Privacy Policy

This Privacy Policy explains how REBIZ SERVICE SP. Z O.O. ("Rebiz", "we", "us", or "our") collects, uses, stores, shares, and protects personal data when individuals visit our website, register for an account, or use our services.

Rebiz operates a technology and operational platform that provides access to business infrastructure, including the ability to arrange commercial transactions, issue invoices through participating legal entities, and coordinate payments and payouts.

We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and other applicable data protection laws.

This Policy applies to website visitors, prospective and registered users, business representatives, beneficial owners, customers, counterparties, and other individuals whose personal data we process in connection with our services.

The data controller responsible for the operation of the Rebiz platform is:

REBIZ SERVICE SP. Z O.O.

Registered address: al. Prymasa Tysiąclecia 83A lok. 133, 01-242 Warszawa, Poland

KRS: 0001167335

NIP: 5273160998

REGON: 541451057

Email: info@rebiz.pro

Website: https://rebiz.pro

Rebiz determines the purposes and means of processing personal data in connection with platform operations, account management, onboarding, compliance verification, and related activities.

Participating companies, banks, payment service providers, and other partners may act as independent data controllers when they determine their own purposes and means of processing personal data.

Depending on your relationship with Rebiz, we may process the following categories of information.

3.1. Personal and contact information

• Full name
• Date of birth and nationality
• Residential or business address
• Email address and telephone number
• Identity document information
• Account credentials and preferences

3.2. Business and compliance information

• Business registration and tax identification details
• Business activity and ownership structure
• Information about directors, authorized representatives, and beneficial owners
• Identity verification documents and results
• Information concerning the nature and purpose of business activities
• Source-of-funds information, where required
• Sanctions, politically exposed person (PEP), and compliance screening results

3.3. Transaction and financial information

• Invoice and commercial transaction details
• Customer and counterparty information
• Payment amounts, currencies, and transaction references
• Bank account and payout information
• Payment status and supporting documentation
• Information necessary to administer commercial transactions

3.4. Technical and usage information

• IP address
• Device and browser information
• Login and account activity
• Security and diagnostic records
• Website and platform usage information
• Cookie identifiers and analytics data, where applicable

3.5. Communications

• Customer support requests
• Correspondence with Rebiz
• Documents and information submitted through the platform
• Communications concerning onboarding, verification, and transactions

Personal data may be obtained directly from individuals, their representatives, participating companies, public registers, verification providers, financial institutions, or other lawful sources.

Where personal data is obtained indirectly, we provide the information required by Article 14 GDPR, unless an applicable exception applies.

We limit collection to information reasonably necessary for specified and legitimate purposes.

We process personal data for the following purposes and under the corresponding legal bases.

Account registration and management

To create, maintain, authenticate, and administer user accounts.

Legal basis: Article 6(1)(b) GDPR, where processing is necessary for a contract with the individual or steps requested before entering into a contract; otherwise Article 6(1)(f), where appropriate.

Provision of services

To provide access to business infrastructure, administer commercial arrangements, manage invoices, and coordinate related operations.

Legal basis: Article 6(1)(b), 6(1)(c), or 6(1)(f) GDPR, depending on the activity and the individual's relationship with Rebiz.

Identity verification and compliance

To perform customer identification, business verification, applicable sanctions screening, fraud prevention, and compliance assessments.

Legal basis: Article 6(1)(c) GDPR where processing is required by law, or Article 6(1)(f) where processing is necessary for legitimate compliance and risk-management interests and is legally permitted.

Transaction administration

To manage transaction information, coordinate payment-related processes, and maintain relevant business records.

Legal basis: Article 6(1)(b), 6(1)(c), or 6(1)(f) GDPR, as applicable.

Accounting, tax, and legal obligations

To comply with statutory reporting, recordkeeping, regulatory, and other legal obligations.

Legal basis: Article 6(1)(c) GDPR.

Security and fraud prevention

To protect users, prevent unauthorized access, detect misuse, and maintain platform integrity.

Legal basis: Article 6(1)(f) or 6(1)(c) GDPR, as applicable.

Communications and customer support

To respond to inquiries, resolve issues, and provide operational notifications.

Legal basis: Article 6(1)(b) or 6(1)(f) GDPR, as applicable.

Analytics and marketing

To understand website performance, improve our services, and measure advertising effectiveness.

Legal basis: Article 6(1)(a) GDPR where consent is required, or another applicable lawful basis.

Where we rely on legitimate interests, we balance those interests against the rights and freedoms of affected individuals.

Where consent is the legal basis, it may be withdrawn at any time without affecting prior lawful processing.

If special categories of personal data or data concerning criminal convictions and offences are processed, the additional conditions imposed by GDPR must also be satisfied.

Rebiz may perform identity verification and compliance checks before providing access to certain services and during an ongoing business relationship.

These checks may include:

• Identity and document verification
• Verification of company information and ownership
• Identification of beneficial owners and authorized representatives
• Sanctions and PEP screening
• Assessment of business activities and relevant transaction risks
• Requests for additional information or supporting documentation

We may use automated systems, public registers, specialist databases, and external verification providers.

Access to certain services may be delayed, restricted, or refused where required information is missing, verification cannot be completed, applicable legal restrictions arise, or relevant compliance requirements are not satisfied.

