Privacy Policy
Last Revised Date: April 20, 2026
Previous version of this document: here.
Introduction
At Appchance, we care about your personal data and make every effort to provide you with clear information about how we process and protect it.
We want you to know who we are, why and how we process your data, who we may share it with, what rights you have, and how you can contact us if you have any questions or concerns.
This Privacy Policy consists of two parts:
General Part contains information common to all categories of individuals to whom this Privacy Policy is addressed.
Dedicated Sections contain specific information tailored to your possible relationship with us:
- Contractors, contractor representatives and contact persons — if you cooperate with us on a business basis or represent a company with which we cooperate or intend to cooperate,
- Job candidates — if you are applying for a position at Appchance or are interested infuture recruitment processes,
- Correspondents — if you contact us for any purpose other than the above,
- Website users — if you visit our website, browse its pages or use its functionalities.
Please read the General Part and the section that applies to your situation.
General Part
Who is the controller of your personal data?
The controller of your personal data is Appchance Group sp. z o.o. with its registered office in Poznań (“Appchance”), at the following address: ul. Głogowska 216, 60-104 Poznań, entered in the Register of Entrepreneurs of the National Court Register maintained by the District Court Poznań – Nowe Miasto i Wilda in Poznań, 8th Commercial Division of the National Court Register, under number: 0000755808, Tax Identification Number (NIP): 7811905715, share capital of PLN 126,000.00, electronic delivery address: AE:PL-48252-60250-VICRS-12.
For any matters relating to the processing and protection of your personal data, you can write to us at: iod@appchance.com — this address provides you with direct contact with our designated Data Protection Officer (“DPO”).
The DPO function at Appchance is performed by: Małgorzata Duszyńska, CIPP/E.
Are your data transferred outside the European Economic Area?
As a general rule, we process personal data within the European Economic Area (“EEA”). However, in the course of our day-to-day operations, we also use tools and services provided by entities based outside the EEA, in particular in the United States, which means that your personal data may be transferred outside the EEA.
Any such transfer is carried out solely using the mechanisms provided for under the GDPR, in particular:
- on the basis of a European Commission adequacy decision (Art. 45 GDPR), including under the EU-U.S. Data Privacy Framework, or
- on the basis of standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR).
For detailed information about the providers to whom your data may be transferred and the transfer safeguards applied, please contact us at: iod@appchance.com.
What rights may you have in connection with our processing of your personal data?
In connection with the processing of your personal data, you may have the following rights:
| Your right | What it means |
|---|---|
| Right of access (Art. 15 GDPR) | You may obtain confirmation from us as to whether we process your personal data, and if so: access to it, as well as, in particular, information about the purposes of processing, the categories of data, the recipients, the envisaged storage period, and a copy of your data. |
| Right to rectification (Art. 16 GDPR) | You may request that we promptly correct any inaccurate data relating to you and that we complete any incomplete data. |
| Right to erasure (Art. 17 GDPR) | You may request that we erase your personal data. This right is not absolute, however, and is subject to the limitations set out in Art. 17 GDPR. For example, we will not be obliged to erase your data where processing is necessary to comply with a legal obligation to which we are subject as the controller of your personal data. |
| Right to restriction of processing (Art. 18 GDPR) | You may request that we restrict the processing of your data (i.e. only store it), for example where you contest the accuracy of the data (for the period of verification), where processing is unlawful but you do not wish to have the data erased, or where you have lodged an objection (pending determination of whether our legitimate grounds override yours). |
| Right to notification of recipients (Art. 19 GDPR) | If we rectify, erase or restrict the processing of your data, we will notify each recipient to whom the data has been disclosed, unless this proves impossible or involves disproportionate effort. At your request, we will inform you about those recipients. |
| Right to data portability (Art. 20 GDPR) | You may receive your data in a structured, commonly used, machine-readable format and transmit it directly to another controller. This right applies where processing is based on consent or a contract and is carried out by automated means. |
| Right to object (Art. 21 GDPR) | You may object at any time to the processing of your data based on our legitimate interest (Art. 6(1)(f) GDPR), on grounds relating to your particular situation. In such case, we will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms. In the case of direct marketing, you have the right to object at any time, without giving any reasons. |
| Right to withdraw consent (Art. 7(3) GDPR) | If we process your data on the basis of consent, you may withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. |
| Right not to be subject to automated decisions (Art. 22 GDPR) | You have the right not to be subject to decisions based solely on automated processing (including profiling) that produce legal effects concerning you or similarly significantly affect you. Appchance does not make such decisions concerning you. |
| Right to lodge a complaint (Art. 77 GDPR) | You have the right to lodge a complaint with the competent supervisory authority for personal data protection. In Poland, this authority is the President of the Personal Data Protection Office (www.uodo.gov.pl). |
To exercise your rights, please contact us at: iod@appchance.com.
