INFORMATION ON THE RULES FOR PROCESSING DEBTORS’ PERSONAL DATA

Based on the General Data Protection Regulation No. 2016/679 (hereinafter “GDPR”), we inform you that:

1. DEBTUS Hubert Czapiński (hereinafter: “Debtus”), based in Piaseczno (Poland), conducts business activities that include, among others, pursuing claims against debtors (hereinafter: “Debtors”) on behalf and for the benefit of third-party entities (hereinafter: “Third Parties”) in relation to receivables owed to these entities.
2. The data controller of the Debtors’ personal data (hereinafter “Controller”) may be the Third Party/creditor/assignor or directly Debtus.
3. Debtors’ personal data may be processed based on Article 6(1)(f) of the GDPR for purposes arising from the legitimate interests pursued by the Controller or a third party, including:
   • handling the creditor’s claims against the Debtor;
   • archival (evidentiary) purposes, in case of a legal need to establish facts (potentially to determine, pursue, or defend against claims);
   • creating internal reports related to debt collection.
4. Scope of Debtors’ Data Subject to Processing. Scope of Debtors’ Data Subject to Processing:
   • Identification data (name and surname, age, gender),
   • Contact details (phone number, email),
   • Correspondence details (residential address),
   • Data related to agreements/settlements concluded with the Controller, data regarding debt (including debts with entities other than the Controller) and its history (information on judicial collection, obtained enforcement titles, enforcement proceedings),
   • Debtor’s asset data, including (i) real estate – address, land and mortgage register number, area, encumbrances/mortgages.
5. Recipients of Debtors’ Personal Data. Debtors’ personal data may be disclosed to:
   • entities managing receivables on behalf of the Controller, particularly Debtus;
   • law firms pursuing claims on behalf of the Controller;
   • courts and bailiffs executing the collection of receivables;
   • entities cooperating with the Controller in handling receivables, including IT service providers;
   • entities supporting the debt collection process by ensuring data accuracy, timeliness, and completeness (e.g., correcting identification or address details if found incorrect);
   • credit information agencies.
6. Debtors’ personal data will not be transferred to countries outside the EU.
7. Data Retention Period. Based on Article 14(2A) of the GDPR, the retention period for Debtors’ personal data will be a maximum of 5 years, determined using the following criteria:
   • In the case of out-of-court debt recovery, i.e., without initiating court proceedings – until the final resolution of the case;
   • In the case of an out-of-court settlement – until the limitation period for claims related to the settlement;
   • In the case of legal proceedings (e.g., to recover claims owed to the Controller or if the Debtor initiates proceedings against us) – until the expiry of obligations related to the final conclusion of the court case and any subsequent enforcement proceedings.
8. Debtors’ Rights. Debtors have the right to access their personal data and to request its rectification, erasure, or restriction of processing. They also have the right to data portability (if processing is based on consent under Article 6(1)(a) or Article 9(2)(a) or on a contract under Article 6(1)(b) of the GDPR) and the right to object to the processing of their data based on legitimate interests, for reasons related to their particular situation. In such cases, the processing of their data for these purposes will cease unless the Controller can demonstrate compelling legitimate grounds that override the interests, rights, and freedoms of the Debtor or if the data is necessary for establishing, pursuing, or defending legal claims.
9. Debtors have the right to lodge a complaint with the President of the Personal Data Protection Office if they believe that the processing of their personal data violates the GDPR.
10. Debtors’ personal data is not subject to automated decision-making, including profiling, within the meaning of the GDPR.
11. Contact: uodo@debtus.pl