About the platformPrivacy Policy

Privacy Policy

Declaration of privacy policy in ING Usługi dla Biznesu S. A.
    General information
  1. This Privacy Policy contains information on the processing of personal data by ING Usługi dla Biznesu S.A., with its registered office in Katowice, 40-121, ul. Chorzowska 50, entered in the register of entrepreneurs at the District Court Katowice-Wschód, 8th Commercial Division of the National Court Register, under KRS number: 0000408358, REGON: 242834901, NIP: 6342805313 6342805313 (hereinafter: the "Company").
  2. The Company is committed to ensuring the confidentiality, security and protection of your personal data during processing, in accordance with applicable data protection legislation, including the provisions of the EU Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: "GDPR")
  3. The Company can be contacted via email address [email protected] or in writing to the Company's registered office address.
  4. In all matters concerning the processing of your personal data, in particular the exercise of your rights in relation to the processing of your personal data, you may contact the Company's designated Data Protection Officer (Liliana Rother-Obrączka) via email address: [email protected] or in writing to the Company's registered office address (preferably marked "GDPR").
  5. The Company may process your personal data as set out in this Statement and as indicated at the time of data collection from you. Therefore, this Statement should be read in conjunction with any other notices or terms and conditions provided to you at the time of collection of personal data from you (or at a later stage) or available on other Company's websites, including the terms and conditions of the ALEO.com online platform (hereinafter: "ALEO.com Platform"), available on: https://aleo.com/pl/o-platformie/regulamin and https://aleo.com/pl/o-platformie/regulamin-serwisu (hereinafter: the "“Terms of Service"")
  6. When you use websites belonging to the Company, your personal data collected through cookies may be processed in accordance with the Cookies Policy, available here.

    7. Categories of persons whose personal data are processed
  7. The Company processes the personal data of natural persons, who:

    a) are users of the ALEO.com Platform, including Non-Registered Users ("Users");

    b) are users of the Website, including in particular Professionals within the meaning of the Terms of Service ("“Website Users"");

    c) are entrepreneurs whose data come from publicly available sources, including public registers (inter alia, the Register of Entrepreneurs of the National Court Register, the National Official Register of Business Entities and the Central Registration and Information on Business) ("Entrepreneurs");

    d) are potential customers, contractors or suppliers of the Company because, for example, they have provided the Company with contact details in connection with the services and products offered by the Company ("Potential Customers");

    e) are customers, counterparties or suppliers of the Company (whereby customers include persons for whom the Company executes financial transactions ordered by customers) („Customers”);

    f) act as persons authorized to represent legal persons or other organization entities ("Representatives");

    g) are part of applications, complaints or other letters addressed to the Company ("Complainant");

    h) may, in accordance with the relevant legislation, be the addressees of marketing communications.