DEDICATED SECTIONS
- Contractors, contractor representatives and contact persons in connection with ongoing cooperation
This section is addressed to you if your data has been provided to us by a company with which we cooperate or intend to cooperate, for example as a contact person or a representative (e.g. a member of the Management Board) involved in our business relations. If you run a business and are entering into a contract with us as part of that business, the information in this section is also addressed to you.
What are the purposes and legal bases for processing your personal data?
| Purpose of processing | Legal basis |
|---|---|
| Conclusion and performance of a contract with the company you represent | Art. 6(1)(b) GDPR if you are a party to the contract; Art. 6(1)(f) GDPR (our legitimate interest in carrying out the cooperation) if you are a contact person or a representative of the entity with which we are entering into cooperation |
| Day-to-day contact and coordination of the cooperation | Art. 6(1)(f) GDPR (our legitimate interest in efficient communication with the contractor’s team) |
| Fulfilment of legal obligations, in particular in the area of accounting, taxation and archiving of documentation | Art. 6(1)(c) GDPR (legal obligation incumbent on us as the controller) |
| Establishment, pursuit or defence of claims related to the contract | Art. 6(1)(f) GDPR (our legitimate interest) |
What data do we process about you and where do we obtain it?
In connection with the above purposes, we may process the following personal data:
- first and last name,
- position / function,
- business e-mail address and telephone number,
- name of the company you represent,
- for persons signing contracts: identification data required for the conclusion of the contract, where this results from applicable law.
Depending on the circumstances, your data may originate from:
- directly from you, e.g. from correspondence, a business card or a meeting,
- from the company with which we cooperate, if you have been designated as a contact person,
- from another company within the Vercom S.A. group, if cooperation with your company is coordinated at the level of the capital group to which we belong.należymy.
Who may have access to your personal data?
Your data may be disclosed to:
- other companies within the Vercom S.A. group, to the extent necessary for the coordination of cooperation, technical, operational or administrative support; each group company that receives your data processes it as a separate controller or on the basis of an appropriate data processing agreement,
- our service providers, e.g. IT system providers (including website hosting, IT infrastructure, communication tools, project management tools, file storage and CRM systems), accounting services and legal services,
- public authorities, where required by law.
How long do we process your personal data?
- For the duration of the contract with the entity you represent (or on whose behalf you participate in the cooperation with us).
- After the contract ends: for the period required by applicable law and for the limitation period for potential claims, as a general rule no longer than 6 years from the end of the cooperation, unless applicable law requires longer retention.
- We delete the data of contact persons when the purpose of processing ceases (e.g. a change of contact person or termination of cooperation with the entity you represent).
Are you required to provide us with your personal data?
Providing your data is not a statutory obligation, but it is necessary for the conclusion and performance of the contract and for maintaining contact within the cooperation. Without this data, we will not be able to cooperate with your company in a manner that requires direct communication. If you are a representative of the entity with which we are entering into cooperation (or are negotiating or concluding a contract), it will not be possible to conclude the contract without providing your personal data.
