https://tomhrm.com/assets/PrivacyPolicy-Bn2jgWrV.js

1import{j as e}from"./react-vendor-BsS3SB5Z.js";import{H as a,L as r}from"./app-U2eHB1lT.js";import{L as o}from"./LegalPage-L504XIU4.js";import"./framer-motion-Vyhlm7UV.js";import"./useLocale-CwoniRjT.js";import"./Footer-CXHE8rAo.js";import"./TomhrmLogo-BqSp_17N.js";import"./posts-BV2Y5wyl.js";import"./chevron-down-C7gkWImr.js";import"./mail-B5NVVkFH.js";const s="align-top border border-ink-100 px-3 py-2 text-[14.5px] leading-relaxed",t="align-bottom border border-ink-100 bg-ink-50 px-3 py-2 text-left text-[13px] font-semibold uppercase tracking-wide text-ink-700";function x(){return e.jsxs(e.Fragment,{children:[e.jsx(a,{children:e.jsx("html",{lang:"en"})}),e.jsx(o,{eyebrow:null,title:"Privacy Policy",updated:"September 1, 2026",showSectionNumbers:!1,titleInContent:!0,relatedLinks:[{label:"GDPR information",href:"/en/gdpr"},{label:"Data processing agreement",href:"/umowa-powierzenia-przetwarzania-danych-osobowych"},{label:"Security",href:"/en/security"}],sections:[{id:"controller",title:"Data controller",content:e.jsxs(e.Fragment,{children:[e.jsxs("p",{children:["The controller of your personal data collected via the ",e.jsx("strong",{children:"tomhrm.com"})," ","website is ",e.jsx("strong",{children:"ENNOVA Spółka Jawna"})," (a Polish registered partnership, hereinafter “ENNOVA”), with its registered office in Elbląg, ul. Sadowa 7/13, entered in the Register of Entrepreneurs of the National Court Register (KRS) maintained by the District Court in Olsztyn, 8th Commercial Division, under KRS No. 0000282777, Tax ID (NIP) 5782976225."]}),e.jsxs("p",{children:["With respect to data that Clients input into the tomHRM application (data of their employees, candidates and other individuals), ENNOVA acts as a"," ",e.jsx("strong",{children:"data processor"})," on the Client's documented instructions - see the section"," ",e.jsx("a",{className:"underline underline-offset-4",href:"#entrusted-data",children:"Data entrusted to us by our Clients"}),"."]})]})},{id:"purposes",title:"Purposes and legal bases for processing",content:e.jsxs(e.Fragment,{children:[e.jsx("p",{children:"We process personal data for the following purposes and on the following legal bases:"}),e.jsx("div",{className:"overflow-x-auto",children:e.jsxs("table",{className:"w-full border-collapse",children:[e.jsx("thead",{children:e.jsxs("tr",{children:[e.jsx("th",{className:t,children:"Purpose of processing"}),e.jsx("th",{className:t,children:"Legal basis (GDPR)"})]})}),e.jsx("tbody",{children:[["Handling enquiries submitted via the contact form and communicating with the ENNOVA team","Article 6(1)(f) - our legitimate interest (responding to enquiries)"],["Scheduling a demo presentation and provisioning a trial account","Article 6(1)(b) - steps taken prior to entering into a contract"],["Performing the SaaS services agreement for the tomHRM application","Article 6(1)(b) - performance of a contract"],["Issuing and retaining accounting records","Article 6(1)(c) - compliance with a legal obligation"],["Marketing activities relating to the tomHRM service","Article 6(1)(a) - your separate consent"],["Handling recruitment processes conducted by ENNOVA","Article 6(1)(a) and (b), and Article 6(1)(c) for data required under employment law"],["Analytics, performance measurement and service improvement","Article 6(1)(a) - consent (analytics/marketing cookies)"],["Establishing, pursuing or defending legal claims","Article 6(1)(f) - our legitimate interest"]].map(([i,n])=>e.jsxs("tr",{children:[e.jsx("td",{className:s,children:i}),e.jsx("td",{className:s,children:n})]},i))})]})})]})},{id:"scope",title:"Scope of processed data",content:e.jsxs(e.Fragment,{children:[e.jsx("p",{children:"To deliver our services, respond to enquiries and share knowledge, we process the data you provide to us - through website forms, chat, email or other communication channels. This typically includes:"}),e.jsxs("ul",{className:"list-disc pl-6 space-y-1.5",children:[e.jsx("li",{children:"first name and surname,"}),e.jsx("li",{children:"business email address,"}),e.jsx("li",{children:"telephone number,"}),e.jsx("li",{children:"company name."})]}),e.jsxs("p",{children:["In addition, we automatically collect technical data described 

