Privacy Policy

Last updated: 1 July 2026

This Privacy Policy explains how Vistulo Sp. z o.o. ("Vistulo", "we", "us" or "our") collects, uses, stores and protects your personal data when you visit our website or apply for a role through our applicant tracking system. We are committed to protecting your privacy and handling your personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and applicable Polish data protection law. If you are a California resident, please also see the "California Privacy Rights" section below, which describes additional rights you have under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA").

Data Controller

The data controller responsible for your personal data is:

Personal Data We Collect

When you apply for a role or complete any of the subsequent forms, we collect the personal data you provide to us for recruitment purposes, which may include:

• Your name
• Your address
• Your phone number
• Your email address
• Your resume or CV, and any information contained within it
• Any additional information you choose to provide in your application or at later steps of the recruitment process

When you browse our website, we also collect limited technical data through cookies and similar technologies, as described in the "Cookies" section below.

How We Use Your Personal Data and Legal Basis

We process your personal data for the following purposes:

• Recruitment. To assess your application, communicate with you about the recruitment process, evaluate your suitability for a role, and manage our relationship with you as a candidate. The legal basis for this processing is the taking of steps at your request prior to entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in conducting recruitment (Article 6(1)(f) GDPR).
• Future opportunities. Where permitted, to keep your details on file so we can contact you about other suitable roles. The legal basis is your consent (Article 6(1)(a) GDPR) or our legitimate interest (Article 6(1)(f) GDPR).
• Website analytics. To understand how visitors use our website and to improve it. The legal basis is your consent (Article 6(1)(a) GDPR), which you provide through our cookie banner.

Cookies

We use cookies for the following purposes:

• Strictly necessary cookies. We use a session cookie to keep our website working correctly and to maintain your session. These cookies are essential and cannot be switched off.
• Analytics cookies. We use Google Analytics, a web analytics service provided by Google, to help us understand how visitors interact with our website. Google Analytics sets cookies that collect information such as the pages you visit and how you arrived at our site. These cookies are only set if you accept them via our cookie banner. For more information, see Google's Privacy Policy.

When you first visit our website, we show a cookie banner that lets you accept or reject non-essential (analytics) cookies. Your choice is stored in a cookie so we can remember it on future visits. You can change your choice at any time by clearing the cookies in your browser, after which the banner will appear again.

Sharing Your Personal Data

We do not sell your personal data. We may share your personal data with trusted service providers who process it on our behalf (for example, hosting and analytics providers such as Google), and with our clients for the purpose of presenting you as a candidate. Where service providers are located outside the European Economic Area, we ensure that appropriate safeguards (such as the European Commission's Standard Contractual Clauses) are in place.

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including the duration of the recruitment process and, where relevant, for a reasonable period afterwards in case suitable future opportunities arise. When your data is no longer needed, we securely delete or anonymise it.

Your Rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request erasure of your personal data ("right to be forgotten")
• Restrict or object to our processing of your personal data
• Request the portability of your personal data
• Withdraw your consent at any time, where processing is based on consent
• Lodge a complaint with a supervisory authority

To exercise any of these rights, please contact us at contact@vistulo.com. You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

California Privacy Rights (CCPA)

This section applies to residents of California and supplements the rest of this Privacy Policy. It describes how we handle personal information under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the "CCPA"). For the purposes of this section, "personal information" has the meaning given to it under the CCPA.

Categories of personal information we collect

In the past twelve months, we have collected the following categories of personal information, depending on how you interact with us:

• Identifiers and personal records (Cal. Civ. Code §1798.80(e)) — such as your name, postal address, email address and phone number.
• Professional or employment-related information — such as your resume or CV and any work history, qualifications and other details you include in your application or at later steps of the recruitment process.
• Internet or other electronic network activity information — such as information about how you interact with our website, collected through cookies and similar technologies (only where you have accepted analytics cookies).

We do not collect or process sensitive personal information for the purpose of inferring characteristics about you, and we do not use or disclose sensitive personal information for purposes that would entitle you to limit its use under the CCPA. If your application materials happen to contain information that may be considered sensitive, we use it only for the recruitment purposes described in this policy.

Sources and purposes

We collect this information directly from you when you apply for a role or complete a subsequent form, and automatically from your device when you browse our website. We use it for the business purposes described in the "How We Use Your Personal Data" and "Cookies" sections above, including assessing your application, communicating with you, presenting you to our clients as a candidate, operating and improving our website, and complying with our legal obligations.

Disclosure of personal information

We may disclose the categories of personal information described above to service providers who process it on our behalf (such as hosting and analytics providers) and to our clients for the purpose of presenting you as a candidate, as described in the "Sharing Your Personal Data" section above.

We do not sell or share your personal information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA. We have not sold or shared personal information in the preceding twelve months. Because we do not sell or share personal information, we do not offer a "Do Not Sell or Share My Personal Information" link.

Your California rights

As a California resident, you have the right to:

• Know and access the categories and specific pieces of personal information we have collected about you, the sources, the purposes for collecting it, and the categories of third parties to whom we disclose it.
• Delete personal information we have collected from you, subject to certain exceptions.
• Correct inaccurate personal information we maintain about you.
• Opt out of the sale or sharing of your personal information (note that we do not sell or share personal information).
• Limit the use and disclosure of your sensitive personal information (note that we do not use sensitive personal information for purposes that trigger this right).
• Not be discriminated against for exercising any of your CCPA rights.

How to exercise your California rights

To exercise any of these rights, please contact us at contact@vistulo.com. We will verify your request by confirming that the information you provide matches the information we hold about you, and we will respond within the timeframes required by the CCPA. You may also use an authorized agent to submit a request on your behalf, in which case we may require proof of the agent's authorization and verification of your identity.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date.

Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at contact@vistulo.com.