Privacy Policy
Data controller
The controller of your personal data collected via the tomhrm.com website is ENNOVA Spółka Jawna (a Polish registered partnership, hereinafter “ENNOVA”), with its registered office in Elbląg, ul. Sadowa 7/13, entered in the Register of Entrepreneurs of the National Court Register (KRS) maintained by the District Court in Olsztyn, 8th Commercial Division, under KRS No. 0000282777, Tax ID (NIP) 5782976225.
With respect to data that Clients input into the tomHRM application (data of their employees, candidates and other individuals), ENNOVA acts as a data processor on the Client's documented instructions - see the section Data entrusted to us by our Clients.
Purposes and legal bases for processing
We process personal data for the following purposes and on the following legal bases:
| Purpose of processing | Legal basis (GDPR) |
|---|---|
| Handling enquiries submitted via the contact form and communicating with the ENNOVA team | Article 6(1)(f) - our legitimate interest (responding to enquiries) |
| Scheduling a demo presentation and provisioning a trial account | Article 6(1)(b) - steps taken prior to entering into a contract |
| Performing the SaaS services agreement for the tomHRM application | Article 6(1)(b) - performance of a contract |
| Issuing and retaining accounting records | Article 6(1)(c) - compliance with a legal obligation |
| Marketing activities relating to the tomHRM service | Article 6(1)(a) - your separate consent |
| Handling recruitment processes conducted by ENNOVA | Article 6(1)(a) and (b), and Article 6(1)(c) for data required under employment law |
| Analytics, performance measurement and service improvement | Article 6(1)(a) - consent (analytics/marketing cookies) |
| Establishing, pursuing or defending legal claims | Article 6(1)(f) - our legitimate interest |
Scope of processed data
To deliver our services, respond to enquiries and share knowledge, we process the data you provide to us - through website forms, chat, email or other communication channels. This typically includes:
- first name and surname,
- business email address,
- telephone number,
- company name.
In addition, we automatically collect technical data described in the section Cookies and tracking technologies.
Providing your data is voluntary but necessary to handle your enquiry, schedule a presentation or enter into a contract.
Data retention periods
Given our clients' long decision-making cycle, we retain contact data for up to 3 years from the last contact, unless you withdraw your consent or raise an objection earlier.
Data recipients and transfers outside the EEA
The recipients of your data are authorised ENNOVA staff and associates, as well as carefully selected service providers acting as data processors on our behalf:
| Provider | Role | Region | Legal basis for transfer |
|---|---|---|---|
| OVH S.A. | Server infrastructure | EU (Poland) | GDPR (EU 2016/679) |
| Google Ireland Limited | Analytics | EU (Ireland) | GDPR (EU 2016/679) |
| Positive Group Polska Sp. z o.o. | Chat, email messaging | EU (Poland) | GDPR (EU 2016/679) |
| MailerLite Limited | Email delivery | EU (Ireland) | GDPR (EU 2016/679) |
| Twilio Inc. | Email / SMS handling | Outside EU (USA) | Certification under the EU-US Data Privacy Framework (DPF) |
| Pipedrive Inc. | CRM | Outside EU (USA) | Certification under the EU-US Data Privacy Framework (DPF) |
| Calendly | Meeting scheduling | Outside EU (USA) | EU-US Data Privacy Framework (DPF) |
Transfers of data outside the European Economic Area to the USA rely on the European Commission's implementing decision of July 10, 2023 on the “EU-US Data Privacy Framework” (for certified entities) or, for entities outside the DPF programme, on Standard Contractual Clauses (SCCs) approved by the European Commission.
Profiling and automated decision-making
As part of our marketing activities - solely where you have given your consent - we may carry out profiling consisting of tailoring advertising content to your activity on the website (including through Google and LinkedIn advertising tools). Such profiling does not produce legal effects concerning you. You may withdraw your consent and raise an objection at any time.
Your rights
In connection with the processing of your data, you have:
- the right of access to your data and to obtain a copy of it,
- the right to rectification of inaccurate data,
- the right to erasure (“the right to be forgotten”),
- the right to restriction of processing,
- the right to data portability,
- the right to object to processing based on legitimate interest,
- the right to withdraw consent at any time - without affecting the lawfulness of processing carried out before withdrawal,
- the right to lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).
To exercise any of these rights, please contact us via the contact form.
Data entrusted to us by our Clients
Clients may input into tomHRM the personal data of their employees, candidates and other individuals. We have no direct relationship with those individuals - in such cases we act as a data processor on the Client's instructions, and it is the Client (as controller) who is responsible for having a legal basis, including any necessary consents, to entrust such data to us.
The terms of such entrustment are governed by the Data processing agreement. If your data was entered into tomHRM by your employer or another entity, please contact that entity directly, as the controller, to exercise your rights.
Data security
We implement appropriate technical and organisational measures to ensure the security of the processed data, commensurate with the risk (Article 32 GDPR). You can find more information on our Security page.
Changes to this policy
We may update this policy from time to time, e.g. in connection with changes in legislation or the scope of our services. The current version is always available on the website, and we indicate the date of the last update at the top of this document.