Privacy Policy

1. How to Use This Policy

Select the situation that best describes your contact with NAJ International:

• you have received a LinkedIn message from us about a specific career opportunity;
• you are applying for a specific recruitment process or are already taking part in one;
• you have consented to your data being considered for future recruitment processes;
• you are taking part in an Assessment & Development Center or another competency assessment;
• you have been named as a person who may provide a professional reference;
• you represent a client, prospective client, supplier or business partner;
• you contact us through a form, by email or by telephone;
• you have subscribed to our newsletter;
• you use our website and its cookie settings.

Information common to all these situations, including information about recipients, transfers outside the European Economic Area, retention periods and your rights, appears later in this document.

Back to table of contents

2. Data Controller and Contact Details

The controller of your personal data is NAJ International Sp. z o.o., Rondo ONZ 1, 00-124 Warsaw, Poland, Tax Identification Number (NIP): 5210090012, referred to below as “NAJ” or “we”.

We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, the General Data Protection Regulation, referred to below as the “GDPR”.

For matters concerning personal data, contact us at RODO@naj.com.pl

You may withdraw consent to participate in a recruitment process, to future recruitment or to marketing communications by writing to out@naj.com.pl

Back to table of contents

3. Privacy Notice for People We Contact About a Career Ppportunity (Direct Search)

This section applies when an NAJ consultant contacts you, for example through LinkedIn, about a specific career opportunity. It does not apply to a general connection request that does not relate to a particular recruitment assignment.

Where we obtained your data

We use professional information that you have made available through a professional social networking service, primarily your LinkedIn profile. LinkedIn remains a separate controller of the personal data processed through its platform.

We may use information such as:

• your name;
• your job title and the name of your organisation;
• your employment history;
• your education, qualifications and skills;
• your professional location;
• contact details made available in your profile;
• your profile URL and information provided in correspondence with us.

Why we contact you and the lawful basis

We use professional information to assess whether a particular opportunity may be relevant to your experience and to ask whether you would like to receive further details.

The lawful basis is our legitimate interest under Article 6(1)(f) GDPR. Our legitimate interest is to identify and contact people whose experience may match the requirements of a specific Executive Search assignment that we conduct for a client.

We limit the data used to professional information and provide this privacy notice no later than our first message concerning a specific career opportunity.

Your right to object

You may object at any time to our use of your data for Direct Search. You can reply to the consultant’s message or write to RODO@naj.com.pl. Once we receive your objection, we will not contact you further about that opportunity. Information about the objection may remain only in the correspondence maintained on the platform so that we can respect your decision.

What happens if you are not interested

If you do not express an interest in taking part in the process, we do not create a record for you in the NAJ candidate database and we do not transfer information from your profile to that database. The correspondence remains on LinkedIn in accordance with the platform’s operating rules and your settings.

What happens if you would like to learn more

If you express an interest, we may send you the job description and invite you to a conversation. If you decide to take part in the process and submit an application form or CV, the section relating to candidates taking part in a specific recruitment process applies.

At this initial stage, we do not disclose data that identifies you to our client.

Further information about recipients and transfers, retention periods and your rights is provided later in this Policy.

Back to table of contents

4. Candidates Taking Part in a Specific Recruitment Process

This section applies to people who apply to take part in a recruitment process conducted by NAJ for one of our clients.

What data we process

Depending on the role and the course of the process, we may process:

• identification and contact details;
• information contained in your CV, application form and any other documents you provide;
• information about your education, qualifications, language skills, employment history and professional achievements;
• information about your professional and salary expectations, availability, notice period, mobility and willingness to relocate;
• information provided during conversations and correspondence;
• consultant notes concerning your experience, competencies, motivation and fit with the role requirements;
• the results of competency assessments or an Assessment & Development Center, where these form part of the process;
• a concise summary of professional references, where references have been checked;
• information about the course of the process, meetings, decisions and consents provided.

We do not require special categories of personal data, such as information concerning health, origin, beliefs, private life or trade union membership. Please do not include such information in your CV or other documents unless it is necessary and has been agreed with us in advance.

Why we process the data

We process your data to:

• receive your application and conduct the specific recruitment process;
• contact you and organise the next stages;
• assess your experience, competencies, motivation and fit with the role requirements;
• prepare a candidate profile or candidate report;
• present the client with a profile that does not directly identify you at the initial stage, where the process model requires this;
• disclose data that identifies you to the client after obtaining your separate consent;
• conduct competency assessments or an Assessment & Development Center, where you provide separate consent;
• verify professional references after agreeing this with you;
• document the course of the process and establish, pursue or defend legal claims.

