GRFHR Privacy and Cookies Policy

Last updated: 27 August 2026

General Information

This Privacy Policy sets out the rules for processing personal data in connection with the use of the grfhr.com website, contact with Growth Factor HR, participation in recruitment processes, submission of CVs and use of the newsletter.

The controller of your personal data is:

Growth Factor HR Piotr Ferenc
Kartuska 30/7
81-002 Gdynia
NIP: 8442359794

Contact with the Controller:

e-mail: piotr.ferenc@grfhr.com

For recruitment-related matters:

rekrutacja@grfhr.com

Personal data is processed in accordance with applicable data protection laws, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 – the General Data Protection Regulation (“GDPR”).

2. What Personal Data May We Process?

The scope of personal data we process depends on how you use the Website and the nature of your interaction with GRFHR.

We may process, in particular:

Please do not include information in your CV that is not necessary for the recruitment process, particularly sensitive personal data, unless such information is specifically required for the relevant process.

3. Contact Form

The Website includes a contact form through which you may provide information such as:

Data submitted through the contact form is processed for the purposes of:

The legal basis for processing may be:

Article 6(1)(b) GDPR – where the contact is made for the purpose of entering into a contract or taking steps prior to entering into a contract

lub

art. 6 ust. 1 lit. f RODO the Controller’s legitimate interest in conducting business communications, responding to enquiries and developing relationships with potential clients.

The data may be retained for the time necessary to handle the matter and subsequently for a period justified by the need to establish, pursue or defend potential claims or to maintain a record of previous communications.

4. CV Submission

Candidates may submit their CV:

The Website form is configured so that submitted CVs are delivered to GRFHR’s company email account. WordPress is not used as the primary database for storing CVs.

Candidate data may be processed in particular for the purposes of:

Submitting a CV to GRFHR constitutes an expression of interest in participating in a recruitment process and allows us to process the data necessary to handle that application.

Where recruitment is conducted by a recruitment agency, the agency may act as an independent controller of candidate data in relation to the stages of the recruitment process it manages.

5. Recruitment for a Specific Role

Data provided in connection with a specific recruitment process will be processed for the period necessary to conduct that process.

GRFHR may contact the candidate, in particular, for the purpose of:

After the process has been completed, the data may be retained for the period necessary to demonstrate that the recruitment process was conducted properly and to establish, pursue or defend potential claims.

6. Future Recruitment Processes

GRFHR may also offer candidates the opportunity to retain their data for future recruitment processes.

If the candidate gives separate consent to the use of their data for future recruitment processes, the data may be retained for this purpose for a period of:

up to 24 months from the date consent is given.

Consent may be given, in particular:

The legal basis for processing is Article 6(1)(a) GDPR – consent..

The candidate may withdraw their consent at any time, for example by sending an email to:

rekrutacja@grfhr.com

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

The UODO notes that consent for future recruitment may be valid for a specific period of time, so that period should be clearly defined.

7. Direct Search and Data Obtained from Other Sources

GRFHR also conducts recruitment through direct search, which involves proactively reaching out to potential candidates.

As part of such activities, we may use professional information available from lawfully accessible sources, in particular professional social networks and other sources related to professional activity.

In such cases, we may obtain, in particular:

The legal basis for processing is Article 6(1)(f) GDPR, namely the Controller’s legitimate interest in conducting recruitment activities and identifying individuals whose experience may match ongoing recruitment processes.

The individual may object to the further processing of their data.

Where data has not been obtained directly from the individual concerned, GRFHR fulfils the information obligation under Article 14 GDPR, in particular at the time of the first communication with the candidate or within another period required by law.

8. Sharing Candidate Profiles with GRFHR Clients

GRFHR works with companies looking to recruit employees and specialists.

As part of a specific recruitment process, the candidate’s data may be shared with a GRFHR client.

We do not present a candidate’s profile to a client without first agreeing this with the candidate.

Before the data is shared, the candidate receives sufficient information about the recruitment process to make an informed decision about participation.

The data shared with the client may include:

The client receiving the candidate’s data may subsequently act as an independent data controller in relation to its own recruitment process.

9. Recruitment Interviews

During a recruitment interview, we may collect information necessary to assess the candidate’s suitability for a particular role.

This may include information about:

This information is used only to the extent necessary for the relevant recruitment process.

10. Newsletter

The Website may offer the option to subscribe to the GRFHR newsletter.

The newsletter may include:

For the purpose of managing the newsletter, we may process:

The legal basis for processing is the user’s consent – Article 6(1)(a) GDPR. zgoda użytkownika – art. 6 ust. 1 lit. a RODO.

You may unsubscribe from the newsletter at any time by using the unsubscribe link included in the email or by contacting the Controller.

GRFHR uses MailerLite to manage the newsletter. MailerLite.

MailerLite processes subscriber data in accordance with its applicable terms and Data Processing Addendum.

11. Google Analytics 4

The Website uses Google Analytics 4 to analyse how users interact with the Website.

The tool may process information including:

The data is used for the purposes of:

The use of analytics technologies that require consent is based on the preferences selected by the user in the cookie banner.

Google uses Consent Mode, where signals such as analytics_storage and ad_storage allow tags to adjust their behaviour based on the user’s consent choices. analytics_storage czy ad_storage pozwalają dostosowywać działanie tagów do decyzji użytkownika dotyczącej zgody.

