Privacy policy

Privacy Notice on Data processing in connection with the activities of PastPay Europe sp. z o.o. and Péntech Solutions Kft.

1. Data controller and contact details

The PastPay Europe sp. z o.o. (KRS no.: 0000886016, NIP: 5472223365, REGON: 388248699) and the Péntech Solutions Kft. (seat: 1126 Budapest, Böszörményi út 13.-15. V/3., company registration number: 01-09-338535) (hereinafter together referred to as “the Data controller” or the “Companies” or separately the “Company”).

Name of the Data controller:

PastPay Europe sp. z o.o.
Péntech Solutions Kft.

Seat:
ul. Legionów 33/3, 43-300 Bielsko-Biała, Poland
1126 Budapest, Böszörményi út 13.-15. V/3.

E-mail address:
info@pastpay.com
info@pastpay.com

Name of the contact person designated by the Data controller for matters relating to Data processing:
Bálint Tamás Réti
dr. Réti Tamás Bálint

E-mail address:
info@pastpay.com
info@pastpay.com

1. Definitions of terms

Data processor:
the natural or legal person, public authority, agency or any other body which processes Personal data on behalf of the Data controller;‍

Data processing:
any operation or set of operations which is performed on Personal data or on sets of Personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction‍

Data controller:
‍the natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the management of Personal data; where the purposes and means of the management are determined by Union or Member State law, the Data controller or the specific criteria for the designation of the Data controller may also be determined by Union or Member State law

‍Data subject:
an identified or identifiable natural person‍

GDPR:
REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

‍Website:
www.pastpay.com

Infotv.:
‍Hungarian Act CXII of 2011 on informational self-determination and freedom of information‍

Pmt.:
Hungarian Act on the Prevention and Combating of Money Laundering and Terrorism Financing‍

Personal data:
Any information relating to a data subject which makes it possible to identify that natural person, directly or indirectly, in particular by reference to an identifier such as a name, number, location data, an online identifier or one or more factors to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

1. From what sources do we obtain Personal data?

Our Company may receive Personal data from the following sources:

• From you, as a Data subject;
• From our Client, which organisation has appointed you as a contact person;
• From our client, for which debtor organisation you are the known contact person.
• From our contracted partner, whose client is a company that has designated you as a contact person;
• From our contracted partner, whose client is a company for which you are a known contact person of the debtor of the organisation;
• From our contracted partner, of which you are a customer;
• from public databases.

1. The scope of the data managed, the purpose of the management, the legal basis for the management and the period for which the data are kept

The Data controller shall inform the Data subject that the Data processing is carried out in accordance with the provisions of the applicable legislation, in particular the GDPR, the Personal Data Protection Act of 10 May 2018 and the Infotv.

Joint data processing by Péntech Solutions Kft. and PastPay Europe sp. z o.o.

THE SCOPE OF THE DATA managed:
Details of the legal person’s representative or contact of our client (in particular: name, e-mail address, telephone number, job title)

PURPOSE OF DATA MANAGEMENT:
Contacting and maintaining contacts for business purposes

LEGAL BASIS OF DATA MANAGEMENT:
Our legitimate interest in the performance of a contract with a legal person client or partner or in maintaining a business relationship

RETENTION PERIOD:
Until the end of the business relationship with the legal person or, if earlier, until the termination of the Data subject’s legal relationship with the legal person, if the Data controller becomes aware of this.

-

THE SCOPE OF THE DATA managed:
In the case of our self-employed clients, the details of the Data subject (in particular name, e-mail address)

PURPOSE OF DATA MANAGEMENT:
Contacting and maintaining contacts for contracting and performance purposes

LEGAL BASIS OF DATA MANAGEMENT:
Preparation and performance of the contract with the Data subject

RETENTION PERIOD:
Until the end of the business relationship with the Data subject

-

THE SCOPE OF THE DATA managed:
Contact details of our client’s debtor (in particular: name, e-mail address, telephone number, job title)

PURPOSE OF DATA MANAGEMENT:
Factoring a claim based on a relationship between our client and the debtor of our client

LEGAL BASIS OF DATA MANAGEMENT:
Our legitimate interest in the performance of a contract with our customer.

RETENTION PERIOD:
Until the end of the business relationship with our client or, if earlier, until the termination of the legal relationship of the Data subject with our client’s debtor, if the Data controller becomes aware of this

-

THE SCOPE OF THE DATA managed:
Data collected by cookies on the Website

PURPOSE OF DATA MANAGEMENT:
Please read our Cookie information, available on the Website.