Lawful basis

The lawful basis for processing personal data in connection with a specific recruitment process is your freely given consent under Article 6(1)(a) GDPR, expressed by ticking the relevant box and submitting the application form or by another unambiguous indication that you wish to take part in the process.

To the extent necessary to demonstrate that the process was conducted correctly, handle complaints, and establish, pursue or defend legal claims, the lawful basis may be NAJ’s legitimate interest under Article 6(1)(f) GDPR.

Is providing the data mandatory?

Providing personal data is voluntary. Without information that enables us to assess your application and contact you, however, we will not be able to conduct the recruitment process.

You may withdraw from the process and withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. It may also not result in the immediate deletion of limited documentation where continued retention is necessary to protect legal claims or comply with a legal obligation.

Back to table of contents

5. Confidential Recruitment and Disclosure of Data to a Client

In some assignments, the client requires confidentiality. In that situation, we do not disclose the name of the prospective employer at the initial stage.

We may present the client with a candidate profile that excludes your name, contact details and other direct identifiers. We select the scope of information so as to limit the possibility of identifying you at this stage.

In a confidential assignment, the client’s name may be disclosed only at an agreed stage and, where appropriate, after you have signed a confidentiality undertaking.

We do not disclose identifying data, in particular your CV, to the client unless we have first:

• told you to whom the data is to be disclosed;
• disclosed the client’s name and, where relevant, the recipient country;
• obtained your separate and explicit consent.

If you do not consent, we will not disclose data that identifies you to the client. You may then end your participation in the process without affecting the lawfulness of actions taken earlier.

Once it receives the data, the client generally determines independently how it will use the data in its own recruitment process and acts as a separate controller for that purpose. The client should provide you with its own privacy notice.

Back to table of contents

6. Candidate Database and Future Recruitment

Taking part in a specific process does not automatically mean that we will keep your data for future recruitment.

We may do so only if you provide separate, freely given consent in the application form or in another unambiguous manner.

How we use the data

For future recruitment, we may:

• search the database for profiles matching new assignments;
• contact you about a career opportunity that may be relevant to you;
• update information with you about your experience, expectations and availability;
• use data, documents, notes and assessment results to the extent adequate and relevant to assessing your fit for a future assignment.

Being included in the database does not mean that we will automatically present your candidacy to a client. Before disclosing data that identifies you, we will always tell you about the specific assignment and ask for separate consent.

How long we keep the data

We keep data intended for future recruitment for no longer than 10 years from the date on which consent is given or last renewed, unless you withdraw it earlier or the data is no longer adequate for this purpose.

Before that period expires, where we hold current contact details, we will contact you to inform you of the planned deletion and give you an opportunity to update your data and provide new consent. If we do not receive new consent, data intended for future recruitment will be deleted once the 10-year period expires.

You may at any time:

• withdraw consent by writing to out@naj.com.pl;
• request rectification or an update by writing to RODO@naj.com.pl;
• send us an up-to-date CV.

Candidates do not have individual accounts with direct access to the NAJ database. We update data at the request of the person to whom the data relates.

Back to table of contents

7. Assessment & Development Center and Competency Assessments

In selected processes, we may use an Assessment & Development Center, competency-based interviews, simulation exercises, psychometric tests or behavioural style assessments, including DISC D3.

Where the assessment concerns a candidate

The assessment is conducted only where it is an agreed part of the process and you provide separate consent.

We may process:

• data required to provide access to the assessment;
• your responses;
• results, profiles and reports;
• assessor observations and feedback;
• the consultant’s conclusions concerning competencies and potential.

The purpose is an in-depth assessment of competencies, behaviours and potential against the requirements of a specific role. The assessment result is not the sole basis for evaluating a candidate and is interpreted by a consultant.

A report identifying the candidate may be disclosed to the client in connection with the specific process after consent to disclose the data has been obtained. If the candidate has consented to future recruitment, the report may remain in the database for the duration of that consent, provided it remains adequate for that purpose.

We may use external assessment-tool providers. They receive only the data required to conduct the assessment and generate the report. Depending on how a particular tool operates, the provider may process data on NAJ’s behalf or act as a separate controller. Before the assessment begins, we provide the information relevant to the particular solution.

Where the assessment concerns an employee of a client

In development, succession or promotion projects, the participant’s employer is generally the controller. NAJ processes personal data on the client’s documented instructions and within the scope of the data-processing agreement.

