|The purpose of the document||Fulfilling the disclosure requirement resulting from personal data protection regulations|
The policy is always available at Symmetrical.ai/gdpr and via Symmetrical’s mobile application. It is also sent to your email address in the course of concluding any agreement with Symmetrical (if the agreement is concluded in writing, a hard copy of the policy may be additionally provided).
- What personal data does Symmetrical collect?
- What is the purpose for which Symmetrical processes personal data?
- From where does Symmetrical obtain personal data?
- Who will have access to my personal data?
- Rights of the data subject
- Data storage period
- Data protection officer
You can also use the links above to download the Policy (as a PDF file) or obtain abridged versions of the policy that are dedicated to certain agreements or services.
We used our best efforts to write the Policy in a clear, simple and transparent manner. We limited the number of references within the document and references to legal regulations. Nevertheless, a read-through the entire policy will reveal unavoidable repetitions.
The policy applies to all our websites, applications, services and agreements, that is to all the personal data that we process. Therefore, the Policy is available to all our employees, collaborators, contractors and clients across Europe. The type of relationship between us or the method in which it was established (in writing, via the website, via the mobile application, over the phone, by email, in the course of a promotional campaign, on a conference, or via a social networking site) is of no relevance. For this reason, the Policy contains information that may not apply to your specific situation. In order to ensure that the policy is legible, we made the main text of the Policy a collection of universal information and principles, and any derogations from that standard are clearly marked and their origin is explained.
Please note that Symmetrical is not a single entity. Symmetrical is a group that currently comprises three enterprises, each of which provides a different scope of services, concludes different agreements, and processes different personal data, but for the sake of simplicity, we refer to them as Symmetrical, We or Our. If there is a need to distinguish information about a certain enterprise from our group, it will be clearly marked.
What enterprises belong to the Symmetrical group?
SYMMETRICAL.AI Limited., with its registered office in Suite 1, 3rd Floor 11 – 12 St. James’s Square, London, United Kingdom, SW1Y 4LB, entered in the Companies House Register under number 11843660.
Symmetrical.ai is a British company that owns Symmetrical Labs and Symmetrical Financials; it predominantly serves a holding function (supports the management of the Symmetrical group).
SYMMETRICAL LABS SP. Z O.O., with its registered office in Warsaw on ul. Rozbrat 6/17, 00-451 Warsaw, entered in the register of entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, 12th Commercial Division of the National Court Register, under KRS no. 0000747407, NIP (tax ID) 7010850471, share capital: PLN 300,000 paid in full.
Symmetrical Labs is a Polish technology company which delivers IT solutions required for the proper functioning of salary financing services.
SYMMETRICAL FINANCIALS SP. Z O.O., with its registered office in Warsaw on ul. Rozbrat 6/17, 00-451 Warsaw, entered in the register of entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, 12th Commercial Division of the National Court Register, under KRS no. 0000775925, NIP (tax ID) 7010911511, share capital: PLN 200,000 paid in full.
Symmetrical Financials is a Polish financial company which is a credit intermediary registered with the Polish Financial Supervision Authority and a lending institution that provides financial products as a part of salary financing services.
What personal data does Symmetrical collect?
We process different data from different sources depending on the services you use, the agreements you conclude and on whether you contact us in writing, online or, e.g., over the phone. Much of that data is provided by you personally, e.g., when filling in an agreement or registering in the mobile application. Data may also be provided by your employer or ordering party. We may compile data about the device through which you use our services or communicate with us, or data obtained via your device, e.g., about your location. If necessary, we also obtain data from data providers, e.g., from economic information bureaus.
By data, we mean personal data, i.e., all information through which we are able to identify you and all data connected to that information. Such data includes, e.g., a given name and surname, phone number, email address and residential address.
We only ask for data that we consider necessary to achieve the purpose for which we collect them. If in any situation the provision of data is not necessary, you will be informed of that fact and you will decide whether to provide such data or not. Please note that your refusal to provide additional data may affect the terms and conditions and the manner in which a given service is provided or a concluded agreement is performed.
- Personal data
Personal data are your basic data, such as your given name and surname. In order to provide salary financing services, we also need your date of birth (which allows your
unique identification), and in the case of financial services (e.g., loans), we also require your PESEL number (or country of birth), nationality, number and series of your identity document, and your residential address. We are obliged to collect those data by anti-money laundering regulations. In other cases, it might be necessary to collect other data as well, such as your NIP number (tax ID).
