MHC Mobility Sp. z o.o. – Privacy Notice for Clients and Users

Your data may be processed by MHC Mobility for the following purposes:

1. to take steps aimed at concluding a contract and to perform a concluded contract, including assessing your creditworthiness as a Client, your ability to meet obligations and analysing the risk connected with the conclusion and performance of a contract, on the basis of Article 6(1)(b)–(c) GDPR;
2. to perform activities arising from generally applicable laws, on the basis of Article 6(1)(c) and (e) GDPR;
3. to perform obligations arising from internal policies and procedures, codes of conduct and reporting obligations imposed by the Mitsubishi HC Capital Group – on the basis of Article 6(1)(f) GDPR;
4. to perform activities falling within the Controller’s legitimate interests, in particular:
   - handling complaints and claims, establishing, pursuing and defending against claims, on the basis of Article 6(1)(f) GDPR;
   - conducting direct marketing of the Controller’s own products and services (including profiling) – on the basis of Article 6(1)(a) or (c) GDPR in connection with Article 6(1)(f) GDPR;
   - carrying out statistical research and analyses to summarise the effectiveness of undertaken actions, on the basis of Article 6(1)(f) GDPR;
   - customer satisfaction surveys, on the basis of Article 6(1)(f) GDPR;
   - processing data for archiving and evidentiary purposes, on the basis of Article 6(1)(f) GDPR;
   - registering and handling reports of road incidents involving a vehicle owned by MHC Mobility, including for the purpose of contacting insurance undertakings, participants in the incident resulting in damage and the relevant authorities, as well as for the purpose of defending against and pursuing claims connected with the incident resulting in the reported damage, on the basis of Article 6(1)(b) in connection with Article 6(1)(c) and (f) GDPR;
   - keeping a vehicle register necessary for issuing the vehicle, communicating with vehicle users regarding activities necessary for the proper use of the vehicle (e.g. information on periodic inspections), on the basis of Article 6(1)(b) and (c) GDPR in connection with Article 6(1)(f) GDPR;
   - using vehicle location (GPS system) to safeguard MHC’s property, ensure optimal use of the vehicle fleet and cost optimisation, on the basis of Article 6(1)(b) and (f) GDPR;
   - providing additional services, including the installation, use and removal of GPS and telematics devices, on the basis of Article 6(1)(f) GDPR.
5. in the case of attorneys-in-fact, representatives and contact persons, the data of such persons will be processed to exercise rights arising from representation (including a power of attorney) in connection with the conclusion and performance of a contract with the entity they represent or for which they work, on the basis of Article 6(1)(b) and (c) GDPR;
6. in the case of vehicle users, personal data will be processed for the performance of a contract concluded between the Client and MHC Mobility, on the basis of Article 6(1)(f) GDPR, i.e. the Controller’s legitimate interests, in particular:
   - registering and handling reports of road incidents concerning a vehicle owned by MHC Mobility, including for the purpose of contacting insurance undertakings, participants in the incident resulting in damage and the relevant authorities, as well as for the purpose of defending against and pursuing claims connected with the incident resulting in the reported damage – on the basis of Article 6(1)(b) and (c) GDPR in connection with Article 6(1)(f) GDPR,
   - keeping a vehicle register necessary for issuing the vehicle, communicating with vehicle users regarding activities necessary for the proper use of the vehicle (including information on periodic inspections), on the basis of Article 6(1)(b) and (c) in connection with Article 6(1)(f) GDPR;
   - using vehicle location (GPS system) to safeguard MHC’s property, ensure optimal use of the vehicle fleet and cost optimisation, on the basis of Article 6(1)(b) in connection with Article 6(1)(f) GDPR;
   - providing additional services, including the installation, use and removal of GPS and telematics devices, on the basis of Article 6(1)(b) and (f) GDPR.

Information concerning the Mitsubishi HC Capital Inc. group is available on the MHC Mobility website https://mhcmobility.pl/en/about-us

The period for which personal data are stored depends on the purposes for which the data were collected and on legal provisions requiring their storage. Your personal data will be processed by MHC Mobility for the period:

1. necessary to consider an application in connection with applying to use MHC Mobility’s services;
2. of the term of a contract concluded with MHC Mobility and, after its termination, in connection with MHC Mobility’s performance of obligations arising from generally applicable laws;
3. in the case of handling submissions, enquiries, complaints and claims – for the period necessary to reply on the matter. After this period, we will process your personal data if required by applicable laws, including to document how the request of the data subject was handled, or for the period of the statute of limitations for claims;
4. where processing is based on your consent – until the consent given is withdrawn or until a request for erasure of personal data is received;
5. in the case of processing for the purpose of direct marketing of the Controller’s own products and services – until you object to such processing.

In each case, the purpose, legal basis, period and scope, as well as the recipients of the personal data processed by the Controller, result from the actions undertaken for the Client. Detailed information on the period of processing of your personal data can be obtained by contacting the MHC Mobility Data Protection Officer.

In the case of attorneys-in-fact, representatives and persons indicated for contact and cooperation, MHC Mobility may process the following categories of your personal data: identification data (first name, surname, job title, NIP number in the case of sole traders), contact data (e.g. business e-mail address, business telephone number).

In the case of Clients, MHC Mobility may process identification data, address data, contact data, financial data, data concerning the Applicant’s (Client’s) financial obligations, information on the Client’s financial resources and asset position or that of a natural person indicated by the Client, as well as other data obtained from publicly available sources (e.g. KRS, CEIDG, BIK, BIG, KRD), vehicle data and data of its users, data of persons participating in administrative and court proceedings, and data included in submitted complaints and applications.