1in the section"," ",e.jsx("a",{className:"underline underline-offset-4",href:"#cookies",children:"Cookies and tracking technologies"}),"."]}),e.jsx("p",{children:"Providing your data is voluntary but necessary to handle your enquiry, schedule a presentation or enter into a contract."})]})},{id:"retention",title:"Data retention periods",content:e.jsxs("p",{children:["Given our clients' long decision-making cycle, we retain contact data for up to"," ",e.jsx("strong",{children:"3 years"})," from the last contact, unless you withdraw your consent or raise an objection earlier."]})},{id:"recipients",title:"Data recipients and transfers outside the EEA",content:e.jsxs(e.Fragment,{children:[e.jsxs("p",{children:["The recipients of your data are authorised ENNOVA staff and associates, as well as carefully selected ",e.jsx("strong",{children:"service providers acting as data processors"})," on our behalf:"]}),e.jsx("div",{className:"overflow-x-auto",children:e.jsxs("table",{className:"w-full border-collapse",children:[e.jsx("thead",{children:e.jsxs("tr",{children:[e.jsx("th",{className:t,children:"Provider"}),e.jsx("th",{className:t,children:"Role"}),e.jsx("th",{className:t,children:"Region"}),e.jsx("th",{className:t,children:"Legal basis for transfer"})]})}),e.jsx("tbody",{children:[["OVH S.A.","Server infrastructure","EU (Poland)","GDPR (EU 2016/679)"],["Google Ireland Limited","Analytics","EU (Ireland)","GDPR (EU 2016/679)"],["Positive Group Polska Sp. z o.o.","Chat, email messaging","EU (Poland)","GDPR (EU 2016/679)"],["MailerLite Limited","Email delivery","EU (Ireland)","GDPR (EU 2016/679)"],["Twilio Inc.","Email / SMS handling","Outside EU (USA)","Certification under the EU-US Data Privacy Framework (DPF)"],["Pipedrive Inc.","CRM","Outside EU (USA)","Certification under the EU-US Data Privacy Framework (DPF)"],["Calendly","Meeting scheduling","Outside EU (USA)","EU-US Data Privacy Framework (DPF)"]].map(i=>e.jsx("tr",{children:i.map(n=>e.jsx("td",{className:s,children:n},n))},i[0]))})]})}),e.jsx("p",{children:"Transfers of data outside the European Economic Area to the USA rely on the European Commission's implementing decision of July 10, 2023 on the “EU-US Data Privacy Framework” (for certified entities) or, for entities outside the DPF programme, on Standard Contractual Clauses (SCCs) approved by the European Commission."})]})},{id:"profiling",title:"Profiling and automated decision-making",content:e.jsxs("p",{children:["As part of our marketing activities - solely where you have given your consent - we may carry out ",e.jsx("strong",{children:"profiling"})," consisting of tailoring advertising content to your activity on the website (including through Google and LinkedIn advertising tools). Such profiling does not produce legal effects concerning you. You may withdraw your consent and raise an objection at any time."]})},{id:"rights",title:"Your rights",content:e.jsxs(e.Fragment,{children:[e.jsx("p",{children:"In connection with the processing of your data, you have:"}),e.jsxs("ul",{className:"list-disc pl-6 space-y-1.5",children:[e.jsx("li",{children:"the right of access to your data and to obtain a copy of it,"}),e.jsx("li",{children:"the right to rectification of inaccurate data,"}),e.jsx("li",{children:"the right to erasure (“the right to be forgotten”),"}),e.jsx("li",{children:"the right to restriction of processing,"}),e.jsx("li",{children:"the right to data portability,"}),e.jsx("li",{children:"the right to object to processing based on legitimate interest,"}),e.jsx("li",{children:"the right to withdraw consent at any time - without affecting the lawfulness of processing carried out before withdrawal,"}),e.jsx("li",{children:"the right to lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland)."})]}),e.jsx("p",{children:"To exercise any of these rights, please contact us via the contact form."})]})},{id:"cookies",title:"Cookies and tracking technologies",content:e.jsxs(e.Fragment,{children:[e.jsx("p",{children:"On your first visit to the website, we ask for your consent to use cookies and similar technologies other than strictly necessary ones. You may change or withdraw your preferences at any time in the consent settings (banner / Cookie Preference Center). Strictly necessary cookies, required for the website to function, are used on the basis of our legitimate interest and do not require consent."