Privacy notice for the recruitment site
rekrutacja.loyal.net.pl · As of: 25 September 2026 · Version 2026-09-25.1
1 Controller
The controller within the meaning of the GDPR is:
- LOYAL sp. z o.o.
- Aleja Rzeczypospolitej 8, 80-369 Gdańsk, Polen
- NIP: 8581860842 · REGON: 368320107 · KRS: 0000695536
- Phone: +49 160 96589047 · Contact: P. Wojcicki
- E-mail: privacy@loyal.net.pl
Questions about this notice, withdrawals of consent, objections and requests to exercise your rights should be sent to the e-mail or postal address above.
Cooperation may be concluded with LOYAL sp. z o.o. or with another company of the Loyal group, in particular Better Loyal Sp. z o.o. (same address). In that case the data required for the contract is passed to that company; this notice applies to it accordingly.
2 General information on data processing
We process personal data only as far as necessary to provide the website and to handle your application as a self-employed subcontractor. Personal data is any information relating to an identified or identifiable natural person, for example name, phone number, e-mail address or details of your qualifications.
Processing complies with the applicable law. Data is passed to third parties only in the cases described in this notice and on a permissible legal basis.
3 Visiting the website and server log data
When you open the website, the following access data is processed for technical delivery and operation:
- IP address of the requesting device,
- date and time of access,
- page or file requested,
- amount of data transferred and status of the request,
- browser type and version and the operating system.
Purpose: This data is technically necessary to display the website, to ensure the stability and security of the system and to prevent abuse.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and trouble-free operation of the website).
Retention: Server logs are deleted after 14 days at the latest unless a security incident requires longer retention.
4 Application form and contact
The application form collects the details listed below. Mandatory fields are marked with an asterisk. If you contact us by e-mail, phone or WhatsApp, we process the contact and content data you provide to handle your request.
| Detail | Mandatory and purpose |
|---|---|
| First and last name | Mandatory · assignment of your application |
| Phone number | Mandatory · call-back and scheduling |
| Trade (electrical, plumbing, welding) and welding processes | Mandatory · matching to suitable sites |
| E-mail address | Optional · written follow-up |
| Languages and German level | Optional · planning work on German sites |
| Available from, rotation, preferred assignment length, working hours, countries | Optional · capacity and scheduling |
| Driving licence, own vehicle | Optional · travel planning |
| Business form, tax number, details on A1, Freistellung, insurance, Handwerkskarte | Optional · preliminary check of documents required for an assignment |
| Remarks | Optional · additional information |
| Timestamp, language, application source (e.g. Facebook, OLX, referral), version of the confirmed privacy notice | Automatic on submission · assignment and proof |
Purpose: Processing serves to assess your application, to contact you and to prepare possible cooperation as a self-employed subcontractor on construction sites in Germany.
Legal basis: Art. 6(1)(b) GDPR, because we take pre-contractual steps at your request and you as a natural person are to become the contracting party. If you act as a contact person of a company, we process your contact details on the basis of our legitimate interest in managing the cooperation, Art. 6(1)(f) GDPR.
Retention: If no cooperation comes about, we delete the application data at the latest twelve months after the last contact; open applications without handling are reviewed after 90 days. In case of cooperation we keep the necessary data for its duration and afterwards only as long as statutory retention periods or the defence of legal claims require (see section 5.6).
Provision: Name, phone number and trade are mandatory for submitting the form. All other details are optional. There is no legal obligation to apply. Without the mandatory details the form cannot be submitted.
5 Recipients and technical processing of your data
5.1 Hosting and server location
Our website, our self-hosted automation and our database run on an Oracle Cloud Infrastructure (OCI) instance in Frankfurt am Main, Germany. Data submitted through the form is received and stored there. A data processing agreement under Art. 28 GDPR is in place with Oracle.
Technical delivery and protection of the website are based on Art. 6(1)(f) GDPR; the legitimate interest is its secure and trouble-free operation. The content of your application is governed by the purposes and legal bases in section 4.
5.2 Notification of incoming applications
To process incoming applications we use n8n as self-hosted software on the same Oracle instance in Frankfurt. n8n receives the form data, stores it in our own database and notifies the person responsible for recruitment by e-mail.
E-mail communication and the internal notification mailbox are operated via SEOHOST Sp. z o.o., ul. Obornicka 330, 60-689 Poznań, Polen. A data processing agreement is in place with SEOHOST; processing takes place within the European Union. Internal notifications are deleted once the application has been fully handled.
Application data is not forwarded via messaging services (e.g. Telegram, WhatsApp). No SMS is sent.
5.3 Possible access from third countries
Storage on our Oracle instance takes place in Frankfurt am Main. For support, troubleshooting, data recovery and other contractual operating services, Oracle group companies and sub-processors may access personal data, including from countries outside the EEA.
In its service-specific list for OCI (PaaS/IaaS) Oracle names possible group companies in the following countries and territories (retrieved: 25. September 2026):
- Within the EEA: Österreich, Belgien, Bulgarien, Kroatien, Zypern, Tschechien, Dänemark, Estland, Finnland, Frankreich, Deutschland, Griechenland, Ungarn, Irland, Italien, Niederlande, Polen, Portugal, Rumänien, Spanien, Schweden und Norwegen.
- Outside the EEA: Vereinigtes Königreich, Schweiz, Ukraine, USA, Kanada, Mexiko, Argentinien, Brasilien, Chile, Costa Rica, Kolumbien, Südafrika, Ägypten, Israel, Saudi-Arabien, Vereinigte Arabische Emirate, China, Hongkong (China), Australien, Neuseeland, Indien, Japan, Singapur, Südkorea, Malaysia, Philippinen und Thailand.
The overview describes the possible recipient locations provided for by Oracle. It does not mean that LOYAL data is actually transferred to or stored in each of these countries.
