Data Processing

Dear Customer,

Below you can find necessary information regarding the data protection and the applicability of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (further referred to as GDPR).

1. Data Controller

The InvestCapital LTD. constitutes a Data Controller of your personal data, with its registered seat in:
The Hub, Suite E101, Triq Sant’ Andrija, SGN 1612 San Gwann, Malta
E-mail address: secretary@investcapital.com.mt

2. Appointment of the Data Protection Officer

InvestCapital LTD has appointed a Data Protection Officer (DPO). The contact details are as follows:

Data Protection Officer: Ewelina Fuławka-Nawrocka
Email: dpo@investcapital.com.mt
Address: The Hub, Suite E 101, Triq Sant’ Andrija, San Gwann, SGN 1612, Malta

3. Who are we and what do we do?

We are InvestCapital LTD, and if you are our Client, we have informed you that we have purchased a debt you owe and we are the new claim holder.

We are a company that is part of the KRUK Group. We have outsourced our collection activity to reputable Service companies, who pursue the claim on our behalf.

If we have informed you about the purchase of the debt via a Welcome Letter and the assignment of collection to a Service company that is part of the KRUK Group, we invite you to review the Data Protection information available on the website of the Service company managing debt collection in your country:

• KRUK Deutschland GmbH: https://de.kruk.eu/datenschutzerklaerung
• KRUK España S.L.U.: https://es.kruk.eu/ES/boxes/proteccion-de-datos
• Kruk Romania S.R.L.: https://ro.kruk.eu/nota-de-informare-privind-protectia-datelor-personale
• KRUK Česká a Slovenská republika s.r.o.: http://cz.kruk.eu/ochrana-osobnich-udaju/

Respective entities of the KRUK Group act as data processors and/or data controllers of your personal data, depending on which of them pursues the claim for the debt or with which of them you concluded an agreement.

4. Why do we process your personal data and what is the basis for processing?

We may process your personal data for the following purposes on the grounds of legitimate interests pursued by the controller (Art. 6(1)(f) GDPR):

• To pursue debt collection, which may involve amicable debt collection as well as judicial and enforcement proceedings;
• To handle complaints and requests received from you, including any queries submitted via the Contact Form;
• To examine the quality of our service, evaluate your satisfaction, and verify that we act appropriately;
• To determine your preferences, including profiling, in order to adjust how we contact you, what offers we present, and how we structure debt repayment options.

We may also process your personal data for the following purposes:

• Marketing, including offering you financial products and services, if you have given your consent (Art. 6(1)(a) GDPR);
• Taking steps prior to concluding a contract or executing an agreement concluded with you (Art. 6(1)(b) GDPR);
• Compliance with legal obligations (e.g., tax and accounting purposes) (Art. 6(1)(c) GDPR).

Additionally, if you apply for a job with us, we process your personal data for recruitment purposes, as detailed in Section X. Processing of Personal Data for Recruitment Purposes.

5. What data do we process?

We process personal data, meaning any information relating to an identified or identifiable natural person. This includes:

• Identification data (e.g., first and last name, personal identification number, ID card number);
• Contact details (e.g., address, telephone number, email address);
• Financial information, including income, assets, and debts related to collection proceedings.

If you apply for a job with us, we process your application details, as detailed in Section X.

6. How long do we keep your personal data?

We retain personal data for as long as necessary to achieve the purpose for which it was collected, considering:

• Debt repayment or termination of collection activities;
• Agreement duration;
• Statutory limitation periods;
• Legal and regulatory obligations.

For recruitment, data retention periods are specified in Section X.

7. Transfers of Data outside the European Economic Area (EEA)

We use suppliers and partners outside the EEA, and therefore transfers of personal data to third countries may occur. Such transfers are conducted under:

• Adequacy decisions (Art. 45 GDPR) where applicable;
• Appropriate safeguards (Art. 46 GDPR), such as Standard Contractual Clauses (SCCs).

8. To whom may we disclose your personal data?

We may share your personal data within KRUK Group companies. Your data may also be shared with:

• Entities supporting debt collection (e.g., law firms, auditors, postal services, IT providers);
• Public authorities if required by law.

9. Your rights under GDPR

You have the right to:

• Access your data and obtain a copy (Art. 15 GDPR);
• Rectify incorrect or outdated data (Art. 16 GDPR);
• Erase your data under certain conditions (Art. 17 GDPR);
• Restrict processing (Art. 18 GDPR);
• Object to processing (Art. 21 GDPR);
• Lodge a complaint with the Information and Data Protection Commissioner.

To exercise your rights, contact us via:

Email: dpo@investcapital.com.mt
Mail: Data Protection Officer, InvestCapital LTD, The Hub, Suite E101, Triq Sant’ Andrija, San Gwann, SGN 1612, Malta

10. Processing of Personal Data for Recruitment Purposes

We process personal data provided by job applicants for recruitment purposes, including:

• Identification and contact details;
• Education and professional experience;
• Additional data (with your consent, e.g., image, CV details).

If you consent to future recruitment, we retain your data for 18 months.

To exercise your recruitment-related data rights, contact us at:

Email: rekrutacja@kruksa.pl