With respect to vehicle users and their close persons authorised to drive the vehicle, MHC processes identification and contact data to the extent necessary to contact that person, in particular: first name and surname, mobile phone number, e-mail address and correspondence address, and information on the entitlement to drive the vehicle. In the event of damage being reported in relation to the above categories of persons, information necessary to register and handle reports of road incidents involving a vehicle owned by MHC Mobility and for insurance and compensation proceedings at the stage of administrative or court proceedings is processed.

We may obtain your personal data:

1. in a direct relationship between MHC Mobility and the data subjects, i.e. from the client – a natural person, a natural person conducting a sole proprietorship or a legal person – your employer, where you are users of a company vehicle. Data are usually provided by completing contact forms through which clients or vehicle users contact us and provide information about themselves, e.g. to obtain information about a car, services or other matters, by registering an account on the Website or by participating in events organised by the Data Controller or entities acting on its behalf;
2. from other sources:                         
   - from third parties, including companies within the capital group to which MHC Mobility belongs,
   - from the vehicle user – the Client’s employee who indicates the data of the closest person authorised to use the company vehicle,
   - from statements by persons involved in a loss event or from a public authority,
   - from the Dealer or Service Station whose services you use,
   - from the car manufacturer, entities providing financial services,
   - from our marketing partners,
   - from publicly available sources in connection with the analysis of the risk associated with concluding a contract with you, your financial situation, past and current obligations, employment and income, e.g. the KRS, CEIDG, REGON, KRD registers, and sources with restricted access, e.g. BIK, BIG.

In each of the above cases, MHC carefully verifies whether it has a legal basis for processing personal data to that extent. We may also obtain data directly from the vehicle if it is equipped with telemetric devices (location data), as well as from cookies used on the MHC website and placed in marketing campaigns addressed to clients or vehicle users (e.g. by e-mail). More information on the use of cookies can be found in the Cookies Policy (available at: https://mhcmobility.pl/polityka-cookies).

If you did not provide your data yourself in connection with the conclusion of a contract with MHC Mobility, your personal data were provided by your employer or the entity you represent in connection with taking steps to conclude a contract or in connection with its performance.

Your personal data may be disclosed by MHC Mobility to:

1. public authorities, including courts, if required by law or necessary for the establishment, exercise or defence of legal claims;
2. MHC Mobility’s professional advisers, including tax, accounting or legal advisers;
3. suppliers acting for MHC Mobility: providers of IT services, accounting systems, services supporting marketing activities, analytics services, courier services, security of persons and property, and entities cooperating with MHC Mobility in handling client communications;
4. insurance undertakings and insurance brokers competent due to the insurance cover of the leased object;
5. banks and financial institutions providing services to MHC Mobility;
6. entities within the Mitsubishi HC Capital Group, including in connection with fraud and abuse prevention, effective risk management, the performance of reporting obligations and compliance with corporate rules;
7. entities cooperating with MHC Mobility in potential debt recovery processes;
8. authorities or institutions connected with fine or administrative proceedings concerning parking charges for the vehicle and other authorities or institutions authorised under applicable laws (e.g. tax offices, courts).

Additionally, in connection with the performance of vehicle lease/rental agreements and service agreements, your data may also be disclosed by MHC Mobility to:

1. suppliers and sellers of vehicles and their equipment cooperating with MHC Mobility, including dealers, importers and manufacturers, bodywork/fit-out contractors, and companies handling the collection, hand-over, return and inspection of vehicles, as well as the preparation of expert opinions and reports by independent experts;
2. entities cooperating with MHC Mobility, e.g. mechanical, body and paint, glass and tyre services, entities providing installation, removal and maintenance of additional equipment, fit-outs, markings and advertising regardless of the form in which the services are provided;
3. entities cooperating with MHC Mobility for the purpose of pursuing the Controller’s legitimate interests.

In connection with MHC Mobility’s processing of your personal data, you have the right to:

1. access your personal data;
2. rectify your personal data;
3. erase your personal data (“right to be forgotten”);
4. restrict the processing of your personal data;
5. data portability to another controller;
6. object to processing, including for the purposes of direct marketing;
7. withdraw consent where MHC Mobility processes your personal data on the basis of consent, at any time and in any manner, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal;
8. lodge a complaint with the President of the Personal Data Protection Office if you consider that the processing of personal data infringes the provisions of the GDPR.

If you act as an Applicant/Client, your personal data may be processed using analytical models in an automated manner, including profiling, for risk analysis and for marketing purposes. The consequence may be the possibility of applying a simplified service path or implementing solutions that support the handling of obligations, the protection of MHC Mobility’s assets and those of its stakeholders, or presenting an individualised offer of products and services offered by MHC Mobility.

In the processing of your data, decisions are not taken in a fully automated manner.

1. As MHC Mobility is part of the international Mitsubishi HC Capital Inc. group, the Controller may transfer personal data to a third country in which companies belonging to that group are located, in particular Japan and the United Kingdom of Great Britain and Northern Ireland.
2. Japan and the United Kingdom of Great Britain and Northern Ireland are countries for which the European Commission has issued an adequacy decision.
3. In other cases, your personal data will, as a rule, not be transferred outside the European Economic Area. In exceptional cases where such a transfer nevertheless takes place, the Controller will comply with the safeguards and rules set out in Articles 44–49 GDPR.

You can obtain detailed information on the safeguards applied in such cases by contacting MHC Mobility.