Privacy Policy

PRIVACY POLICY

thyssenkrupp Group Services Gdańsk sp. z o.o.

Table of Contents

1. Applicants.

2. Reference Providers.

3. Employees and Persons Engaged under Civil Law Contracts.

4. Referrers and Referred Candidates under the Employee Referral Programme.

5. Emergency Contacts in the Event of an Accident at Work.

6. Witnesses to an Accident at Work.

7. Whistleblowers – Privacy Notice for Persons Making a Report under the Act of 14 June 2024 on the Protection of Whistleblowers.

8. Whistleblowers – Privacy Notice for Persons Whose Personal Data Are Processed in Connection with an Investigation Conducted under the Act of 14 June 2024 on the Protection of Whistleblowers.

9. Clients and Their Representatives.

10. Contractors (Including Suppliers) and Their Representatives.

11. Recipients of Marketing Communications.

12. Event Participants.

13. People Whose Image Appears in Promotional Materials.

15. Website Users (Data Collected via Cookies or Other Tracking Technologies)

16. Social Media Users.

17. Visitors.

18. Correspondents (Including Persons Redirected from the Website)

19. Cookies.

20. Changes to the Privacy Policy.

We are the Controller of your personal data

Protecting your personal data is not only our obligation, but above all a matter of trust that we want to build together.

This is why we have created this document.

It contains information about how we use your personal data, why we are entitled to do so and how long we retain it. You will also find information about the rights available to you under the GDPR.

We have divided the information into two parts:

in the first part, we explain how and when we process your personal data – the information is presented in the form of dedicated privacy notices;

in the second part, we explain how cookies and other tools that track your online activity operate in connection with your use of our website.

To quickly find the information you are interested in, please use the links in the table of contents.

1. Applicants

Controller and contact details

thyssenkrupp Group Services Gdańsk sp. z o.o., with its registered office in Gdańsk, 80-309, al. Grunwaldzka 472D, KRS: 0000498388, career.pl@thyssenkrup.com, tel. (58) 783-60-00 career.pl@thyssenkrup.com .

Data Protection Officer

dpo.gsg@thyssenkrupp.com

Purposes and legal bases for processing

Purpose:

· Taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR).

· Conducting the recruitment process to the extent directly required by law, in particular Article 22(1) § 1 of the Polish Labour Code (Article 6(1)(c) GDPR).

· Conducting the recruitment process where you voluntarily provide data other than those required by law (Article 6(1)(a) GDPR and, where special categories of personal data are provided, Article 9(2)(a) GDPR).

· NOTE: where an applicant provides information exceeding the minimum scope of data regulated by labour law, this constitutes a clear affirmative action equivalent to giving consent to the processing of such data for the purposes of the recruitment process.

· Pursuing the Controller’s legitimate interest in the establishment, exercise or defence of legal claims (Article 6(1)(f) GDPR and, where special categories of personal data are provided, also Article 9(2)(f) GDPR).

· Considering your application for future recruitment processes, where you have given additional consent (Article 6(1)(a) GDPR).

· Verifying references provided in relation to you, where you have given additional consent (Article 6(1)(a) GDPR).

Data retention period:

The data will be retained until the recruitment process has been completed and subsequently for a period of 3 months so that we can contact you if, during this additional period, we decide to employ you after all. Where you have consented to participation in future recruitment processes, the data will be retained for 12 months from the completion of the recruitment process.

Where processing may give rise to claims relating to potential discrimination in employment, your data will be retained until the limitation period for such claims has expired. In such a case, the data retention period is 3 years in accordance with Article 291 § 1 of the Polish Labour Code.

If you are employed, we will continue to process your data in accordance with the retention periods applicable to employees/contractors.

Where we process specific data on the basis of the Controller’s legitimate interests (Article 6(1)(f) GDPR) and, before the expiry of the standard retention period, you raise an effective and justified objection to the processing, the data will be processed for that specific purpose for a shorter period, i.e. until your objection is upheld.

Where we process specific data based on your consent (Article 6(1)(a) GDPR) and you withdraw your consent before the expiry of the standard retention period, the data will be processed for that specific purpose for a shorter period, i.e. until the consent is withdrawn.

Categories of data

We process the data that you provide to us yourself, i.e. data contained in your application documents. These include your contact details and information concerning your qualifications and experience.

If you consent to this and submit a recording as part of the recruitment process, we will also process your image and voice.

During the recruitment process, we may also collect additional data, e.g. information provided orally during an interview and information concerning the results of tests carried out.

Sources of data

We obtain the data directly from you.

Where we use recruitment agencies that source applicants and subsequently provide us with their data, those agencies are the source of the data. If you were referred for employment under an employee referral programme, the person who referred to you was the source of the data.

Requirement to provide data

Providing certain data is a statutory requirement for an applicant for an employment contract, in particular the data referred to in Article 22(1) § 1 of the Polish Labour Code (first name(s) and surname; date of birth; contact details indicated by you; education; professional qualifications; employment history).

Providing certain data may also be a condition for entering into an employment/cooperation agreement.

What happens if you do not provide your data

If you do not provide data that you are legally or contractually required to provide, we will not be able to conduct the recruitment process and, consequently, employ you.

Recipients of data

Recipients are external entities to which we disclose your data:

- recruitment agencies and recruitment platforms,

- providers of IT services, ICT systems and hosting services,

- entities providing us with archiving and disposal services,

- companies within our corporate group,

- providers of legal and advisory services,

- courier and postal service providers,

- public authorities or other entities authorised under applicable law,

- persons indicated by the applicant as reference providers,

- medical facilities carrying out occupational health examinations (where a decision is made to employ the applicant),

- providers of HR services (recruitment agencies).

Data transfers

Data may be transferred to the United States in connection with the Controller’s use of ICT services and IT infrastructure provided by entities established in that country, pursuant to the European Commission adequacy decision (Article 45 GDPR) of 10 July 2023. Such transfer may take place only to entities holding a valid certification under the Data Privacy Framework.

Automated decision-making

Your data will not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Your rights

a) the right of access to your personal data – within the scope of Article 15 GDPR,

b) the right to rectification of your personal data – within the scope of Article 16 GDPR,

c) the right to erasure of your personal data – within the scope of Article 17 GDPR,

d) the right to restriction of processing of your personal data – within the scope of Article 18 GDPR,

e) the right to data portability – within the scope of Article 20 GDPR,

f) the right to withdraw your consent to the processing of personal data at any time, where consent was the legal basis for processing, without affecting the lawfulness of processing based on consent before its withdrawal,

as well as

g) the right to object at any time to the processing of your personal data – within the scope of Article 21 GDPR – where the legal basis for processing is the legitimate interests pursued by the Controller or by a third party (Article 6(1)(f) GDPR). When raising an objection, you must state the grounds relating to your situation, unless the objection concerns processing for direct marketing purposes, in which case no such grounds are required.

Right to lodge a complaint

If you believe that we process your personal data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office. More information is available on the authority’s website.

Last updated: 26 May 2026.

2. Reference Providers

Controller and contact details

thyssenkrupp Group Services Gdańsk sp. z o.o., with its registered office in Gdańsk, 80-309, al. Grunwaldzka 472D, KRS: 0000498388, career.pl@thyssenkrup.com, tel. (58) 783-60-00

Data Protection Officer

dpo.gsg@thyssenkrupp.com

Purposes and legal bases for processing

Purpose:

Verification of the candidate’s qualifications for a given position and the accuracy of the personal data provided by the candidate – this constitutes a legitimate interest pursued by the Controller (Article 6(1)(f) GDPR).
Establishment, exercise or defence of legal claims, which constitutes a legitimate interest pursued by the Controller, where claims may arise in connection with the processing (Article 6(1)(f) GDPR and, where special categories of personal data are involved, also Article 9(2)(f) GDPR).