For the contractually provided third-country transfers, the EU standard contractual clauses agreed with Oracle under Art. 46(2)(c) GDPR apply. You can request a copy of the applicable safeguards at privacy@loyal.net.pl.
Source: https://www.oracle.com/corporate/oracle-affiliates.html · https://www.oracle.com/legal/privacy/services-privacy-policy/
5.4 Backups and execution logs
Backups of our database are created. They are kept on a rolling basis for at most 30 days and then automatically overwritten. The automation software n8n stores execution logs of processed operations for up to 90 days; they are then deleted automatically.
Backups serve recovery after data loss; execution logs support traceability and troubleshooting of the technical processing. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in resilience and traceability of the processing.
5.5 Documents of self-employed subcontractors
After your application has been accepted we ask you for the documents required for the assignment. These include, as far as required for the specific assignment, an identity document, a face photo for site registration, the business registration (CEIDG), the A1 certificate, the Freistellungsbescheinigung under § 48b EStG, proof of insurance and accident insurance (BG) and, for German self-employed persons, the Handwerkskarte. These documents are not collected through the public form.
We process the documents for contract handling, site registration and the verification of the required proofs. For contracts concluded directly with you, Art. 6(1)(b) GDPR applies; passing data to clients and authorities is based on Art. 6(1)(c) GDPR (legal obligation when posting workers) and (f) GDPR.
Recipients: The client of the respective site (general contractor) receives the documents required for site registration. When posting to Germany, the competent bodies receive the legally required data: ZUS (A1), customs (Zoll), the tax office (Freistellung), SOKA-BAU and the accident insurance (BG). Accommodation providers you name receive your name and arrival dates.
Data source: The documents are provided by you or by the company for which you will work.
5.6 Retention of subcontractor documents
Business registrations: Copies are kept for checking and handling the respective assignment. Once this purpose ends they are deleted unless statutory archiving or necessary preservation of evidence applies.
Freistellungsbescheinigungen: Where they serve as proof for not withholding construction tax under §§ 48 ff. EStG, they are kept together with the required check notes as tax-relevant documents for six years as a rule.
A1 certificates: Site copies are deleted after the end of the assignment and completion of the related verification, as soon as no further statutory proof obligation or necessary preservation of evidence exists.
ID copies and photos: Used only for site registration and deleted after the end of the last assignment unless a legal obligation prevents this.
Accounting and archiving: Where German retention law applies, accounting records are kept for eight years and books or annual accounts for ten years; business letters and other tax-relevant documents are generally kept for six years. Under Polish law the periods provided there apply (as a rule five years from the end of the tax year).
After the end of operational use, documents that must be kept are processed only for the respective archiving, audit or legal enforcement purpose. Once all grounds for storage cease, they are deleted.
5.7 Data we do not receive from you
Some people in our applicant pool reach us via coordinators or partner companies (name, phone number, trade, A1 validity). We inform them of this notice at first contact, at the latest within one month (Art. 14 GDPR). Anyone who does not wish the processing can tell us informally; the data is then deleted unless a retention obligation exists.
5.8 Google Workspace
A company account with Google Workspace (Google Ireland Limited) may be used to store documents. Data may then be processed on Google servers; the basis is the EU standard contractual clauses offered by Google. The connection to our system is used only after internal approval.
6 Cookies and tracking
The website uses only technically necessary cookies: a cookie for the selected language and, in the internal area, a session cookie. Whether you have confirmed the cookie notice is remembered locally by your browser for 180 days. No analytics, tracking or marketing scripts are used, no external fonts are loaded and no maps, videos or social media content are embedded.
External pages are reached only via ordinary links. Only when you follow such a link is the external website opened; its own privacy notice applies to that processing.
7 Data security
All data is transferred encrypted via HTTPS. This transport encryption protects the transfer between your browser and our server. Access to stored applications is restricted to authorised staff and password-protected; backups are kept on a rolling basis.
8 Your rights as a data subject
Subject to the respective legal requirements you have in particular the following rights:
- Access (Art. 15 GDPR) to the data stored about you.
- Rectification (Art. 16 GDPR) of inaccurate or incomplete data.
- Erasure (Art. 17 GDPR), unless retention obligations or other grounds prevent it.
- Restriction of processing (Art. 18 GDPR).
- Data portability (Art. 20 GDPR), where processing is automated and based on consent or a contract.
- Objection (Art. 21 GDPR): Where processing is based on Art. 6(1)(f) GDPR, you may object on grounds relating to your particular situation. You may object to processing for direct marketing at any time without giving reasons.
Withdrawal of consent: Where processing is based on your consent, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected. You can send the withdrawal by e-mail to privacy@loyal.net.pl.
To exercise your rights you can contact us by e-mail at privacy@loyal.net.pl or at the postal address in section 1. If there are reasonable doubts about your identity, we may request additional information necessary to confirm it.
9 Right to lodge a complaint with a supervisory authority
If you consider that the processing of your personal data infringes the GDPR, you may lodge a complaint with a supervisory authority under Art. 77 GDPR, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The supervisory authority competent for us is:
- Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Polen, https://uodo.gov.pl/
You do not have to contact us first. The right to complain exists alongside other administrative or judicial remedies.
10 No automated decision-making
There is no automated decision-making within the meaning of Art. 22 GDPR and no profiling. Automated receipt, storage and notification serve only to forward your application. Review, assessment and reply are carried out by a member of staff.
11 Currency and changes to this notice
We update this notice when the data processing or the applicable requirements change. The version applicable to operations is provided on the website. As of: 25 September 2026, version 2026-09-25.1.
Confirmation in the form
I have read the privacy notice. My details will be processed to assess my enquiry as a self-employed subcontractor (pre-contractual measure).