Skip to content
ATUT logo

Privacy Policy

Last updated: 14 October 2026

This policy explains what personal data we process in connection with the use of the atutnet.com website, for what purposes and on what legal basis, to whom we disclose it, how long we keep it and what rights the data subjects have. It fulfils the information obligation under Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, GDPR). This English version is a translation; in case of any discrepancies, the Polish version prevails.

1. Data controller

The controller of your personal data is PPHU ATUT Sp. z o.o., with its registered office in Mysłowice, ul. 1000‑lecia Państwa Polskiego 30a, 41‑400 Mysłowice, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0000151406, NIP (tax ID) 6340133803, REGON 003451476, share capital PLN 90,000 (hereinafter: “ATUT”, “we”).

2. Contact regarding personal data

In all matters concerning personal data, including exercising your rights, you can contact us:

  • by e‑mail: biuro@atutnet.pl,
  • in writing: PPHU ATUT Sp. z o.o., ul. 1000‑lecia Państwa Polskiego 30a, 41‑400 Mysłowice, Poland.

3. What data we process, for what purposes and on what legal basis

3.1. Contact by e‑mail, telephone and contact form

When you write to us, call us or use the contact form, we process the data you provide, most often your name, e‑mail address, telephone number, company name and position, and the content of your message.

  • We reply to your enquiry and conduct further correspondence. The legal basis is our legitimate interest, namely communicating with people who contact us (Article 6(1)(f) GDPR). Data submitted through the contact form is processed on the basis of the consent you give when sending it (Article 6(1)(a) GDPR). You may withdraw your consent at any time by writing to the address given in section 2.
  • If your enquiry concerns an offer, an order, service or a complaint, we process the data to take steps prior to entering into a contract and to perform it (Article 6(1)(b) GDPR). Where you act on behalf of a company, the legal basis is our legitimate interest in contacting its representative (Article 6(1)(f) GDPR).
  • We comply with legal obligations, e.g. under tax and accounting law (Article 6(1)(c) GDPR).
  • We may also process data to establish, exercise or defend legal claims (Article 6(1)(f) GDPR).

3.2. Recruitment

When you respond to a job advertisement in the Careers section and send us your application documents (e.g. CV, cover letter):

  • we process the data specified in Article 22¹ § 1 of the Polish Labour Code (name, date of birth, contact details, education, professional qualifications, employment history) in order to carry out the recruitment. The legal basis is a legal obligation (Article 6(1)(c) GDPR in conjunction with Article 22¹ of the Polish Labour Code) and steps taken prior to entering into a contract (Article 6(1)(b) GDPR);
  • other data you provide on your own initiative (e.g. a photo, interests) are processed on the basis of your consent, expressed by sending them (Article 6(1)(a) GDPR);
  • if you consent to taking part in future recruitment processes, we also process your data for this purpose on the basis of that consent (Article 6(1)(a) GDPR).

Please do not send special categories of data, e.g. information about your health, unless required by law.

3.3. Technical data when visiting the website

When the website is displayed, the servers hosting it automatically record technical data: IP address, date and time of the request, address of the page viewed and information about the browser and operating system. We use this data solely to ensure the operation and security of the website and to diagnose errors. The legal basis is our legitimate interest (Article 6(1)(f) GDPR). We do not combine this data with other data or use it to identify visitors.

3.4. YouTube videos

Some pages contain videos from YouTube. A video loads only when you click the play button. Only from that moment does your browser connect to YouTube servers, and Google Ireland Limited may process your data (e.g. IP address) and store cookies in accordance with Google’s privacy policy. If you do not click a video, no data is transferred to YouTube.

4. Cookies and similar technologies

The atutnet.com website does not use analytics or advertising tools and does not itself store cookies on your device. Cookies may be stored only by YouTube if you play a video (section 3.4).

The website stores one technical item in your browser’s session storage (sessionStorage): the number of pages opened during the current visit. It is used solely for the “Back” button, contains no data that could identify you, is not sent anywhere and is deleted when you close the browser tab. This storage is strictly necessary for a function you use and, under Article 399 of the Polish Electronic Communications Law, does not require consent.

You can change your cookie and browser storage settings at any time in your browser, including blocking storage or deleting stored data.

5. Recipients of data

Your data may be disclosed only to entities that support us in running our business and process data on our behalf, under contracts and in accordance with our instructions:

  • Vercel Inc. (USA), the provider of the infrastructure on which the website runs,
  • cyber_Folks S.A., ul. Wierzbięcice 1B, 61‑569 Poznań, Poland, the hosting provider for the website’s content management system and published files,
  • providers of e‑mail, IT, accounting and legal services, to the extent necessary to provide these services.

We may also disclose data to public authorities where required by law.

6. Transfers of data outside the European Economic Area

Vercel Inc. is based in the United States, so the technical data described in section 3.3 may be transferred to the USA. Vercel Inc. participates in the EU‑U.S. Data Privacy Framework, covered by a European Commission decision finding an adequate level of data protection (Article 45 GDPR).

7. How long we keep data

  • Correspondence and enquiries: until the matter is concluded, and then until the limitation period for any claims expires. Where the correspondence concerns a concluded contract, we also keep it for the period required by tax and accounting law.
  • Recruitment: until the end of the recruitment process for which the documents were sent. If you consent to future recruitment processes, for 12 months from sending the documents or until you withdraw your consent, whichever is earlier.
  • Technical data (server logs): for the retention period set by the infrastructure provider, in the case of Vercel Inc. up to 30 days.
  • Data processed on the basis of consent: until consent is withdrawn.

8. Your rights

Under the terms set out in the GDPR, you have the right to:

  • access your data and receive a copy (Article 15 GDPR),
  • rectification of your data (Article 16 GDPR),
  • erasure of your data (Article 17 GDPR),
  • restriction of processing (Article 18 GDPR),
  • data portability, where we process data on the basis of consent or a contract by automated means (Article 20 GDPR),
  • object to processing based on our legitimate interest (Article 21 GDPR),
  • withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Article 7(3) GDPR).

To exercise these rights, contact us as described in section 2.

9. Complaint to the supervisory authority

If you believe that we process your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Moniuszki 1A, 00‑014 Warsaw, Poland.

10. Voluntary provision of data

Providing data is voluntary. However, without contact details we will not be able to reply to your enquiry, and in recruitment, providing the data specified in Article 22¹ § 1 of the Polish Labour Code is necessary to take part.

11. Automated decision‑making

We do not make decisions based solely on automated processing of data, including profiling.

12. Changes to this policy

We update this policy when the law or the way the website works changes, e.g. when new tools are introduced. The current version is always available on this page, and the date of the last update is shown at the top.