Data retention period:

The data will be retained for no longer than the retention period applicable to the candidate’s application documents, i.e. until the completion of the recruitment process concerning the candidate for whom you are providing a reference, and where consent has been given to participate in future recruitment processes – until such consent is withdrawn, but in any event for no longer than two years.

Where claims may arise in connection with the processing, the data will be retained until the expiry of the limitation period applicable to such claims.

Categories of data

As a standard, these include: first name, surname, position, business e-mail address or business telephone number, and place of employment.

Sources of data

We obtained your data from the candidate whom we are recruiting.

Requirement to provide data

The provision of your data by the candidate whom we are recruiting is neither a statutory requirement nor a condition for entering into a contract.

What happens if you do not provide your data

If the candidate does not provide us with your data, we will not be able to confirm/obtain the reference you have provided in relation to the candidate.

Recipients of data

Recipients are external entities to which we disclose your data:

entities supporting us in our business activities based on concluded agreements/commissioned services, such as companies providing services or IT solutions and companies providing document archiving and destruction services,
providers of legal, advisory and audit services,
entities supporting us in the candidate verification process, including providers of HR services,
courier and postal service providers,
other companies within the Group.

Data transfers

Your rights

a) the right of access to your personal data – within the scope of Article 15 GDPR,

b) the right to rectification of your personal data – within the scope of Article 16 GDPR,

c) the right to erasure of your personal data – within the scope of Article 17 GDPR,

d) the right to restriction of processing of your personal data – within the scope of Article 18 GDPR,

e) the right to data portability – within the scope of Article 20 GDPR,

as well as

Right to lodge a complaint

Last updated: 26 May 2026

3. Employees and Persons Engaged under Civil Law Contracts

Controller and contact details

thyssenkrupp Group Services Gdańsk sp. z o.o., with its registered office in Gdańsk, 80-309, al. Grunwaldzka 472D, KRS: 0000498388, career.pl@thyssenkrup.com, tel. (58) 783-60-00

Data Protection Officer

dpo.gsg@thyssenkrupp.com

Purposes and legal bases for processing

Purpose:

Performance of an employment contract/civil law contract (Article 6(1)(b) GDPR).
Regarding the processing of:

Ø ordinary personal data

Compliance with the Controller’s obligations arising from the employment relationship, including, inter alia, those related to work organisation, ensuring safe and healthy working conditions, preventing discrimination, settlement of amounts due, maintaining and archiving personnel files, as well as the Controller’s obligations arising from legislation concerning social security, health insurance, taxation, the Company Social Benefits Fund, Employee Capital Plans, trade unions, accounting and the general duty of defence (Article 6(1)(c) GDPR).

Ø special categories of personal data

Compliance with the Controller’s obligations in the fields of employment law, social security and social protection, regarding health data, including data processed in connection with the Company Social Benefits Fund (Article 9(2)(b) GDPR).

Pursuing the Controller’s legitimate interest in the establishment, exercise or defence of legal claims (Article 6(1)(f) GDPR and, where special categories of personal data are provided, also Article 9(2)(f) GDPR).
Purposes specified in the wording of consents to the processing of personal data, where such consents have been given (Article 6(1)(a) GDPR and Article 9(2)(a) GDPR).
With regard to data obtained through e-mail monitoring and monitoring of websites visited: ensuring work organisation that enables full use of working time and the proper use of work tools made available to the employee (or person engaged under a civil law contract) (Article 6(1)(f) GDPR in conjunction with Article 22³ § 1 of the Polish Labour Code).
Organisation of training courses and development programmes, assessment of employees’ performance and capabilities, organisation of events and social initiatives – where the individual has expressed an intention to participate – performance of contracts with the organisation’s clients, contractors and suppliers, as well as statistical purposes related to improving work efficiency, the quality of services provided and adapting them to their recipients, which constitutes a legitimate interest pursued by the Controller (Article 6(1)(f) GDPR).
Organisation and documentation of events and social initiatives, where the individual has expressed an intention to participate, which constitutes a legitimate interest pursued by the Controller (Article 6(1)(f) GDPR).

If you participate in events organised by the Controller that are recorded or photographed, your image may also be captured in such materials.

Photographs and recordings from such events will be processed for the Controller’s internal purposes, which include placing photographs in Teams and SharePoint folders and making them available to employees, displaying them on screens at the Controller’s office and using them in internal corporate materials (e.g. e-mails and PowerPoint presentations), which constitutes a legitimate interest pursued by the Controller (Article 6(1)(f) GDPR).

Where data in the form of an image are disseminated, photographs or recordings from an event may be disseminated for the purpose of providing information about the Controller’s activities and for marketing and promotional purposes (on the Controller’s website, on the Controller’s social media profiles such as Facebook, Instagram and LinkedIn, and in promotional materials printed or distributed electronically via the Internet), as well as for the purpose of exercising the rights arising from the authorisation to disseminate an image referred to in Article 81 of the Polish Act on Copyright and Related Rights, which constitutes a legitimate interest pursued by the Controller (Article 6(1)(f) GDPR).

Participation in an event organized by the Controller that is documented by means of photographs or recordings is deemed to constitute consent to the recording and free-of-charge use and/or dissemination of your image/voice/statements in promotional and marketing materials without any time or territorial limitations. Consent given in this manner covers all forms of dissemination and making such materials available, publication on the Controller’s website, on the Controller’s social media profiles such as Facebook, Instagram and LinkedIn, and in promotional materials printed or distributed electronically via the Internet. The image may be subject to various forms of electronic image processing, cropping and composition without the requirement to approve the final product, if it is not used in an offensive manner or in a manner generally considered unethical. The image of an event participant may be combined with images of other participants and with content relating to the Controller’s business activities, including marketing and promotional content.

Performance of contracts with the Controller’s clients, contractors and suppliers (Article 6(1)(f) GDPR).
Marketing of the Controller’s products and services to prospective clients using the personal data of employees/persons engaged under civil law contracts (Article 6(1)(f) GDPR).
Temporary sharing, throughout the organization, of a photograph and a brief description of newly hired employees, which constitutes a legitimate interest pursued by the Controller in supporting onboarding processes, facilitating the identification of new employees, building professional relationships, improving internal communication and strengthening integration and cooperation between members of the organization by increasing mutual recognition and a sense of belonging to the team (Article 6(1)(f) GDPR).

Data retention period:

Data will be retained for a period of 10 years from the end of the calendar year in which the employment relationship ceased/was terminated, where the employment relationship commenced on or after 1 January 2019.

Data will be retained for a period of 50 years from the end of the calendar year in which the employment relationship ceased/was terminated, where the employment relationship commenced before 1 January 2019.

Regarding settlement documents submitted to ZUS (the Polish Social Insurance Institution), data will be retained for 5 years from the date on which such documents were submitted to the relevant organizational unit of ZUS.

In the case of people engaged under civil law contracts, data will be retained until the expiry of the limitation period for claims arising from the contract or until the expiry of statutory data retention obligations, particularly those concerning the retention of accounting documents. As a rule, the data retention period is a maximum of 6 years.

Data originating from recordings or photographs taken during events organized by the Controller (recorded image) will be processed for the period necessary to achieve the purposes of processing, i.e. documenting events and promoting and providing information about the Controller’s activities, but no longer than until such data cease to be current or useful for the above purposes (with the Controller periodically reviewing whether their continued processing remains justified). Where such data are published on the Controller’s website or social media, they will be processed until they are removed from those communication channels, unless an objection to such processing is raised earlier.

Categories of data

At the time of your engagement, we process the data that you provide to us yourself. These are data necessary for entering into an employment contract or a civil law contract and, if you are employed under an employment contract, also data related to the performance of various employer obligations, such as information concerning members of your family, information concerning your disability or information concerning your fitness for work.

During the term of the employment contract or civil law contract, we obtain various additional data concerning you. These include, for example, information about training courses you have completed, information about your use of employee benefits, your image (obtained, for example, in connection with the production of a promotional video), data concerning your activity within the resources made available to you (so-called logs), data concerning your geolocation (in the context of company cars), as well as various other data, the scope of which may differ at individual stages of the employment or civil law contractual relationship.