- Contact details
Contact details are information that allows us to contact you directly. These are, above all, your phone number and email address. Sometimes, these data may include your mailing address (e.g., if the correspondence is sent using traditional methods), your residential address or your business address.
- Data concerning the history of your cooperation with Symmetrical We store information about the agreements that bind us, the related settlement of accounts, incurred expenses and about any possible complaints.
- Economic and payment data
Usually, this is the number of the payment account you use for the purposes of settling accounts with Symmetrical, but it can also be other information, e.g., in the case of salary financing services or financial services, we may collect information on your income, expenses, property or, e.g., the number of your dependents. We may also collect similar information for people with whom you share a household.
- Employment data
This is information about your employment and cooperation with ordering parties (regardless of its legal basis). This information concerns your seniority, type, and terms and conditions of your contract, your position, and method in which your salary is calculated.
- Location data
If you use our salary financing services, and more specifically the service that enables you to register your working time, we will obtain information about your location through your device. These data are necessary to confirm your presence at work.
- Correspondence history and conversation recordings
We strive to archive our correspondence and thus we will store all emails and letters exchanged with you. We may also record our phone conversations (which you will always be informed of before we start recording). In such a case, we will store the recording as well.
- Device data
The use of our website or mobile application enables us to obtain information on the device that you use. We collect that information to optimize our services and monitor issues related to IT security.
- Data from third-party databases
In specific situations, we use third-party databases which enable us to supplement your data that we already have. We obtain your relevant consent which allows us to, e.g., inquire at the economic information bureau about any possible bills or loan payments that you may be overdue with.
- Other data required under legal regulations
Legal regulations impose numerous obligations on us with regard to certain situations, e.g., in the case of employment contracts, we must collect data provided for in the Labor Code. Therefore, in the case of many agreements, we will collect data not only for our own purposes, but also in relation to legal requirements and requirements imposed on us by authorities that supervise our activity.
What is the purpose for which Symmetrical processes personal data?
We process data for the purposes of performing the agreement, fulfilling our obligations resulting from legal regulations, for marketing purposes, quality testing, or even asserting claims/defending against claims. Naturally, in doing so we follow personal data protection laws. Some of those purposes do not require your consent (as the processing of your data is, for instance, simply required for the provision of the ordered service, which makes it unnecessary for us to collect your additional consent, and we will contact you via all the available communication channels, i.e., we will contact you by traditional post, email, text message, over the phone or using messages in the Mobile Application), and if such consent is required, we will not only ask you for permission to process your data, but we will also try to ask for your preferences, e.g., as to the method of contacting you when accomplishing a given objective (e.g., you may consent to receiving marketing information via email, but not over the phone).
- Salary financing services
In order to conclude and perform the agreement concerning salary financing services, we can process your data without your consent. The fact that you are requesting to conclude or are concluding an agreement is sufficient to do so. It should be emphasized that in this case, the data is used for the purposes of negotiating, preparing and concluding the agreement, and to ensure its efficient performance, e.g., by ensuring the possibility of unique identification. That purpose of processing concerns both Symmetrical Labs and Financials.
- Financial products (limit, loan)
Our mobile application enables you to use financial services, and for this purpose we will process your data that enable us to conclude such an agreement. The scope of such data is usually broader than in the case of just salary financing services, but as in that case, the processing is based on the necessity to conclude and perform the agreement. This purpose applies to Symmetrical Financials, the entity that provides you with financial services.
- Verification of creditworthiness and credit standing
If you are applying for access to financial products and during the period of the agreement concluded with us with regard to such a product, considering valid legal regulations (the Consumer Credit Act requires us to verify the lender’s credit standing), the necessary conclusion and performance of the agreement, our legitimate interest as the controller of your data, we will verify and monitor your credit standing and creditworthiness, i.e., we will check whether you are able to pay loan installments and whether you actually pay off your debts. This purpose applies to Symmetrical Labs (as the collection and monitoring of such information is a functionality of our mobile application available to financial partners) and Symmetrical Financials.
- Quality testing
As we want to improve our services, we strive to monitor their quality on an ongoing basis. Therefore, your data may be processed for the purposes of testing the quality of services. Having your convenience in mind, we will ask for your consent and the preferred contact channel with regard to this matter.
