Privacy policy and information notice

This document explains how DeepMelon Technologies P.S.A. processes personal data – on this website, in correspondence, recruitment, contracts and research and development projects, including those carried out in consortia and funded from public sources. It constitutes the information required by Articles 13 and 14 of the GDPR (Regulation (EU) 2016/679).

01Controller

02Whose data we process

• people who contact us (e-mail, phone, meetings);
• candidates for employment and collaboration, including the CTO position;
• contractors, partners, advisers, investors and their representatives;
• people involved in projects, including staff and collaborators of consortium partners (e.g. universities);
• visitors to this website – technical data described in section 10.

03Purposes and legal bases

• Responding to correspondence and maintaining contacts – the controller’s legitimate interest (Art. 6(1)(f) GDPR).
• Recruitment – steps prior to entering into a contract (Art. 6(1)(b)); for future recruitment – consent (Art. 6(1)(a)).
• Concluding and performing contracts – Art. 6(1)(b); data of contractors’ representatives and contact persons – Art. 6(1)(f).
• Preparing, implementing, settling and auditing projects, including those funded by the European Union and national programmes (e.g. FENG) – legal obligations arising from cohesion-policy implementation rules and grant agreements (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)).
• Accounting and tax obligations – Art. 6(1)(c).
• Establishing, pursuing or defending claims – Art. 6(1)(f).

04Data received from other parties

Data of people involved in projects on the partners’ side (e.g. universities) is received from their employers or principals. It covers: name, position or function, business contact details, role and time commitment in the project, and – to the extent required to settle the project – data on remuneration and working time.

05Recipients

• the National Centre for Research and Development (NCBR) and other funding institutions and their operators, as well as institutions authorised to carry out controls and audits (including bodies of the European Commission, the National Revenue Administration and the Supreme Audit Office);
• consortium partners – to the extent needed for the joint project;
• IT service providers: e-mail and file storage (Proton AG), accounting software, website hosting and office tools;
• legal, accounting and financial advisers;
• current and prospective investors – only to the extent necessary and after a confidentiality undertaking.

06Transfers outside the European Economic Area

Some providers may process data outside the EEA. Proton AG operates in Switzerland, for which the European Commission has issued an adequacy decision. In other cases, transfers are based on an adequacy decision of the Commission or on standard contractual clauses approved by the Commission. A copy of the safeguards is available on request.

07Retention

• correspondence – until the matter is closed, then until any claims become time-barred;
• recruitment – until it ends; with consent – up to 12 months for future recruitment;
• contracts – for their duration and until claims become time-barred;
• accounting records – 5 years from the end of the year in which the tax payment deadline expired;
• funded projects – for the period required by the grant agreement, at least 5 years from 31 December of the year of the last payment to the beneficiary and no less than 10 years from the date the last aid was granted.

08Your rights

You have the right to access, rectify and erase your data, restrict its processing, data portability and to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).

09Voluntary provision and automated decisions

Providing data is voluntary but may be necessary to conclude or perform a contract, take part in recruitment, or implement and settle a project. We do not make decisions based solely on automated processing, including profiling.

10This website

This website does not use cookies, analytics tools or forms. The hosting provider may automatically log technical connection data (e.g. IP address, date and time of the visit) to ensure security and proper operation of the website – based on legitimate interest (Art. 6(1)(f) GDPR).

11Changes

This document may be updated. The current version is always available at deepmelon.tech/privacy-policy.