Privacy Policy

Last updated: 13 May 2026

1. Introduction

This Privacy Policy sets out the principles for processing personal data of users of the website available at airizen.eu (hereinafter: the "Website") and of candidates applying for job opportunities offered by AIRIZEN.

This document has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: "GDPR") and the Polish Personal Data Protection Act of 10 May 2018.

By using the Website and submitting your data through the available forms, you accept the principles described in this Policy.

2. Data Controller

The Controller of your personal data is:

AIRIZEN Ireneusz Bińczak ul. Jana Henryka Dąbrowskiego 77A, 60-529 Poznań, Poland (Nobel Tower Poznań Building)

Contact:

• E-mail: info@airizen.eu
• Phone: +48 530 895 546

For any matters concerning the processing of personal data, you may contact the Controller using the contact details provided above.

3. Scope and purposes of data processing

We process your personal data for the following purposes and within the following scopes:

3.1. Business contact and handling of inquiries

Purpose: Responding to requests for quotation, conducting commercial correspondence, preparing cooperation offers, contract negotiations, and order fulfilment.

Scope of data:

• first name and surname,
• company name,
• e-mail address,
• phone number,
• content of the message,
• other data voluntarily provided in correspondence.

Legal basis:

• art. 6(1)(b) GDPR - steps taken towards entering into a contract or contract performance,
• art. 6(1)(f) GDPR - legitimate interest of the Controller, namely conducting business correspondence and handling inquiries.

Retention period: Until the correspondence is concluded or the contract is performed, and subsequently for the period required by applicable law (including tax and accounting regulations - typically 5 years) or until the limitation period for potential claims expires (up to 6 years under the Polish Civil Code).

3.2. Recruitment - candidates applying for job opportunities

Purpose: Conducting recruitment processes for positions offered by AIRIZEN, including verification of professional qualifications, contact with the candidate, and decision-making regarding potential employment or entering into a cooperation agreement.

Scope of data:

• first name and surname,
• e-mail address and phone number,
• submitted CV and attached certificates, diplomas, and qualifications (e.g. ASME, AWS, IWI, IWE, NDE/NDT certifications),
• professional experience, education, qualifications,
• other data voluntarily provided by the candidate in the application.

Legal basis:

• art. 6(1)(b) GDPR and art. 22(1) § 1 of the Polish Labour Code - data necessary for taking steps prior to entering into an employment contract,
• art. 6(1)(a) GDPR - candidate's consent to the processing of data exceeding the scope set out in the Labour Code (e.g. photograph in the CV, additional information),
• art. 6(1)(f) GDPR - legitimate interest of the Controller consisting in defence against potential claims related to the recruitment process.

Retention period:

• data of candidates who were not selected is retained for a period of up to 3 years from the conclusion of the recruitment process - in accordance with the judgment of the Polish Supreme Administrative Court of 20 February 2024 (file ref. III OSK 2700/22), which allows such a period due to the limitation period for claims related to recruitment,
• if a candidate provides separate consent to participate in future recruitment processes, their data will be retained for the period indicated in the consent, but no longer than 24 months from the date the consent is given,
• in case of employment or entering into a cooperation agreement - data is retained in accordance with applicable labour and tax law.

Important: Providing data within the scope specified in art. 22(1) § 1 of the Polish Labour Code (first name, surname, date of birth, contact details, education, qualifications, employment history) is required by law. Providing other data is voluntary, and submitting such data is treated as consent to its processing in the recruitment process.

3.3. Handling the contact form on the Website

Purpose: Enabling contact via the form and providing a response to the submitted inquiry.

Scope of data: Data provided in the form (first name, e-mail, phone, company name, message content).

Legal basis: art. 6(1)(f) GDPR - legitimate interest of the Controller.

Retention period: Until the correspondence is concluded and the matter is resolved, no longer than 12 months from the last contact, unless further retention is necessary for contract performance or fulfilment of legal obligations.

3.4. Compliance with legal obligations

Purpose: Fulfilment of obligations arising from applicable law, including tax, accounting, and personal data protection regulations.

Legal basis: art. 6(1)(c) GDPR - legal obligation to which the Controller is subject.

4. Special categories of data (sensitive data)

As a general rule, the Controller does not collect or process special categories of data within the meaning of art. 9 GDPR (e.g. data concerning health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation).

We kindly ask you not to include such data in your applications, CVs, or correspondence. If a candidate voluntarily includes such information in the submitted documents, the Controller will either delete it without delay or - if justified - process it solely on the basis of the candidate's explicit consent (art. 9(2)(a) GDPR).

