I. Introduction

Pursuant to the art. 13 sec. 1 and sec. 2 of the Regulation of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 / EC (hereinafter: "GDPR"), we would like to inform you that:

1. The Controller of your personal data is AmRest Franchise sp. z o.o. based in Poland, Wrocław (53-332), Powstańców Śląskich 15-17 street, (hereinafter: "AmRest Franchise", or/and ‘We’).
2. Questions, comments and requests regarding the processing of your personal data are welcomed and should be provided to the Data Protection Officer via email: iod.franczyza@amrest.eu or by post to address indicated above.

This Privacy Notice describes how We collect, use and process your personal data during the franchisee recruitment process, also makes you aware of your rights under the GDPR. 

   II. Information that We collect 

We may collect, store and process some or all of the personal data/information listed below: 
   a) General identification: name, surname, address, telephone number and e-mail address;
   b) Concerning your professional experience and qualifications: business experience (mainly in the restaurant industry), qualifications and other relevant data;
   c) Other: interests and hobbies, financial data regarding cooperation as our potential franchisee, as well other data which may be included in your application.

   III. How do We collect information?

We collect information directly from you, but We may also receive personal data about you from other sources such as public registers. We will also collect additional personal information in the course of the analysis process 
(e.g. internal notes, assessment records).

If you have been appointed as a contact person of the Company who would like to become our franchisee, your personal data will be made available to us by your Company (employer) on whose behalf you are acting. 

You are under no statutory or contractual obligation to provide data to us during the process, however, if you do not provide the information, we may not be able to process your application properly or at all.

   IV. How do We use your personal data ?

If you run a sole proprietorship, your personal data will be processed for the following purposes:

   a) To consider your application as potential franchisee, including qualification and financial assessment;
   b) Get in contact with you;
   c) Verifying details you have provided;
   d) To set up and conduct interviews and assessments;
   e) For statistical and analytical purposes;
   f) Conducting training in a Pizza Hut restaurant
   g) Establish or defend our legal claims (where required).

The legal basis for processing is to take pre-contractual activities, and if the contract will be concluded with you, the data will also be processed in order to perform the franchise contract. In some cases (e.g. point. g) above) we may use our legitimate interests for processing of your data.  

If you have been appointed as a contact person of the Company who would like to become our franchisee, your personal data will be processed for the following purposes: 

   a) Get contact with you and entity you represent; 
   b) Verifying details you have provided;
   c) To set up and conduct interviews and assessments;
   d) Establish or defend our legal claims (where required).

The legal basis for processing is to take pre-contractual activities, and if the contract will be concluded with the Company, the data will also be processed in order to perform the franchise contract. In some cases (e.g. point. d) above) we may use our legitimate interests for processing of your data. 

   V. To whom We share your personal data?

Your personal data is transferred to entities providing services to us, such as suppliers of IT systems and IT services, entities providing administrative support and entities related to us, including companies from our capital group, as well as the owner of the Pizza Hut brand in connection with the operation on this brand on the market.

Where we do share your data with 3rd parties or other AmRest entities, the shared data will be limited to that which is required by the 3rd party or other AmRest entity to provide the required processing. In such cases your personal data is safeguarded by Data Processing Agreements, committing outsourced service providers to process your personal data for specified purposes and in accordance with our instructions, comply with the GDPR and apply appropriate security measures to protect your personal information in line with our internal policies. All transfers outside of the EEA made to countries which are considered by the European Commission to not provide an adequate level of protection of personal information are safeguarded with agreement based on Standard Contractual Clauses approved by the European Commission. 

More details about sharing data can be obtained from contact point specified in point I.

   VI. Retention schedule of your personal data

Your personal data will be processed for the duration of the negotiations regarding establishing franchise cooperation with Us and until the expiry of the contract (if it is concluded), or in the case of processing your data on the basis of our legitimate interest - until you submit an effective objection to the processing of your personal data. 

The retention period may be extended each time by the period of limitation for claims, if the processing of your personal data is necessary to establish or pursue any claims or to defend against such claims by us. 

  VII. Your rights in relation to personal data 

You have the right to: access the data and request rectification, deletion, processing restrictions, the right to transfer data and the right to object to data processing.

If you wish to exercise any of the rights set out above, please use contact details provided in point I above. Please note that:

   a) You will not have to pay a fee to access your personal data (or to exercise any of the other rights), however, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances;
   b) We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response;
   c) We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated;
   d) In certain circumstances we may need to limit the scope of fulfilment of the data subject’s rights request e.g. where a request is made to delete data that has to be retained for legal or regulatory reasons, or where fulfilling the request may expose the personal data of another data subject.  

You have the right to make a complaint at any time to the Local Supervisory Authority. We would however, appreciate the chance to deal with your concerns before you approach the Local Supervisory Authority so we encourage you to contact us in the first instance.

   VIII. Use of automated decision-making and profiling

We do not undertake automated decision-making and profiling. A person will always be involved in the decision making process.

   IX. Changes to the Privacy Notice 

If any changes are made to our Privacy Notice in the future, we will inform you and provide a copy of the amended notice.