Summary of jointcontrollership

Randstad information on joint controllership pursuant to Art. 26 of the General Data Protection Regulation (GDPR)

Pursuant to Art. 26 GDPR, with the following information we provide you with a summary of the processing activities where Randstad Polska and other entities belonging to the Randstad Group jointly determine the purposes and means of processing your personal data. The following information also clarifies their roles and how you can exercise your rights under the GDPR in relation to the jointly-controlled processing of your personal data.

  • who could be the joint-controllers processing your personal data?

    • Randstad Polska Sp. z o.o., with its registered office in Warsaw, Al. Jerozolimskie 134 (and other companies of the Randstad Group in Poland: Randstad Services APO, Gerendis APO, APO oraz Randstad Payroll Solutions), and
    • Randstad B.V, registered at the Chamber of Commerce under number 34126765 and registered office in the Netherlands, Diemermere 25, 1112 TC Diemen; and,
    • Randstad N.V, registered at the Chamber of Commerce under number 33216172 and registered office in the Netherlands, Diemermere 25, 1112 TC Diemen, specifically for the Misconduct Report Procedure;

      (hereinafter referred to as "the Parties")

  • what have the Parties agreed to?

    The Parties have defined in an agreement the principles for the processing of your personal data and their respective responsibilities for the jointly controlled processing activities. In particular, the Parties have agreed on who is responsible for handling any requests by you when exercising your rights under Articles 15 to 22 GDPR and for adequately informing you on the processing of your personal data in accordance with Articles 13 and 14 GDPR. 

    The essential content of this agreement and the concerned processing activities are explained in the following sections.

  • how is the cooperation organized between the Parties?

    In the agreement, the Parties have specifically defined their responsibilities and obligations for the jointly controlled processing activities. The competent data protection authority(ies) is also defined. 

    The Parties that have appointed data protection officers, these officers will act as internal contacts for all data protection issues related to the jointly controlled processing activities. 

  • who assumes which obligations under the GDPR?

    The Parties have contractually committed themselves to ensuring GDPR compliance within their area of ​​responsibility and influence, in particular the distribution of responsibility covers the general data principles, legal basis, security measures, data breach notifications obligation, data protection impact assessments, the use of processors, third country transfers and contacts with data subjects and supervisory authorities. In particular, each Party within its respective area of ​​responsibility and influence is responsible for the following obligations:

    a) General Data Protection Principles: obligations for the data processing activities to comply with the following data protection principles under the GDPR:

    • Lawfulness, fairness and transparency
    • Purpose limitation 
    • Data minimisation 
    • Accuracy 
    • Storage limitation 
    • Integrity and confidentiality;

    b) Legal Basis: obligation to ensure there is a lawful basis for the jointly controlled data processing activities;

    c) Accountability: obligation to implement technical and organisational measures to ensure and to be able to demonstrate compliance;

    d) Privacy by design and privacy by default obligations;

    e) Data Processor: obligation to conclude written agreement with processors; manage processors; monitor the processors’ compliance with their obligations under the GDPR and under the data processing agreement; and that each Party is responsible for managing its own processors;

    f) Record Keeping: Obligation to keep records of processing activities/data mapping;

    g) Personal Data Breach Notification: obligation to (jointly or individually) notify personal data breaches, as defined under the GDPR, to the competent data protection authority and/or to the data subjects;

    h) Data Protection Impacts Assessment: obligation to carry out a data protection impact assessment (jointly or individually);

    i) Data Protection Officer: obligation to designate a data protection officer; and, 

    j) Data Transfers: obligation to comply with restrictions on international data transfers..

     

    B. Randstad Polska is responsible for the following obligations:

    a) Obligation to provide information to the data subjects in accordance with the Articles 13 and 14 GDPR;

    b) Obligation to handle and respond to requests from data subjects exercising their rights under the GDPR; 

    c) Obligation to make the essence of the joint controllership arrangement available to the data subjects; and,

    d) Possibly -  the notification of a personal data breach with the competent supervisory authority. 

which are the jointly controlled processing activities under scope of this summary?

The Parties are jointly responsible for the processing of the following activities: 

  • Misconduct Report Procedure

    • joint-controllers

    Randstad Polska Sp z o.o., Randstad Services APO, APO, Gerendis i Randstad Payroll Solutionsa and Randstad N.V.

    • purpose

    In order to assist in the reporting of concerns related to serious misconduct within the Randstad Group, we have established dedicated channels through which stakeholders may voice concerns, either through local reporting mechanisms in place at the operating company level or through our Randstad Group reporting procedure, where the processing is jointly-controlled. 

    The personal data obtained as part of any report, communication/complaint and investigation, will be used by the Parties for the purpose of: (i) carrying out the appropriate investigations into the alleged inappropriate/illegal behaviors that it has been reported; (ii) guarantee the protection against reprisals of any natural person involved in the procedure and, especially, of the informants (with the exceptions indicated in the Procedure); (iii) adoption of corrective measures or any other action relevant to a specific inappropriate/illegal conduct (eg reporting to the competent authorities) and; (iv) comply with applicable regulations and, in particular, those governing the protection of individuals who report violations of regulations and the fight against corruption.
     

    • which categories of personal data?

    Depending on the nature of the reports or investigations to be carried out, the Parties may process all or some of the following categories of personal data: identification and contact data, data relating to personal characteristics, academic data and professionals, employment details, data relating to business information or social circumstances, economic, financial or insurance data, property or insurance transactions, special categories of data (e.g. health data, criminal records, political opinions, etc.) and, in general, all the personal data that may be included in a complaint derived from inappropriate/illegal conduct.

    • which are the concerned data subjects?

    Depending on the reports or investigations, the data subjects whose personal data can be processed may be: Randstad employees, clients and prospective clients, candidates, temporary workers and vendors. 