- Marketing purposes
Sometimes we want to provide you with information on our services, present new releases or encourage you to use our mobile application. In such a case, the data are processed for a marketing purpose on the basis of our legitimate interest as a data controller, but you have the right to object to such processing. Additionally, wherever it is possible, we try to ask for your consent and the preferred channel of contact to ensure that you find the cooperation with Symmetrical highly convenient.
- Correspondence exchange, newsletter
We collect your data that is necessary for sending our correspondence, usually in response to your interest in our services or inquiries concerning our services via our website, application (in particular via the contact form in the app), electronic mail and personally.
- Performance of agreements
In order to conclude and perform other agreements than those concluded with our clients, such as employment contracts, service or goods delivery contracts, lease agreements, we process the data of parties to such agreements and their representatives.
- Assertion of claims and defense against claims
As the data controller, we have the right to process your data for the purposes of asserting our claims or defending against your claims. It is our legitimate purpose and it does not require your consent.
- Fulfillment of obligations under legal regulations
We also collect personal data to fulfill our obligations resulting from legal regulations, which are primarily related to the Accounting Act (the requirement to store accounting records and agreements) and the Act on Counteracting Money Laundering and Financing of Terrorism (the requirement to store agreements and documents related to the identification of clients using financial services).
From where does Symmetrical obtain personal data?
We obtain your data using various methods. Firstly, we try to obtain your data directly from you, which gives you the knowledge about what and when is disclosed to us. Data can also be obtained from your employer or ordering party, which, in particular in the course of providing salary financing services, allows us to confirm your data at a reliable source, avoid unnecessary bureaucracy, and relieves you from having to provide us with numerous certificates or declarations documenting, e.g., the employment with a given employer or your earnings. We also use the services of third-party data providers, e.g., economic information bureaus. Please bear in mind that we exchange data within the Symmetrical group, in particular in the scope necessary to perform the administrative functions (e.g., handling correspondence, accounting and financial reporting).
- Information obtained directly from you You provide us with your data directly, e.g., by filling in forms, agreement documents, or exchanging correspondence with us. We may also ask you to confirm your data that we obtained from another source. The data you provide us with are necessary for the achievement of the purposes for which they are collected. Their provision is voluntary, but if you do not provide such data, we will be unable to achieve the intended purpose or its achievement will be hindered.
- Employer / ordering party
We receive data from your employer or ordering party, in particular in the course of providing salary financing services, but also in other cases (e.g., when your employer is our contracting party and provides us with goods or services). In the case of salary financing services, the data is provided with your consent. The consent is voluntary, but it is necessary to use our services.
- Symmetrical Group
Our companies exchange your data for administrative purposes (we handle our correspondence, manage our finances, financial reporting, personal data protection and compliance risk jointly) and to provide services, in particular the salary financing services for which Symmetrical Labs is the provider of technology and data, while Symmetrical Financials is the provider of capital and financial services (as a credit intermediary or lender).
- Internal databases
With regard to the salary financing services, we supplement your data with information obtained, with your consent, from specialized databases, e.g., from economic information bureaus. These are usually data regarding your economic situation and creditworthiness as well as information which allows us to effectively manage the security of our products (e.g., information from databases on IT security incidents or devices/addresses used in fraudulent activities).
Who will have access to my personal data?
Your data are transferred only when such a transfer is permitted by legal regulations. However, it should be emphasized that sometimes such a transfer does not require your consent. A data transfer might be based directly on legal regulations, a need to perform an agreement or be conducted under a data processing agreement that we concluded, which enables us to provide the data to our subcontractors. If the data are entrusted to our subcontractors, they process your data only within a scope and for a purpose that we strictly defined. We strive to select only proven and trustworthy providers, and these are mostly IT service providers, accountants and couriers. We also transfer the data from Symmetrical Labs to the providers of financial and insurance products, if you express willingness to use such services in the Application. Importantly, we do not transfer your data outside of Europe – all our subcontractors process the data using infrastructure located within the European Economic Area and, like us, fully observe the GDPR requirements.
- Symmetrical Group entities
Data is exchanged within the Symmetrical group in relation to the joint use of many services, sharing the IT infrastructure, offices, etc. In the course of our operations, which in particular concern the handling of correspondence, financial reporting, or joint management of personal data security and compliance risk, data that is necessary for the performance of such operations might be exchanged between particular companies within the group.
- Financial and insurance service providers
If, using the mobile application, you express your wish to use the services of a financial institution (please note that one of those institutions might be Symmetrical Financials) or an insurance company, your data that is required for the conclusion of the agreement will be transferred to such entities. The recipient of your data should advise you about the personal data processing policy that they follow (if they have not done so beforehand).