Sources of data

As a standard, we obtain data directly from you.

In exceptional circumstances, we obtain such data from sources other than you. One example is a request from a court enforcement officer to garnish your remuneration. Another example is where we ask our clients about their satisfaction with the services provided – in such cases, we receive your personal data from them in the form of their opinions about you.

Requirement to provide data

Providing certain data is a statutory requirement for an employee employed under an employment contract, in particular the data referred to in Article 22¹ of the Polish Labour Code.

Providing certain data may also be a condition for entering into an employment contract or a civil law contract.

What happens if you do not provide your data

If you do not provide data that you are legally or contractually required to provide, we will not be able to employ/engage you or enable you to exercise your rights / fulfil our obligations arising from specific provisions of law.

Recipients of data

Recipients are external entities to which we disclose your data:

public authorities or other entities authorised under applicable law, where this is necessary for compliance with legal obligations,
our clients, contractors and business partners,
entities providing us with IT tools used to store your data or entities having access to your data as part of IT system maintenance activities,
entities auditing our activities or expert appraisers,
providers of accounting, HR or legal services,
trade unions and employee mutual assistance and loan funds,
users of websites, social media or other members of the public where your data are made publicly available,
companies providing disposal or archiving services for documents and other media,
courier and postal service providers,
medical facilities,
banks, insurance companies and other financial and payment institutions,
companies preparing personalised clothing, identification badges or certificates,
companies providing security and access control services and monitoring the use of work tools,
providers of marketing and promotional services,
training providers,
hotels and transport companies,
companies within the Controller’s corporate group,
where data are made publicly available – users of websites and social media such as Facebook, Instagram, LinkedIn and Google+, as well as traditional media (radio, television),
where photographs or recordings from the Controller’s events are shared internally, other employees/contractors of the Controller may also be recipients of personal data in the form of images contained in such photographs or recordings.

Furthermore, if you consent to this, selected data may be disclosed to entities providing:

private healthcare services,
access to sports and recreational facilities and insurance services.

Data transfers

Data may be transferred to Meta Platforms, Inc. for the purpose of pursuing the Controller’s legitimate interest in providing information about the Controller’s activities and for marketing and promotional purposes. In this context, your personal data will be transferred outside the EEA. You can find detailed information in the Privacy Policy of Meta Platforms, Inc. here: Facebook Privacy Policy and Instagram Privacy Policy.

Data may be transferred to Microsoft, the owner of the LinkedIn platform, for the purpose of pursuing the Controller’s legitimate interest in providing information about the Controller’s activities and for marketing and promotional purposes. In this context, your personal data will be transferred outside the EEA. You can find detailed information in this entity’s Privacy Policy here: LinkedIn Privacy Policy.

Automated decision-making

Your data will not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Your rights

a) the right of access to your personal data – within the scope of Article 15 GDPR,

b) the right to rectification of your personal data – within the scope of Article 16 GDPR,

c) the right to erasure of your personal data – within the scope of Article 17 GDPR,

d) the right to restriction of processing of your personal data – within the scope of Article 18 GDPR,

e) the right to data portability – within the scope of Article 20 GDPR,

as well as

Right to lodge a complaint

Last updated: 26 May 2026

4. Referrers and Referred Candidates under the Employee Referral Programme

Controller and contact details

thyssenkrupp Group Services Gdańsk sp. z o.o., with its registered office in Gdańsk, 80-309, al. Grunwaldzka 472D, KRS: 0000498388, career.pl@thyssenkrup.com, tel. (58) 783-60-00

Data Protection Officer

dpo.gsg@thyssenkrupp.com

Purposes and legal bases for processing

Purpose:

Implementation of the Employee Referral Programme, i.e. processing information concerning the referrer and, in the event of a successful recruitment process, payment of a referral bonus to the referrer (Article 6(1)(f) GDPR).

Where a referral bonus is paid for referring a candidate – for settlement, accounting and financial reporting purposes (Article 6(1)(c) and (f) GDPR).

Conducting the recruitment process in respect of the referred candidate. All information concerning the processing of job applicants’ personal data is provided in a separate dedicated privacy notice presented to all candidates (including those who do not participate in the Employee Referral Programme) during the recruitment process (Article 6(1)(f) GDPR).
Pursuing the Controller’s legitimate interest in the establishment, exercise or defence of legal claims relating to the Employee Referral Programme (Article 6(1)(f) GDPR).

Data retention period:

The data will be retained until the Controller has completed all settlements with the referrer and subsequently until the expiry of the limitation period for any potential claims arising from the Employee Referral Programme.

Where the data retention period is expressly prescribed by generally applicable law, the relevant data will be processed for the period specified by such provisions, e.g. accounting/tax data relating to a referral bonus paid to the referrer.

Where we process specific data on the basis of the Controller’s legitimate interests (Article 6(1)(f) GDPR) and, before the expiry of the standard retention period, you raise a justified objection to the processing, the data will be processed for that specific purpose for a shorter period, i.e. until your objection is upheld.

Categories of data

Referred candidate: data contained in the CV and processed as part of a separate recruitment process, information concerning the outcome of the recruitment process, and information identifying the person who referred the candidate.

Referrer: first name, surname, position, information identifying the person referred by the referrer, information concerning the referral bonus paid, and bank account number.

Sources of data

We obtain the data from the job applicant (the referred candidate) when they submit their application documents via our website.

Requirement to provide data

Providing the data is neither a statutory requirement nor a condition for entering into a contract.

What happens if you do not provide your data

If you do not provide us with your data, we will not be able to implement the provisions of the Employee Referral Programme.

Recipients of data

Recipients are external entities to which we disclose your data:

entities processing personal data on the Controller’s instructions in accordance with concluded agreements, including providers of IT systems and services, providers of technical and maintenance services for IT systems used for data processing, providers of document archiving and destruction services, as well as providers of advisory, accounting and HR services,
law firms,
entities providing payment services (banks and payment institutions – for the purpose of making payments to the referrer),
other companies within the Group.

Data transfers

Automated decision-making

Your data will not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Your rights

a) the right of access to your personal data – within the scope of Article 15 GDPR,

b) the right to rectification of your personal data – within the scope of Article 16 GDPR,

c) the right to erasure of your personal data – within the scope of Article 17 GDPR,

d) the right to restriction of processing of your personal data – within the scope of Article 18 GDPR,

e) the right to data portability – within the scope of Article 20 GDPR,

as well as

Right to lodge a complaint

Last updated: 26 May 2026

5. Emergency Contacts in the Event of an Accident at Work

Controller and contact details

thyssenkrupp Group Services Gdańsk sp. z o.o., with its registered office in Gdańsk, 80-309, al. Grunwaldzka 472D, KRS: 0000498388, career.pl@thyssenkrup.com, tel. (58) 783-60-00

Data Protection Officer

dpo.gsg@thyssenkrup.com

Purposes and legal bases for processing

Purpose:

Informing the person designated by the employee about an accident involving that employee (Article 6(1)(f) GDPR).

Data retention period:

The data will be processed for the duration of the employment relationship of the employee who designated you as their emergency contact.

Categories of data

First name, surname, telephone number.

Sources of data

We obtain your data from our employee.

Requirement to provide data

Providing the data is neither a statutory requirement nor a condition for entering into a contract.

What happens if you do not provide your data

If your data are not provided, we will not be able to inform you about an accident at work involving our employee.

Recipients of data

Recipients are external entities to which we disclose your data:

entities providing us with IT tools used to store your data or entities having access to your data as part of IT system maintenance activities.

