Explanation:
This is about any actions taken in order to prepare for conclusion of the agreement, to execute agreement, analyse and assess credit capacity, review claims, terminate agreement, archive as well as perform other legal actions related to the agreement, as well as actions taken to conclude, through the Bank, agreements with other entities, for instance, insurance agreement.

Legal basis:
GDPR, Art. 6 section 1 letter b)

Duration of data processing:

• Until the end of the contract, and after that, in other legitimate purposes related to the contract, e.g. for the period of securing any claims, i.e. until the end of the calendar year in which the 6-year limitation period expires, counting from the day agreement. However, if the contract was concluded before July 9, 2018, this period shall be subject to the transitional provisions defining the limitation periods contained in art. 5 para. 2 and 3 of the Act of 13 April 2018 amending the Act - Civil Code and certain acts (Journal of Laws of 2018, item 1104), by virtue of which the limitation periods for claims were shortened
• If agreement is not concluded- until the application is reviewed and for 3 years for potential claims and complaints.

Explanation:
In this case the Bank processes personal data in order to fulfil the duties imposed by the virtue of the law or carry out tasks in the public interest. In particular, we talk here about fulfilment of the Bank’s duties in connection with conducting banking activity and execution of the concluded agreements, and for archiving purposes, as well as in connection with assessment of credit capacity and analysis of credit risk. Furthermore, such duties stem from, inter alia, Act on Counteracting Money Laundering and Terrorism Financing, Act on performance of the Agreement between the Government of the Republic of Poland and the Government of the United States of America on improvement of fulfilment of international tax obligations and implementation of FATCA, Act on Exchange of Tax Information with Other Countries, Act on Protection of Competition and Consumers, Act on Trading in Financial Instruments and security measures for funds.

Legal basis:
GDPR, Art. 6 section 1 letter c) and special provisions, which impose on the Bank the duties indicated in the explanations or Art. 6 section 1 letter e) of the Regulation.

Duration of data processing:

• For calculations related to statistical approaches for calculation of methods and models determined by the banking law - for a period of 12 years from the day of expiry of the obligation.
• For processing information that constitutes bank secret in order to assess credit capacity and to analyse credit risk – after expiry of the obligation stemming from the agreement concluded with the Bank until the time of withdrawal of this consent.
• In other cases – until the Bank has fulfilled the duties defined in specific regulations of the law or completed the tasks carried out in the public interest.

Explanation:
This is about the Bank’s marketing, in particular, that carried out through communication, display or sending trade information by traditional mail or, in case of obtaining an appropriate consent, also through electronic or telephone communication devices. Marketing may be also carried out based on profiling which means processing for marketing purposes the information on Client’s characteristics, behaviour or preferences. Thanks to profiling, on the grounds of to-date relationship, the Bank may customise your trade offers to your interests and needs.

Legal basis:
GDPR, Art. 6 section 1 letter f)

Duration of data processing:

• Until objection is lodged against such processing, or until agreement with the Bank expires.

Explanation:
It is, for instance, marketing of products and services of the companies cooperating with the Bank; processing information that constitutes bank secret (also, in order to assess credit capacity and analyse credit risk) after expiry of the obligation. In each case, the consent obtained from you will indicate, inter alia, the purpose of data processing, which we intend to achieve based on this consent.

Legal basis:
GDPR, Art. 6 section 1 letter a)

Duration of data processing::

• Until the consents granted are withdrawn.

Explanation:
Within the indicated purpose, we will process your data, also to enable communication or delivery of services through the Bank’s websites and mobile application. To this extent, inter alia identifiers, such as IP address of the device or geolocation information will be processed.

Legal basis:
GDPR, Art. 6 section 1 letter b) or Art. 6 section 1 letter f)

Duration of data processing:

• Period of communication or delivery of services, not later than until effective objection is lodged.
• Until the end of the contract, and after that, in other legitimate purposes related to the contract, e.g. for the period of securing any claims, i.e. until the end of the calendar year in which the 6-year limitation period expires, counting from the day agreement. However, if the contract was concluded before July 9, 2018, this period shall be subject to the transitional provisions defining the limitation periods contained in art. 5 para. 2 and 3 of the Act of 13 April 2018 amending the Act - Civil Code and certain acts (Journal of Laws of 2018, item 1104), by virtue of which the limitation periods for claims were shortened

Explanation:
Purposes pursued within so-called legitimate interest are connected to execution of the agreement concluded with you and these are the following:

• ensuring security of the persons and the Bank’s assets, including monitoring of the Bank’s branches, preserving privacy and human dignity,
• ensuring transaction security, in particular, prevention of frauds,
• customisation of the marketing content of the Bank’s websites, depending on the behaviour of the viewers,
• protection against claims and collection of receivables,
• internal administrative, analytical and statistical purposes, including analyses of the credit portfolio, statistics and the internal reporting of the Bank and Bank’s Group.

