Acting under the authority of the Polish Bank Association (Związek Banków Polskich, ZBP), KUKE Finance S.A. provides, in accordance with Article 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter “GDPR”), the following information:

Who is the Data Controller?

The Data Controller is the Polish Bank Association (ZBP), NIP 5260000991 | KRS 0000104695 | REGON 012015529, with its registered office in Warsaw at ul. Leona Kruczkowskiego 8, 00-380 Warsaw, e-mail: kontakt@zbp.pl.

How can you contact the Data Protection Officer at the Polish Bank Association (ZBP)?

For all matters related to the processing of personal data, you may contact the Data Protection Officer of ZBP at: iod@zbp.pl.

What personal data does the Polish Bank Association (ZBP) process?

The Polish Bank Association (ZBP) processes personal data obtained from the entity conducting factoring activities, including identification data of the seller and the debtor (name, PESEL, NIP, foreign debtor identifier) as well as the debtor’s country.

For what purposes and on what legal bases does the Polish Bank Association (ZBP) process personal data?

Data are processed on the basis of:

a.    Article 104(3) of the Banking Law of 29 August 1997 (Journal of Laws 2022, item 2324, as amended) in connection with Article 6(1)(b) or (f) GDPR, i.e. written or electronic consent of the beneficiary of banking secrecy regarding information covered by banking secrecy that is provided to the Polish Bank Association (ZBP) for the purpose of verifying the seller or debtor (applies to banking entities providing data to SWIFF and to the Polish Bank Association (ZBP);

or

Article 6(1)(f) GDPR, where processing is necessary for the legitimate interest of preventing criminal activity in the area of factoring operations (applies to non-banking entities providing data to SWIFF and to ZBP);

these data will be deleted after the financing ends;

b.    Article 6(1)(c) GDPR, for the purpose of fulfilling obligations arising from generally applicable legal provisions, including the prevention of offences committed in the financial sector;

these data will be deleted after the expiry of the retention period specified by law;

c.    Article 6(1)(f) GDPR, where processing is necessary for the legitimate interest of the Polish Bank Association (ZBP), which consists of handling potential complaints and submitted claims, pursuing the Polish Bank Association’s own claims, as well as securing and archiving information in case it is needed to prove facts or demonstrate compliance with an obligation imposed on ZBP;

these data will be deleted after the expiry of the limitation periods specified in civil and criminal law;

Who is the recipient of the personal data processed by the Polish Bank Association (ZBP)?

The recipients of the personal data are entities participating in the information exchange within SWIFF, in particular banking and non-banking entities conducting factoring activities, as well as other entities processing data on behalf of the Polish Bank Association (ZBP), such as IT service providers, debt collection companies, entities archiving or deleting data, or entities legally authorised to receive such information, including law enforcement authorities, tax officers, and others.

What rights do you have in relation to the processing of your personal data?

The rights you are entitled to include: (1) the right to access your personal data, (2) the right to request their rectification or erasure, (3) the right to request restriction of processing, (4) the right to object to processing where the data are processed on the basis of a legitimate interest, (5) the right to data portability, (6) the right to lodge a complaint with the President of the Personal Data Protection Office if you believe that the processing of your personal data violates the GDPR.

Does the Polish Bank Association (ZBP) transfer personal data to a third country or an international organisation?

The Polish Bank Association (ZBP) does not transfer personal data to any third country or international organisation.

Does the Polish Bank Association (ZBP) use automated decision-making or profiling?

The Polish Bank Association (ZBP) does not use automated decision-making or profiling.