    • what is the legal basis for this jointly controlled activity?

    Processing is necessary for the purpose of the compliance with a legal obligation to which the Parties are subject to. In the case of Randstad companies with fewer than fifty workers or those to which the aforementioned rule does not apply, the processing will be based on the legitimate interest of such entities in guaranteeing not only adequate protection for whistleblowers when report any inappropriate/illegal conduct, but also adherence to the common values ​​and principles of Randstad as a global organization.
     

  • Sanction Checks

    • joint-controllers

    Randstad Polska Sp z o.o., Randstad Services APO, APO, Gerendis i Randstad Payroll Solutions and Randstad B.V.

    • purpose

    With the purpose of either protecting national security interests, international law, and/or defend against threats to international peace and security, governments of individual countries, international organizations (e.g., United Nations) or political and economic groupings implement political and economic decisions against countries, territories, regimes or organizations, and businesses and/or individuals (“Designated Parties”).

    In order to comply with such decisions and rules, the Parties screen individuals against “Freeze lists” which are issued by international organizations and economic groupings, such as the United Nations Security Council and the European Union, respectively, as well as by individual states, through a process supported by the local sanctions team of each Randstad Group entity, and subject to confidentiality as much as possible. The purpose and means of such screening of individuals is jointly determined by the Parties. 

    For the purposes mentioned above, the Parties may transfer personal data to other Randstad entities that provide services on behalf of the concerned Randstad entity.

    • which categories of personal data?

    For sanction checks, the following categories of personal data may be processed: name, e-mail, contact details, company, role, identification number, date of birth, work location, personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and criminal or administrative convictions and offences, in accordance with applicable laws.

    • which are the concerned data subjects?

    Business partners and contracted individuals (e.g., freelancers, independent contractors or consultants); and contracted talent and corporate staff.

    • what is the legal basis for this jointly controlled activity?

    Processing is necessary for the purpose of compliance with laws and regulations, including but not limited to employment law, tax and social security and national and international sanctions regulation compliance that the Parties are subject to.

  • Randstad Talent Portal

    •  joint-controllers

    Randstad Polska Sp z o.o., Randstad Services APO Sp. z o.o. Sp.K., APO, Gerendis APO Sp. z o.o. sp.k.  i Randstad Payroll Solutions Sp. z o.o. and Randstad B.V.
     

    •   purpose

    The Randstad Talent Portal is composed of several integrated systems that offer a fully digitized workflow that allows for an end-to-end transaction system, between the Talents and Clients and the Randstad markets. This structure is powered by AI and built on a secure digital architecture and allows for consultants to manage the talent pool and client interactions, manage their profiles, assignments, and other relevant information and connect that information to other HR or Finance systems to streamline administrative tasks. 

     

    These platforms operationalize, implement, and further develop a global platform based on the strategic direction and management of Randstad B.V. to support the markets. This includes various functionalities with the following purposes:

     

    • To support financial processes and manage customer and employment information for talent and market clients; 
    • For talent registration and communication, matching candidates with vacancies, and managing the entire order-to-invoice cycle; 
    • For talent engagement through the local Randstad website and app where talent can register, find jobs, schedule shifts, report hours, and find and organize other services; 
    • For client engagement through the local Randstad website where customers can post their jobs and find and organize other services;
    • For data management and reporting at an aggregated and anonymized level to monitor Randstad N.V.'s global strategy executed by Randstad B.V and Randstad group companies.
    • For the Digital Marketplace/WorkNow, which combines various platform functionalities to enable markets to serve talent and customers 24/7 in a digital-first manner.
       
    •  which categories of personal data?

    The specific categories of personal data processed can vary depending on the exact activities within the Randstad Talent Portal. The Parties may process all or some of the following categories of personal data: identification and contact data, data relating to personal characteristics, academic data (e.g. qualifications, work history, skills), professional details, financial data, data relating to business information or social circumstances, special categories of data (e.g. health data, etc.) and potentially other data necessary for matching talent with clients and managing the employment journey.

    •   which are the concerned data subjects?

    The data subjects whose personal data can be processed within the Randstad Talent Platform. primarily include: talent (candidates, temporary workers), Randstad employees, (contacts at) clients.

    •  what is the legal basis for this jointly controlled activity?

    The processing of personal data within the Randstad Talent Portal is based on various legal grounds, including:

    • (pre-) Contractual necessity: the processing of personal data and the use of automated systems for matching services are necessary for the performance of a contract (or in anticipation of entering into a contract) between Talents and Randstad, specifically to enable talent participation in and use of our Randstad Talent Portal (e.g., matching, job placement, managing employment).
    • Legitimate interests: for activities such as improving the platform, developing new features, and conducting analytics, provided these interests are not overridden by the data subjects' rights and freedoms, and for the protection of Randstad’s legal interests and managing legal claims/disputes; and/or protection of the vital interests of the data subjects; 
    • Consent: Where required for specific processing activities, such as for the collection of Talent sensitive data.

data subjects rights 

The specific rights you are entitled to can be found in the “Your data protection rights” section in our data protection notice. If you wish to exercise the rights to which you are entitled under Art. 15 to 22 GDPR with regard to the joint processing of your personal data by the Parties, please contact us at dpo@randstad.pl

 

changes to this Summary 

We may update this Summary from time to time. You can see the date on which the last change was made below in this notice. We advise you to review this notice on a regular basis so that you are aware of any changes. 

 

contact us

If you have any questions about this Summary or any privacy concerns, or would like to exercise your rights, or obtain further information about the safeguards we have in place so that your personal data is adequately protected when transferred outside Europe, please contact us at dpo@randstad.pl

This Summary was updated on: October 26, 2026.