When assessing whether the indicated purposes are justified, we take into account inter alia the following:

1. any connections between the purposes for which the personal data have been collected and the purposes of the intended further processing,
2. context in which the personal data have been collected, in particular, relationship between the data subjects and the controller,
3. nature of the personal data,
4. potential consequences of the intended processing,
5. existence of appropriate safeguards.

Legal basis:
GDPR, Art. 6 section 1 letter f)

Duration of data processing:

• Until fulfilment of the Bank’s legitimate interests that constitute the grounds for this processing or until an objection is lodged against such processing, no longer than for the period of securing any claims, i.e. until the end of the calendar year in which the 6-year limitation period expires, counting from the day agreement. However, if the contract was concluded before July 9, 2018, this period shall be subject to the transitional provisions defining the limitation periods contained in art. 5 para. 2 and 3 of the Act of 13 April 2018 amending the Act - Civil Code and certain acts (Journal of Laws of 2018, item 1104), by virtue of which the limitation periods for claims were shortened.

Access to your personal data – inside the Bank’s organisational structure – will be available exclusively to employees authorised by the Bank and only to the extent necessary. In some situations your personal data may be disclosed by the Bank to recipients outside the Bank’s structure. In such situation the Bank always examines thoroughly the legal grounds for disclosure of personal data. Importantly, the recipient of the data in the understanding of the Regulation is both the entity which processes personal data on behalf of the Bank and the entity to which the data are made available for its own purposes (for instance, public administration authorities).

Recipients of your personal data may be:

1. public authorities, institutions or third parties authorised to demand access or receive personal data on the grounds of the law, for instance, Polish Financial Supervision Authority, Ministry of Finance, General Inspector of Financial Information, Tax Office, Bank arbiter,
2. bentities, to which the Bank entrusted processing of personal data on the grounds of the concluded agreements, for instance, parcel delivery services, producers of payment cards, photo inspection providers, mass printing providers, IT suppliers and other service providers processing data on behalf of the Bank,
3. banks, financial or credit institutions, or other institutions, which may receive personal data in connection with execution of economic relations between the Bank and you (for instance, banks intermediating in execution of international transfers) and on the grounds of appropriate laws, for instance, BIK, Centrum Prawa Bankowego i Informacji Sp. z o.o., economic information bureaus (KRD, ERIF, BIG),
4. clearing chambers, other clearing entities, for instance, KIR, Swift,
5. card organisations, for instance, VISA, MasterCard – if data are transferred out of the European Economic Area, we apply appropriate safeguards in the form of binding corporate rules,
6. telecommunication services providers,
7. entities providing advisory and inspection services, for instance, audit companies,
8. processors processing the data for recovery of receivables or legal representation, for instance, law firms,
9. insurance companies,
10. entities, for which you expressed your consent for making available and processing your personal data,
11. entities operating with the Bank’s Group or entities from the capital group responsible for execution of contractual obligations and obligations stemming from the law,
12. detailed list of recipients can be downloaded here

Bank Millennium website uses, inter alia, the following types of cookie files:

• statistical cookie files, which support collection of information on the use of the Bank’s website,
• advertising cookie files, which support delivery of content that is better adjusted to user interests,
• security cookie files, such as cookies used for fraud detection, for instance, in website authentication;
• functional cookie files supporting „saving” the settings selected by user and personalisation of user interface as regards, for instance, selected language or region from which the user comes, font size, website display.

Below please find a list of examples of application of cookie files by Bank Millennium website:

• improvement in security level,
• keeping user session in applications, forms, questionnaires and transaction system (cookie files used for user session identification in Millenet). They allow to improve security ensuring that all calls to the server come from the Client’s computer. On the server the cookies and IP address of the computer from which user is connecting are validated. In case of an attempt to hijack user’s session from another computer, the session will be interrupted,
• reporting traffic sources,
• assessment of effectiveness of promotional actions,
• Google advertisements – for better adjustment of advertisements to the users’ preferences, Bank Millennium uses cookie files, which collect only basic information about users’ behaviour on the Bank’s website and their interests. All the information is anonymous and their purpose is the best customisation of the advertisements displayed in Google search engine as well as on other websites to user’s preferences with such tools as, for instance, Google AdWords and DoubleClick. At any time, user may resign from Goole cookies advertisement settings (www.google.pl/settings/ads)
• Analysis with use of Google Analytics – in order to better understand users’ intentions, Bank Millennium uses Google cookie files which anonymously collect only basic information on the user’s activity on the Bank’s portal and are used to report traffic, to analyse users’ behaviour of the website and to assess effectiveness of promotional actions.