Data transfers

Automated decision-making

Your data will not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Your rights

a) the right of access to your personal data – within the scope of Article 15 GDPR,

b) the right to rectification of your personal data – within the scope of Article 16 GDPR,

c) the right to erasure of your personal data – within the scope of Article 17 GDPR,

d) the right to restriction of processing of your personal data – within the scope of Article 18 GDPR,

e) the right to data portability – within the scope of Article 20 GDPR,

as well as

Right to lodge a complaint

Last updated: 26 May 2026

6. Witnesses to an Accident at Work

Controller and contact details

thyssenkrupp Group Services Gdańsk sp. z o.o., with its registered office in Gdańsk, 80-309, al. Grunwaldzka 472D, KRS: 0000498388, career.pl@thyssenkrup.com, tel. (58) 783-60-00

Data Protection Officer

dpo.gsg@thyssenkrup.com

Purposes and legal bases for processing

Purpose:

Compliance with the Controller’s legal obligation to collect information concerning an accident from witnesses to such an event and to prepare an accident report (Article 6(1)(c) GDPR in conjunction with the Polish Labour Code).

Data retention period:

10 years (the employer is required to retain the report establishing the circumstances and causes of an accident at work, together with the remaining post-accident documentation, for a period of 10 years).

Categories of data

First name, surname, telephone number.

Sources of data

As a standard, we obtain your data directly from you. Your data may also be obtained from the person injured in the accident or from another witness.

Requirement to provide data

Providing data by a witness to an accident at work is neither a statutory requirement nor a condition for entering into a contract.

What happens if you do not provide your data

If you do not provide your data, we will not be able to obtain your statement concerning the accident at work involving our employee.

Recipients of data

Recipients are external entities to which we disclose your data:

public authorities or other entities authorized under applicable law, where this is necessary for compliance with legal obligations,
entities providing us with IT tools used to store your data or entities having access to your data as part of IT system maintenance activities,
providers of HR or legal services,
companies providing disposal or archiving services for documents and other media,
courier and postal service providers.

Data transfers

Automated decision-making

Your data will not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Your rights

a) the right of access to your personal data – within the scope of Article 15 GDPR,

b) the right to rectification of your personal data – within the scope of Article 16 GDPR,

c) the right to erasure of your personal data – within the scope of Article 17 GDPR,

d) the right to restriction of processing of your personal data – within the scope of Article 18 GDPR,

e) the right to data portability – within the scope of Article 20 GDPR,

as well as

Right to lodge a complaint

Last updated: 26 May 2026

7. Whistleblowers – Privacy Notice for Persons Making a Report under the Act of 14 June 2024 on the Protection of Whistleblowers

Controller and contact details

thyssenkrupp Group Services Gdańsk sp. z o.o., with its registered office in Gdańsk, 80-309, al. Grunwaldzka 472D, KRS: 0000498388, career.pl@thyssenkrup.com, tel. (58) 783-60-00

Data Protection Officer

dpo.gsg@thyssenkrup.com

Purposes and legal bases for processing

Purpose:

Compliance with the Controller’s legal obligation – verification and handling of a report concerning a breach of law (Article 6(1)(c) GDPR in conjunction with the Act of 14 June 2024 on the Protection of Whistleblowers, hereinafter referred to as the “Act”).
Pursuing the Controller’s legitimate interest in the establishment, exercise or defence of legal claims (Article 6(1)(f) GDPR).
Where the whistleblower has given consent to the disclosure of their identity (Article 6(1)(a) GDPR).
Where special categories of personal data are processed (Article 9(2)(g) GDPR).

Data retention period:

Personal data and other information contained in the register of internal reports will be retained by the Controller for a period of 3 years following the end of the calendar year in which the follow-up actions were completed or the proceedings initiated because of such actions were concluded.

We will not collect personal data that is not relevant to handling a report. If such data is collected accidentally, we will delete it without undue delay and, in any case, within 14 days of determining that it is irrelevant.

Where claims may arise from the processing, we may retain the data until those claims are finally resolved or until the applicable limitation period expires.

Categories of data

First name, surname, position and, where applicable, information concerning the whistleblower’s involvement in the reported breach and/or actions taken by the whistleblower.

Sources of data

We obtain your data directly from you.

Requirement to provide data

The requirement for a person reporting a breach of law to provide their personal data, or the right to make such a report anonymously, is governed by the Internal Reporting Procedure.

What happens if you do not provide your data

The Internal Reporting Procedure provides that anonymous reports will be considered. This means that even if you do not provide us with your personal data, your report will still be subject to verification in accordance with the adopted procedure.

Recipients of data

The Controller does not intend to disclose personal data processed under the procedure for reporting breaches of law to recipients within the meaning of Article 4(9) GDPR, except in cases provided for by applicable law.

Data transfers

Your rights

a) the right of access to your personal data – within the scope of Article 15 GDPR,

b) the right to rectification of your personal data – within the scope of Article 16 GDPR,

c) the right to restriction of processing of your personal data – within the scope of Article 18 GDPR,

d) the right to withdraw your consent to the processing of personal data at any time, where consent was the legal basis for processing, without affecting the lawfulness of processing based on consent before its withdrawal.

Right to lodge a complaint

Automated decision-making

Your data processed in connection with the handling of a report concerning a breach of law will not be subject to automated decision-making, including profiling.

Last updated: 26 May 2026

8. Whistleblowers – Privacy Notice for Persons Whose Personal Data Are Processed in Connection with an Investigation Conducted under the Act of 14 June 2024 on the Protection of Whistleblowers

Controller and contact details

thyssenkrupp Group Services Gdańsk sp. z o.o., with its registered office in Gdańsk, 80-309, al. Grunwaldzka 472D, KRS: 0000498388, career.pl@thyssenkrup.com, tel. (58) 783-60-00

Data Protection Officer

dpo.gsg@thyssenkrup.com

Purposes and legal bases for processing

Purpose:

Compliance with the Controller’s legal obligation – verification and handling of a report concerning a breach of law (Article 6(1)(c) GDPR in conjunction with the Act of 14 June 2024 on the Protection of Whistleblowers, hereinafter referred to as the “Act”).
Pursuing the Controller’s legitimate interest in the establishment, exercise or defence of legal claims (Article 6(1)(f) GDPR).
Where special categories of personal data are processed, the legal basis for processing is Article 9(2)(g) GDPR.

Data retention period:

Personal data and other information contained in the register of internal reports will be retained by the Controller for no longer than 3 years following the end of the calendar year in which the follow-up actions were completed or the proceedings initiated because of such actions were concluded.

Personal data that is not relevant to the handling of a report will not be collected and, if collected accidentally, will be deleted without undue delay. Such personal data will be deleted within 14 days of determining whether they are not relevant to the case.

Where claims may arise in connection with the processing, the data may be processed until the claims pursued have been finally satisfied or until the applicable limitation period has expired.

Categories of data

Person concerned by the report: first name, surname, position and circumstances of the alleged breach.

Witness: first name, surname and, where applicable, information concerning the witness’ involvement in the reported breach and/or actions taken by the witness.

Recipients of data

Your data may only be disclosed to entities authorized to receive them under applicable law and to entities to which the Controller has entrusted the processing of personal data pursuant to appropriate agreements, such as providers of whistleblowing systems, e-mail services and data storage services.

The data may be disclosed to unauthorized persons only with your explicit consent.

Data transfers

Your rights

the right to rectification of your personal data – within the scope of Article 16 GDPR,
the right to restriction of processing of your personal data – within the scope of Article 18 GDPR.

Right to lodge a complaint

Automated decision-making

Your data processed in connection with the handling of a report concerning a breach of law will not be subject to automated decision-making, including profiling.

Last updated: 26 May 2026

9. Clients and Their Representatives

Controller and contact details

thyssenkrupp Group Services Gdańsk sp. z o.o., with its registered office in Gdańsk, 80-309, al. Grunwaldzka 472D, KRS: 0000498388, career.pl@thyssenkrup.com, tel. (58) 783-60-00

Data Protection Officer

dpo.gsg@thyssenkrup.com

Purposes and legal bases for processing

Purpose:

Performance of a contract with a client or taking steps at the client’s request prior to entering into a contract, irrespective of the form in which such request is made (Article 6(1)(b) GDPR – if you are the client; Article 6(1)(f) GDPR – if you are a natural person acting on behalf of or for the benefit of the client).
Compliance with legal obligations, particularly those relating to taxation and accounting (Article 6(1)(c) GDPR).
Pursuing the Controller’s legitimate interest in the establishment, exercise or defence of legal claims (Article 6(1)(f) GDPR).
Purposes specified in the wording of consents to the processing of personal data, where such consents have been given (Article 6(1)(a) GDPR).