-

THE SCOPE OF THE DATA managed:
Personal data necessary to process and respond to complaints, requests and questions

PURPOSE OF DATA MANAGEMENT:
The procedure that meets your request or complaint

LEGAL BASIS OF DATA MANAGEMENT:
In case of a complaint about Data processing, to comply with a legal obligation under the GDPR, otherwise our legitimate interest in handling the complaint

RETENTION PERIOD:
Until the complaint handling process is completed

-

THE SCOPE OF THE DATA managed:
Content of video calls, if they are recorded

PURPOSE OF DATA MANAGEMENT:
The recallability of the content of the meeting, its use in case of possible legal claims

LEGAL BASIS OF DATA MANAGEMENT:
Our legitimate interest in the recallability of the content of the meeting

RETENTION PERIOD:
5 years from the termination of the contract (civil law limitation period)

-

THE SCOPE OF THE DATA managed:
Personal data required for economic profiling for our self-employed clients

PURPOSE OF DATA MANAGEMENT:
Assessing the financial reliability and capacity of our existing and prospective clients, the debtors of our existing and prospective clients, the clients of our contracted partners and the debtors of these entities

LEGAL BASIS OF DATA MANAGEMENT:
Preparation and performance of the contract with the Data subject

RETENTION PERIOD:
Until the contract is concluded

-

THE SCOPE OF THE DATA managed:
Details of our legal person client’s representative, contact person (in particular: name, e-mail address, telephone number, job title)
In the case of our self-employed clients, the details of the Data subject (in particular name, e-mail address)

PURPOSE OF DATA MANAGEMENT:
To contact and engage with you for business purposes through our website or other channels

LEGAL BASIS OF DATA MANAGEMENT:
Our legitimate interest in answering your questions or requests

RETENTION PERIOD:
Until the question or request is answered

-

THE SCOPE OF THE DATA managed:
E-mail address; business entity or self-employed status represented

PURPOSE OF DATA MANAGEMENT:
Subscribe to a marketing newsletter

LEGAL BASIS OF DATA MANAGEMENT:
Explicit consent of the Data subject

RETENTION PERIOD:
Until consent is withdrawn

-

THE SCOPE OF THE DATA managed:
Personal data required to participate in the professional event

PURPOSE OF DATA MANAGEMENT:
Contacts related to the event

LEGAL BASIS OF DATA MANAGEMENT:
For self-employed participants, the fulfilment of the contract for the event, for participants representing a legal person, our legitimate interest in the conduct of the event

RETENTION PERIOD:
Until the end of the event

-

THE SCOPE OF THE DATA managed:
Personal data required to participate in the prize draws

PURPOSE OF DATA MANAGEMENT:
Organisation of the prize draw and related contacts with participants

LEGAL BASIS OF DATA MANAGEMENT:
For sole proprietor participants, the performance of the contract for participation in the prize draw, for participants representing a legal person, our legitimate interest in the running of the prize draw

RETENTION PERIOD:
Until the prize draw closes

-

THE SCOPE OF THE DATA managed:
All Personal data mentioned in rows 1-11

PURPOSE OF DATA MANAGEMENT:
Enforcing legal claims

LEGAL BASIS OF DATA MANAGEMENT:
Our legitimate interest in enforcing a claim

RETENTION PERIOD:
5 years from the termination of the contract (civil limitation period)

-

In connection with the above Data processing, we draw your attention to the fact that the provision of the Data subject’s data that are managed on the basis of a legal obligation or legitimate interest in the preparation or performance of a contract or business relationship with a Company is mandatory for the conclusion of a factoring framework contract or for certain obligations arising from the legal relationship. Without providing the necessary data, the Companies are unable to fulfil their obligations in connection with factoring or as required by law, and in some cases failure to provide the data may result in our inability to accept or fulfil an order for services.

With regard to data managed on the basis of legitimate interest, please note that you have the right to object to the Data processing.

1. Recipients of Personal data, categories of recipients

Joint Data controller:

The Companies are considered to be joint controllers of each other in relation to the Data processing referred to in Chapter 4, lines 1-12 of this Notice.

Data processor:

Name/category of Data processor:
Accountant

Category of Personal data transferred to the Data processor:
Personal data for accounting purposes

Activity involving a Data processor:
Accounting services

-

Name/category of Data processor:
PastPay Europe sp. z o.o. in relation to its independent data processing, the Péntech Solutions Kft.

Category of Personal data transferred to the Data processor:
Personal data listed in Chapter 4, line 13

Activity involving a Data processor:
Customer identification / customer due diligence

-

Name/category of Data processor:
Service providers providing the IT operations of the Companies (in particular server and domain service providers, mobile phone operating system service providers), customer management service providers, so-called CRM system service providers

Category of Personal data transferred to the Data processor:
Personal data stored on IT servers

Activity involving a Data processor:
IT infrastructure in the office.

-

Some service providers may process Personal data outside the European Economic Area. Where this occurs, the Companies rely on an adequacy decision, Standard Contractual Clauses or another safeguard permitted by Chapter V of the GDPR.

1. Special Personal data:

No special Personal data will be managed in the course of the Data processing.

1. Rights of the Data subject:

The Data subject may request the Data controller to access, rectify or erase Personal data relating to them, in certain cases to restrict the management of the data and to object to the management of Personal data. The Data subject shall also have the right to data portability and the right to submit a complaint to the supervisory authority and to a judicial remedy.

In the case of management based on consent, the Data subject also has the right to withdraw consent at any time, without prejudice to the lawfulness of the management carried out on the basis of consent prior to the withdrawal.

