Privacy Policy for Job Candidates
Enzym Group
Date of update: 01.09.2025
LLC "Enzym Company", LLC “Linkcell”, Extracell Ingredients Sp. z o.o. (“Enzym Group”, “Group” or “we”) are glad to welcome candidates for our vacancies (“Candidates” or “you”).
This Privacy Policy for Job Candidates ("Policy") describes how we collect, use, and otherwise process your personal data during pre-employment processes.
We do not knowingly process the personal data of Candidates who are younger than 18 years old. If you believe that we may have inadvertently collected personal data from a natural person under 18, please immediately contact us. We will promptly take steps to delete such information from our records.
Content
Sources of personal data collection. 2
Purpose of personal data processing. 2
Lawful bases for personal data processing. 3
Protection of personal data. 3
Data controller
As part of the Enzym Group, each entity operates as a separate data controller for the vacancies it posts and the hiring processes it conducts. This means that each company determines the purposes and means of processing personal data for its specific vacancies. While each entity may have different recruitment activities, they all adhere to the same principles and comply with applicable data protection laws, including the General Data Protection Regulation (GDPR).
More detailed information about each data controller:
- LLC "Enzym Company" – data controller for vacancies related to its activities. Registered under the laws of Ukraine, company registration number: 00383320, address: Ukraine, 79014, Lviv Region, Lviv, Lychakivska Street, Building 232.
- LLC “Linkcell” – data controller for vacancies related to its activities. Registered under the laws of Ukraine, company registration number: 42897285, address: Ukraine, 79014, Lviv Region, Lviv, Lychakivska Street, Building 232-A.
- Extracell Ingredients Sp. z o.o. – data controller for vacancies related to its activities. Registered under the laws of Poland, KRS: 0000697312, NIP: 6762536742, REGON: 368406790, address: 20/4 Edmunda Wasilewskiego Street, 30-305 Kraków, Małopolskie, Poland.
| Contact information | [email protected] – for data protection inquiries |
| Web form on the website – for general inquiries |
Principles of processing
In our employment lifecycle, we ensure the following principles:
● Transparency. We clearly inform Candidates about how their personal data will be used, ensuring openness and clarity in all communications.
● Lawfulness. We ensure that personal data is processed only for legitimate purposes, following legal bases outlined in GDPR.
● Fairness. We handle Candidates’ data in a way that is fair, ethical, and respects the rights of individuals, without misusing the information.
● Data minimisation. We collect only the personal data that is necessary for employment and recruitment purposes, avoiding excessive or irrelevant information.
● Storage limitation. We retain Candidates’ data only for as long as necessary for recruitment, with clear policies for data retention and deletion after the process concludes.
● Accuracy. We keep Candidates’ data accurate and up to date, correcting any errors as soon as they are discovered.
● Confidentiality. We protect the Candidates’ data against unauthorised access, ensuring that it remains confidential and secure during processing.
Sources of personal data collection
We may receive your personal data directly from you (e.g. when you solely apply for our open vacancies through email, our websites, or by other means), or from publicly available sources (e.g. your profiles in professional social networks).
Personal data
We may collect the following categories of personal data during the pre-employment period:
| Category of personal data | Description of the category |
Identification Data | full name, country and city of residence, date of birth, photography (if provided), ID document and number (for employment) |
Communication Data | email address, phone number |
CV Data | cover letters and information you indicated in your CV or resume |
Qualification Data | work experience, work and education records, professional references, languages, and other data disclosed by you or provided in your CV or resume |
Public Data | information from professional social media profiles and open registers |
Purpose of personal data processing
We process your personal data for the following purposes:
● communicating with Candidates throughout the recruitment process;
● carrying out the testing of candidates;
● conducting background and reference checks;
● assessing the suitability of candidate profiles for vacancies;
● offering employment and preparing employment agreements;
● retention of data for future recruitment opportunities.
Lawful bases for personal data processing
We rely on the following lawful bases for processing your data:
● Performance of a Contract: the processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract (for example, to contact you after submission of the application);
● Legitimate Interests: the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party (for example, the confirmation of your experience indicated in your CV);
● Consent: the processing is necessary for specific purposes that require your freely given, specific, informed, and unambiguous consent (for example, the processing for special categories of personal data);
● Legal Obligation: the processing is necessary for compliance with a legal obligation to which the controller is subject (for example, employment or tax legislation, or to comply with a lawful request from a governmental or local authority).
Data retention
We will retain your personal data collected during the recruitment process for as long as necessary to fulfil the purposes for which it was collected, in line with applicable legal requirements and our legitimate interests.
If your job application is not successful, we will keep your personal data for 12 month after the recruitment process ends. However, we may keep it longer if required by law or if you have requested us to retain it for future job opportunities.
If your application is successful, the personal information collected during the recruitment process will be stored for the duration of your employment or engagement. It will be handled in line with our privacy policy for employees, workers, and contractors.
After the retention period expires, or upon request from the Candidate, personal data will be securely deleted or anonymised in accordance with applicable laws.
Protection of personal data
We implement the necessary organisational, physical, and technical measures to ensure the protection of your data against accidental loss or destruction, and unlawful processing, including unlawful destruction or access to personal data. These measures include the following:
1) Physical Measures
● Physical perimeter security;
● Air conditioning in server rooms;
● Control of physical access to premises;
● Video surveillance;
● Fire and smoke detection systems;
● Fire extinguishers in server rooms;
● Uninterruptible Power Supply (UPS).
2) Organisational Measures
● Password policy;
● Assignment of user rights;
● Creation of user profiles;
● Assignment of user profiles to IT systems.
3) Technical Measures
● Assignment of passwords;
● Authentication via username/password;
● Two-factor authentication;
● Use of VPN technology;
● Use of antivirus software;
● Use of hardware firewalls;
● Installation of dedicated lines or VPN tunnels.
Data subject rights
Candidates, as data subjects, have the following rights under GDPR:
● Right to be Informed: You have the right to receive clear and transparent information about the collection and use of your personal data;
● Right of Access: You have the right to request access to your personal data held by us;
● Right to Rectification: You have the right to request the correction of inaccurate or incomplete personal data concerning you;
● Right to Erasure (Right to be Forgotten): You have the right to request the deletion of your personal data under certain conditions, such as when the data is no longer necessary for the purposes for which it was collected;
● Right to Restrict Processing: You have the right to request the limitation of processing your personal data under certain circumstances, such as when the accuracy of the data is contested;
● Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another data controller without hindrance;
● Right to Object: You have the right to object to the processing of your personal data for certain purposes including direct marketing and profiling;
● Rights Related to Automated Decision-Making and Profiling: You have the right not to be subject to decisions based solely on automated processing, including profiling, which significantly affects you;
● Right to Withdraw Consent: You have the right to withdraw your consent at any time, where data processing activities were based on your consent;
● Right to Complain to a Supervisory Authority: You have the right to lodge a complaint with a supervisory authority.
We will respond to your request regarding personal data within one month of receipt. If a request is complex or numerous, we may extend the response time by an additional two months and will inform you within the initial one-month period. In cases of manifestly unfounded or excessive requests, we reserve the right to refuse the request and will provide a justification for the refusal.
Policy updates
Our Policy and the legal relationships related to the protection and processing of personal data are governed by the General Data Protection Regulation, other applicable laws, and best practices in the field of privacy.
We will make necessary amendments to the Policy and publish its updated version on the website in the event of changes to the current applicable legislation.
In the case of significant changes that may affect your privacy and the protection of personal data, we will post information about the Policy updates on the website and, if necessary, obtain your consent.
