Last updated: October 23, 2026
1. Who is responsible for your data?
Brand Position is responsible for the personal data processed through friendlyworkplace.com and for administering the Friendly Workplace program. Our address is ul. St. Augusta 6 lok. 20, 03-847 Warsaw, Poland. For privacy questions or requests concerning your personal data, contact info@friendlyworkplace.com.
This policy covers website visitors, people who contact us or request program information, newsletter subscribers, people recommending an employer, employer representatives, and people featured in materials supplied for publication.
2. Inquiries and requests for program information
When you contact us, we process the information you provide, such as your name, email address, organization, country, employee count, telephone number, and message. The fields depend on the form used. Required fields are needed to handle your request; optional fields can be left blank.
We use this information to respond, send requested materials, and manage correspondence. Our legal basis is our legitimate interest in handling business inquiries and communicating with interested people (Article 6(1)(f) GDPR). Where you request steps toward a contract with you personally, Article 6(1)(b) GDPR applies. Providing information through these forms is voluntary, but we may be unable to handle a request without the required contact details. A prospectus request does not automatically subscribe you to our newsletter.
3. Employer recommendations
The recommendation form collects your name and email address, your employer’s name, country and location or business unit, your reasons for recommending the employer, and a business contact email for the employer. You may also provide the company website and the name of a contact person or department.
We process recommendations to review the workplace practices described, clarify information, and consider whether to invite an employer to learn about the program. This is based on our legitimate interest in identifying relevant workplace practices and administering Friendly Workplace® (Article 6(1)(f) GDPR). A recommendation is not an application and does not guarantee contact or recognition. Please do not include health information or other sensitive personal information about yourself or others.
We share your full name and the fact that you recommended the named employer only if you separately agree to this. That choice is optional and based on consent (Article 6(1)(a) GDPR). It does not authorize disclosure of your email address or the full recommendation. Without your agreement, we will not identify you to your employer without first asking you. We also avoid sharing details that would indirectly identify you.
You can withdraw this consent by emailing info@friendlyworkplace.com. Withdrawal stops future disclosure under that consent and does not affect the lawfulness of earlier disclosure. We record your choice, the consent wording or version, and the submission date and time.
4. Employer contacts supplied by someone else
If someone recommends your organization and names you as a contact, we may receive your name, role or department, business email address, employer, and location from that person. We use these details to assess the relevance of the recommendation and, where appropriate and permitted, communicate about it. Our basis is the legitimate interest described above. Being named as a contact does not subscribe you to marketing emails.
We provide the required privacy information within the applicable GDPR time limits, normally within one month and no later than our first communication with you. You may ask about the source of your data and object to processing based on legitimate interests. We assess requests while protecting the rights of other people involved.
5. Newsletter
If you subscribe to Friendly Workplace Insights, we use your email address to send employer profiles, workplace practices, and program updates. Subscription is based on consent (Article 6(1)(a) GDPR). We use Brevo to manage subscriptions and send emails. Our signup process asks you to confirm your email address through a confirmation link.
You can unsubscribe using the link in a newsletter or by contacting us. We may retain limited records of your subscription and withdrawal to demonstrate your choices and prevent unwanted future mailings. Brevo is configured to require recorded consent for open and click tracking and not to track contacts whose tracking consent is unknown. Our newsletter signup form does not request tracking consent. Subscription alone does not authorize tracking your opens or clicks.
6. Employer profiles, articles, and photographs
Employers supply materials for profiles and other editorial publications. These may include names, job titles, professional statements, and identifiable photographs of employees or representatives. The supplying employer is expected to obtain the necessary permissions for publication by Brand Position on this website and inform the people concerned.
Where publication relies on consent, the legal basis is Article 6(1)(a) GDPR. Professional editorial information may also be processed on the basis of our legitimate interest in publishing relevant workplace information, where that basis is appropriate and the rights of the person concerned are respected. We assess the basis for the material concerned rather than assuming that an employer’s submission removes our responsibilities.
Published material is accessible to website visitors and may be indexed by search engines. Contact us if you have a question about material featuring you or wish to request a correction, removal, or withdrawal of consent.
