Privacy Policy

This Privacy Policy sets out the rules for collecting, processing and protecting personal data in connection with the Hunter service available at https://hunter.workplays.it(the „Service”). Hunter supports recruitment in the game development industry (gamedev) by connecting employers with suitable candidates.

This Policy is addressed to three groups: Users (recruiters and studios using the Service), Candidates (gamedev professionals whose professional data is processed in the Service) and visitorsto the Service's pages, including people joining the waitlist or using the free profile scan.

The controller of personal data is WORKPLAYS IT SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄwith its registered office in Lublin, Poland, ul. Związkowa 26, 20-148 Lublin, KRS: 0001097357, NIP (tax ID): 7123473171, REGON: 528250745 (the „Controller”).

Contact in data-protection matters: office@workplays.it or in writing to the registered office address.

• GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016;
• EEA - the European Economic Area (EU plus Iceland, Liechtenstein, Norway);
• SCC - Standard Contractual Clauses approved by the European Commission;
• EU-US DPF - the EU-US Data Privacy Framework;
• Candidate Base - a non-public directory of professional profiles of gamedev specialists maintained by the Controller for recruitment purposes.

A. Users (recruiters and studios):

• account data: e-mail address, password (stored only in encrypted form), first and last name;
• data of the company linked to the account (name, logo);
• if a User voluntarily connects their own LinkedIn account - the identifier of the connected account, its display name and statistics of activity performed through the Service;
• content entered in the Service (role descriptions, notes, settings).

B. Candidates: we process professional data only, originating from:

• publicly available professional sources (public professional profiles, public portfolio sites) and professional business-contact databases operated by specialised third parties;
• WorkPlays communities (the WorkPlays and Lobby services, the Discord community) - to the extent a person consented there to being contacted about recruitment;
• directly from the Candidate- via a role-specific consent form or the free profile scan (the „For candidates” page).

The scope of Candidate data may include:

• first and last name, current role and employer, employment history;
• skills, specialization, experience level, city/region;
• links to public professional profiles and portfolios, and the photo from a public profile;
• contact details (e-mail address, link to a professional profile);
• after the Candidate voluntarily completes a consent form: contact preferences, salary expectations, submitted documents (e.g. a CV) and messages;
• information about the Candidate's interactions with our communication and services (e.g. confirming or declining interest, using the profile scan) together with dates - solely to honor the Candidate's decisions and to target contact more accurately.

We do not collect special categories of data (Art. 9 GDPR) and we ask that they not be included in messages or documents sent to us.

C. Waitlist sign-ups: the e-mail address provided in the form.

D. Technical data: security logs (including IP address) necessary to protect the Service against abuse, and the result of anti-bot verification on public forms.

• Performance of a contract (Art. 6(1)(b) GDPR):operating User accounts and providing the Service's functionality; performing the free profile scan requested by a Candidate.
• Legitimate interest of the Controller and Users (Art. 6(1)(f) GDPR): building and maintaining the Candidate Base for the gamedev industry, matching professional profiles to specific roles, and the first, targeted contact with a Candidate containing an invitation to give consent - carried out in a low-volume manner and strictly in a professional context; as well as Service security, abuse prevention, and establishing and pursuing claims.
• Consent (Art. 6(1)(a) GDPR):further contact with a Candidate about a role, presenting the Candidate's profile to a specific employer, contact about future matching roles (after signing up via the „For candidates” page), and the waitlist. Consent can be withdrawn at any time without affecting the lawfulness of prior processing.
• Legal obligation (Art. 6(1)(c) GDPR): obligations under applicable law, including tax and accounting rules.

Part of the Candidate data is obtained from publicly available professional sources and third-party professional databases rather than directly from the Candidate. In such cases:

• we record the source (source category) of every profile;
• we provide the processing information no later than at the first contact with the Candidate, together with a link to this Policy and a simple way to decline;
• a decline („not interested”) is recorded and honored - we stop further contact in line with the Candidate's request.

To match Candidates to roles, the Service analyses professional data, including with the help of AI models, and assigns match scores to profiles. This constitutes profiling within the meaning of the GDPR; it does not, however, involve automated decision-making that produces legal or similarly significant effects for the Candidate (Art. 22 GDPR) - every decision about contacting a Candidate, presenting a profile to an employer or further recruitment steps is made by a human. The Candidate has the right to object to profiling based on legitimate interest (section XI).

AI-generated output (e.g. profile tips within the free scan) is informational only and does not guarantee any recruitment outcome.

Personal data may be disclosed to:

• processorsacting on the Controller's instructions under data-processing agreements, in the following categories: cloud infrastructure and hosting providers, database providers, AI technology providers, providers of professional business-contact databases and data-acquisition tools, a provider of professional-network integration technology, e-mail delivery providers, an anti-bot security provider, and an internal communications provider;
• Users of the Service (employers)- a Candidate's profile is presented to a specific employer in full once the Candidate has given consent; from the moment of disclosure the employer becomes an independent controller of the Candidate's data within its own recruitment process;
• public authorities where required by law.

The Controller does not sell personal data and does not make the Candidate Base as a whole available to any third party.

Some service providers used by the Controller process data outside the European Economic Area (in particular in the USA). Every transfer takes place with the safeguards required by Chapter V GDPR: Standard Contractual Clauses (SCC) or a European Commission adequacy decision (including EU-US Data Privacy Framework certification). Details of the safeguards are available from the Controller on request.

• User account data - for the duration of the agreement and thereafter until the expiry of limitation periods for claims;
• Candidate profiles - for as long as they remain relevant for recruitment, no longer than 3 years from the last update or interaction; profiles undergo periodic retention reviews, and data originating from licensed databases is additionally subject to the source's licence terms;
• Candidate consents and declines- until consent is withdrawn; the fact of a decline or objection is retained to the extent necessary to permanently honor the Candidate's decision;
• waitlist sign-ups - up to 12 months from sign-up or until consent is withdrawn;
• e-mail verification tokens - 24 hours from generation;
• security logs - up to 12 months;
• claims-related data - until the expiry of limitation periods (Art. 118 of the Polish Civil Code).

Everyone whose data we process (Users and Candidates) has the right to:

• access their data and obtain a copy;
• rectification of inaccurate or incomplete data;
• erasure („right to be forgotten”);
• restriction of processing;
• object to processing based on legitimate interest - including profiling and recruitment contact; an objection to contact is honored unconditionally;
• data portability (where processing is based on contract or consent);
• withdraw consent at any time, without affecting prior processing;
• lodge a complaint with the President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.

Requests can be sent to office@workplays.it or in writing to the registered office. We respond without undue delay, at the latest within one month. Candidates can also use the decline options available directly in the communication they receive from us.

• Essential cookies and data- maintaining the signed-in User's session and remembering interface preferences (e.g. theme). They do not require consent.
• Anti-bot protection - public forms use a verification mechanism (Cloudflare Turnstile) which may process technical browser data to distinguish humans from bots.
• The Service does not use analytics or marketing cookies.

The Controller applies appropriate technical and organisational measures, in particular: password encryption, encrypted connections (TLS), role-based access control (Candidate data is visible only to authorised Users within their own processes), data separation between User accounts, anti-abuse limits, and backups.

This Policy may be updated as the Service evolves or the law changes. The current version, with the date of the last update, is always available at this address.

WORKPLAYS IT Sp. z o.o. · ul. Związkowa 26, 20-148 Lublin, Poland · office@workplays.it