Privacy and Cookies Policy

Name:

KB Recruit Kinga Milewska-Barcikowska

Address:

ul. Szeligowska 25DF, 01-320 Warszawa, Poland

NIP (Tax ID):

5213308888

REGON:

541274690

Email:

kinga@kbrecruit.eu

Phone:

+48 725 777 778

For matters related to personal data protection, you can contact the Controller directly using the contact details above.

1.Recruitment form (Send your CV)

When a CV is submitted through the recruitment form, the following data is processed:

• first name and last name,
• email address,
• phone number,
• the contents of the CV and, optionally, of an additional file (e.g. a cover letter, portfolio),
• data provided voluntarily in the “Additional information” field (e.g. availability, expected rate).

Purpose: conducting recruitment processes — contacting candidates about job offers that match their profile. A submitted CV may undergo automated analysis to make matching with offers easier (see section II.4).

Legal basis: Art. 6(1)(a) GDPR — the voluntary consent of the data subject.

Retention period: 24 months from the date the data is provided, unless consent is withdrawn earlier. After this period, the data is deleted automatically.

2.Contact (form, email, phone)

When the Controller is contacted, the data provided by the user is processed (e.g. first name, email address, message content).

Legal basis: Art. 6(1)(f) GDPR — the Controller's legitimate interest in handling enquiries.

Retention period: for as long as necessary to handle the enquiry, and then for the limitation period of any potential claims.

3.Cooperation with business clients

In connection with providing recruitment services to companies, the contact details of persons representing clients (full name, position, email, phone) are processed, together with company details and the content of the cooperation agreements concluded.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(c) (tax and accounting obligations) and Art. 6(1)(f) (legitimate interest in maintaining business relationships).

Retention period: for the duration of the cooperation and for the period required by law (including 5 years for tax documents).

4.Automated CV analysis

A submitted CV is automatically analysed by the Anthropic Claude language model running in the Amazon Bedrock service in the European Union region (Frankfurt). The purpose of the analysis is to extract information contained in the CV (including technologies, experience, language skills and professional links) to make it easier to match the candidate with offers. The results of the analysis are visible only in the administration panel. The model is not trained on the submitted data. The analysis does not make decisions about the candidate that produce legal effects within the meaning of Art. 22 GDPR.

5.Cookies and website analytics

Details about cookies are described in section VII of this Policy.

Data may be shared only with trusted entities that the Controller works with and that guarantee an adequate level of data protection:

• the cloud infrastructure provider (Amazon Web Services EMEA SARL) — application hosting, CV file storage, databases, sending emails, CV analysis; EU region (Frankfurt),
• the CDN, DNS and attack protection provider (Cloudflare, Inc.) — delivering the website,
• the email service provider (Google Ireland Ltd.) — handling the kinga@kbrecruit.eu mailbox,
• an accounting firm — to the extent necessary for financial administration,
• public authorities, where required by law.

A data processing agreement (DPA) compliant with Art. 28 GDPR has been concluded with, or applies to, each of the above providers. Personal data is not sold to third parties.

The Controller's core infrastructure (AWS Frankfurt) is located in the European Union. Some tools used by the Controller (Cloudflare, Google Workspace) may transfer limited technical data to countries outside the EEA. In such cases, this takes place on the basis of standard contractual clauses approved by the European Commission or on the basis of an adequacy decision.

Every person whose data is processed has the following rights:

• the right of access — to request a copy of the data being processed,
• the right to rectification — if the data is inaccurate or incomplete,
• the right to erasure (the right to be forgotten) — in specific cases provided for by law,
• the right to restriction of processing — e.g. while an objection is being considered,
• the right to data portability — to receive the data in a machine-readable format,
• the right to object — to processing based on the Controller's legitimate interest,
• the right to withdraw consent — at any time, without affecting the lawfulness of processing carried out before the withdrawal,
• the right to lodge a complaint with the President of the Personal Data Protection Office in Poland (UODO, ul. Stawki 2, 00-193 Warszawa).

To exercise the above rights, contact the Controller by email: kinga@kbrecruit.eu. A response will be provided without undue delay, and no later than within 30 days.

The Controller applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss or destruction. The website uses an encrypted HTTPS connection.

CV files are stored in private, encrypted storage (AWS S3, SSE-S3 encryption) and are automatically scanned for malware (AWS GuardDuty Malware Protection) before being made available to the administrator. Access to the administration panel is secured by magic-link sign-in and a session token with a limited lifetime. All compute and database infrastructure runs exclusively in the EU region (Frankfurt).

What are cookies?

Cookies are small text files saved on the user's device (computer, smartphone, tablet) by the web browser when visiting websites. They are used to remember preferences, analyse website traffic and improve how the website works.

Types of cookies used

1. Technical cookies of the CDN provider (Cloudflare)

The kbrecruit.eu website is delivered through the Cloudflare network, which in certain situations (e.g. when suspicious bot traffic is detected) may save the following cookies on the user's device:

• __cf_bm — a bot management cookie, valid for 30 minutes, used solely to distinguish automated traffic from human traffic,
• cf_clearance — a cookie set after successfully passing a verification (challenge), if one is required.

These cookies are necessary for the website to operate securely and do not require the user's consent (Art. 173(3)(2) of the Polish Telecommunications Law).

2. Analytics and marketing cookies

The kbrecruit.eu website does not use any analytics or marketing cookies. We do not use Google Analytics, Meta Pixel, LinkedIn Insight Tag or similar tracking tools.

3. Administration panel (localStorage)

The administration panel (/admin), available only to authorised persons, stores a session token in the browser's local storage (localStorage) after sign-in — this is not a cookie and does not apply to visitors of the public website.

Managing cookies

The user can change the cookie settings in their browser at any time — block cookies completely or delete them after each session. Please note, however, that disabling technical cookies may make it harder to use the website.

How to disable cookies in popular browsers:

• Google Chrome: Settings – Privacy and security – Cookies and other site data
• Mozilla Firefox: Settings – Privacy & Security – Cookies and Site Data
• Safari: Preferences – Privacy – Manage Website Data
• Microsoft Edge: Settings – Cookies and site permissions

Cookie retention period

• Session cookies — deleted when the browser is closed.
• Persistent cookies — stored for the period specified in the settings of the given cookie (usually from 30 days to 2 years).

The Controller reserves the right to make changes to this Policy. Any changes will be published on the website together with the date of the update.

This Privacy and Cookies Policy is effective from 26 May 2026.