}),e.jsx("p",{children:"We use the following categories of technologies:"}),e.jsxs("ul",{className:"list-disc pl-6 space-y-1.5",children:[e.jsxs("li",{children:[e.jsx("strong",{children:"Strictly necessary cookies"})," - enable the core functioning of the website (e.g. maintaining a session, remembering consent preferences). You do not have to provide the same data on each visit."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Analytics cookies"})," - allow us to measure page views, time on site and the number of visitors in order to improve the website (activated only after consent is given)."]}),e.jsxs("li",{children:[e.jsx("strong",{children:"Marketing cookies"})," - enable us to measure campaign effectiveness and display ads tailored to your interests, including on third-party sites (activated only after consent is given)."]})]}),e.jsxs("p",{children:[e.jsx("strong",{children:"Web beacons."})," In the emails we send, we embed single-pixel images that let us know when a message has been opened, as well as the IP address, browser or email-client type and similar data. We use these for reporting on the effectiveness of our email communications."]}),e.jsxs("p",{children:[e.jsx("strong",{children:"Log data."})," On each access to the website and application, we may record: IP address, browser type and version, pages visited and other usage statistics. When accessed from a mobile device, this may also include the device type, its identifier, IP address, operating system and mobile usage statistics."]}),e.jsxs("p",{children:[e.jsx("strong",{children:"Google Enhanced Conversions."})," To measure the effectiveness of our marketing activities, following a registration or purchase we may - solely where you have given your consent - collect, hash (using the one-way SHA-256 algorithm) and securely transmit to Google, via Google Tag Manager, data such as your email address. This allows us to link your interactions with our site to a Google account and better assess ad effectiveness."]}),e.jsxs("p",{children:[e.jsx("strong",{children:"Third-party services."})," We use external tools, including Google Analytics and LinkedIn, which collect and analyse log data to improve the website and deliver targeted advertising. Our partners may use their own cookies and tracking technologies. You can find more information and opt-out options at"," ",e.jsx("a",{className:"underline underline-offset-4",href:"https://www.youronlinechoices.eu/",target:"_blank",rel:"noopener noreferrer",children:"youronlinechoices.eu"}),"."]})]})},{id:"entrusted-data",title:"Data entrusted to us by our Clients",content:e.jsxs(e.Fragment,{children:[e.jsxs("p",{children:["Clients may input into tomHRM the personal data of their employees, candidates and other individuals. We have no direct relationship with those individuals - in such cases we act as a ",e.jsx("strong",{children:"data processor"}

1)," on the Client's instructions, and it is the Client (as controller) who is responsible for having a legal basis, including any necessary consents, to entrust such data to us."]}),e.jsxs("p",{children:["The terms of such entrustment are governed by the"," ",e.jsx(r,{className:"underline underline-offset-4",to:"/umowa-powierzenia-przetwarzania-danych-osobowych",children:"Data processing agreement"}),". If your data was entered into tomHRM by your employer or another entity, please contact that entity directly, as the controller, to exercise your rights."]})]})},{id:"security",title:"Data security",content:e.jsxs("p",{children:["We implement appropriate technical and organisational measures to ensure the security of the processed data, commensurate with the risk (Article 32 GDPR). You can find more information on our"," ",e.jsx(r,{className:"underline underline-offset-4",to:"/en/security",children:"Security"})," ","page."]})},{id:"changes",title:"Changes to this policy",content:e.jsx("p",{children:"We may update this policy from time to time, e.g. in connection with changes in legislation or the scope of our services. The current version is always available on the website, and we indicate the date of the last update at the top of this document."})}]})]})}export{x as default};