Note: Providing data other than those requested by the Controller or data marked as optional constitutes a clear affirmative action equivalent to giving consent to the processing of personal data for the purposes for which they were provided.

Statistical purposes related to improving work efficiency, the quality of services provided and adapting them to their recipients (Article 6(1)(f) GDPR).

Data retention period

Personal data will be retained until the expiry of the limitation periods applicable to claims arising from the contract with the client. If no business relationship is established, your data will be deleted without undue delay, unless their retention is justified for the establishment, exercise or defence of legal claims – in which case the data will be retained until the limitation period applicable to such claims has expired.

Certain data will also be retained until the expiry of data retention obligations arising from specific provisions of law, particularly those concerning the retention of accounting documents.

Categories of data

Our client (i.e. a party to the contract) may be a natural person or an organisation, such as a commercial company. In the latter case, we process the personal data of persons acting on behalf of the organisation, e.g. its management board president, authorised representatives or contact persons responsible for the performance of the contract.

Before entering into a contract with a client, we obtain the data necessary to prepare and present an offer. These usually include basic contact details: first name and surname, e-mail address and telephone number. In the case of clients who are natural persons, before entering into a contract we also obtain additional data necessary for its conclusion, e.g. PESEL number or residential address, depending on the product/service we provide. Where a written contract is concluded through an authorised representative, we also process their PESEL number or identity card number. Where cooperation takes place through an IT system, we also process the login credentials, including login and password, as well as the history of cooperation.

During the term of the contract with the client, we obtain or process further data, such as information concerning transactions concluded or, more generally, the history of our cooperation, including the results of satisfaction surveys.

Note: If, in connection with using our services/purchasing the products we offer, you have registered an account on our website, please note that such an account constitutes a separate service. Information concerning the processing of your personal data in connection with the provision of this service can be found in another section of this Policy.

Sources of data

As a standard, we obtain data directly from you.

Your personal data may also be obtained from another source, e.g. from our client or prospective client, if you are their employee or representative. In some cases, we obtain personal data from publicly available sources, such as the client’s website or business intelligence providers, where we wish to verify the client before establishing a business relationship with them.

Requirement to provide data

Providing certain data is necessary to enter and subsequently perform a contract.

Please note that a contract may be concluded in various ways, e.g. by placing an order in an online store.

What happens if you do not provide your data

If you do not provide data that are required to enter into a contract, the contract cannot be concluded.

Recipients of data

Recipients are external entities to which we disclose your data:

public authorities or other entities authorised under applicable law, where this is necessary for compliance with legal obligations,
providers of external ICT systems that provide support and IT solutions,
entities auditing our activities or expert appraisers,
providers of accounting, advisory or legal services,
companies providing disposal or archiving services for documents and other media,
courier and postal service providers,
the organization’s subcontractors or suppliers,
banks and other financial and payment institutions,
marketing agencies,
companies within the Controller’s corporate group.

Data transfers

Automated decision-making

Your data will not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Your rights

a) the right of access to your personal data – within the scope of Article 15 GDPR,

b) the right to rectification of your personal data – within the scope of Article 16 GDPR,

c) the right to erasure of your personal data – within the scope of Article 17 GDPR,

d) the right to restriction of processing of your personal data – within the scope of Article 18 GDPR,

e) the right to data portability – within the scope of Article 20 GDPR,

as well as

Right to lodge a complaint

Last updated: 26 May 2026

10. Contractors (Including Suppliers) and Their Representatives

Controller and contact details

thyssenkrupp Group Services Gdańsk sp. z o.o., with its registered office in Gdańsk, 80-309, al. Grunwaldzka 472D, KRS: 0000498388, career.pl@thyssenkrup.com, tel. (58) 783-60-00

Data Protection Officer

dpo.gsg@thyssenkrup.com

Purposes and legal bases for processing

Purpose:

Establishing a business relationship, presenting a service offer where consent has been obtained, or responding to inquiries (Article 6(1)(f) GDPR, i.e. based on our legitimate interest consisting in the ability to establish business relationships, present offers and respond to inquiries).
Performance of a contract with a contractor or taking steps at the contractor’s request prior to entering into a contract, expressed in any form, e.g. by completing a contact form on the website (Article 6(1)(b) GDPR – if you are the contractor; Article 6(1)(f) GDPR – if you are a natural person acting on behalf of or for the benefit of the contractor).
Compliance with legal obligations, particularly those relating to taxation and accounting (Article 6(1)(c) GDPR).
Pursuing the Controller’s legitimate interest in the establishment, exercise or defence of legal claims (Article 6(1)(f) GDPR).
Statistical purposes related to improving work efficiency, the quality of services provided and adapting them to their recipients (Article 6(1)(f) GDPR).

Data retention period

Personal data will be retained until the expiry of the limitation periods applicable to claims arising from the contract with the contractor or from statutory provisions, whichever period is longer.

If no business relationship is established, your data will be deleted without undue delay, unless their retention is justified for the establishment, exercise or defence of legal claims – in which case the data will be retained until the limitation period applicable to such claims has expired.

Certain data will also be retained until the expiry of data retention obligations arising from specific provisions of law, particularly those concerning the retention of accounting records.

Categories of data

Our contractor (i.e. a party to the contract) may be a natural person or an organization, such as a commercial company. In the latter case, we process the personal data of persons acting on behalf of the organization, e.g. its management board president, authorized representatives or contact persons responsible for the performance of the contract.

Before entering into a contract with a contractor, we obtain the data necessary to commence negotiations regarding the terms of cooperation. These usually include basic contact details: first name and surname, e-mail address and telephone number. In the case of contractors who are natural people, before entering into a contract we also obtain additional data necessary for its conclusion, such as a PESEL number or residential address.

Where a written contract is concluded through an authorized representative, we also process their PESEL number or identity card number. Where cooperation takes place through an IT system, we also process login credentials, including login and password, as well as the history of cooperation.

During the term of the contract, we obtain or process further data, such as information regarding invoices issued by the contractor or, more generally, the history of our cooperation.

Sources of data

As a standard, we obtain data directly from you.

Your personal data may also be obtained from another source, e.g. from our contractor company, if you are its employee or representative. In some cases, we obtain personal data from publicly available sources, such as the contractor’s website or business intelligence providers, where we wish to verify the contractor before establishing a business relationship.

Requirement to provide data

Providing certain data is necessary to enter and subsequently perform a contract.

What happens if you do not provide your data

If you do not provide data that are required to conclude or perform a contract, the contract cannot be concluded or properly performed.

Recipients of data

Recipients are external entities to which we disclose your data:

public authorities or other entities authorized under applicable law, where this is necessary for compliance with legal obligations,
providers of external ICT systems that provide support and IT solutions,
entities auditing our activities or expert appraisers,
providers of accounting, legal advisory or debt collection services,
companies providing disposal or archiving services for documents and other media,
courier and postal service providers,
banks and other financial and payment institutions,
the organization’s clients,
other companies within the Controller’s corporate group.

