Privacy Policy

Last updated: 29 August 2026

Astoria International Consulting is committed to protecting the privacy and personal data of candidates, employer representatives, recruitment partners, business contacts and website visitors.

This Privacy Policy explains how personal data is collected and processed when you use astoriasummit.com, contact us, submit an inquiry, upload a CV or other document, participate in a recruitment process, or communicate with us in connection with our recruitment and business activities.

Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council — the General Data Protection Regulation (“GDPR”) — together with applicable Polish data protection legislation and other laws relevant to our activities.

1. Data Controller

The controller of personal data processed through this website and in connection with Astoria’s own recruitment, employment-placement and business activities is:

ASTORIA SUMMIT ENTERPRISES Sp. z o.o.
operating under the business brand Astoria International Consulting

Registered office:
ul. Nawrot 114 lok. 9
90-029 Łódź
Poland

Email: support@astoriasummit.com
Telephone: +48 733 019 169

Registered Employment Agency in Poland
KRAZ No. 35836

Questions concerning this Privacy Policy or the processing of personal data may be sent to the contact details above.

2. Who This Policy Applies To

This Privacy Policy applies in particular to personal data relating to:

• candidates and prospective candidates;
• individuals seeking information about employment opportunities;
• representatives of current and prospective employer clients;
• recruitment agencies and recruitment partners;
• suppliers, contractors and other business contacts;
• persons submitting inquiries through our website;
• individuals communicating with us by email, telephone, WhatsApp or other business communication channels;
• visitors interacting with our website and online forms.

3. Categories of Personal Data We May Process

The type of information we process depends on the nature of your relationship with Astoria and the purpose for which you contact us.

Contact and identification information

This may include:

• name and surname;
• email address;
• telephone or WhatsApp number;
• country of residence or location;
• company name;
• professional position or business function;
• other information you choose to provide when contacting us.

Candidate and recruitment information

Where you participate in a recruitment process, we may process information contained in your CV, resume, application or other recruitment documents, including:

• education and professional qualifications;
• employment history;
• professional skills and experience;
• language abilities;
• professional certificates or licences;
• availability;
• preferred position or work location;
• information relevant to assessing suitability for a particular role;
• correspondence and interview-related information;
• other information voluntarily provided in connection with a recruitment process.

We seek to collect only information that is relevant and reasonably necessary for the recruitment purpose concerned.

Employer and business information

Where you contact Astoria on behalf of a business or organization, we may process:

• your business contact details;
• employer or company information;
• your professional role;
• vacancy and workforce requirements;
• job descriptions;
• manpower requests;
• commercial correspondence;
• proposals and supporting business documents;
• information necessary to negotiate, establish or manage a business relationship.

Information submitted through our website

Our website contact form may collect:

• name;
• company name;
• email address;
• telephone or WhatsApp number;
• country;
• whether you are contacting us as an employer, candidate, recruitment agency/partner or another party;
• the content of your inquiry;
• uploaded CVs, resumes, job descriptions, proposals or other relevant supporting documents.

Technical and security information

When a form is submitted or our website is used, certain technical information may also be processed, including:

• IP address;
• browser or user-agent information;
• device or operating-system information where technically available;
• date and time of submission;
• anti-spam and website-security information.

Such data may be processed for security, spam prevention, fraud prevention, troubleshooting and protection of our website and systems.

4. Why We Process Personal Data

We process personal data only where there is a lawful basis under GDPR.

Website and general inquiries

Where you contact Astoria through our website, by email, telephone or another communication channel, we use the information provided to respond to your inquiry, identify the appropriate service or contact person and manage follow-up communication.

Depending on the circumstances, the legal basis may be:

• Article 6(1)(b) GDPR — where processing is necessary to take steps at your request before entering into a contract; or
• Article 6(1)(f) GDPR — our legitimate interest in managing professional communications and responding to business inquiries.

Recruitment and employment-placement activities

Candidate information may be processed for purposes including:

• receiving and reviewing applications;
• assessing candidate suitability;
• identifying suitable vacancies;
• matching candidates with employer requirements;
• communicating with candidates;
• presenting candidate profiles to prospective employers where appropriate;
• coordinating interviews and feedback;
• managing recruitment and employment-placement processes;
• maintaining records necessary for legitimate recruitment and regulatory purposes.