5. Recipients of the data

Your personal data may be transferred to the following categories of recipients:

• IT and hosting service providers - the Webflow platform provider (website hosting), Airtable Inc. based in the USA (platform handling the application form for candidates),
• Postal and e-mail service providers - e-mail service provider,
• Accounting office - to the extent necessary for fulfilling accounting and tax obligations,
• Law firms and advisors - within the scope of legal services for the Controller's business activity,
• AIRIZEN clients - exclusively in the case of candidates whose application is considered in the context of a specific project at a client's site, and only after prior notification of the candidate,
• Authorised public authorities - where the obligation to transfer data arises from applicable law.

All entities processing data on behalf of the Controller do so on the basis of data processing agreements (art. 28 GDPR) and are obliged to maintain confidentiality.

6. Transfer of data outside the European Economic Area (EEA)

Some of the Controller's service providers are based outside the European Economic Area, in particular:

• Airtable Inc. (United States) - the platform handling application forms for candidates. Airtable processes data on the basis of the Standard Contractual Clauses (SCCs) approved by the European Commission and in accordance with its own Data Processing Addendum (DPA). Airtable holds ISO 27001, ISO 27701, and SOC 2 Type II certifications and applies data encryption both in transit and at rest.

In every case of data transfer outside the EEA, the Controller ensures appropriate safeguards in accordance with art. 46 GDPR. You may obtain a copy of the applicable safeguards by contacting the Controller.

7. Your rights

In connection with the processing of your personal data, you have the following rights:

• Right of access to your data (art. 15 GDPR) - to obtain information about the processing and a copy of the data,
• Right to rectification of data (art. 16 GDPR) - to correct inaccurate or supplement incomplete data,
• Right to erasure of data (art. 17 GDPR) - the so-called "right to be forgotten", provided that there are no legal grounds for further processing,
• Right to restriction of processing (art. 18 GDPR),
• Right to data portability (art. 20 GDPR) - in respect of data processed on the basis of consent or a contract by automated means,
• Right to object to processing (art. 21 GDPR) - where the processing is carried out on the basis of the Controller's legitimate interest,
• Right to withdraw consent at any time - where processing is based on consent (art. 7(3) GDPR). Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

To exercise the above rights, please contact the Controller at the e-mail address info@airizen.eu or in writing to the registered address. We will respond without undue delay, no later than within one month of receiving the request.

Right to lodge a complaint

You have the right to lodge a complaint with the supervisory authority, which is:

President of the Polish Personal Data Protection Office (UODO)ul. Stawki 2, 00-193 Warsaw, Polandwww.uodo.gov.pl

If you are based in another EU/EEA Member State, you may also lodge a complaint with the supervisory authority of your habitual residence, place of work, or place of the alleged infringement.

8. Voluntariness of providing data

Providing personal data is voluntary; however, in some cases it is necessary for:

• responding to a contact inquiry (without contact details, we will not be able to reply),
• conducting the recruitment process (without the data required by the Polish Labour Code, we will not be able to consider the application),
• entering into and performing a contract.

9. Automated decision-making and profiling

Your personal data is not subject to automated decision-making, including profiling, within the meaning of art. 22 GDPR. All recruitment and business decisions are made by natural persons.

10. Cookies and tracking technologies

The airizen.eu website may use cookies and similar technologies.

10.1. What are cookies?

Cookies are small text files stored on the user's device while using websites. They allow, among other things, the user's device to be recognised and the website to be displayed correctly.

10.2. Types of cookies used

The Website uses the following types of cookies:

• Necessary cookies - enable the proper functioning of the Website (e.g. session handling, security). Do not require user consent.
• Analytical cookies (if enabled) - used to analyse traffic on the Website and improve its operation. Require user consent.
• Functional cookies (if enabled) - enable the user's preferences to be remembered.

10.3. Managing cookies

You may change the cookie settings in your web browser at any time, or through the consent management panel on the Website (if available). Disabling cookies may affect the functionality of the Website.

Detailed information on managing cookies in popular browsers can be found on their official technical support pages.

11. Data security

The Controller applies appropriate technical and organisational measures to ensure the security of your personal data, in particular:

• encrypted connection to the Website (HTTPS/SSL protocol),
• restriction of access to data exclusively to authorised persons,
• regular security updates,
• cooperation with providers that meet high data protection standards (including ISO 27001, SOC 2 certifications).

Despite the application of security measures, no IT system is fully resistant to threats. In the event of a personal data breach, the Controller will take action in accordance with art. 33-34 GDPR, including notifying the supervisory authority and - where required - the persons whose data has been affected.

12. Changes to the Privacy Policy

The Controller reserves the right to make changes to this Privacy Policy. The current version of the document is always available at airizen.eu. We will inform you of significant changes via the website or - where required - by e-mail.

13. Contact

Should you have any questions or doubts regarding this Privacy Policy or the processing of your personal data, please contact us:

AIRIZEN Ireneusz Bińczak ul. Jana Henryka Dąbrowskiego 77A, 60-529 Poznań, Poland, E-mail: info@airizen.eu, Phone: +48 530 895 546