    8. Purposes and grounds for personal data processing
  8. Users' personal data may be processed by the Company - as data controller - for the following purposes:
    Purpose of processing Legal basis of processing
    The conclusion and execution of the contract for the use of the ALEO.com Platform, including the creation and maintenance of an account within the ALEO.com Platform, confirmation of the User's identity, collection of fees, processing of complaints and reports of abuse. Necessity of the processing for the conclusion and performance of the contract; performance of the Company's legal obligations, including those under the Act on Provision of Services by Electronic Means.
    Maintaining and communicating via websites, including through chat, electronic contact forms, etc. On the basis of the User's consent. In the case of service/automated communications - as the fulfilment of the Company's legitimate interests (i.e. communication with Users).
    Direct marketing of products and services (i.e. receiving commercial information through various communication channels). On the basis of the User's consent.
    The assertion and defence of claims in connection with the use of the ALEO.com Platform. Fulfilment of the Company's legitimate interests (i.e. investigation and defence of claims).
    Conducting statistical research, analytical purposes, user satisfaction surveys. Fulfilment of the Company's legitimate interests related to the improvement of the products and services offered.
    Ensuring network and information security; disaster recovery (e.g. backups). Fulfilment of the Company's legitimate interests (i.e. ensuring security).
    Fulfilment of legal obligations under Polish and EU law. Fulfilment of legal obligations arising, inter alia, from tax law and accounting regulations.
  9. The personal data of Website Users may be processed by the Company - as data controller - for the following purposes:
    Purpose of processing Legal basis of processing
    The conclusion and performance of the contract (Terms of Service), including the creation and maintenance of an account, confirmation of identity, processing of complaints and reports of abuse. Necessity of the processing for the conclusion and performance of the contract; performance of the Company's legal obligations, including those under the Act on Provision of Services by Electronic Means.
    Maintaining and communicating via websites, including through chat, electronic contact forms, etc. On the basis of the Website User's consent. In the case of service/automated communications - as the fulfilment of the Company's legitimate interests (i.e. communication with Website Users)
    Direct marketing of products and services (i.e. receiving commercial information through various communication channels). On the basis of the User's consent.
    Investigation and defence of claims. Fulfilment of the Company's legitimate interests (i.e. investigation and defence of claims).
    Conducting statistical surveys, analytical objectives, satisfaction surveys. Fulfilment of the Company's legitimate interests related to the improvement of the products and services offered.
    Ensuring network and information security; disaster recovery (e.g. backups). Fulfilment of the Company's legitimate interests (i.e. ensuring security).
  10. Entrepreneurs' personal data may be processed by the Company - as data controller - for the following purposes:
    Purpose of processing Legal basis of processing
    Information objectives, related to the dissemination of information on doing business. Fulfilment of the Company's legitimate interests, related to the aim of increasing the certainty and security of business transactions, verification of the reliability of entities conducting business, dissemination of information on conducting business, including through opinions issued within the ALEO.com Platform.
  11. Personal data of Potential Customers may be processed by the Company - as data controller - for the following purposes:
    Purpose of processing Legal basis of processing
    Entering into a cooperation agreement with the Company. Necessity of the processing for the conclusion of a contract; performance of the Company's legal obligations, including those under counteracting money laundering and terrorism financing legislation.
    Conducting statistical research, analytical purposes. Fulfilment of the Company's legitimate interests related to the improvement of the products and services offered.
    Investigation and defence of claims. Fulfilment of the Company's legitimate interests (i.e. investigation and defence of claims).
    Fulfilment of legal obligations under Polish and EU law. Fulfilment of legal obligations arising, inter alia, from the provisions of the Civil Code.
  12. Customers' personal data may be processed by the Company - as data controller - for the following purposes:
    Purpose of processing Legal basis of processing
    The performance of a cooperation agreement with the Company, including the making of payments or other financial transactions, the recording and financial settlement of services, products and materials supplied to and by the Company. Necessity of the processing for the performance of the contract; performance of the Company's legal obligations, including those under counteracting money laundering and terrorism financing legislation.
    Direct marketing of products and services (i.e. receiving commercial information through various communication channels). Based on the Customer's consent.
    Seeking redress and defence from claims. Realization of legitimate interests of the Company (seeking redress and defence from claims).
    Investigation and defence of claims. Fulfilment of the Company's legitimate interests (i.e. investigation and defence of claims).
    Conducting statistical surveys, analytical purposes, customer satisfaction surveys. Fulfilment of the Company's legitimate interests related to the improvement of the products and services offered.
    Fulfilment of legal obligations under Polish and EU law. Fulfilment of legal obligations arising, inter alia, from tax law and accounting regulations.
  13. Personal data of Representatives and Complainants may be processed by the Company - as data controller - for the following purposes:
    Purpose of processing Legal basis of processing
    The conclusion and execution of a contract for the use of the ALEO.com Platform or a cooperation agreement with the Company. Necessity of the processing for the conclusion and performance of the contract; performance of the Company's legal obligations, including those under counteracting money laundering and terrorism financing legislation.
    Handling of applications, complaints, claims or other correspondence addressed to the Company. Fulfilment of the Company's legitimate interests; fulfilment of the Company's legal obligations.
    Investigation and defence of claims. Fulfilment of the Company's legitimate interests (i.e. investigation and defence of claims).
    Fulfilment of legal obligations under Polish and EU law. Fulfilment of legal obligations arising, inter alia, from the provisions of the Civil Code, the Code of Civil Procedure.
  14. Commercial communications are all forms of promotion and commercial offers that may relate to the Company's products or services and those of other ING Group companies. Commercial information may be in the form of personalised communications based on profiling operations that allow us to offer you products or services that are best suited to your preferences, your business profile (you or the entity you represent), your purchase history, known or anticipated expectations.

    15. Data storage period
  15. The storage period for your personal data depends on the purpose of the processing and is:
    • in connection with the performance of the agreement for the use of the ALEO.com Platform / Terms of Service / cooperation agreement with the Company and the assertion and defence of claims related thereto - for the duration of the agreement, and after its termination until the statute of limitations for claims related thereto (this period results from the Civil Code);
    • in connection with the fulfilment of information purposes related to the dissemination of business information - until you object on grounds relating to your particular situation (provided that there are no valid legitimate grounds on the part of the Company for further processing);
    • in connection with the maintenance and communication via the websites, for a period of 30 days;
    • in connection with the handling of applications, complaints or other communications addressed to the Company - until the matter covered by the application, complaint or other communication addressed to the Company is clarified;
    • in connection with direct marketing - until you withdraw the relevant consent;
    • in connection with statistical research, analytical activities, satisfaction surveys - for the duration of the contract and after its termination only in anonymised or aggregated form (statistical data);
    • in connection with the fulfilment of legal obligations - until the obligation expires (e.g. accounting documents, including the data contained therein, need to be kept for a period of 5 years).

    16. To whom the personal data can be transferred?
  16. Your personal data can be transferred to the following entities:
    • to other ING Group companies, a current list of which can be found at: https://ingdlabiznesu.pl/grupa-ing - for internal administrative purposes, e.g. related to reporting within ING Group, for statistical, accounting and management purposes, including internal management analysis (e.g. in connection with the implementation of requirements under counteracting money laundering and terrorism financing legislation);
    • to other ING Group companies for their own marketing purposes (where consent has been given);
    • entities acting on the basis of the law (public authorities), including, among others, the Public Prosecutor's Office, the Police and the Tax Office - in connection with the fulfilment of legal obligations incumbent on the Company (e.g. in connection with abuses that may have occurred within the ALEO.com Platform);
    • to entities providing marketing and advertising services to the Company or other ING Group companies (e.g. marketing agencies, interactive agencies) - to the extent necessary for the provision of these services;
    • to entities providing IT services to the Company or other ING Group companies (e.g. website hosting) - to the extent necessary for the provision of these services;
    • to entities providing other types of services to the Company or other ING Group companies, e.g. legal and advisory service providers - in connection with the provision of these services.

