1. Who is the data controller with respect to your personal data? How to contact the data protection officer at ING Commercial Finance Polska S.A.?

The data controller with respect to your personal data is ING Commercial Finance Polska Spółka Akcyjna seated in Warsaw at ul. Puławska 2, entered in the National Court Register under the entry number KRS 0000005577 ("ING"). You may contact the ING Data Protection Officer by writing to the above-mentioned ING postal address, preferably with the annotation: "Data Protection Officer", by e-mail at: abi.commercial.finance@ingcomfin.pl or by phone at: (+48) 887 847 143.

2. Where do your personal data processed by ING come from and why are they processed?

ING has received your personal data from a business entity cooperating with your business entity, for the purpose of execution and performance of the factoring agreement or similar agreement/contract whereunder ING assumed or finances trade receivables due from the business entity cooperating with you on account of sale ofgoods or services. Specifically, the business entity who provided us with your personal data may be your supplier or customer. The identification data of the business entity concerned are provided in a separate document sent to you, e.g. in the Notice on Assignment of Receivables.

3. What categories of your data do we process?

ING processes only those of your personal data which are necessary due to the purpose of processing described in sec. 4 below. These are the following data categories:
1) your identity (including: first and last name);
2) contact details (including: company address, phone number, e-mail address, IP address of the device sending the invoice lists);
3) other public data included in the Central Business Records and Information Bureau (CEIDG) and National Court Register.

4. What is the purpose and legal basis of the processing of your personal data by ING?

ING processes your personal data:
1) in order to execute, perform, and terminate a factoring agreement or any other similar contract/agreement executed with the business entity selling goods or services to you or buying goods or services from you – this means all preparatory activities, analyses, risk assessments and activities involved in the process of executing, performing or terminating a contract/agreement or other activities related to a contract/agreement (e.g. powers of attorney / authorisations) or ordered by other entities, but related to servicing a contract/agreement; what is meant here is all contracts/agreements and all activities, including the ones performed by ING on behalf of or for third parties. The legal basis for such processing is the contracts/agreements or other legal transactions;
2) in order to fulfil legal obligations imposed on ING by various regulations, in particular by the Act on Prevention of Money-Laundering and Terrorism Financing, and obligations related to transferring data to and retrieving data from data bases used for the purpose of evaluating creditworthiness/credit rating or assessing credit risk; other ING's obligations may also stem from tax law or accounting law;
3) in order to maintain and display websites or communicate via websites - data processed for that purpose may include IP addresses, device ID numbers and other data, subject to and based on relevant provisions of the telecommunication law.
4) for purposes justified by legitimate interests of ING (based on the Regulation, Civil Code, Code of Civil Procedure, of Commercial Companies Code), such as pursuing ING's claims or defending against claims by other parties.

5. Other information on other purposes ING may use your personal data for ING processes personal data in relation to the purposes for which they were collected (primary purpose).

However, personal data may be also processed for other lawful purposes (secondary purposes) as long and the primary and secondary purposes are closely interrelated. In general, the following secondary purposes are allowed:
(a) archiving purposes; (b) audits or investigatory proceedings; (c) implementation of business and management controls, (d) statistical and historical or scientific research purposes, (e) dispute resolution; (f) business, economic and legal consultancy; (g) purposes related to financial or electronic services, such as insurance, including the services provided by other entities via or with the participation of ING.

6. Categories of recipients of your personal data ING may transfer your personal data to:

1) entities or bodies authorised under applicable provisions of law to receive personal data;
2) entities or bodies, who need to receive your personal data in order to be able to perform a specific action, including a payment transaction, legal service or debt enforcement service;
3) entities receiving personal data from ING on the basis of a consent/authorisation granted by the data subject;
4) entities maintaining data bases for the purpose of assessing creditworthiness/credit risk or risk analysis, in particular to Biuro Informacji Kredytowej S.A., Związek Banków Polskich [Polish Bank Association] and business information bureaus (BIG).

