Key Legal Documents
The following documents govern the use of our services and our approach to regulatory obligations:
- Rules for AML/CFT Verification — describing how Speedy AG performs customer due diligence and fulfils anti-money-laundering / counter-terrorist-financing (AML/CFT) obligations in accordance with the Polish AML Act and applicable EU regulations.
- Payment Services Terms & Conditions — terms and conditions for payment services provided by Speedy AG sp. z o.o. as a licensed national payment institution under KNF supervision (registration no. IP60/2024).
- Privacy Policy — information on how Speedy AG processes personal data, available on our website and summarised in Section B of this document.
- The Polish Act of 19 August 2011 on Payment Services (Ustawa o usługach płatniczych) — the primary legislative framework governing Speedy AG’s operations.
- Whistleblowing Procedure — channels and rules for reporting suspected breaches of law or internal regulations, described in detail in Section C of this document.
Privacy Policy
Speedy AG sp. z o.o. is committed to protecting the personal data of all clients, transaction participants and other individuals whose data we process. This section summarises our Privacy Statement in accordance with Regulation (EU) 2016/679 (GDPR) and the Polish Personal Data Protection Act.
1. Scope of the Privacy Statement
This Privacy Statement applies to:
- all former, present and potential clients of Speedy AG sp. z o.o.;
- all persons participating in any transaction via Speedy AG’s payment services.
Personal data means any information that identifies or can be connected with you, including your name, telephone number, address, IP address or payment information. Processing covers all operations performed on such data, including collection, storage, use, disclosure and deletion.
2. Types of Data We Collect
Personal data
- Sender identification: first name, last name, identity document number, personal identity number, address, postal code, city, country, e-mail, telephone number;
- Recipient identification: first and last name, e-mail address;
- Transaction data: payment card number, recipient card number, transaction amounts and locations;
- Technical data: IP address, browser data, device data.
Sensitive data
Speedy AG does not obtain or process sensitive data of natural persons.
Profiling
Speedy AG does not perform profiling of natural persons.
3. How We Use Your Personal Data
We use your personal data only for justified business purposes, including:
- To provide payment services — based on the necessity to process data in order to perform the agreement;
- For analytical and statistical purposes — based on the legitimate interest of Speedy AG;
- For direct marketing of Speedy AG’s own products and services — based on our legitimate interest;
- For other marketing or commercial communication purposes — based on your voluntary consent;
- To establish, assert or defend against claims and legal obligations — based on our legitimate interest and legal duties, including protection against fraud and identity theft.
4. Whom We Share Your Data With
State authorities
To fulfil regulatory obligations under Polish and EU law (including AML/CFT requirements), we may disclose data to competent authorities such as law enforcement, courts, the prosecutor’s office or arbitration bodies upon lawful request.
Financial institutions
When processing card payments, we share necessary data (e.g. name, address, card number) with payment scheme operators such as Mastercard or Visa.
Service providers
We share only the minimum data required with third-party service providers supporting our operations. All such transfers are governed by appropriate data processing agreements. For transfers outside the European Economic Area, Speedy AG relies on standard contractual clauses adopted within the European Union.
5. Your Rights
- Right of access — you may request a statement of the personal data we process about you;
- Right to rectification — you may request correction of inaccurate data;
- Right to object — you may object to processing based on our legitimate interests;
- Right to restriction — you may request that we restrict the use of your data in certain circumstances;
- Right to erasure — you may request deletion of your data where it is no longer necessary or where consent is withdrawn;
- Right to lodge a complaint — you may raise a concern with Speedy AG or escalate it to the Data Protection Officer or the President of the Personal Data Protection Office (UODO).
6. Data Security
Speedy AG applies internal policies, technical and organisational measures (including IT security controls and staff confidentiality obligations) to ensure the confidentiality, integrity and availability of personal data. These measures are periodically reviewed and updated.
7. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, and in accordance with applicable legal retention requirements under Polish and EU law.
8. Contact — Data Protection
Data Protection Officer (DPO): gdpr@speedy.pl
Postal address: Speedy AG sp. z o.o. — DPO Plac Europejski 2 00-844 Warszawa, Poland (with the note: DPO)
Data protection authority: President of the Personal Data Protection Office (UODO) stawki 2, 00-193 Warsaw, Poland www.uodo.gov.pl
Whistleblowing
Speedy AG sp. z o.o. conducts its business in line with legal requirements, internal regulations and high ethical standards. To help us uphold these standards, we have introduced a Procedure for Receiving and Handling Reports of Breaches of Law in Speedy AG sp. z o.o. (“Procedure”), in accordance with the Polish Act of 14 June 2024 on the Protection of Whistleblowers (implementing EU Directive 2019/1937).
The Procedure describes:
- How to report suspected breaches;
- How whistleblowers are protected against retaliation;
- How reports are verified and what follow-up actions are taken.
Reporting concerns helps us address problems early and reduce the risk of similar issues in the future.
How to Submit a Report
By email: zgloszenia@speedy.pl
In person: Direct meeting with the Compliance Officer
By post: Speedy AG sp. z o.o. — Compliance Officer Plac Europejski 2 00-844 Warszawa, Poland (mark envelope: “WHISTLEBLOWING”)
What Your Report Should Include
To help us examine your report, please include (as far as possible):
- Whether you wish the report to remain anonymous or not;
- Your name and surname — unless you choose to remain anonymous;
- Your contact details (postal address or e-mail);
- The area or topic the report concerns;
- A description of the event or behaviour you are reporting;
- The person(s) the report relates to (name, surname, position or entity name);
- Any other persons who may be connected to the reported breach.
You do not need to have full evidence. Please report in good faith and provide as much factual information as possible.
Rights and Protection of Whistleblowers
A person submitting a report (“Whistleblower”) is entitled to:
- Remain anonymous;
- Receive information on planned or taken follow-up actions and the reasons for those actions;
- Protection against retaliation from persons concerned by the report or other persons connected with the breach.
Speedy AG sp. z o.o. does not tolerate retaliation against anyone who reports a concern in good faith.
Personal Data Protection
Personal data of whistleblowers is protected in accordance with:
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation — GDPR);
- The Polish Act of 14 June 2024 on the Protection of Whistleblowers.
Data is processed only to the extent necessary to receive, verify and handle the report and to fulfil our legal obligations. If you are unsure whether something should be reported, we encourage you to contact us using one of the channels above and describe the situation.