Information Clause of MHC Mobility Sp. z o.o. for Potential Clients and Their Representatives

Your data may be processed by MHC Mobility for the following purposes:

1. taking steps aimed at concluding a contract, including assessing your credibility, your ability to meet payment obligations and analysing the risk connected with concluding a contract, on the basis of Article 6(1)(b)–(c) GDPR;
2. performing activities arising from generally applicable laws, on the basis of Article 6(1)(c) and (e) GDPR;
3. sending commercial offers, including direct marketing of the Controller’s own products and services (including profiling) – on the basis of Article 6(1)(a) in connection with Article 6(1)(f) GDPR;
4. processing data for archiving and evidentiary purposes, on the basis of Article 6(1)(f) GDPR;
5. pursuing the Controller’s legitimate interests, e.g. obligations arising from internal policies and procedures, codes of conduct and necessary reporting within the capital group to which MHC Mobility belongs (on the basis of Article 6(1)(f) GDPR);
6. in the case of attorneys-in-fact, representatives and persons indicated for contact and cooperation, the data of such persons will be processed to exercise rights arising from representation (including a power of attorney) in connection with the conclusion and performance of a contract with the entity they represent or in which they work, on the basis of Article 6(1)(b) and (c) GDPR;

Information concerning the Mitsubishi HC Capital Inc. group is available on the MHC Mobility website https://mhcmobility.pl/o-nas

The period for which personal data are stored depends on the purposes for which the data were collected and on legal provisions requiring their storage. Your personal data will be processed by MHC Mobility for the period:

1. necessary to consider an application in connection with applying to use MHC Mobility’s services;
2. required for MHC Mobility’s performance of obligations arising from generally applicable laws;
3. in the case of handling submissions and enquiries – for the period necessary to reply on the matter. After this period, we will process your personal data if required by applicable laws, including to document how the request of the data subject was handled or for the period of the statute of limitations for claims;
4. where processing is based on your consent – until the consent given is withdrawn or until a request for erasure of personal data is received;
5. in the case of processing for the purpose of sending commercial offers, including direct marketing of the Controller’s own products and services – until you object to such processing.

Detailed information on the period of processing of your personal data can be obtained by contacting the MHC Mobility Data Protection Officer.

In the case of attorneys-in-fact, representatives and persons indicated for contact and cooperation, MHC Mobility may process the following categories of your personal data: identification data (first name, surname, job title, NIP number in the case of sole traders), contact data (e.g. business e-mail address, business telephone number). In the case of prospective Clients, MHC Mobility may process identification data, address data, contact data, financial data, data concerning the Applicant’s (prospective Client’s) financial obligations, information on financial resources and asset position of the prospective Client or a natural person indicated by them, as well as other data obtained from publicly available sources (e.g. KRS, CEIDG, BIK, BIG, KRD), vehicle data and data of its users, data of persons participating in administrative and court proceedings, and data included in submitted complaints and applications.

We may obtain your personal data:

1. in a direct relationship between MHC Mobility and the data subjects, i.e. from the prospective client – a natural person, a natural person conducting a sole proprietorship or a legal person. Data are usually provided by completing contact forms through which prospective clients contact us and provide information about themselves, e.g. to obtain information about a car, services or other matters, by registering an account on the Controller’s website or by participating in events organised by the Data Controller or entities acting on its behalf;
2. from other sources:
   - from your employer or the entity you represent in connection with steps taken to conclude a contract.
   - from third parties, including companies within the capital group to which MHC Mobility belongs,
   - from our marketing partners,
    - from publicly available sources in connection with the analysis of the risk associated with taking steps to conclude a contract with you, your financial situation, past and current obligations, employment and income, e.g. the KRS, CEIDG, REGON, KRD registers and sources with restricted access, e.g. BIK, BIG.
3. In each of the above cases, MHC carefully verifies whether it has a legal basis for processing personal data to that extent.

Your personal data may be disclosed by MHC Mobility to:

1. public authorities, including courts, if required by law or necessary for the establishment, exercise or defence of legal claims;
2. MHC Mobility’s professional advisers, including legal advisers;
3. suppliers acting for MHC Mobility: providers of IT services, services supporting marketing activities, analytics services, courier services, security of persons and property, and entities cooperating with MHC Mobility in handling client communications;
4. entities belonging to the Mitsubishi HC Capital Inc. group, including in connection with fraud and abuse prevention, effective risk management, the performance of reporting obligations and compliance with corporate rules;

In connection with MHC Mobility’s processing of your personal data, you have the right to:

1. access your personal data;
2. rectify your personal data;
3. erase your personal data (the “right to be forgotten”);
4. restrict the processing of your personal data;
5. data portability to another controller;
6. object to processing, including for the purposes of direct marketing;
7. withdraw consent where MHC Mobility processes your personal data on the basis of consent, at any time and in any manner, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal;
8. lodge a complaint with the President of the Personal Data Protection Office if you consider that the processing of personal data infringes the provisions of the GDPR.

If you act as an Applicant/prospective Client, your personal data may be processed using analytical models in an automated manner, including profiling, for risk analysis and for marketing purposes. The consequence may be the possibility of applying a simplified service path or implementing solutions that support the handling of obligations, the protection of MHC Mobility’s assets and those of its stakeholders, or presenting an individualised offer of products and services offered by MHC Mobility.

In the processing of your data, decisions are not taken in a fully automated manner.

1. MHC Mobility is part of the international Mitsubishi HC Capital Inc. group; therefore, the Controller may transfer personal data to a third country in which companies belonging to that group are located, in particular Japan and the United Kingdom of Great Britain and Northern Ireland.
2. Japan and the United Kingdom of Great Britain and Northern Ireland are countries for which the European Commission has issued an adequacy decision.
3. In other cases, your personal data will, as a rule, not be transferred outside the European Economic Area. In exceptional cases where such a transfer nevertheless takes place, the Controller will comply with the safeguards and rules set out in Articles 44–49 GDPR.

Detailed information on the safeguards applied in such cases can be obtained by contacting MHC Mobility.