Data transfers

Automated decision-making

Your data will not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Your rights

a) the right of access to your personal data – within the scope of Article 15 GDPR,

b) the right to rectification of your personal data – within the scope of Article 16 GDPR,

c) the right to erasure of your personal data – within the scope of Article 17 GDPR,

d) the right to restriction of processing of your personal data – within the scope of Article 18 GDPR,

e) the right to data portability – within the scope of Article 20 GDPR,

as well as

Right to lodge a complaint

Last updated: 26 May 2026

11. Recipients of Marketing Communications

Controller and contact details

thyssenkrupp Group Services Gdańsk sp. z o.o., with its registered office in Gdańsk, 80-309, al. Grunwaldzka 472D, KRS: 0000498388, career.pl@thyssenkrup.com, tel. (58) 783-60-00

Data Protection Officer

dpo.gsg@thyssenkrup.com

Purposes and legal bases for processing

Purpose:

Pursuing the Controller’s legitimate interest in marketing its own products and services (Article 6(1)(f) GDPR), through the following communication channels:

- voice calls,

- e-mail messages,

- SMS messages,

- traditional mail.

NOTE: The use of certain communication channels requires separate consent to the use of that channel. This applies to e-mail messages, voice calls and SMS messages (Article 398 of the Polish Electronic Communications Law).

Compliance with legal obligations, particularly those arising under the Polish Electronic Communications Law (Article 6(1)(c) GDPR).
Pursuing the legitimate interests of companies cooperating with the Controller in marketing their products and services, where you have given your consent to such activities (Article 6(1)(a) GDPR).
Pursuing the Controller’s legitimate interest in the establishment, exercise or defence of legal claims relating to the sending of marketing communications, where such claims are raised (Article 6(1)(f) GDPR).
Purposes specified in the wording of consents to the processing of personal data, where such consents have been given (Article 6(1)(a) GDPR).
Statistical purposes related to improving work efficiency, the quality of services provided and adapting them to their recipients, which constitutes our legitimate interest (Article 6(1)(f) GDPR).

Data retention period

Personal data will be retained until you object to marketing activities or withdraw your consent, depending on the legal basis for sending the communications, i.e. until you indicate to us, in any manner, that you no longer wish to receive information from us about our activities/services.

If you raise specific claims relating to the marketing communications sent by us, the data will be retained until the expiry of the limitation periods applicable to such claims.

Where we process specific data on the basis of the Controller’s legitimate interests (Article 6(1)(f) GDPR) and, before the expiry of the standard retention period, you raise an effective objection to the processing, the data will be processed for that specific purpose for a shorter period, i.e. until your objection is upheld (unless the objection concerns processing for direct marketing purposes, in which case you are not required to provide grounds for the objection).

Categories of data

As a standard, these are limited to the data necessary to send marketing communications, i.e. first name and surname, e-mail address and telephone number and, in the case of communications sent by traditional mail, also the correspondence address.

Sources of data

As a standard, we obtain data directly from you.

Requirement to provide data

Providing the data is neither a contractual nor a statutory requirement.

What happens if you do not provide your data

There are no consequences given the above.

Recipients of data

Recipients are external entities to which we disclose your data:

providers of external ICT systems that provide support and IT solutions,
entities providing marketing communication distribution services on our behalf,
entities within the Controller’s corporate group,
courier and postal service providers,
companies providing disposal or archiving services for documents and other media,
subcontractors,
companies providing advisory, audit or legal services,
companies within the Controller’s corporate group.

Data transfers

Automated decision-making

Your data will not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

We do not make automated decisions based on the data processed for the purpose of sending marketing communications. However, we may make such decisions based on data obtained in other processing activities, e.g. in connection with the performance of a contract concluded with you. We use your purchase history to create your profile and then, on that basis, determine which offers to send to you. This takes place pursuant to Article 22(2)(c) GDPR and is subject to obtaining your explicit consent in advance.

Your rights

a) the right of access to your personal data – within the scope of Article 15 GDPR,

b) the right to rectification of your personal data – within the scope of Article 16 GDPR,

c) the right to erasure of your personal data – within the scope of Article 17 GDPR,

d) the right to restriction of processing of your personal data – within the scope of Article 18 GDPR,

e) the right to data portability – within the scope of Article 20 GDPR,

as well as

Right to lodge a complaint

Last updated: 26 May 2026

12. Event Participants

Controller and contact details

thyssenkrupp Group Services Gdańsk sp. z o.o., with its registered office in Gdańsk, 80-309, al. Grunwaldzka 472D, KRS: 0000498388, career.pl@thyssenkrup.com, tel. (58) 783-60-00

Data Protection Officer

dpo.gsg@thyssenkrup.com

Purposes and legal bases for processing

Purpose:

Organization of the event, which constitutes a legitimate interest pursued by the Controller (Article 6(1)(f) GDPR).

Where personal data in the form of an image are disseminated – promotion of the Controller (to the extent resulting from the consent granted for the dissemination of the image pursuant to Article 81 of the Act of 4 February 1994 on Copyright and Related Rights, hereinafter referred to as the “Copyright Consent”) – the legal basis for processing is Article 6(1)(f) GDPR.

NOTE: If you participate in events organized by the Controller that are recorded or photographed, participation in such events is deemed to constitute consent to the recording and free-of-charge use and/or dissemination of your image/voice/statements in promotional and marketing materials without any time or territorial limitations.

Consent given in this manner covers all forms of dissemination and making such materials available, publication on the Controller’s websites, on social media profiles operated by the Controller, such as Facebook, Instagram and LinkedIn, and in promotional materials printed or distributed electronically via the Internet.

Your image may be subject to various forms of electronic image processing, cropping and composition without the requirement to approve the final product, provided that it is not used in an offensive manner or in a manner generally considered unethical. The image of an event participant may be combined with images of other participants and with content relating to the business activities of the Controller and/or its partners, including marketing and promotional content.

The event participant hereby waives, both now and in the future, any claims, including financial claims, that may arise in connection with the publication of their image in the materials referred to above.

Pursuing the Controller’s legitimate interest in the establishment, exercise or defence of legal claims relating to the organized event, where such claims are raised (Article 6(1)(f) GDPR).
Purposes specified in the wording of consents to the processing of personal data, where such consents have been given (Article 6(1)(a) GDPR).

Data retention period

Personal data will be retained until the event has ended and, where claims may arise in connection with the processing, the data will be retained until the expiry of the limitation periods applicable to such claims.

Categories of data

As a standard, these are limited to the data necessary to send an invitation and organize the event. Depending on the event, these may include: first name and surname, e-mail address, telephone number and, subsequently, your image recorded during the event.

Sources of data

As a standard, we obtain data directly from you.

Requirement to provide data

Providing the data is neither a contractual nor a statutory requirement.

What happens if you do not provide your data

Failure to provide the data may result in you being unable to participate in the event.

Recipients of data

Recipients are external entities to which we disclose your data:

providers of external ICT systems that provide support and IT solutions,
entities supporting the organization and delivery of the event,
entities within the Controller’s corporate group,
entities auditing our activities,
providers of accounting, debt collection or legal services,
security service providers.

Data transfers

Data may be transferred to Meta Platforms, Inc. for the purpose of pursuing the Controller’s legitimate interest in providing information about the Controller’s activities and for marketing and promotional purposes. In this context, your personal data will be transferred outside the EEA. Detailed information is available in the Privacy Policies of Meta Platforms, Inc.: Facebook Privacy Policy and Instagram Privacy Policy.

Data may be transferred to Microsoft, the owner of the LinkedIn platform, for the purpose of pursuing the Controller’s legitimate interest in providing information about the Controller’s activities and for marketing and promotional purposes. In this context, your personal data will be transferred outside the EEA. Detailed information is available in the entity’s LinkedIn Privacy Policy.

Automated decision-making

Your data will not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Your rights

a) the right of access to your personal data – within the scope of Article 15 GDPR,

b) the right to rectification of your personal data – within the scope of Article 16 GDPR,

c) the right to erasure of your personal data – within the scope of Article 17 GDPR,

d) the right to restriction of processing of your personal data – within the scope of Article 18 GDPR,

e) the right to data portability – within the scope of Article 20 GDPR,

as well as

Right to lodge a complaint

Last updated: 26 May 2026

13. People Whose Image Appears in Promotional Materials

Controller and contact details

thyssenkrupp Group Services Gdańsk sp. z o.o., with its registered office in Gdańsk, 80-309, al. Grunwaldzka 472D, KRS: 0000498388, career.pl@thyssenkrup.com, tel. (58) 783-60-00

Data Protection Officer

dpo.gsg@thyssenkrup.com

Purposes and legal bases for processing

Purpose:

Promotion of the Controller or entities cooperating with the Controller (Article 6(1)(f) GDPR).

