1. Scope of data
The Factor processes the following categories of personal data of a Client who is a sole proprietor or of the Client’s Representative: first name, last name, job title, name of the business entity, NIP, REGON, PESEL, ID card series and number or passport number, telephone number, e-mail address, residential address, registered address, correspondence address, data relating to concluded factoring agreements, bank account number, information on assets and liabilities, data contained in notarial deeds – marital property agreements, data contained in company agreements executed in the form of a notarial deed, and IP address.
2. Data Controller
The Data Controller is KUKE Finance S.A., with its registered office in Warsaw (00-025) , ul. Krucza 50, entered into the Register of Entrepreneurs maintained by the District Court for the Capital City of Warsaw , 12th Division, under KRS 0000501348, NIP 525 258 12 00, REGON 147130332.
3. Contact with the Data Protection Officer of the Factor
Any person may contact the Data Protection Officer of the Factor in writing at the Factor’s registered address (KUKE Finance S.A., ul. Krucza 50, 00-025 Warsaw, with the note “Data Protection Officer”) or electronically at: iod@kuke-finance.pl.
4. Purposes and legal bases of processing
Personal data are processed for the following purposes:
a) performance of the concluded agreement (Article 6(1)(b) and (f) GDPR);
b) documenting the concluded agreement and its settlement under tax and accounting regulations (Article 6(1)(c) GDPR);
c) fulfilment of reporting obligations, as well as compliance with sanctions and prevention of money laundering and terrorist financing (Article 6(1)(c) GDPR);
d) prevention of criminal activity in the area of factoring operations (Article 6(1)(f) GDPR);
e) Internal administrative purposes of KUKE Finance, including internal statistics and reporting of the Factor and within the KUKE Group, constituting the legitimate interest of the Factor (Article 6(1)(f) GDPR);
f) archival (evidentiary) purposes, constituting the legitimate interest of the Factor in securing information in case it is needed to demonstrate facts (Article 6(1)(f) GDPR);
g) establishment, exercise, or defence of legal claims, constituting the legitimate interest of the Factor (Article 6(1)(f) GDPR);
h) handling complaints, if submitted, regarding the performance of the agreement between the Client and the Factor (Article 6(1)(b) GDPR);
i) handling complaints, if submitted, regarding the quality of services provided by the Factor and the manner in which the Factor’s employees provide customer service (Article 6(1)(f) GDPR).
Personal data may also be processed for the following marketing purposes:
a) offering the Factor’s products and services (direct marketing) (Article 6(1)(a) GDPR);
b) offering products and services based on interest in the offer (Article 6(1)(b) GDPR);
c) conducting customer satisfaction surveys in connection with the offering of services and products (Article 6(1)(a) GDPR).
5. Data recipients
Recipients of personal data may include: entities providing services to the Factor that require access to personal data for which the Factor is the Data Controller (under data processing agreements), including entities cooperating in the area of IT services, marketing services (marketing agencies), market research, entities supporting the settlement of agreements, debt collection companies, document archiving service providers, administrative and office service providers, advisory and consulting firms, as well as KUKE S.A., the Polish Bank Association (Związek Banków Polskich) – https://kuke-finance.pl/polityka-prywatnosci/, business information bureaus, law firms, audit service providers, and entities authorised under applicable law.
6. Retention period
Data processed on the basis of consent are stored until the consent is withdrawn or until it is determined that the data have become outdated. Data processed on the basis of the legitimate interest of the Data Controller are stored until the legitimate interest of the Factor that constitutes the basis for such processing has been fulfilled or until an objection is raised. Data processed for other purposes are stored for no longer than 5 years from the end of the year in which the agreement was terminated.
7. Rights of the data subject
A Client who is a sole proprietor or a Client’s Representative has the right to access their personal data, the right to rectify, erase, or restrict the processing of their data, the right to data portability, the right to object, the right to withdraw consent at any time without giving a reason and without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal and the right to lodge a complaint with the President of the Personal Data Protection Office.
8. Right to object
A Client who is a sole proprietor or a Client’s Representative has the right to object at any time to the processing of personal data based on the legitimate interest described above. The Factor will cease processing the data for these purposes unless it demonstrates compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or unless the data are necessary for the establishment, exercise, or defence of legal claims.
9. Source of data
Personal data may be obtained from KUKE S.A., institutions processing business information relating to the economic situation of entities, and from public registers such as CEIDG or KRS.
10. Provision of data
Providing personal data by a Client who is a sole proprietor and by a Client’s Representative is necessary for the conclusion of the agreement.
11. Automated decision-making
Personal data are not subject to automated decision-making, including profiling related to automated decision-making.
12. Withdrawal of consent
Where personal data are processed on the basis of consent, the data subject has the right to withdraw consent at any time by contacting the Factor in writing at the Factor’s registered address (KUKE Finance S.A., ul. Krucza 50, 00-025 Warsaw), without giving a reason and without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal. Upon exercising this right, the Factor will cease processing the data for the purpose covered by the withdrawn consent.