The applicable legal basis will depend on the nature of the recruitment process and may include Article 6(1)(b), 6(1)(c), 6(1)(f) or, where appropriate, Article 6(1)(a) GDPR.

Where Polish employment law or another applicable law requires particular information to be processed, the legal basis may be Article 6(1)(c) GDPR.

Information provided voluntarily beyond what is legally required may, where appropriate, be processed on the basis of consent.

Employer, partner and B2B relationships

We process information concerning employer representatives, recruitment partners, contractors and other business contacts for purposes including:

• discussing recruitment requirements;
• preparing proposals;
• negotiating and performing agreements;
• coordinating recruitment projects;
• managing commercial relationships;
• invoicing and accounting;
• maintaining necessary business records;
• establishing, exercising or defending legal claims.

The legal basis may include Article 6(1)(b), 6(1)(c) and 6(1)(f) GDPR.

Compliance with legal obligations

Personal data may also be processed where necessary to:

• comply with legal, accounting, tax or regulatory requirements;
• satisfy obligations connected with our registered employment-agency activities;
• respond to lawful requests from public authorities;
• maintain records required by applicable law;
• establish, exercise or defend legal claims.

The legal basis is generally Article 6(1)(c) GDPR or, where appropriate, Article 6(1)(f) GDPR.

Website and information security

Technical information may be processed for:

• prevention of spam and automated abuse;
• detection of suspicious activity;
• prevention of fraud;
• website and system security;
• troubleshooting;
• protection of Astoria, candidates, clients and business partners.

The legal basis is Article 6(1)(f) GDPR — our legitimate interest in maintaining secure and reliable systems.

5. Candidate Data and Data Minimisation

Candidates should provide only information relevant to their professional qualifications, experience and suitability for employment.

Please do not include unnecessary personal information in your CV or application.

In particular, candidates should avoid submitting information concerning private matters that are unrelated to the recruitment process.

Astoria may disregard, restrict or delete information that is clearly unnecessary for the recruitment purpose.

Polish data-protection guidance emphasizes that recruitment data should not be collected in advance merely because it might possibly become useful later. Personal data should correspond to an identified recruitment purpose and be limited to what is necessary.

6. Special Categories of Personal Data

Certain information receives additional protection under Article 9 GDPR, including information revealing:

• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade-union membership;
• genetic or biometric data used for identification;
• health information;
• information concerning a person’s sex life or sexual orientation.

Please do not provide such information through our general contact form unless it is genuinely necessary and its processing is legally permitted.

If a candidate voluntarily includes special-category information in an application, Astoria will process it only where an appropriate legal basis under Article 9 GDPR exists.

Where no such basis exists, the information may be removed or deleted.

7. Sharing Candidate Data With Employers

Where Astoria identifies a candidate as potentially suitable for a vacancy, relevant candidate information may be shared with a prospective employer where this is necessary for the recruitment process and an appropriate legal basis exists.

We do not provide candidate information indiscriminately to unrelated companies.

Where appropriate, candidates will be informed of the employer or recruitment opportunity before their personal data is presented.

Once candidate information is lawfully disclosed to a prospective employer, that employer may process the information as an independent data controller for its own recruitment and employment purposes. The employer is responsible for providing any privacy information required in relation to its own processing.

8. Recruitment Partners and Other Sources of Candidate Data

Astoria may receive candidate information from authorized recruitment agencies, recruitment partners or other lawful sources.

Where personal data has not been obtained directly from the person concerned, Astoria will comply with the information obligations applicable under Article 14 GDPR, unless a lawful exception applies.

Where necessary, we may provide the individual with information concerning:

• the identity of Astoria;
• the categories of data obtained;
• the source of the data;
• the purposes and legal bases for processing;
• recipients or categories of recipients;
• retention;
• applicable GDPR rights.

9. Recruitment for Future Opportunities

Information provided for a particular recruitment process is not automatically treated as permission to retain a candidate indefinitely for unrelated future vacancies.