This purpose is also pursued where an image is disseminated (to an unlimited audience), to the extent resulting from consent granted for the dissemination of the image pursuant to Article 81 of the Act of 4 February 1994 on Copyright and Related Rights, or under an agreement providing for remuneration for posing.

Performance of an agreement between the person depicted in the promotional material and the Controller, where such an agreement has been concluded (Article 6(1)(b) GDPR).
Compliance with the Controller’s obligations arising from specific provisions of law, in particular tax and accounting regulations, where financial settlements are made between the Controller and the person depicted in the promotional material (Article 6(1)(c) GDPR).
Pursuing the Controller’s legitimate interest in the establishment, exercise or defense of legal claims relating to the inclusion of personal data in promotional materials, where such claims are raised (Article 6(1)(f) GDPR).
Purposes specified in the wording of consents to the processing of personal data, where such consents have been given (Article 6(1)(a) GDPR).

Data retention period

Personal data will be retained until the publication of the promotional material has ended.

Where an agreement has been concluded with the person depicted in the promotional material (e.g. an agreement for posing), the data will also be processed until the expiry of the limitation period applicable to claims arising from that agreement.

The data will be retained until the expiry of the limitation periods applicable to claims relating to your appearance in the Controller’s promotional materials.

Categories of data

As a standard, this includes your image. Depending on the promotional material, the data may also include your first name and surname and your professional role or function, e.g. university lecturer.

Sources of data

As a standard, we obtain data directly from you. Alternatively, where personal data consist of your image, the source of the data may be the author of the relevant material or an entity holding the rights to that material.

Requirement to provide data

Providing the data is neither a contractual nor a statutory requirement, except where we enter into an agreement with people depicted in promotional materials, e.g. an agreement for posing.

What happens if you do not provide your data

There are no consequences in view of the above, except in relation to data necessary to enter into an agreement. In such a case, if you do not provide the required data, the agreement cannot be concluded and, for example, remuneration for posing cannot be paid to you.

Recipients of data

Recipients are external entities to which we disclose your data:

entities providing us with IT tools used to store your data or entities having access to your data as part of IT system maintenance activities,
entities supporting us in the production of promotional materials, such as photography agencies or graphic designers providing professional editing and processing of promotional materials,
providers of legal services, where necessary, e.g. in connection with claims that have been raised.

Data transfers

Your rights

a) the right of access to your personal data – within the scope of Article 15 GDPR,

b) the right to rectification of your personal data – within the scope of Article 16 GDPR,

c) the right to erasure of your personal data – within the scope of Article 17 GDPR,

d) the right to restriction of processing of your personal data – within the scope of Article 18 GDPR,

e) the right to data portability – within the scope of Article 20 GDPR,

as well as

Right to lodge a complaint

Last updated: 26 May 2026

15. Website Users (Data Collected via Cookies or Other Tracking Technologies)

Controller and contact details

thyssenkrupp Group Services Gdańsk sp. z o.o., with its registered office in Gdańsk, 80-309, al. Grunwaldzka 472D, KRS: 0000498388, career.pl@thyssenkrup.com, tel. (58) 783-60-00

Data Protection Officer

dpo.gsg@thyssenkrup.com

Purposes and legal bases for processing

Purpose:

Ensuring the functionality of the website and facilitating its use (Article 6(1)(f) GDPR).
Conducting analyses and compiling statistics concerning users’ use of the Controller’s website (Article 6(1)(f) GDPR).
Pursuing the Controller’s legitimate interest in analyzing users’ activities and subsequently using such data for so-called remarketing purposes, i.e. displaying advertisements for products and services in which you have shown interest (Article 6(1)(f) GDPR).
Purposes specified in the wording of consents to the processing of personal data, where such consents have been given (Article 6(1)(a) GDPR).

Data retention period

Where we process specific data on the basis of the Controller’s legitimate interests (Article 6(1)(f) GDPR) and you raise a justified objection to the processing, the data will be processed for that specific purpose until your objection is upheld.

Where we process specific data on the basis of your consent (Article 6(1)(a) GDPR) and you withdraw your consent, the data will be processed for that specific purpose until the consent is withdrawn.

Categories of data

As a standard, these include data such as your IP address and any information concerning you obtained from cookies or using other tracking technologies. This may include, for example, information about the device you use to connect to us (and access our website), information about the browser you use, and information about the actions you take or content you click on while using our website. Detailed information about the types of data that may be collected can be found in the section of this Policy dedicated to cookies.

Sources of data

As a standard, we obtain the data directly from you as a user of our website.

Requirement to provide data

Providing the data is neither a contractual nor a statutory requirement.

What happens if you do not provide your data

There are no consequences, given the above.

Recipients of data

Recipients are external entities to which we disclose your data:

public authorities or other entities authorised under applicable law, where this is necessary for compliance with legal obligations,
companies within the Controller’s corporate group,
the Controller’s subcontractors,
our suppliers, including the service providers referred to below,
entities providing us with IT tools used to process your data, including providers of tracking technologies,
marketing agencies.

Data transfers

Automated decision-making

Your data will not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Your rights

a) the right of access to your personal data – within the scope of Article 15 GDPR,

b) the right to rectification of your personal data – within the scope of Article 16 GDPR,

c) the right to erasure of your personal data – within the scope of Article 17 GDPR,

d) the right to restriction of processing of your personal data – within the scope of Article 18 GDPR,

e) the right to data portability – within the scope of Article 20 GDPR,

as well as

Right to lodge a complaint

Last updated: 26 May 2026

16. Social Media Users

Controller and contact details

thyssenkrupp Group Services Gdańsk sp. z o.o., with its registered office in Gdańsk, 80-309, al. Grunwaldzka 472D, KRS: 0000498388, career.pl@thyssenkrup.com, tel. (58) 783-60-00

Data Protection Officer

dpo.gsg@thyssenkrup.com

Purposes and legal bases for processing

Purpose:

Promoting the Controller’s activities through social media and enabling social media users to communicate with the Controller (Article 6(1)(f) GDPR).
Conducting analyses and compiling statistics concerning users’ interactions with the Controller’s social media profiles (Article 6(1)(f) GDPR).

Data retention period

We retain/process your data for as long as we hold them on the relevant social media platform. We do not delete posts or comments posted under them (unless they violate the applicable terms and conditions), nor do we delete private messages sent to us.

Where we process specific data based on the Controller’s legitimate interests (Article 6(1)(f) GDPR) and you raise a justified objection to the processing, the data will be processed for that specific purpose until your objection is upheld. In practice, this means that we will then delete your data, e.g. from a post, or delete a private message received from you.

Categories of data

As a standard, these are the data that you make available to us by interacting with our social media profile. We therefore process information indicating that you have liked/followed our profile, as well as the content of comments you post or private messages you send to us. This will often also include your first name and surname, although this depends on the username you use on the relevant social media platform.

We may also derive certain statistical data from your activity on our social media profiles, e.g. information concerning your interest in particular topics.

Sources of data

As a standard, we obtain data directly from you.

Requirement to provide data

Providing the data is neither a contractual nor a statutory requirement.

What happens if you do not provide your data

There are no consequences, given the above.

Recipients of data

Recipients are external entities to which we disclose your data:

entities providing us with IT tools used to process your data, including providers of tracking technologies,
marketing agencies, where we engage them to manage our social media profiles.

Data transfers

Transfers of data outside the EEA may also result from the nature and international operation of social media platforms. Further information in this regard can be found in the privacy policies of the relevant social media platforms.