    17. Transfer of personal data outside the European Economic Area (EEA)
  17. Your personal data may be transferred outside the EEA, in particular to the United States of America.
  18. Any such transfer shall be adequately secured. Where a particular country outside the EEA has not been covered by a European Commission decision declaring an adequate level of protection for personal data, the Controller shall apply appropriate safeguards and conclude up-to-date standard contractual clauses with the relevant entity from that country.
  19. A copy of the mechanism used (safeguards included) can be obtained by contacting the Data Protection Officer.

    20. How do we protect your personal data?
  20. We are aware that your personal data are confidential. The Company maintains the confidentiality, security and protects your personal data in accordance with applicable laws, including the provisions of the GDPR, as well as internal policies and instructions adopted by the Company.
  21. The Company has implemented technological and operational security measures to protect your personal data from loss, misuse, or unauthorised modification or destruction. Such measures include, but are not limited to, exploitation, encryption, appropriate management processes regarding access rights and other technical and organisational measures to ensure adequate protection of your personal data. These measures shall ensure an adequate level of security with respect to the risks inherent in the nature of the personal data to be protected.
  22. However, we would like to emphasise that if you send information over the Internet, it cannot be guaranteed that this is 100% secure.
  23. For any payments we collect from you online, we use a recognised, secure online payment system.

    24. Is it compulsory to provide personal data?
  24. The use of the ALEO.com Platform, conclusion of the Terms of Service agreement, as well as entering into cooperation or contacting the Company for any other purpose are voluntary. However, providing personal data in connection with registration within the ALEO.com Platform / acceptance of the Terms of Service, as well as conclusion of a cooperation agreement are necessary for the conclusion of the agreement and its subsequent execution - without providing personal data it is not possible to conclude and execute the agreement.
  25. The provision of personal data for direct marketing purposes is voluntary - in particular, it does not condition the conclusion and execution of an agreement for the use of the ALEO.com Platform or the Terms of Service.

    26. Rights in relation to the processing of personal data
  26. In relation to the processing of your personal data, you have certain rights under the terms of the personal data protection legislation, including the provisions of the GDPR, among others:

    a) the right of access – you have the right to obtain confirmation from the Company as to whether your personal data are being processed by the Company, as well as with regard to certain other information (e.g. concerning the purposes of the processing as well as the categories of personal data processed about you). You also have the right of access to your personal data, in the form of obtaining a copy of the personal data concerning you. This is so that you are aware of and can check how the Company uses your personal data. The Company may refuse to provide you with a copy of your personal data where this could adversely affect the rights of another person;

    b) the right to rectification – you have the right to request that the Company immediately rectify your personal data where it is inaccurate or incomplete (e.g. where the Company processes your incorrect name);

    c) the right to erasure (also known as the "right to be forgotten") – this allows you to request the erasure of your personal data where, for example, the data have been used unlawfully or where your consent has been withdrawn (where this was the sole basis for the processing of your data). "The right to be forgotten" does not, however, constitute an absolute right to erasure of your personal data, as there are certain exceptions to it, e.g. where the Company needs to continue to use the data to establish, assert or defend legal claims or to comply with a legal obligation;

    d) the right to restriction of processing – you have the right to stop the Company from further using your personal data in cases where, for example, the Company is in the process of assessing a request for rectification of your data. In a situation of restriction of processing, the Company may continue to store your personal data, but may no longer actively use them (e.g. for marketing purposes);

    e) the right to data portability – you have the right to receive and re-use certain personal data for your own purposes with other parties (who are separate data controllers). This right only applies to your personal data which you have provided to us and which we process (by automated means) with your consent or for the performance of a contract. In this case, we will provide you with a copy of your personal data in a structured, commonly used and machine-readable format or (where technically possible) we may send your data directly to another controller. The Company may refuse to exercise this right where it would adversely affect the rights of another person.

  27. To the extent that the processing of your personal data is based on the exercise of legitimate interests, you have the right to object to the processing of such data, in particular in relation to processing for direct marketing purposes. However, the Company has the option to continue processing your personal data if they can demonstrate valid and legitimate grounds for the processing that override your interests, rights and freedoms, or if it is necessary for the establishment, assertion or defence of claims. If you object to the processing of your personal data for direct marketing purposes, we will no longer process your personal data for such purposes.
  28. To the extent that the processing of your personal data is based on consent, you have the right to withdraw it at any time. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of consent before its withdrawal.
  29. You have the right to lodge a complaint with the authority supervising compliance with personal data protection regulations (i.e. the President of the Personal Data Protection Office, ul. Stawki 2, 00 193 Warszawa).