KHEM Privacy Policy

The controller of personal data is KHEM, the entity operating khem.pl. For privacy matters, you may contact the controller by telephone at +48 797 569 400.

This Policy covers data provided through the project enquiry form, the candidate form, telephone or electronic contact, and technical data generated when the website is used.

Whenever a connection is made to the website, the hosting infrastructure may process the IP address, date and time of the request, requested URL, browser and device information, HTTP headers and error data. This information is used to deliver the website, keep it secure, diagnose failures and prevent abuse.

• the website is hosted on Vercel infrastructure,
• the application does not use analytics or advertising tools,
• fonts are delivered locally with the website,
• downloading a document may be recorded in server logs.

KHEM does not use technical data to identify users or build marketing profiles.

The contact form may include your name, company name, telephone number, email address, project location, type of work, expected date and a description of the scope. The data is used to receive the enquiry, respond, clarify the work, prepare a quotation and take steps before entering into a contract.

Company name and telephone number are optional. The remaining fields marked as required are necessary to handle the enquiry. The form contains an invisible field protecting it against automated submissions. Please do not enter special category data, identity document numbers, Polish PESEL numbers or information unrelated to the project.

The candidate form includes name, telephone number, email address, location, specialisation, availability and a description of experience and qualifications. The data is used to assess the application, contact the candidate and conduct the current recruitment process or agree the terms of cooperation.

KHEM does not require a photograph, PESEL number, health data, criminal record data or other sensitive data unless the law requires it for a specific role. Data is not retained for future recruitment without the candidate's separate, voluntary consent.

Project enquiries are processed under Article 6(1)(b) GDPR where processing is necessary to take steps at the data subject's request before entering into a contract. General correspondence, abuse prevention, website security and the establishment, pursuit or defence of claims rely on KHEM's legitimate interests under Article 6(1)(f) GDPR.

Job candidate data is processed to the extent permitted by law under Article 6(1)(c) GDPR in conjunction with Article 22¹ of the Polish Labour Code. Data voluntarily provided beyond that scope may be processed on the basis of consent. For civil law or B2B cooperation, the legal ground may be steps taken before entering into a contract.

Forms are transmitted through the KHEM server running on Vercel infrastructure. The application does not store their content in its own database. Until the target delivery channel is activated, the application does not send data to an external mailbox or CRM system and the user is informed that submission is unavailable.

Data may be accessed only by authorised KHEM personnel and service providers acting for the controller where necessary for hosting, website maintenance, correspondence or recruitment. Data may also be disclosed to public authorities where required by law.

Vercel and Google operate globally, so data may be processed outside the European Economic Area, including in the United States. In such cases, transfers are made using the safeguards provided for in Chapter V GDPR, according to the provider's role and terms, in particular an adequacy decision or European Commission standard contractual clauses.

The scope of any transfer to Google depends on the user's decision to open the map. KHEM does not provide Google with data from the contact or candidate forms.

Enquiry data is retained for as long as needed to respond and conduct discussions. If cooperation begins, it is retained for its duration and for the period required by law or necessary to establish, pursue or defend claims. Enquiries that do not lead to cooperation are deleted when they are no longer useful for contact and scope assessment.

Candidate data is retained for the duration of the current process and deleted without undue delay after it ends, unless continued retention is justified for handling claims. Data may be retained for future recruitment only on the basis of separate consent. Technical logs are retained in accordance with Vercel's infrastructure settings and retention periods, no longer than necessary for security and diagnostics.

Providing data is voluntary, but failure to provide information marked as required will prevent form submission, a meaningful response or assessment of a candidate application. Where data is necessary to enter into or perform a contract, failure to provide it may prevent cooperation.

KHEM does not make decisions concerning users or candidates based solely on automated processing and does not carry out profiling that produces legal effects or similarly significantly affects an individual.

Data transmission is protected by HTTPS. Forms are validated in the browser and on the server and include protection against automated submissions. Access to data is restricted to authorised personnel and providers according to their duties and the principle of least privilege. No method of transmission or storage can, however, eliminate all risk.

This Policy is updated when website functions, providers, purposes or legal grounds change. Material changes will be published on the website together with a new effective date.