Terms and Conditions

Concluded between the Recipient, indicated in the Terms and Conditions of the provision of electronic services offered on the “HRnest” Website, to which this Agreement constitutes an annex, hereinafter referred to as the “PRINCIPAL”

and

HRnest Sp. z o.o. with its registered seat in Gdynia, al. Zwycięstwa 96/98, 81-451 Gdynia, entered in the register of entrepreneurs of the National Court Register (KRS) by the Gdańsk-Północ [Gdańsk-North] District Court in Gdańsk, KRS No: 0000723806, NIP [Tax Identification Number]: 5833293000, REGON [National Business Registry Number]: 369734182, share capital: PLN 40,000, Hereinafter referred to as the “CONTRACTOR”
which reads as follows:

Section 1
ENTRUSTMENT OF PERSONAL DATA PROCESSING

1. For the purpose of performing the agreement on provision of an electronic service concluded via www.hrnest.io, the Principal entrusts the Contractor, as the processor, with the processing of personal data.

2. The Principal declares to be the Controller of the data which it entrusts.

3. The Principal declares that it has grounds for the processing of personal data which are relevant, in accordance with the Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as “GDPR”.

4. The entrusted data include information about natural persons, i.e. employees of the Principal.

5. The Principal entrusts the Contractor with the processing of personal data within the scope specified in Section 2 hereof.

Section 2
THE SCOPE AND PURPOSE OF DATA PROCESSING

1. The Contractor will process data of the employees (including co-employees operating on the basis of civil law agreements) of the Principal (“Employees”) entrusted on the basis of the Agreement, in connection with the cooperation between these parties, including within the scope of the absence of the Employees at work or their inability to provide services for the benefit of the Principal; these data include in particular:

• a. name and surname,
• b. current position,
• c. reference number,
• d. email address,
• e. the date of birth (optionally),
• f. social security number (optionally),
• g. data included in documents connected with the health condition of the employee (i.e. in attestations or sick leaves),
• h. Employee working time

and in the case of the Principal using the Contractor’s mobile application for recording the working time of Employees using QR codes, additionally:

• – photographs of Employee – if the Principal decides to use the application’s function that allows taking photos.

2. Personal data entrusted by the Principal will be processed by the Contractor exclusively to enable the Contractor to perform the services which are described in detail in the agreement referred to in section 1 subs. 1 for the benefit of the Principal, and in a manner compliant with this Agreement as well as relevant applicable provisions of law.

Section 3
THE MANNER OF PERFORMING THE AGREEMENT WITH REGARD TO THE PROCESSING OF PERSONAL DATA

1. When processing the personal data, referred to in Section 2 subsection 1, the Contractor undertakes to implement any measures required by the GDPR and, in particular, technical and organisational measures, in order to ensure a level of security of the processing of personal data appropriate to the risk of violating law and freedom of natural persons. While implementing appropriate measures, the Contractor takes into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risk referred to in the proceeding sentence.

2. The Contractor declares that it maintains appropriate documentation which describes and defines the manner of personal data processing it uses.

3. The Contractor ensures that the persons it authorises to process personal data are obliged to keep the processed data confidential.

4. The Contractor processes personal data only at a documented request of the Principal.

5. Taking into account the nature of the processing, the Contractor will assist the Principal by adopting appropriate technical and organisational measures, insofar as this is possible, for the fulfillment of the Principal’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III of the GDPR.

6. The Contractor will assist the Principal in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR, taking into account the nature of processing and the information available to the Contractor.

7. The Contractor can subcontract the entrustment of personal data processing, processed by it in relation to the provision of a service covered by the agreement referred to in Section 1 subsection 1 of the Agreement, to other processors (hereinafter referred to as ”Subcontractors“) only with prior specific or general written consent of the Principal and in accordance with conditions of using the services of Subcontractors specified in the GDPR. In the case of a general written consent, the Contractor will inform the Principal of any intended changes concerning the addition or replacement of other Subcontractors, thereby giving the Principal the opportunity to object to such changes.

8. The Principal consents to subcontract the entrustment of personal data, entrusted to the Contractor on the basis of the Agreement, to Subcontractors indicated in annex 1 to the Agreement.

9. In the Agreement with the Subcontractor, the Contractor will oblige it to observe the same data protection obligations which have been imposed on the Contractor herein. These obligations will include, in particular, providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of the GDPR.

10. The Contractor undertakes to select only reputable Subcontractors who deliver IT infrastructure, provide sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of the GDPR and protect the data subject’s rights, as well as ensuring the highest quality of provided services and processing of personal data within European Economic Area.

11. The Contractor will inform the Principal about the addition of new Subcontractors by sending an email to the email address provided by the Principal on the Website. Changing Subcontractors (including adding new ones) within Subcontractors does not constitute a change to this Agreement. In the event of a reasonable objection to the new Subcontractor submitted by the Principal within 3 days from the receipt of a notification about a new Subcontractor as well as, at the same time, the lack of possibility to use the Service without the participation of the Subcontractor – this agreement will be resolved at the time the objection is received. Failure to object on the terms indicated in this subsection is tantamount to the Principal’s consent to add new Subcontractors.

12. The Contractor provides the Principal with all information necessary to ensure compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the Principal or another auditor mandated by the Principal. All costs in relation to the conducting of audits will be covered by the Principal.

13. With regard to subsection 12, the Contractor will immediately inform the Principal if, in its opinion, an instruction infringes the GDPR or other provisions of European Union law or applicable provisions of the Polish law concerning data protection.

Section 4
TERM OF THE ENTRUSTMENT AGREEMENT

1. The term of this Agreement is the same as the period of the Principal’s access to the HRnest Application via www.hrnest.io, i.e. to the duration of the agreement on provision of a service, referred to in Section 1 subs. 1 of the Agreement subject to Section 3 subs. 12 of the Agreement. Once the agreement on provision of an electronic service concluded via www.hrnest.io is terminated, this Agreement is terminated immediately.

2. Processing of the personal data entrusted on the basis of the Agreement occurs within the term of the Agreement.

3. Once the Agreement is terminated, the Contractor will erase or return to the Principal (depending on the Principal’s decision) all personal data as well as erase all existing copies, unless the European Union law or applicable provisions of Polish law require storage of personal data.

Section 5
FINAL PROVISIONS

1. All amendments to this agreement require a documented form under pain of nullity.

2. The Principal is liable for damage caused intentionally by the Contractor. In all other cases, the Contractor’s liability of towards the Principal is limited to the value of remuneration received by the Contractor for provision of a service referred to in Section 1 subs. 1 of the Agreement in the settlement period, in which the event giving rise to the claims occurred.

3. The provisions of the Polish Civil Code apply to all matters not settled herein.

4. All disputes arising from this Agreement will be settled by the court having jurisdiction over the Contractor’s seat.

5. This Agreement was drawn up in two identical counterparts, one for each of the parties.

Annex 1 to the entrustment agreement on personal data processing

Subcontractors to whom data can be entrusted by the Contractor for further processing:

• – Microsoft Ireland Operations Limited with its registered seat in South County Industrial Park, Leopardstown, Dublin 18, Ireland in order to provide server and hosting services
• – Vercom S.A. with its registered seat in Poznań, ul. Roosevelta 22, 60-829 Poznań, NIP: 781-17-65-125, REGON: 300061423, entered in the register of entrepreneurs of the National Court Register (KRS) by the District Court of the City of Poznań – Nowe Miasto i Wilda, KRS No 535618 in order to provide the email API and SMTP service for the purpose of sending transactional messages.