The participant receives detailed information about the purposes, lawful bases, recipients and retention period from the employer or in a notice prepared for the specific project. A report identifying the participant is provided to the client within the agreed scope of the project.

Back to table of contents

8. Professional References

At the final stage of a recruitment process, and after agreeing this with the candidate, we may verify professional references with a person named by the candidate.

We ask the candidate to inform that person about the planned conversation and obtain their consent before providing us with their telephone number.

We use the information obtained only in connection with the specific process. A concise summary may be included in the candidate report provided to the client. We do not disclose the person’s name or contact details to the client. We may indicate the general professional relationship, for example “former line manager”.

Information for a person providing a reference

If the candidate has named you as a reference, we obtained your contact details from that candidate. We use them to conduct the reference conversation and verify professional information about the candidate.

The lawful basis is NAJ’s legitimate interest under Article 6(1)(f) GDPR. Our legitimate interest is to ensure the quality and reliability of the recruitment process.

When we first contact you, we inform you that NAJ is the controller and tell you where this Policy can be found.

We do not store your telephone number in the candidate database and do not disclose it to the client. We use the contact details only to conduct the agreed conversation. The report contains only a concise summary of the reference, without data that directly identifies the person providing it.

Back to table of contents

9. Artificial Intelligence and Meeting Transcription

At NAJ, decisions concerning candidates are made by people.

We do not use artificial intelligence for:

• automated candidate selection;
• candidate ranking or scoring;
• AI-based profiling;
• automated assessment of interviews;
• deciding whether a candidate progresses to the next stage;
• recommending a candidate to a client without a consultant’s assessment.

We do not make decisions about candidates based solely on automated processing where those decisions would produce legal effects or similarly significantly affect them.

AI-enabled language tools may support editorial and administrative work, such as preparing a general job description, article, information material or communication template. We do not provide general-purpose language models with CVs, extracts from CVs, candidate names, interview notes or other data that identifies a specific person.

Meeting transcription

During selected online meetings with candidates or clients, we may use an automatic transcription function.

We activate transcription only after informing the participant in advance and obtaining their consent. Refusal does not affect the ability to hold the meeting or the assessment of the candidate. The meeting then proceeds without transcription.

The function creates a written record of the conversation. We do not retain an audio recording and do not use the transcript for automated assessment of the participant.

The written record is used solely by the consultant to prepare their own meeting note. Once the note has been prepared, the transcript is deleted promptly. The note is retained in accordance with the rules applicable to the relevant process.

The lawful basis for processing personal data in connection with transcription is the participant’s consent under Article 6(1)(a) GDPR.

Back to table of contents

10. Forms, Messages and Other Ways of Contacting Us

If you contact us through a website form, by email, by telephone or through another channel, we process the data you choose to provide, in particular:

• your name;
• your email address and telephone number;
• your organisation and job title;
• the content of the message and attachments;
• information needed to respond or prepare for a conversation.

We process this data to:

• respond to you;
• handle your enquiry;
• prepare a proposal or take steps before entering into a contract;
• conduct further correspondence;
• document arrangements and protect legal claims.

Depending on the nature of the contact, the lawful basis is:

• taking steps at your request before entering into a contract or performing a contract, under Article 6(1)(b) GDPR;
• NAJ’s legitimate interest in handling correspondence, developing business relationships and documenting arrangements, under Article 6(1)(f) GDPR;
• consent where the contact concerns the newsletter or marketing communications, under Article 6(1)(a) GDPR.

Providing the data is voluntary, but without contact details and the information needed to respond, we may be unable to handle the enquiry.

Back to table of contents

11. Clients, Prospective Clients and Contact Persons

We process personal data relating to people who represent clients, prospective clients, suppliers and business partners.

We may obtain the data:

• directly from you;
• from the organisation you represent;
• from another person involved in the project;
• from publicly available professional sources, such as an organisation’s website, a public register or a professional business profile.

The data may include your name, job title, organisation, business contact details, information contained in correspondence and information about the relationship and projects carried out.

We process the data to:

• respond to enquiries and prepare proposals;
• enter into and perform contracts;
• organise projects, meetings and communications;
• handle payments and accounting records;
• maintain the business relationship;
• establish, pursue or defend legal claims.

The lawful basis may be the performance of a contract or steps taken before entering into a contract, a legal obligation, in particular tax and accounting obligations, or NAJ’s legitimate interest in conducting its business, serving clients and maintaining business relationships.