12. Meta Pixel

The Website also uses Meta Pixel, a tool provided in connection with Meta platforms.

Meta Pixel may be used for purposes including:

Marketing technologies that are not necessary for the basic operation of the Website are used in accordance with the user’s choices made through the cookie banner.

Users may refuse consent to marketing cookies or change their preferences at a later time.

13. Cookies and Similar Technologies

The Website uses cookies and similar technologies.

Cookies are small pieces of information stored on a user’s device while using a website.

The Website may use the following categories of cookies:

Necessary Cookies

These cookies are necessary for the proper operation of the Website and for providing functions requested by the user.

They may be used without additional consent to the extent permitted by applicable law.

Analytics Cookies

They allow us to analyse Website traffic and how users interact with the Website, for example through Google Analytics.

They are used in accordance with the user’s cookie preferences.

Marketing Cookies

They may be used to measure the effectiveness of advertising and marketing activities, including in connection with Meta Pixel.

They are used in accordance with the choices made by the user in the cookie banner.

Applicable Polish electronic communications law regulates, among other things, the rules for storing information on a user’s device and accessing such information.

14. Managing Cookie Consent

During the first visit to the Website, users may be given the option to select their cookie preferences.

Depending on the available settings, users may:

Users may also manage cookies through their browser settings.

Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

15. Hosting

The Website uses hosting infrastructure provided by LH.pl. LH.pl.

In connection with the use of the Website, the server may automatically record technical information, including:

Server logs may be used for the purposes of:

The legal basis for processing is Article 6(1)(f) GDPR – the Controller’s legitimate interest in ensuring the security and proper operation of IT systems.

16. Email and Google Workspace

GRFHR uses Google Workspace to manage its business email communications.

This means that data contained in email correspondence may be processed using Google infrastructure.

This may include:

Access to this information is limited to persons who need it to perform their duties.

17. Recipients of Personal Data

Personal data may be shared with entities that support GRFHR in conducting its business activities.

Depending on the circumstances, these may include:

Entities acting as data processors are granted access only to the extent necessary to provide the services entrusted to them.

18. Transfers of Personal Data Outside the European Economic Area

Some technology providers used by GRFHR belong to international corporate groups and, in certain circumstances, personal data may be processed outside the European Economic Area.

Where such a transfer takes place, safeguards provided for under the GDPR are applied, in particular:

19. How Long Do We Retain Personal Data?

The retention period depends on the purpose for which the data is processed.

Current Recruitment Processes

We retain data for the duration of the relevant recruitment process and subsequently for the period necessary to establish, pursue or defend potential claims or fulfil obligations related to the completed process.

Future Recruitment Processes

Where the candidate has given appropriate consent:

for up to 24 months from the date the consent is given, unless it is withdrawn earlier.

Contact Form and Correspondence

For the duration of the relevant matter and subsequently for a period justified by the nature of the correspondence and the need to establish, pursue or defend potential claims.

Newsletter

Until you unsubscribe from the newsletter or withdraw your consent.

We may retain limited information concerning the withdrawal of consent where necessary to demonstrate compliance with applicable law.

Cookies

For the period determined by the duration of the relevant cookies or until the applicable consent is withdrawn.

Technical Logs

For the period necessary to ensure the security and proper operation of the infrastructure.

20. Your Data Protection Rights

Depending on the legal basis and circumstances of the processing, you may have the right to:

Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

To exercise your rights, you may contact the Controller at:

piotr.ferenc@grfhr.com

or, for recruitment-related matters:

rekrutacja@grfhr.com

The GDPR governs these rights primarily in Articles 15–22.

21. Right to Lodge a Complaint

If you believe that your personal data is being processed in breach of applicable data protection law, you have the right to lodge a complaint with a supervisory authority.

In Poland, the supervisory authority is:

President of the Personal Data Protection Office.

22. Right to Object

Where processing is based on Article 6(1)(f) GDPR, you may object to further processing on grounds relating to your particular situation.

This may apply, among other things, to certain direct search activities.

After receiving an objection, GRFHR will assess whether there are compelling legitimate grounds for continuing the processing.

23. Voluntary Provision of Personal Data

Providing personal data is generally voluntary.

However, failure to provide required information may make it impossible to:

24. Automated Decision-Making

GRFHR does not make decisions concerning candidates that produce legal effects or similarly significantly affect them solely on the basis of automated processing.

Final decisions concerning a candidate’s participation in a recruitment process involve human review.

25. Data Security

The Controller applies appropriate organisational and technical measures to protect personal data.

These measures are intended to reduce the risk of:

Access to personal data is granted only to persons and entities that require it to perform specific tasks.

26. Links to External Websites

The Website may contain links to external websites, in particular GRFHR’s social media profiles.

After accessing an external website, the processing of personal data is governed by the policies of the relevant website operator.

The inclusion of a link does not mean that GRFHR controls how personal data is processed by the external service.

27. Changes to this Privacy Policy

This Privacy Policy may be updated from time to time, in particular in the event of:

The current version of this Policy is published on grfhr.com. grfhr.com.

Last updated: 27 August 2026

Submit Your CV

Send us your details and CV. If a recruitment opportunity matching your experience becomes available, we’ll get back to you with information about the opportunity.