- Employers / ordering parties
In the course of using the salary financing services, we exchange your data with the employer or ordering party within a scope necessary for the correct functioning of such services. Therefore, your employer might receive information on the amount of your liabilities that should be deducted from your salary or a request to confirm the data that you provided us with directly.
- Subcontractors (especially technical subcontractors)
On the basis of data processing agreements, we transfer the data to our providers of various services, the most important of which are Amazon Web Services (this service enables the functioning of our system used for the provision of salary financing services) and Google GSuite / Google Firebase (we use these services to send push notifications, emails with notifications or documents that are required in the course of service provision). Our subcontractors process data within Europe and observe the highest security standards with regard to the data entrusted to them.
- Third-party databases
In certain strictly defined situations, we may retransfer to economic information bureaus the information on (for example) how you repay your debt due to Symmetrical. Such situations are regulated by law and you will be notified if such a retransfer is to take place.
- Public offices and state institutions
Legal regulations oblige us to transfer data to various state institutions. Such a transfer may be conducted without your consent or knowledge. This remains beyond our control, but we will
always use our best efforts to verify the correctness of such transfers and to only transfer the required data in a secure manner that ensures the confidentiality of your data.
Rights of the data subject
You have all the basic rights that arise from regulations on personal data protection. If you wish to exercise your rights and, e.g., gain access to your data, withdraw your consent for the processing of your data for a particular purpose, or if you want to request that your data be deleted, all you need to do is contact us by phone, email or in writing. We also use our best efforts to enable the management of personal data via the mobile application. We hope that functionalities allowing, e.g., the management of data processing consents will be available soon.
- You have the right to access your data, that is you can inquire about which of your data we process. Moreover, you can inquire about the source of such data, our subcontractors that have access to such data and other controllers that had access thereto. You can ask for a copy of your data (including an electronic copy), which will be sent to you or to a controller indicated by you.
- You have the right to withdraw your consent for data processing (if you have granted such consent), but it will not affect the correctness of data processing before such withdrawal. You may not withdraw your consent for data processing if the data are processed on a basis other than your consent (e.g., under legal requirements).
- You are also entitled to object to the processing of your data for marketing purposes if in your case such processing is based on our legitimate interest, i.e., without asking for your consent.
- You have the right to update your data or report that they need to be corrected.
- You have the right to request that your data be removed, but only if we are not obligated to the further processing thereof (in connection to an agreement or legal regulations).
- You have the right to request that the processing of your data be restricted if there is any doubt as to the correctness of such processing (e.g., when you submit a complaint questioning the conclusion of the agreement).
- You have the right to lodge a complaint with the Personal Data Protection Office (www.uodo.gov.pl).
Data storage period
We store personal data for as long as necessary to achieve the objectives listed in this Policy.
- Salary financing services
Due to the nature of the provided services, in consideration of the requirements provided for by the Accountancy Act and the applicable statutory claim limitation period, we decided that data will be stored for 6 years as of the termination of the salary financing services agreement. If you submit any claims or complaints, that storage period may be extended. If for any reason no agreement was concluded, we will store the data for 6 years as of their obtainment.
- Business partners/associates and their representatives Due to the nature of the provided services, in consideration of the requirements provided for by the Accountancy Act and the applicable statutory claim limitation period, we decided that data will be stored for 6 years as of the later of the following events: completion or termination of the agreement between us, as of the last transaction, or as of the submission of any claim / complaint.
We do our best to remove the data of people with whom we exchange correspondence that is unrelated to the concluded agreements on an ongoing basis, at least once a year.
- Job candidates
We do our best to remove the data of people with whom we have not started cooperation on an ongoing basis, at least once a year.
We store employee data within the terms prescribed by the applicable labor law regulations.
We would also like to clarify that the obligation to remove data means that we remove data which allows the unique identification of you as a natural person. However, anonymized data
(i.e., data which does not contain such data as your given name, surname, PESEL number, phone number, etc.) may be further stored for statistical and research purposes, and for the purposes of enhancing our services.
Data protection officer
You can contact our data protection officer via email at firstname.lastname@example.org or by writing to:
Symmetrical – Data Protection Officer
Moreover, you are always entitled to lodge a complaint concerning personal data to the President of the Personal Data Protection Office (www.uodo.gov.pl), i.e., the Polish authority supervising the observance of legal regulations on personal data protection.