At the request of a Polish client interested in international cooperation, we may provide the client’s contact details to a designated IESF partner to enable an initial conversation. We do so with the contact person’s knowledge and only to the extent necessary to establish the relationship. We do not disclose candidate data from the NAJ database to IESF partners.

Where we did not obtain the data directly from you, we provide information about the processing no later than at our first contact, unless you already have that information.

We send marketing communications by email only with the consent required under the Polish Electronic Communications Law.

Back to table of contents

12. Newsletter and Marketing Communications

If you subscribe to the newsletter or provide separate marketing consent, we may send the following to the email address you provide:

• information about job opportunities;
• expert content, articles and reports;
• information about NAJ services;
• invitations to events;
• other updates concerning the labour market, Executive Search and NAJ’s activities.

We primarily process your email address and, where you provide them, your name, job title and organisation.

The lawful basis is your consent under Article 6(1)(a) GDPR. Consent to receive commercial communications and direct marketing by electronic means is obtained in accordance with the Polish Electronic Communications Law.

Subscription is voluntary. You may unsubscribe at any time:

• by using the unsubscribe link in the message;
• by writing to out@naj.com.pl or RODO@naj.com.pl.

After you unsubscribe, we will stop sending messages. We may retain limited information about the unsubscribe request so that we can respect your decision and prevent the address from being added to the list again without a lawful basis. The lawful basis for this limited retention is our legitimate interest under Article 6(1)(f) GDPR.

Marketing consent and consent to future recruitment are separate. Withdrawing one does not automatically withdraw the other.

Back to table of contents

13. Cookies and Website Analytics

Cookies are small pieces of information stored on a device when a website is used. Similar technologies may operate through browser storage, identifiers, pixels or scripts.

They may process, among other things:

• the IP address;
• device, operating-system and browser type;
• online identifiers;
• the date and time of a visit;
• pages visited and the way the website is used;
• the source from which the user reached the website;
• selected settings and preferences.

Categories we use

Strictly necessary
These technologies support the operation and security of the website, forms, storage of selected privacy settings and maintenance of a session. They may operate without consent where they are necessary to provide a service requested by the user or to transmit a communication.

Functional and preference
These technologies remember selected settings, such as language or display preferences. Where they are not necessary for a requested function, we activate them only after consent has been given.

Analytics
These technologies help us understand how people use the website, which content they visit and where problems occur. We activate them only after consent has been given.

Marketing and external content
These technologies may be used to measure promotional activities, display embedded content or connect activity on the website with a third-party service. We activate them only after consent has been given.

Lawful basis and consent management

We use strictly necessary cookies under the rules that permit their use without consent and on the basis of NAJ’s legitimate interest in ensuring the security and proper operation of the website.

We use other cookies and similar technologies after obtaining consent, under Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law.

On your first visit, you can accept selected categories, reject cookies other than those that are strictly necessary, or configure your settings. You can change or withdraw consent at any time through the Cookie Settings panel available on the website.

You can also change your browser settings, but blocking cookies in the browser does not replace the consent panel and may limit the operation of certain functions.

The current list of cookies, providers, purposes and retention periods is available in the cookie panel. The list is maintained dynamically because the website configuration may change. Information about any processing outside the EEA and the safeguards applied is available in the panel or in the relevant provider’s privacy notice.

Back to table of contents

14. Data Recipients and Transfers Outside the EEA

Access to personal data is limited to authorised people at NAJ and organisations that need the data to provide services to us or carry out a particular process.

Depending on the situation, recipients or categories of recipients may include:

• clients conducting a recruitment process, after the candidate has consented to the disclosure of data that identifies them;
• providers of recruitment systems, hosting, email, online meeting services and IT support;
• providers of competency-assessment tools and report-generation services;
• providers of newsletter systems, website analytics and cookie-consent management;
• providers of legal, accounting, audit and administrative services;
• an IESF partner designated by a client, only in relation to the client’s contact details and at the client’s request;
• public authorities or other organisations entitled to receive the data under applicable law.

Service providers acting on our behalf process personal data under contracts and only in accordance with our instructions. Some service providers or clients may act as separate controllers. In that case, they are responsible for their own processing and provide their own privacy notices.

Our main candidate database is hosted on servers located in the European Economic Area.

As a rule, we aim to process personal data within the EEA. If data is to be transferred to a recipient outside the EEA in a specific assignment, before the transfer we will inform you about:

• the recipient and the country to which the data will be transferred;
• the scope of the data transferred;
• the lawful basis for the transfer;
• the safeguards applied, such as a European Commission adequacy decision or standard contractual clauses.