7. Website analytics and cookie choices
We use Google Analytics 4 to understand visits and interactions with website content. Analytics can involve online identifiers and information about pages viewed, events, device and browser characteristics, and approximate location. Optional analytics is based on consent (Article 6(1)(a) GDPR).
CookieYes manages cookie choices. You can revisit them through Cookie Settings. See our Cookie Policy for the cookie inventory and durations. Cookie lifetimes are separate from the retention settings for analytics reports and event data.
8. Security and spam prevention
Our hosting and security tools process technical information needed to operate and protect the website, such as IP addresses, requested URLs, timestamps, browser details, and security events. We use Wordfence for website protection and Google reCAPTCHA in the newsletter signup process to help distinguish genuine submissions from automated abuse.
Security processing is based on our legitimate interest in protecting the website and its users (Article 6(1)(f) GDPR). Where a particular use of tracking technology requires consent, that requirement applies separately. reCAPTCHA may set the _GRECAPTCHA cookie when it performs risk analysis. Google explains its processing in its Privacy Policy.
9. Service providers and other recipients
We use service providers for hosting and email, newsletter delivery, website analytics, consent management, backups, and security. Relevant services include MyDevil, Brevo, Google Analytics and reCAPTCHA, CookieYes, and Wordfence. Authorized people working for Brand Position may access information where necessary for their duties. We may also disclose information to professional advisers or public authorities where necessary and legally justified.
Employer recipients receive a recommender’s identity only within the consent described in section 3. Materials intended for publication are shared publicly as described in section 6.
Some providers or their subprocessors may process information outside the European Economic Area. Such transfers require an applicable transfer mechanism, such as an adequacy decision or appropriate contractual safeguards. Contact us for information about the safeguards relevant to your data or to request a copy where available. Information about the mechanisms provided by these services is available in Brevo’s data processing terms, CookieYes’s Data Processing Agreement, Wordfence’s Data Processing Addendum, and Google’s information on analytics data transfers. These mechanisms include European Commission standard contractual clauses and, where applicable, adequacy decisions.
10. How long we retain information
Our retention schedule provides for inquiries to be kept for up to six months after the matter is closed, and recommendations that are not pursued for up to six months from receipt. Backups stored on our hosting are retained for up to six months from creation. A longer period may apply to specific records needed to meet a legal obligation or establish, exercise, or defend a legal claim. In that case, retention is limited to the information and period needed for that purpose.
If an inquiry or recommendation develops into program participation, the necessary information becomes part of the participation records and is retained for the relationship and any applicable legal obligations or claims periods. Newsletter contact information is used until you unsubscribe, with limited records retained where needed to evidence consent or respect an opt-out. Editorial material is retained while publication remains justified, subject to applicable rights and requests.
Retention of technical and security records is determined by the time needed to detect, investigate, and resolve incidents and protect the service. Consent records are retained for the duration of the relevant processing and the period needed to demonstrate compliance or address related claims. Our Google Analytics 4 retention setting for user-level and event-level data is 14 months. This setting does not determine how long aggregated reports are retained. Analytics retention is separate from browser cookie lifetimes; the expiry of a cookie does not by itself delete information already collected by Google Analytics. Contact us for information about retention applicable to your data.
11. Your rights
Subject to the conditions in the GDPR, you can request access, correction, deletion, restriction, or portability of your personal data. You may object to processing based on legitimate interests and withdraw consent at any time. You have an unconditional right to object to direct marketing. Withdrawal does not affect processing that was lawful before it.
Send requests to info@friendlyworkplace.com. We may ask for proportionate information to verify your identity. You may complain to the President of the Personal Data Protection Office in Poland (UODO), or another competent supervisory authority.
12. Automated decisions and external websites
Friendly Workplace recognition is assessed by people. We do not use the recommendation form to make solely automated decisions producing legal or similarly significant effects on an individual. Security tools may automatically flag or block suspicious traffic.
Links to employer career pages and social platforms take you to services that apply their own privacy policies. We may update this policy when our practices change and will indicate the revision date.