Privacy Policy | Nexflow

1. Data Controller

The controller of your personal data is Nexflow Sp. z o.o.with its registered office in Słubice, Poland (NIP: PL5981632310, KRS: 0000496516, REGON: 081188992), hereinafter referred to as “Nexflow” or the “Controller”.

Contact for data protection matters: privacy@nexflow.work or in writing to the Company's registered address.

2. Purposes and Legal Bases for Processing

Purpose	Legal basis
Candidate recruitment	Art. 6(1)(b) GDPR — necessity for contract; Art. 6(1)(a) GDPR — candidate consent
Handling contact form enquiries	Art. 6(1)(b) GDPR — pre-contractual measures
Execution and billing of staffing assignments	Art. 6(1)(b) and (c) GDPR — contract performance and legal obligations
Direct marketing and analytics	Art. 6(1)(f) GDPR — legitimate interests of the Controller
Compliance obligations (GDPR, AUeG, Polish temporary employment act)	Art. 6(1)(c) GDPR — legal obligation

3. Categories of Data Processed

Identity data: first name, last name, national ID number (where required by law)
Contact data: e-mail address, phone number, correspondence address
Professional data: experience, qualifications, preferred position, CV
Employment data: contracts, pay rates, working hours
Document data: identity document type and number, work permit, A1 certificate (for workers posted to DE)
Technical data: IP address, worker portal login credentials

4. Retention Periods

Candidates (recruitment): 12 months from the date of application, unless you consent to longer retention or are hired.
Employees (active employment): throughout the employment relationship and thereafter for the periods required by law (generally 10 years).
Contact enquiries: until the enquiry is resolved and for 12 months after the last contact.

5. Recipients of Data

Your data may be shared with the following categories of recipients:

User employers (Nexflow clients) — to the extent necessary for assignment fulfilment
IT and cloud service providers (AWS eu-central-1, Vercel) — under data processing agreements
Accounting firm and legal advisers — for billing and compliance purposes
Public authorities (ZUS, tax office, labour inspectorate) — as required by law
Communication service providers (SendGrid, Twilio) — for contact purposes only

Nexflow does not sell personal data to third parties. Any transfers outside the EEA are made with appropriate safeguards (EU Standard Contractual Clauses).

6. Your Rights

Under the GDPR you have the following rights:

Right of access

You may request a copy of the data we hold about you.

Right to rectification

You may request correction of inaccurate or completion of incomplete data.

Right to erasure

You may request deletion of your data ("right to be forgotten") where no other legal basis applies.

Right to data portability

You may receive your data in a structured, commonly used and machine-readable format.

Right to restriction of processing

You may request restriction of processing in certain circumstances.

Right to object

You may object to processing based on the Controller's legitimate interests.

Withdrawal of consent

Where processing is based on your consent, you may withdraw it at any time without affecting prior lawful processing.

Right to lodge a complaint

You have the right to lodge a complaint with the President of the Polish Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.

To exercise your rights, contact us at: privacy@nexflow.work. We will respond within 30 days.

7. Cookies and Analytics

The nexflow.work website may use technically necessary cookies. We do not use third-party tracking cookies without your prior consent.

8. Changes to This Policy

Nexflow reserves the right to update this Privacy Policy. We will notify you of any material changes by updating the date at the top of this document.

Data Protection Contact

Nexflow Sp. z o.o.
Słubice, Poland
E-mail: privacy@nexflow.work
Tel.: +48 224 878 828