Information obligation

Information on the processing of personal data of users of our websites or mobile applications:


Who is the personal data controller: Benefit Systems S.A. with its registered office in Warsaw, Plac Europejski 2, 00-844 Warsaw (hereinafter referred to as ‘we’ or ‘Benefit Systems’).

If you are a user of the MyBenefit System and make use of the functionality of the HR tools or submit statements or requests to your employer or other similar functionalities, then your employer is the administrator of personal data processed within these functionalities. For information regarding this processing, please contact your employer directly.

How to contact us: You can contact us in any of the following ways:

We have designated a personal data officer, who can be contacted in any matters concerning the processing of your personal data by us. You can do this by e-mail to: iod@benefitsystems.pl or via post to the address: Benefit Systems S.A. Pl. Europejski 2, 00-844 Warszawa, in an envelope marked “IOD”.

What personal data do we process and where do we collect them from: We will process your personal data that you provide, leave, or to which we may gain access in connection with your use of our websites or mobile applications.

We may also process your data, which we receive from your employer (e.g. in order to create your account in the MyBenefit System).

We may also receive your data from entities that offer you additional services in connection with your account on our websites and mobile applications, or from external authentication service providers (e.g. Facebook, Apple).

Additionally, we may process your child’s personal data, if you have provided us with such.

The data we process, include in particular:

  • the data you or your employer provide in the process of registering an account on our websites and our mobile applications, as well as during the use of our websites and applications;
  • data concerning your activity on our websites and in our mobile applications (e.g. data about pages you visit, bookmarks, how much time you spend there, etc.);
  • if you use the facility search engine and turn on the geolocation function, we will process your geolocation data in order to show you facilities located near your location;
  • if you upload your or your child’s photo to our application in order to obtain a Confirmed Identity, we will process it to guarantee you or your child the Confirmed Identity functionality and in order to send it back to your e-mail address, if you would like to use facility services while a QR code or token number cannot be generated in the Multisport app;
  • data relating to your device through which you use our websites or mobile applications: IP address, data stored in cookies or other similar technologies (see: ‘Cookies’). We also process data comprising contents of HTTP requests transmitted from your device to our server (URL, IP address, browser data, date and time of the request, HTTP response code, error information, cookie ID, page resources viewed). The data so collected are recorded in server logs.

How we process data: We will process your personal data and your child’s personal data, if you have provided us with such, for the purposes of:

  • providing access services and account maintenance services on our websites and in our mobile applications as well as enabling the use of services available on those websites and mobile applications (including enabling the purchase, delivery, and settlement of orders in the MyBenefit System or on the MultiLife Platform) – because it is necessary for the performance of the contract between you and Benefit Systems (legal basis - Article 6(1)(b) of the GDPR);
  • where we collect special categories of data in order to provide you with a service or where we transfer such personal data to external entities, we process your data on the basis of your explicit consent (legal basis – Article 9(2)(a) GDPR). The provision of this data is always voluntary, but may be necessary in order to use the service in question;
  • in case you are a member of the MultiSport or MultiLife Programme, we provide you with services related to the use of the MultiSport or MultiLife Programme because you have given us your consent, which may also be expressed through your explicit application to the Programme directly to us or through the employer (legal basis - Article 6(1)(a) of the GDPR);
  • related to compliance with our legal obligations – we may have obligations arising from applicable laws that require us to process your personal data; in particular, this concerns compliance with tax and accounting obligations (legal basis – Article 6(1)(c) GDPR);
  • server administration and security assurance for statistical purposes and for the purposes of facilitating the use of our websites and mobile applications on the basis of our legitimate interest consisting in improving the functionality of services provided by us electronically (legal basis – Article 6(1)(f) of the GDPR);
  • exercising, establishing or defending legal claims. We act on the basis of our legitimate interest consisting in the ability to establish or defend a legal claim (legal basis – Article 6(1)(f) of the GDPR or Article 9(2)(f) of the GDPR in case of special categories of personal data;
  • in connection with carrying out marketing activities – we may process your personal data: (i) for the purposes of marketing communications, including mailing commercial information and presenting offers in pursuit of our legitimate interest that consists in presenting you with marketing contents, including contents tailored to you on the basis of profiling, in connection with your consent to use the communication channel you have chosen for this purpose; ii) for the purposes of online marketing activities in pursuit of our legitimate interest that consists in presenting advertisements and offers, including those tailored to your potential needs and interests on the basis of profiling, in connection with your consent to the use of cookies or similar technologies or, where applicable, in connection with your consent to our use of information on your location for marketing purposes; iii) for the purpose of carrying out analyses and statistics for marketing purposes and for the purpose of surveying satisfaction with our services in pursuit of our legitimate interest that consists in improving the quality of our customer service and optimizing the products and services offered by us (legal basis – Article 6(1)(f) of the GDPR).

How long will your personal data be stored: After you have finished using our websites or mobile applications, we will process your data for as long as they are stored in the server logs

If you have an account on our websites or in our applications, we will keep your data until you delete your account.

Where we process your data for the purposes of complying with our legal obligations, we will do so for the time necessary to comply with our legal obligations, in particular as required by applicable law.

Where we process your personal data based on our legitimate interests, we will do so until you lodge an effective objection, unless they cease to be necessary for the purposes of our legitimate interests (e.g. the limitation period for claims expires).

Where we process your data based on your consent, we will process them no longer than until its withdrawal.

Is providing data compulsory: As a rule, providing personal data is not compulsory, but may be necessary for you to use the services provided by Benefit Systems, e.g. to enter into a contract with us.

Therefore, your failure to provide your data may in some instances make it impossible for us to provide services. Our forms used to collect data clearly indicate the data the provision of which is necessary.

Do we make automated decisions: We do not make any decision concerning you which would be based solely on automated processing of your information which would produce legal effects concerning you or similarly affect you in a significant way.

Who do we transfer your data to: Your personal data may be transferred to the following entities: Benefit Systems Group companies, hosting and maintenance service providers for our websites and mobile applications, ICT and IT support and security service providers, data storage and destruction service providers, entities providing services for our clients and other stakeholders (e.g. couriers, payment operators) and supporting our marketing activities, to legal counsels and auditors, as well as your employer. Your data may also be transferred to our affiliated entities that offer additional services in connection with your ownership of an account on our website or in our mobile applications (e.g. consultants and partners whose services you access through our websites or mobile applications), as well as to social network operators.

Your data may also be transferred to public authorities in cases provided for by law.

If you use the function of making the Virtual Kids Card available to other users registered in our MultiSport application, your child's personal data will be disclosed to the users indicated by you.

Are your data transferred outside the European Economic Area: As a rule, your personal data are not transferred outside the European Economic Area (EEA). Some of the data recipients (such es technological solution providers) may process them in third countries. We make every effort for the provision of data to these providers to be lawful. If the European Commission has not issued a decision confirming that a given third country ensures an adequate level of personal data protection, we ensure that data transfers are carried out on the basis of other legal protection measures, e.g. based on standard contractual clauses or codes of conduct. You can contact us to obtain copies of the implemented security measures. You can find contact details above in section How to contact us.

What are your rights: The right to demand access to your personal data; the right to demand rectification of personal data; the right to demand erasure of personal data; the right to demand restriction of personal data processing; the right to object to personal data processing; the right to data portability; the right to withdraw consent for the processing of personal data; as well as the right to lodge a complaint with the President of the Personal Data Protection Office.

More information about the processing of your personal data can be found in our Privacy Policy: https://www.benefitsystems.pl/en/privacy-policy/.