- Job candidates
What are the purposes, retention periods and legal bases for processing your personal data?
| Purpose of processing | Legal basis | Retention period |
|---|---|---|
| Selection of a candidate for employment (data required by law) | Art. 6(1)(c) GDPR in conjunction with Art. 22¹ §1 of the Polish Labour Code | Up to 3 months from the end of the recruitment process |
| Selection of a candidate for employment (data provided voluntarily, beyond the scope of Art. 22¹ §1 of the Labour Code) | Art. 6(1)(a) GDPR (consent) | Up to 3 months from the end of the recruitment process |
| Consideration of candidacy in future recruitment processes | Art. 6(1)(a) GDPR (consent) | 12 miesięcy od zakończenia rekrutacji na stanowisko, w związku z którym wyrażono zgodę |
Can you withdraw your consent to the processing of personal data?
Where we process your personal data on the basis of consent, you have the right to withdraw that consent at any time. This does not affect the lawfulness of processing carried out before its withdrawal.
To withdraw your consent, please contact our DPO at: iod@appchance.com.
Who may have access to your personal data?
Access to your personal data may be granted to service providers used in our operations, such as: IT services (hosting, e-mail, etc.), recruitment services, postal and courier services, and legal services.
Are you required to provide us with your personal data?
You are not obliged to provide your personal data; however, if you do not, we will not be able to consider your candidacy in the recruitment process.
- Correspondents
What are the purposes, retention periods and legal bases for processing your personal data?
| Purpose of processing | Legal basis | Retention period | Legitimate interest |
|---|---|---|---|
| Management of correspondence | Art. 6(1)(f) GDPR | 12 months from the last contact on a given matter | Responding to enquiries addressed to Appchance and ensuring continuity of business communication |
| Establishment, pursuit or defence of claims | Art. 6(1)(f) GDPR | 6 years from the end of the calendar year in which the claim arose, or until final conclusion of proceedings | Protection of business interests |
What data do we process about you?
In the course of correspondence, we may process data contained in messages sent to us, in particular: first and last name, e-mail address, telephone number (if provided), and the content of the correspondence.
Who may have access to your personal data?
Access to your personal data may be granted to service providers used in our operations, such as: IT services (hosting, e-mail, etc.), postal and courier services, and legal services.
Are you required to provide us with your personal data?
You are not obliged to provide your personal data; however, if you do not, we will not be able to respond to your message.
- Website users
What are the purposes, retention periods and legal bases for processing your personal data?
| Purpose of processing | Legal basis | Retention period | Legitimate interest (if applicable) |
|---|---|---|---|
| Operating the website and ensuring its proper functioning | Art. 6(1)(f) GDPR | 2 years from the last visit to the website | Ensuring the technical availability and security of the website |
| Marketing * | Art. 6(1)(a) GDPR (consent) | Until withdrawal of consent | – |
| Analytics and statistics * | Art. 6(1)(a) GDPR (consent) | Until withdrawal of consent | – |
| Establishment, pursuit or defence of claims | Art. 6(1)(f) GDPR | 6 years from the end of the calendar year in which the claim arose, or until final conclusion of proceedings | Protection of business interests |
* In the cases marked above, we use cookies and similar technologies provided by third parties (e.g. Meta/Facebook, Google/Alphabet), which may combine data collected on our website with other data based on your online behaviour. These files are installed only after obtaining your consent. You may withdraw your consent at any time; this does not affect the lawfulness of processing carried out before its withdrawal.
You can also manage your cookie preferences through the cookie manager we have made available. More on this topic in our cookie policy.
What data do we process about you?
In connection with your use of our website, we may process technical data, in particular: IP address, browser and device information (browser type, operating system), data about activity on the website (pages visited, time of visit), and identifiers from cookies and similar technologies.
Who may have access to your personal data?
Access to your personal data may be granted to service providers used in our operations, such as: IT services (website hosting, etc.), legal services, as well as analytics service providers, where you have given your consent.
Are you required to provide us with your personal data?
Using our website involves the automatic processing of certain technical data (e.g. IP address), which is necessary to establish a connection and display the content of the website. Refusing consent to cookies used for marketing or analytical purposes does not restrict access to the website content.