Information on the processing of personal data on the ING Księgowość platform

Who is the controller of your data and who is to be contacted?

1. ING Usługi dla Biznesu S.A. with its registered office in Katowice (postal code 40-121), ul. Chorzowska 50, entered in the register of entrepreneurs at the District Court for Katowice-East in Katowice, 8th Commercial Division of the National Court Register, under number KRS: 0000408358, REGON: 242834901, NIP: 6342805313 (“Company”) is the controller of your data.
2. You may contact the Company via the contact form available at the address: https://www.ingbank.pl/kontakt/formularz or by letter to the Company’s registered office (preferably with a note “GDPR”).
3. In all matters that involve the processing of personal data, in particular the exercise of your rights related to the processing of personal data, you may contact the data protection officer appointed by the Company (Lilianna Rother-Obrączka) via the e-mail address abi.uslugi@ingdlabiznesu.pl or by letter to the Company’s registered office (preferably with a note “GDPR”).

Purposes and the basis for the processing of personal data

Your personal data may be processed by the Company for the following purposes:

Purpose of the processing	Legal basis for the processing
The conclusion and performance of the contract for the use of the ING Księgowość platform, including the set-up and use of an account on the ING Księgowość platform, confirming the user’s identity, charging fees, handling complaints and misuse reports, using the services available on the platform	Article 6(1)(b) of the GDPR – the processing is necessary to conclude and perform the contract
Maintaining and communicating via websites, including via chat, electronic contact forms etc.	Consent (Article 6(1)(a) of the GDPR).
Direct marketing for products and services (i.e. receiving commercial information via various communication channels.	Consent (Article 6(1)(a) of the GDPR).
Pursuing and defending against claims in connection with the use of the ING Księgowość platform.	Article 6(1)(f) of the GDPR – pursuing legitimate interest of the Company (i.e. pursuing and defending against claims).
Conducting statistical research, analytical purposes, surveying the satisfaction of ING Księgowość platform users.	Article 6(1)(f) (legitimate interest) of the GDPR and Article 6(1)(c) of the GDPR (legal obligation)
Fulfilling legal obligations under applicable Polish and EU laws, including complaint handling.	Article 6(1)(c) of the GDPR – fulfilling legal obligations under applicable law
Ensuring network and information security; disaster recovery (e.g. creating backup copies).	Article 6(1)(f) of the GDPR – pursuing legitimate interest of the Company (i.e. ensuring security).

 

Commercial information means any form of promotion and commercial offers that may involve the Company’s products or services and the products or services of other ING Group companies. Commercial information may take the form of personalized messages based on profiling operations which enable us to offer you products or services best suited to your preferences, business profile (yours or that of the entity you represent), purchase history, known or anticipated expectations.

For how long may personal data be retained?

The period of retention of your personal data depends on the purpose of their processing, as follows:

• in connection with the performance of the contract for the use of the ING Księgowość platform and the pursuit of and defence against claims related to such contract – for the duration of the contract, and thereafter for the period of limitation for claims related to it (this period is stipulated in the Civil Code);
• in connection with maintaining and communicating via websites – for the duration of the contract;
• in connection with direct marketing – until an objection is raised or the relevant consent is withdrawn;
• conducting statistical research, analytical purposes, surveying the satisfaction of ING Księgowość platform users – for the duration of the contract, and thereafter only in an anonymized or aggregated form (statistical data);
• in connection with the fulfilment of legal obligations – until the obligation expires (e.g. accounting documents, including the data recorded therein, must be retained for a period of 5 years).

To whom may personal data be transferred?

Your personal data may be transferred to the following entities:

• other ING Group companies the current list of which may be found at: https://www.ingbank.pl/o-banku/spolki-zalezne – for their own marketing purposes;
• entities operating under applicable law (public authorities), including but not limited to: the prosecutor’s office, the Police and the Tax Office – in connection with the fulfilment of legal obligations imposed on the Company (e.g. in connection with fraud that may have occurred on the ING Księgowość platform);
• entities providing marketing and advertising services to the Company or other ING Group companies (e.g. marketing agencies, interactive agencies) – to the extent necessary to provide these services;
• entities providing IT services to the Company or other ING Group companies (e.g. website hosting companies) – to the extent necessary to provide these services;
• entities providing other types of services to the Company or other ING Group companies, e.g. providers of legal and consulting services – in connection with the provision of these services.

Transfer of personal data outside the European Economic Area

• Your personal data may be transferred to entities from the ING Group that the Company is a member of, and entities providing specific services to the Company or other ING Group companies. These countries have not been recognized by the European Commission as ensuring an adequate level of personal data protection on their territories.
• The transfer of personal data to entities from the ING Group is based on the Binding Corporate Rules, as approved by the Dutch authority supervising compliance with personal data protection laws.
• The transfer of personal data to entities providing specific services to the Company or other companies from the ING Group is based on appropriate contracts containing standard data protection clauses, as adopted by the European Commission.
• You may obtain a copy of the Binding Corporate Rules and copies of the above-mentioned contracts – please contact the data protection officer.

Is the provision of personal data mandatory?

• The use of ING Księgowość platform is voluntary. However, providing personal data in connection with registration on the ING Księgowość platform is necessary to conclude and perform the contract – without providing personal data, it is not possible to conclude and perform any such contract.
• Providing personal data for direct marketing purposes is voluntary – it does not condition the conclusion and performance of the contract for the use of the ING Księgowość platform.

Rights related to the processing of personal data

• In connection with the processing of personal data, you have specific rights, including: (i) the right to access your personal data; (ii) the right to rectify these data; (iii)
• the right to delete these data, (iv) the right to limit the processing of these data; (v) the right to transfer these data – in accordance with the principles set out in personal data protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”).
• To the extent that the pursuit of legitimate interests is the basis for the processing of your personal data, you have the right to object to the processing of these data, in particular in connection with their processing for direct marketing purposes.
• To the extent that your consent is the basis for the processing of your personal data, you have the right to withdraw it at any time. Withdrawal of your consent does not affect the lawfulness of the processing which was carried out on the basis of your consent before its withdrawal.
• You have the right to lodge a complaint with the authority supervising compliance with personal data protection laws (the President of the Office for Personal Data Protection).