We disclose candidate data to a foreign client only after disclosing the client’s identity and obtaining the candidate’s explicit consent to the disclosure.

Back to table of contents

15. How Long We Keep Personal Data

The retention period depends on the purpose and lawful basis of the processing.

Direct Search without participation in a process

If you do not express an interest and do not submit an application, we do not create a separate record in the candidate database. The correspondence remains on the platform through which the contact was made, in accordance with that platform’s settings and rules.

A specific recruitment process

We keep the data for the duration of the process or until consent is withdrawn. Once the process has ended, we may retain limited documentation for as long as necessary to demonstrate that the process was conducted correctly and to establish, pursue or defend legal claims, but no longer than the applicable limitation periods. If a dispute arises, the data may be retained until the proceedings have been finally concluded.

Future recruitment

We keep the data for no longer than 10 years from the date on which consent is given or last renewed. If no new consent is obtained after that period, data intended for future recruitment is deleted.

Assessment & Development Center and competency assessments

Materials concerning a candidate are retained for the period applicable to the specific process and, where the candidate has consented to future recruitment, for the duration of that consent, provided the materials remain adequate for that purpose. In projects involving employees of a client, the period follows the client’s instructions and the project agreement.

Professional references

We use the reference provider’s contact details only to conduct the conversation and do not store them in the candidate database. A concise summary of the reference forms part of the candidate report and is retained under the rules applicable to the candidate’s data.

Transcripts

We delete a transcript promptly after the consultant has prepared the meeting note.

Enquiries and correspondence

We keep the data for as long as needed to respond and handle the matter, and then for the period needed to document arrangements and protect legal claims.

Clients and accounting records

Data relating to a contract is kept for the duration of the relationship and then for the period required by tax and accounting obligations and the applicable limitation periods.

Newsletter and marketing

We keep the data until consent is withdrawn or the person unsubscribes. Limited information about the unsubscribe request may be retained for longer so that we can respect the person’s decision.

Cookies

The retention periods for individual cookies are stated in the current cookie panel.

Once the relevant period expires, we delete or anonymise the data unless applicable law requires further retention.

Back to table of contents

16. Your Rights

Depending on the lawful basis and the way in which your data is processed, you may exercise the following rights:

• access to your data and receipt of a copy;
• rectification or completion of your data;
• erasure of your data;
• restriction of processing;
• data portability where processing is based on consent or a contract and is carried out by automated means;
• objection to processing based on legitimate interests;
• objection to direct marketing, which is binding on us once made;
• withdrawal of consent at any time;
• lodging a complaint with the President of the Personal Data Protection Office in Poland.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

These rights are not absolute. In certain circumstances, we may refuse a request in whole or in part where continued processing is required by law or is necessary to establish, pursue or defend legal claims. In that case, we will explain the reason.

You may submit a request to RODO@naj.com.pl. You may also withdraw consent by writing to out@naj.com.pl.

We may ask for information necessary to verify your identity so that personal data is not disclosed to an unauthorised person.

Back to table of contents

17. How We Protect Personal Data

We use technical and organisational measures appropriate to the type of data, the scope of processing and the level of risk.

These measures include in particular:

• granting access only to authorised people;
• confidentiality obligations;
• access controls for systems and documentation;
• security measures for IT systems and backups;
• incident-response procedures;
• supplier selection and contracts governing the processing of personal data;
• training for people who work with personal data.

We do not disclose personal data to unauthorised people and limit the data to what is required for the relevant process.

Back to table of contents

18. External Links and Services

Our website may contain links to websites, profiles or services operated by other organisations. When you visit an external service, its operator processes personal data under its own rules.

Before submitting data through an external form or using an external tool, read the relevant privacy notice.

Back to table of contents

19. Changes to This Policy

We may update this Policy when there are changes to the law, the operation of the website, the technologies used or the scope of our services.

The current version is published on the website together with the date of the latest update. Where a change materially affects the way we process the data of people with whom we remain in contact, we may provide additional notice through an appropriate channel.

Before launching a new service that requires processing of personal data not described in this document, we will update the Policy or provide participants with a separate privacy notice.

Back to table of contents

20. Contact Details

Controller: NAJ International Sp. z o.o.

Address: Rondo ONZ 1, 00-124 Warsaw, Poland

Tax Identification Number (NIP): 5210090012

Questions, requests and exercise of rights: RODO@naj.com.pl

Withdrawal of consent to recruitment, future recruitment or marketing: out@naj.com.pl

If you believe that we process your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office in Poland.

Back to table of contents