Where Astoria wishes to retain a candidate’s details for future recruitment opportunities, we will use an appropriate legal basis and, where required, obtain separate consent.

Any such consent must be voluntary and may be withdrawn at any time.

Withdrawal of consent does not affect processing that was lawful before consent was withdrawn.

10. Recipients of Personal Data

Where necessary and legally permitted, personal data may be disclosed to:

• prospective or current employer clients;
• authorized recruitment agencies and recruitment partners;
• accountants, lawyers and other professional advisers;
• website hosting providers;
• email and IT service providers;
• form-management providers;
• cloud or data-storage providers where used;
• security and anti-spam providers;
• authorities or institutions legally entitled to receive information;
• courts, regulators or law-enforcement bodies where disclosure is required or legally justified.

Where a service provider processes personal data on Astoria’s behalf, we seek to ensure that appropriate contractual and data-protection arrangements are in place.

11. International Recruitment and Transfers Outside the EEA

Astoria operates in international recruitment and may cooperate with employers, recruitment agencies and business partners located outside Poland and, in some cases, outside the European Economic Area.

Personal data may therefore need to be transferred outside the EEA where this is genuinely necessary for a recruitment, contractual or business purpose.

Where GDPR requires additional safeguards for such a transfer, Astoria will rely on an appropriate transfer mechanism, which may include:

• an adequacy decision adopted by the European Commission;
• Standard Contractual Clauses approved by the European Commission;
• another transfer mechanism permitted by Chapter V GDPR;
• a specific derogation where the legal conditions for that derogation are satisfied.

International transfers are assessed according to the circumstances of the relevant recruitment or business relationship.

12. Contact Form and File Uploads

Our website allows visitors to submit inquiries and upload relevant supporting documents.

Permitted documents may include:

• CVs and resumes;
• job descriptions;
• recruitment proposals;
• other documents relevant to the inquiry.

The general website form should not be used to send:

• passports;
• national identity cards;
• residence cards;
• PESEL-related documentation;
• banking details;
• other highly sensitive identity documents,

unless Astoria has specifically requested the document through an appropriate and secure process.

Documents uploaded through the website are processed only for purposes reasonably connected with the inquiry, application or business communication for which they were submitted.

13. WPForms

Our website uses WPForms to manage website forms and submissions.

Information entered into a form may be stored within the website’s WordPress/WPForms environment and included in notification emails sent to authorized Astoria personnel.

Depending on the technical configuration, form-entry data may include information submitted by the visitor together with limited technical information associated with the submission.

Access to form entries is restricted to persons who require access for legitimate business, recruitment or technical purposes.

14. Cloudflare Turnstile

Our forms use Cloudflare Turnstile to help distinguish legitimate users from automated bots and to protect the website against spam and abuse.

In connection with this security function, Cloudflare may process technical information necessary to assess whether a request is legitimate.

Turnstile is used for security purposes rather than for advertising or candidate profiling.

15. Cookies and Similar Technologies

Our website may use cookies or similar technologies necessary for:

• core website functionality;
• security;
• form operation;
• session management;
• fraud and spam prevention.

Where the website uses non-essential analytics, advertising, personalization or marketing technologies that require prior consent under applicable law, such technologies should be activated only after the required consent has been obtained.

Where appropriate, additional information will be provided through a cookie banner, consent-management tool or separate Cookie Policy.

16. How Long We Retain Personal Data

Personal data is retained only for as long as there is a lawful and identifiable reason to keep it.

Retention is determined according to the nature of the data, the purpose for which it was collected, applicable legal requirements and the need to establish, exercise or defend legal claims.

Current recruitment processes

Candidate data relating to a particular recruitment process will generally be retained for the duration of that process and thereafter only where a further lawful basis exists.

UODO’s current recruitment information illustrates this principle by retaining candidate data for the current recruitment until that recruitment is completed, while future-recruitment retention is based on separate consent.

Future recruitment

Where a candidate has validly agreed to be considered for future opportunities, data may be retained for the period communicated when that consent is obtained, unless consent is withdrawn sooner or the purpose ceases to exist.

Business and contractual records

Information contained in contracts, invoices, accounting records and other legally required business documentation may be retained for the periods required under tax, accounting, commercial or other applicable legislation.

