce legal effects concerning you or similarly significantly affect you.

10. Data security and hosting

The places where personal data is entered are protected at the transmission layer (SSL certificate). As a result, data entered on the Website is encrypted during transmission. The Controller periodically changes administrative passwords and regularly updates the software used to process data.

The Website is hosted on the servers of Vercel Inc. (United States). Technical support for the Website – its maintenance and the automations that forward form messages and consent register entries to the Controller (the Make platform) – is provided on the Controller’s behalf by Chmielewscy Sp. z o.o.

We protect the contact form against spam and automated submissions with the Cloudflare Turnstile service, provided by Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, United States). The service loads only when you scroll down to the form and, when you send a message, checks whether it is being filled in by a person. For this purpose, Cloudflare processes your IP address, information about your browser and device (including the User-Agent header) and connection parameters. Occasionally, the service may ask you to tick a box confirming that you are not a program. The legal basis for the processing is the Controller’s legitimate interest in protecting the Website and its mailbox against spam and abuse (Art. 6(1)(f) GDPR). Cloudflare processes this data on the Controller’s behalf and, insofar as it improves its bot detection mechanisms, as a separate controller, in accordance with the Turnstile privacy policy (https://www.cloudflare.com/turnstile-privacy-policy/). The service does not store cookies in the Website’s domain.

11. Google Analytics

The Controller uses Google Analytics (Google Ireland Limited, with its registered office in Dublin, Ireland) for statistical analysis of traffic on the Website. The tool may process, among other things, cookie identifiers, information about your device and a truncated IP address. We use it only after you have given your consent in the cookie banner. You can view and edit information about the advertising preferences collected by Google at https://myadcenter.google.com.

12. Meta Pixel and LinkedIn Insight Tag

With your consent to marketing cookies, we use two tools that measure the effectiveness of our advertising campaigns and allow us to display advertisements to people who have visited the Website:

• Meta Pixel – provided by Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland), the operator of Facebook and Instagram;
• LinkedIn Insight Tag – provided by LinkedIn Ireland Unlimited Company (Wilton Plaza, Wilton Place, Dublin 2, Ireland), the operator of LinkedIn.

These tools may process, among other things, cookie identifiers, your IP address, information about your device and browser, the address of the subpage visited and information about your actions on the Website. If you have a Facebook, Instagram or LinkedIn account, the provider may link this information to your account.

Purpose and legal basis: measuring the effectiveness of advertising campaigns, creating advertising audiences and displaying advertisements to people who have visited the Website – on the basis of your consent (Art. 6(1)(a) GDPR). We load these tools only after you have consented to marketing cookies in the banner, and you can withdraw your consent at any time (point 14).

With regard to the collection of data on the Website and its transmission to the tool provider, the Controller and the provider are joint controllers (Art. 26 GDPR). The Controller is responsible for informing you about the processing and obtaining your consent, and the provider – for handling your rights with regard to the data it has received. You may exercise your rights in respect of and against each of the joint controllers. Further processing of the data by the provider, including the display of advertisements, takes place under its own responsibility and is described in its policies: Meta – https://www.facebook.com/privacy/policy, LinkedIn – https://www.linkedin.com/legal/privacy-policy.

The providers may transfer data to affiliated entities in the United States (Meta Platforms, Inc. and LinkedIn Corporation) – on the terms described in point 6.

13. Cookies

Cookies are small text files stored on your device while you use the Website. They usually contain the name of the website from which they originate, their storage period and a unique number.

On the Website we use:

• necessary cookies – they ensure the proper functioning of the Website and remember your cookie choices; we use them without your consent;
• analytics cookies – they allow us to understand how you use the Website (Google Analytics); only with your consent;
• marketing cookies – they are used to measure the effectiveness of advertising and to display advertisements to people who have visited the Website (Meta Pixel, LinkedIn Insight Tag); only with your consent.

We use session cookies, which are deleted when you close your browser, and persistent cookies, which are stored for the period specified in their parameters or until they are deleted.

Cookies are placed on the Website by the Controller and, with your consent, also by its partners: Google Ireland Limited, Meta Platforms Ireland Limited and LinkedIn Ireland Unlimited Company.

14. How to give or withdraw consent to cookies

On your first visit to the Website, we display a banner in which you can accept or reject analytics and marketing cookies, or select only some of them. You can change your choices at any time by clicking “Cookie settings” in the footer of the page.

Irrespective of this, you can block or delete cookies in your browser settings. You will find instructions in your browser’s help pages (e.g. Chrome, Firefox, Safari, Edge, Opera and, on mobile devices, Android and iOS). Blocking necessary cookies may make it difficult to use the Website.

15. Cookie consent register

We record every decision you make regarding cookies – accepting, rejecting or saving your own selection in the banner or in “Cookie settings”, including any later change or withdrawal of consent – in the consent register.

An entry in the register contains: a random consent identifier assigned to your browser, the choice made for each cookie category, the version of the consent rules, the date and time of the decision, the language version of the Website, the browser identifier (the so-called user agent) and a hash of the IP address. We do not store the IP address itself – the hash is calculated with the addition of a secret key, so the address cannot be reconstructed from it.

Purpose and legal basis: demonstrating that consent was given, refused or withdrawn – compliance with the Controller’s legal obligation arising from the accountability principle (Art. 6(1)(c) GDPR in conjunction with Art. 5(2) and Art. 7(1) GDPR).

Retention period: for as long as the Website operates, and thereafter until the limitation period expires for claims in which the consent may be relevant. Changing or withdrawing consent does not delete the earlier entry but adds a new one – as a result, the register reflects the full history of decisions.

The register is kept on the Controller’s behalf by Chmielewscy Sp. z o.o. using the Make platform and Google spreadsheets (points 6 and 10).

16. Changes to the privacy policy

The Controller may update this policy, e.g. in connection with changes in legislation or in the Website’s functions. The current version is always available on the Website.