1. Right to access

At any time, the Data subject has the right to request information on whether and how their Personal data are managed by the Data controller, including the purposes of the management, the recipients to whom their data have been disclosed or the source from which the data were obtained by the Data controller, the retention period, any rights they have in relation to the management, as well as information on automated decision-making, profiling and, in the case of transfers to third countries or international organisations, information on the guarantees relating thereto. In exercising the right to access, the Data subject shall also have the right to request a copy of the data and, in the event of an electronic request, the Data controller shall provide the requested information electronically, unless the Data subject requests otherwise. Where the Data subject’s right to access negatively affects the rights and freedoms of others, in particular the trade secrets or intellectual property of others, the Data controller shall be entitled to refuse to comply with the Data subject’s request to the extent necessary and proportionate.

1. Right to correction

The Data controller shall correct or complete Personal data relating to the Data subject at the Data subject’s request. Where the Personal data concerned by this right has been communicated by the Data controller to another party (i.e. an addressee such as a Data processor), the Data controller shall inform such parties without undue delay after the correction of the data, provided that this is not impossible or involves a disproportionate effort on the part of the Data controller. The Data subject shall be informed of these recipients by the Data controller upon request.

1. Right to erase (“right to be forgotten”)

If the Data subject requests the erasure of any or all of their Personal data, the Data controller shall erase the Personal data without undue delay if:

• the Data controller no longer needs the Personal data for the purposes for which it was collected or otherwise managed;
• Data processing that was based on the Data subject’s consent, but the consent has been withdrawn by the Data subject and there is no other legal basis for the Data processing;
• the Data subject objected to Data processing based on a legitimate interest of the Data controller or a third party, and
• there are no overriding legitimate reasons for the Data processing;
• the Data controller has unlawfully managed the Personal data; or
• necessary to fulfil a legal obligation to delete Personal data.

Where the Personal data concerned by this right have been communicated by the Data controller to another party (i.e. an addressee such as a Data processor), the Data controller shall inform such parties without undue delay after erasure, provided that this is not impossible or involves a disproportionate effort on the part of the Data controller. The Data subject shall be informed by the manager of these recipients upon request. The Data controller is not always obliged to erase Personal data, in particular where, for example, the processing is necessary for the establishment, exercise or defence of legal claims.

1. Right to limitation of Data processing

The Data subject may request the limitation of the Data processing of their Personal data in the following cases:

• the Data subject questions the accuracy of the Personal data – in which case the limitation applies for the period of time that allows the Data controller to verify the accuracy of the Personal data;
• the Data processing is unlawful, but the Data subject opposes the erasure of the data and instead requests the limitation of their use;
• the Data controller no longer needs the Personal data for the purposes of the Data processing, but the Data controller requires them for the establishment, exercise or defence of legal claims; or
• the Data subject has objected to the Data processing – in this case, the limitation applies for the period until it is established whether the legitimate reasons of the Data controller override the legitimate reasons of the Data subject.

Limitation of Data processing means that the Data controller does not manage the Personal data subject to the limitation, except for storage, or only to the extent to which the Data subject has consented, or, in the absence of such consent, the Data controller may manage the data necessary for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or of an important public interest of the Union or of a Member State of the European Union. The Data controller shall inform the Data subject in advance of the un-limiting of the Data processing. Where the Personal data covered by this right have been disclosed by the Data controller to another party (i.e. an addressee such as a Data processor), the Data controller shall inform such parties of the limitation of Data processing, provided that this is not impossible or involves a disproportionate effort on the part of the Data controller. The Data subject shall be informed by the Data controller of these recipients upon request.

1. The right to object

If the legal basis for the Data processing relating to the Data subject is the legitimate interest of the Data controller or a third party, the Data subject has the right to object to the Data processing. The Data controller shall not be obliged to uphold the objection if the Data controller proves that

• Data processing is justified by compelling legitimate reasons which override the interests, rights and freedoms of the Data subject, or
• Data processing relates to the establishment, exercise or defence of legal claims by the Data controller.

1. Right to complain, right to legal remedies

If the Data subject considers that the Data controller’s management of their Personal data breaches the provisions of the applicable data protection legislation, in particular the GDPR, they have the right to submit a complaint to the competent data protection supervisory authority in the Member State where they have their habitual residence, place of work or place of the alleged breach. In Poland, a complaint can be lodged with the Urząd Ochrony Danych Osobowych (“UODO”). The contact details of the UODO are:

Website: https://uodo.gov.pl/en

Address: ul. Stawki 2, 00-193 Warszawa

Phone number: 22 531-03-00

E-mail address: kancelaria@uodo.gov.pl

Regardless of their right to submit a complaint, the Data subject may also take legal action in the event of a breach of the above rights. The Data subject also has the right to appeal to the courts against a final decision of the supervisory authority concerning them. The Data subject also has the right to judicial remedy in accordance with the relevant legal provisions and in the relevant way.

1. Automated decision-making, profiling

The Companies use economic profiling (i.e., the automated combination and evaluation of Personal data) in the selection of their customers, in which process Personal data is processed only in relation to sole proprietors. In particular, the Companies will analyse the individual entrepreneur’s cash book, tax flow account. Profiling is carried out by a natural person and does not involve automated decision-making.

Last updated: 15 November 2023.

‍