Automated decision-making

Your data will not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Your rights

a) the right of access to your personal data – within the scope of Article 15 GDPR,

b) the right to rectification of your personal data – within the scope of Article 16 GDPR,

c) the right to erasure of your personal data – within the scope of Article 17 GDPR,

d) the right to restriction of processing of your personal data – within the scope of Article 18 GDPR,

e) the right to data portability – within the scope of Article 20 GDPR,

as well as

Right to lodge a complaint

Last updated: 26 May 2026

17. Visitors

Controller and contact details

thyssenkrupp Group Services Gdańsk sp. z o.o., with its registered office in Gdańsk, 80-309, al. Grunwaldzka 472D, KRS: 0000498388, career.pl@thyssenkrup.com, tel. (58) 783-60-00

Data Protection Officer

dpo.gsg@thyssenkrup.com

Purposes and legal bases for processing

Purpose:

Ensuring the security of persons and property on the Controller’s premises by recording visitors entering and leaving the premises (Article 6(1)(f) GDPR).
Pursuing the Controller’s legitimate interest in the establishment, exercise or defence of legal claims (Article 6(1)(f) GDPR).

Data retention period

The standard retention period for data contained in the visitor register is 1 year from the date on which the data are recorded in the register.

Categories of data

As a standard, these include your first name and surname, the company you represent, the person on whose invitation (on behalf of the Controller) you are visiting, the date and time of entry, the date and time of departure, and your signature. In some cases, this may also include the registration number of the vehicle in which you arrive.

Sources of data

As a standard, we obtain data directly from you.

However, in some cases we may obtain certain information in advance from the company sending you, e.g. your first name and surname and the registration number of the vehicle in which you will arrive.

Requirement to provide data

Providing the data is neither a contractual nor a statutory requirement.

What happens if you do not provide your data

Failure to provide the data may result in difficulties in gaining access to the Controller’s premises.

Recipients of data

Recipients are external entities to which we disclose your data:

public authorities or other entities authorised under applicable law, where this is necessary for compliance with legal obligations,
companies providing services or IT solutions,
companies within the Controller’s corporate group,
the organisation’s subcontractors and suppliers,
companies providing advisory, audit or legal services.

Data transfers

Automated decision-making

Your data will not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Your rights

a) the right of access to your personal data – within the scope of Article 15 GDPR,

b) the right to rectification of your personal data – within the scope of Article 16 GDPR,

c) the right to erasure of your personal data – within the scope of Article 17 GDPR,

d) the right to restriction of processing of your personal data – within the scope of Article 18 GDPR,

e) the right to data portability – within the scope of Article 20 GDPR,

as well as

Right to lodge a complaint

Last updated: 26 May 2026

18. Correspondents (Including Persons Redirected from the Website)

Controller and contact details

thyssenkrupp Group Services Gdańsk sp. z o.o., with its registered office in Gdańsk, 80-309, al. Grunwaldzka 472D, KRS: 0000498388, career.pl@thyssenkrup.com, tel. (58) 783-60-00

Data Protection Officer

dpo.gsg@thyssenkrup.com

Purposes and legal bases for processing

Purpose:

Managing correspondence and ensuring the circulation and archiving of documents (Article 6(1)(f) GDPR). Depending on the subject matter of the correspondence, further information concerning the purposes of processing personal data contained in the correspondence and the related legal bases is provided in a separate privacy notice.
Responding to your enquiry / handling your request (Article 6(1)(f) GDPR).
Presenting an offer in response to a request made by a prospective client, which constitutes taking steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR – if you are a prospective client; Article 6(1)(f) GDPR – if you are a natural person acting on behalf of or for the benefit of the client).
Pursuing the Controller’s legitimate interest in the establishment, exercise or defence of legal claims, where such claims arise from the matter in connection with which you contact us (Article 6(1)(f) GDPR).

Data retention period

Personal data will be retained until the correspondence has been concluded, your enquiry has been answered / your request has been handled, and subsequently for a period of 1 year.

If you contact us for the purpose of receiving an offer from us, the data will be retained for a period of 3 years from the date on which the offer is presented, provided that the offer is not accepted. If you accept the offer, we will process your data for the period applicable to clients or contractors – further information concerning the processing of your data, including the applicable retention period, can be found in the relevant dedicated privacy notice.

Subsequently, where claims arise from the matter in connection with which you contact us, the data will be processed until the expiry of the limitation periods applicable to such claims.

Categories of data

This depends on the matter in connection with which you contact us, and, on the data, you choose to provide to us in that context. We are therefore unable to specify in advance an exhaustive list of categories of personal data that may be processed.

Sources of data

As a standard, we obtain data directly from you.

However, a person submitting a request or enquiry to us may also provide personal data relating to third parties where this is relevant to the subject matter of the request or enquiry. If you are such a third party, the source of your data is the person who contacts us directly to submit the request or enquiry.

Requirement to provide data

Providing the data is voluntary and is neither a contractual nor a statutory requirement.

What happens if you do not provide your data

Failure to provide the data may result in our inability to fulfil the purposes of the processing.

Recipients of data

Recipients are external entities to which we disclose your data:

public authorities or other entities authorised under applicable law, where this is necessary for compliance with legal obligations,
entities providing us with IT tools used to store your data or entities having access to your data as part of IT system maintenance activities,
companies providing disposal or archiving services for documents and other media,
courier and postal service providers,
audit firms,
companies providing advisory, audit or legal services,
subcontractors,
companies within the Controller’s corporate group.

Data transfers

Automated decision-making

Your data will not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Your rights

a) the right of access to your personal data – within the scope of Article 15 GDPR,

b) the right to rectification of your personal data – within the scope of Article 16 GDPR,

c) the right to erasure of your personal data – within the scope of Article 17 GDPR,

d) the right to restriction of processing of your personal data – within the scope of Article 18 GDPR,

e) the right to data portability – within the scope of Article 20 GDPR,

as well as

g) the right to object at any time to the processing of your personal data – within the scope of Article 21 GDPR – where the legal basis for processing is the legitimate interests pursued by the Controller or by a third party (Article 6(1)(f) GDPR). When raising an objection, you must state the grounds relating to your particular situation, unless the objection concerns processing for direct marketing purposes, in which case no such grounds are required.

Right to lodge a complaint

Last updated: 26 May 2026

19. Cookies

What are cookies?

Cookies are small text files that are stored on your computer or smartphone when you visit our website. There are different types of cookies. We have divided them into two categories:

a) cookies necessary for the use of our website,

b) other cookies.

Necessary cookies ensure that our website operates reliably. These cookies measure website traffic and protect the website against overload. They remember your choices concerning privacy and how you complete our forms. Cookies also store the contents of your shopping cart and monitor your login status. We use these cookies by default. This means that they are stored on your computer or smartphone when you visit our website.
[Article 399(3) of the Electronic Communications Law]
We use other cookies only where you have given your consent.

What cookies do we use?

All cookies used by us are described in detail in the cookie banner available on our website: thyssenkrupp Group Services Gdańsk website.

Consent to the use of cookies

When you visit our website, we will display a banner informing you that we use cookies. If you select “Accept All”, this means that you accept all cookies. By doing so, you also confirm that you understand what cookies we use, the purposes for which we use them and when we disclose data obtained from these cookies to our partners.
Please note that we do not need your consent to use necessary cookies.

[Article 399(3) of the Electronic Communications Law]

Refusing consent to the use of cookies

If you do not want our cookies to be stored on your device, select “Deny”. By selecting this option, you will reject all cookies except those that are necessary.

Managing cookie settings

If you wish to manage your cookie preferences, select “Save Settings”.

Withdrawal of consent

Please remember that you can change your consent preferences at any time. To do so, click the blue fingerprint icon located in the bottom-left corner of our website

20. Changes to the Privacy Policy

If there are any changes to the way in which we process your personal data, we will update this Privacy Policy and publish its latest version on our website sufficiently in advance, considering the significance of the changes.