We may also transfer your personal data to other members of ING Group¹ – under binding corporate rules and legal provisions. If we transfer data to ING Group members outside the European Economic Area, we shall apply appropriate security measures provided for in corporate rules and standard personal data security clauses approved by the European Commission.
ING may also entrust personal data to other entities while remaining the data controller.

7. How long will ING process your personal data?

1) The period of processing of personal data by ING depends on the purpose of processing of given personal data.
ING processes personal data related to:

1. a contract/agreement or other legal action – for a period necessary to perform a given action or execute a given contract/agreement. When the action or contract/agreement has been executed - for the time necessary to complete the performance thereof; when the action or contract/agreement has not been eventually executed - for three years;
2. calculating financial ratios and capitals - for a period prescribed by law;
3. archival data – for a period of six years from termination of cooperation with a given person, unless a dispute, court litigation, or other proceeding is pending, in particular a criminal proceeding; in such case, the period of processing of archival data will run from the moment of ending the dispute or the final and binding resolution of the proceeding, unless applicable legal provision provides for a longer statue of limitation period applicable to the right/claim concerned;
4. court adjudication – for a period of up to six years from issuing the final and binding adjudication ending the proceeding concerned;
5. customer's consent – for a period indicated in the relevant consent or – if the period in not defined – until the consent is withdrawn; discontinuation of processing of personal data during the period covered by the consent does not waive the ING's right to process the data for other purposes or even for the same purpose, provided that there is another legal basis for such processing, e.g. the customer's consent refers to a different manner of data processing or transferring. When ING has obtained data from such data base, but a given contract/agreement or transaction has not been executed, the data will be deleted within three yearsw of obtaining the same, unless the customer has consented to the processing of their personal data for other purposes or for a longer period.

2) The above-mentioned periods are not cumulative. The data may be processed separately for each individual purpose and legal basis, e.g. you may withdraw your consent to processing for marketing purposes, but ING may still process your data for other purposes or under a different legal basis.

 

8. Information on the data subject's rights

1) You have the right to request from ING access to your personal data, to correct any error in your personal data, and - in instances envisaged by law - to delete your personal data or limit the scope of their processing. Furthermore, you have the right to object to processing of your personal data. In instances envisaged by law, subject to the reservation that this right must not adversely affect the rights and obligations of other people, including business secrets and intellectual property rights, as long as it is technically possible, you have the right to data portability and to obtain copies of your personal data. The first requested copy of your data shall be provided free of charge. Due to other legal regulations, data portability may require the consent of the customer or other person, or satisfaction of other requirements prescribed in such legal regulations. When performing the customer's request concerning portability of the personal data or a copy thereof, ING shall provide the data along with the information on the data format and data carrier used.
2) If the processing of specific data or for specific purpose is based on your consent, you have the right to withdraw all or any of your consents concerning the processing of the specific data or for a specific purpose. Withdrawal of the consent does not affect the processing prior to such withdrawal or the legal basis for such withdrawal.
3) The supervisory authority competent for ING with respect to personal data is the President of the Personal Data Protection Office. You have the right to lodge a complaint with the supervisory authority.
4) Your personal data are necessary to execute or perform a contract/agreement. You may be required under legal provisions to provide your personal data for the purpose prescribed therein (e.g. identification or verification). Moreover, the provision of your personal data may be  necessary to execute certain transactions. If you fail to provide the personal data required under the contract/agreement or legal provisions, ING will not execute the contract/agreement with you or perform any other applicable action.

¹ Presently, ING Group consists of the following entities: ING Bank Śląski S.A. of Katowice, ING Investment Holding (Polska) S.A. of Katowice, ING Lease (Polska) Sp. z o.o., ING Finance Sp. z o.o., ING Bank N.V. of Amsterdam (the Netherlands) and ING Usługi dla Biznesu S.A. of Katowice. The list of subsidiaries of ING Bank Śląski S.A. can be found at: https://www.ingcomfin.pl/o-nas