General inquiries

General inquiries that do not result in a recruitment or contractual relationship will be retained only for as long as reasonably necessary to respond to the inquiry, manage legitimate follow-up and protect against relevant claims where justified.

Security information

Technical and security logs will be retained only for as long as reasonably necessary for security, troubleshooting, abuse prevention and legal purposes.

When information is no longer required, it will be deleted, anonymized or otherwise securely disposed of, subject to applicable legal obligations.

17. Your Rights Under GDPR

Subject to the conditions and limitations set out in GDPR, you may have the right to:

• obtain confirmation as to whether Astoria processes your personal data;
• access your personal data;
• obtain a copy of your personal data;
• request correction of inaccurate or incomplete information;
• request erasure of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain personal data in a portable format where the right to data portability applies;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with a competent supervisory authority.

Requests concerning your rights may be sent to:

support@astoriasummit.com

Before fulfilling certain requests, we may ask for information reasonably necessary to verify the identity of the person making the request and prevent unauthorized disclosure.

18. Right to Object

Where Astoria processes personal data on the basis of legitimate interests under Article 6(1)(f) GDPR, you have the right to object to such processing on grounds relating to your particular situation.

Astoria will cease the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or where processing is necessary for the establishment, exercise or defence of legal claims.

19. Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Where consent is withdrawn and no other lawful basis applies, Astoria will cease the relevant processing.

20. Complaints to the Supervisory Authority

If you believe your personal data has been processed contrary to applicable data-protection law, you have the right to lodge a complaint with:

Prezes Urzędu Ochrony Danych Osobowych
President of the Personal Data Protection Office

ul. Stanisława Moniuszki 1A
00-014 Warszawa
Poland

You may also contact Astoria first if you would like us to address your concern directly.

21. Automated Decision-Making and Profiling

Astoria does not currently make final recruitment or employment-placement decisions solely by means of automated processing producing legal effects or similarly significant effects on an individual.

Recruitment activities involve human review and assessment.

Where an employer is responsible for the final hiring decision, that decision remains the responsibility of the employer.

If Astoria introduces material automated decision-making or profiling in the future, this Privacy Policy will be updated and any additional GDPR obligations will be addressed.

22. Security of Personal Data

Astoria applies reasonable technical and organizational measures intended to protect personal data against:

• unauthorized or unlawful access;
• unauthorized disclosure;
• accidental loss;
• alteration;
• destruction;
• misuse.

Measures may include:

• access restrictions;
• password and account controls;
• website security measures;
• anti-spam and bot protection;
• controlled access to recruitment information;
• secure service providers;
• periodic review of access and website configuration.

No internet-based system can be guaranteed to be completely secure. We therefore review our practices and take reasonable measures appropriate to the nature of the information processed.

23. Providing Personal Data

Whether providing personal data is mandatory or voluntary depends on the circumstances.

Where information is necessary to:

• respond to an inquiry;
• assess an application;
• perform recruitment services;
• prepare or perform a contract;
• comply with a legal requirement,

failure to provide the necessary information may mean that Astoria cannot process the request or continue with the relevant service.

Information not required by law or by the relevant recruitment or business process is generally voluntary.

24. Children

Astoria’s recruitment and business services are not directed toward children.

We do not knowingly use our general website contact form to recruit children or intentionally collect children’s personal data for inappropriate purposes.

Where a specific legally permitted activity involves a minor, any processing will be assessed separately in accordance with applicable law.

25. Changes to This Privacy Policy

This Privacy Policy may be updated from time to time to reflect:

• changes in applicable law or regulatory guidance;
• changes to our recruitment activities;
• changes to website functionality;
• changes to service providers;
• changes to the way personal data is processed.

The latest version will be published on our website together with the date on which it was last updated.

26. Contact

Questions concerning privacy, personal data or GDPR rights may be directed to:

Astoria International Consulting
Business brand of ASTORIA SUMMIT ENTERPRISES Sp. z o.o.

ul. Nawrot 114 lok. 9
90-029 Łódź
Poland

Email: support@astoriasummit.com
Telephone: +48 733 019 169

Registered Employment Agency in Poland
KRAZ No. 35836