Privacy Notice for Referrers and Referees
Last updated: 30-Jan 2026
This Privacy Notice outlines how Exadel processes personal data collected through its Referral Program in compliance with the General Data Protection Regulation (GDPR) and applicable local data protection laws, including those in Poland, Bulgaria, and Brazil.
1. Scope and applicability
This Notice applies to all individuals participating in the Referral Program:
- Referrers - individuals providing a referral to Exadel
- Referees - candidates who have been referred to Exadel
2. Data Controller
The Data Controller for your personal data is the local Exadel entity that operates the Referral Program in your region.
- For Poland: Exadel Poland Sp. z o.o, located at Warszawa, 00-688, Emilii Plater 28
- For Bulgaria: Exadel Bulgaria Sofia Center, Knyagina Maria Luisa Blvd 53, 1202 Sofia, Bułgaria
- For Brazil: Exadel FS (CPQi), Loja 65B, Shopping Salinas, Av. Washington Soares, 909 - Edson Queiroz, CE
For any inquiries regarding your Personal Data, you can contact us at privacy@exadel.com.
3. Categories of personal data processed
We receive your personal data either directly from you (Referrer) or from the Referrer who confirmed your interest in a position (Referee).
3.1. Data relating to Referrers
The scope of data shared by the Referrer includes:
- Name and surname;
- Date of birth;
- PESEL number (for Poland);
- Email address;
- Home address;
- Bank account number.
3.2. Data relating to Referees (Candidates)
The scope of the Referee's personal data shared with us by the Referrer includes:
- Name and surname;
- Email address;
- English level;
- Location;
- Phone number (optional);
- LinkedIn account (optional).
4. Purposes and legal basis of processing
Data is processed primarily for contract performance, legal obligations, and recruitment.
4.1. Processing Referrer Data
Your data is processed for the following purposes and legal bases:
| Purpose | Legal Basis | ||
|---|---|---|---|
| To manage your participation and remuneration in the Referral Program. | Performance of the contract | Keeping appropriate accounting documentation and tax settlements. | Fulfilling legal obligations |
4.2. Processing Referee Data
The Referee's data is processed to facilitate the recruitment process:
| Purpose | Legal Basis |
|---|---|
| Managing a Referral program (contacting the Referee about a job opportunity, cooperation, or participation in a recruitment or business process) | Legitimate interest of the Data Controller in conducting an effective recruitment process and managing the Referral Program. |
5. Data retention period
The personal data relating to the Referrer will be processed for the period required by law for the storage of accounting documentation.
The personal data relating to the Referee will be processed for the duration of the recruitment process and up to 1 month thereafter in Greenhouse, after which it will be anonymised. If the Referee consents to future recruitment processing, their data will be retained for up to 365 days.
6. Data recipients and sharing
Data is shared with internal cooperators, clients, service providers, and relevant public authorities (e.g. tax authorities).
Personal data recipients might include:
- Eligible staff in the company, including Exadel recruitment, HR, IT system providers, IT support, and managers;
- Our clients;
- Entities providing services to Exadel, e.g., IT, software and hosting cloud providers (GreenHouse, Workday), legal, accounting;
- Public authorities, such as ZUS and US (for Poland), and equivalent regulatory bodies in other jurisdictions, in cases set forth by law.
7. Transfer of personal data to third countries
Your data may be transferred internationally to third countries like the United States, and Exadel applies appropriate contractual, technical, and organizational safeguards to ensure protection and legal compliance.
Your personal data may be transferred to, stored in, or otherwise processed in countries outside your country of residence, including countries outside the EEA, the United Kingdom, or Brazil, where this is necessary for the purposes described in this Privacy Notice. In particular, your Personal Data may be shared with Exadel Group entities, including Exadel Group headquarters located in the United States. We will keep your personal data in a third party recruitment database that is located outside of your country of residence.
Where your personal data is transferred to countries that do not provide a level of data protection considered equivalent to that applicable in your jurisdiction, Exadel ensures that appropriate safeguards are implemented in accordance with applicable data protection laws, including the GDPR, the UK GDPR, and the Brazilian LGPD.
For transfers subject to the GDPR or the UK GDPR, such safeguards may include, where applicable, standard contractual clauses adopted or approved by the European Commission or the UK Information Commissioner’s Office, as well as supplementary measures where required.
For transfers subject to the LGPD, international transfers of Personal Data will take place only in accordance with the legal mechanisms provided for under Article 33 of the LGPD, including, where applicable, standard contractual clauses, specific contractual clauses, global corporate rules, or other lawful transfer mechanisms recognised by the Brazilian National Data Protection Authority (ANPD).
Exadel ensures that appropriate contractual, technical, and organizational safeguards are in place to maintain an adequate level of data protection consistent with the applicable standards.
You may request further information about international data transfers and the safeguards applied by contacting us at privacy@exadel.com .
8. Your rights
You have rights including access, rectification, erasure, restriction, portability, and objection.
You have the following rights regarding your personal data:
Right to be informed: You have the right to be informed about processing of your personal data;
Right to access: You have the right to request access to your personal data;
Right to rectification: You can request the correction of inaccurate or incomplete personal data;
Right to erasure: You have the right to request the deletion of your personal data under certain circumstances;
Right to restriction of processing: You can request the restriction of processing of your personal data in certain situations;
Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format;
Right to object: You can object to the processing of your personal data in certain situations, such as in case of direct marketing;
If you wish to exercise your rights, please use the contact form available on our website: https://exadel.com/privacy-policy.
Right to lodge a complaint: If you believe that we have not complied with applicable data protection laws, you have the right to lodge a complaint with the data protection authority in your country.
| Jurisdiction | Supervisory Authority | ||||
|---|---|---|---|---|---|
| Poland | Urząd Ochrony Danych Osobowych ul.Stawki 2 00-193 Warszawa, Poland Phone: +48225310300 Electronic box: https://uodo.gov.pl/pl/p/kontakt | Bulgaria | Personal Data Protection Commission (In Bulgarian: Комисия за защита на личните данни, the 'Commission'). 2 Professor Tsvetan Lazarov, Sofia 1592, Bulgaria kzld@cpdp.bg www.cpdp.bg | Brazil | Agência Nacional de Proteção de Dados (ANPD) Website: https://www.gov.br/anpd/pt-br Email: anpd@anpd.gov.br |
9. Freedom to provide data
Providing data is voluntary but may be necessary to participate in the program.
Providing data is voluntary. However, not providing it may make it impossible to start or continue cooperation, for example, due to Exadel’s obligation to account for the income tax.
10. Automated decision-making
We do not make decisions based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
11. Updates to this Notice
We may update this notice from time to time to reflect changes in our data processing practices or legal requirements. We will notify you of any significant changes. This version was issued in April 2026.