Where required by law, compliance information may be retained after the customer relationship ends.

We may also share relevant information with competent authorities when legally required.

Rebiz uses automated technologies to support identity verification, sanctions screening, fraud prevention, compliance assessments, and customer onboarding.

Automated processing may involve evaluating identity verification results, document validity, relevant database matches, inconsistencies in submitted information, and transaction-related risk indicators.

Such processing may result in account approval, requests for additional information, temporary restrictions, or referral for further assessment.

Where an adverse decision based solely on automated processing would produce legal or similarly significant effects for an individual, Rebiz will apply the requirements of Article 22 GDPR.

Such decisions will be made only where permitted under an applicable legal exception and subject to the safeguards required by law.

Where applicable, individuals have the right to request human intervention, express their point of view, and contest a decision.

Requests concerning automated decisions may be submitted to info@rebiz.pro.

Human review, where required, must involve a meaningful assessment by an authorized person with the ability to reconsider the outcome, subject to mandatory legal restrictions.

Certain information relating to financial crime prevention, sanctions enforcement, or compliance investigations may be withheld where disclosure is prohibited by applicable law.

Rebiz provides technological and operational infrastructure for administering commercial transactions and coordinating payment-related processes.

Regulated banking and payment services are performed by the relevant banks, financial institutions, or authorized payment service providers.

Rebiz does not represent itself as a bank or payment institution merely by providing access to this infrastructure.

To support commercial transactions and related payment processes, we may process or share:

• Identification and contact details
• Bank account and beneficiary information
• Invoice and transaction details
• Payment references, amounts, and currencies
• Counterparty information
• Documents required for verification and compliance

Banks and payment service providers may act as independent data controllers and process information in accordance with their own legal obligations and privacy notices.

The legal entity identified as the contracting party in a particular commercial transaction may also process relevant personal data as an independent controller.

Rebiz does not sell personal data.

We may disclose personal data where necessary to provide our services, administer transactions, maintain security, or comply with applicable law.

Recipients may include:

• Participating legal entities and business partners
• Banks and payment service providers
• Identity verification, AML, and compliance providers
• Cloud hosting, IT infrastructure, and security providers
• Accounting, legal, tax, and professional advisers
• Analytics and advertising providers, subject to applicable consent requirements
• Regulatory, judicial, and other competent public authorities where legally required

We share only information relevant to the applicable purpose.

Where external service providers process personal data on our behalf, we use appropriate contractual safeguards, including data processing agreements under Article 28 GDPR where required.

Independent controllers are responsible for their own processing activities.

Rebiz may work with participating companies, service providers, financial institutions, and counterparties across multiple jurisdictions.

Accordingly, personal data may be transferred to or accessed from countries outside the European Economic Area (EEA).

Where GDPR rules on international data transfers apply, we rely on an appropriate legal mechanism, including:

• European Commission adequacy decisions
• Standard Contractual Clauses approved by the European Commission
• Other transfer mechanisms permitted under Chapter V GDPR

We implement additional safeguards where required.

Individuals may request information about applicable international transfer safeguards by contacting info@rebiz.pro.

Rebiz retains personal data only for as long as necessary for the purposes for which it was collected, subject to applicable legal, regulatory, accounting, tax, and compliance requirements.

Retention periods are determined according to the following categories and criteria.

Account and customer information

Retained during the business relationship and, where necessary, afterward for account closure, dispute resolution, legal claims, security, or compliance purposes.

KYC and AML records

Where statutory AML retention obligations apply, relevant identification and transaction records are generally retained for five years following termination of the business relationship or completion of an occasional transaction, subject to applicable statutory extensions.

Other compliance records are retained for the periods required or permitted by applicable law and the relevant processing purpose.

Accounting and transaction records

Retained for the applicable statutory accounting and tax periods, including any legally applicable suspension, interruption, or extension of limitation periods.

Communications and support records

Retained for periods necessary to resolve inquiries, maintain relevant business records, and address potential legal claims.

Technical and security records

Retained for documented periods appropriate to the relevant operational and security purposes, taking into account the necessity and proportionality of retention.

Marketing and analytics information

Retained according to the purposes of processing, applicable consent, configured retention periods, and legal requirements.

Where more than one lawful retention requirement applies, the relevant information may be retained for the longest applicable period.

Once personal data is no longer necessary and no valid retention requirement applies, it is deleted or anonymized using appropriate measures.

Rebiz implements technical and organizational measures appropriate to the nature of the personal data processed and the associated risks.

These measures may include:

• Role-based access restrictions
• Account authentication and security controls
• Encryption where appropriate
• Monitoring and security logging
• Secure data storage and transmission
• Backup and recovery procedures
• Confidentiality requirements
• Incident response measures

Access to personal data is restricted to authorized individuals and service providers who require it for legitimate purposes.

No electronic system can be guaranteed to be completely secure. Rebiz reviews and adjusts its safeguards in light of relevant risks and operational requirements.

Where a personal data breach occurs, we comply with applicable notification obligations.

Our website uses cookies and similar technologies for essential functionality, analytics, and advertising measurement.

Essential technologies

These support website operation, security, session management, and other necessary functionality. They may be used without consent where permitted by applicable law.

Analytics and advertising technologies

Subject to user consent, our website may use technologies provided by:

• Google Ireland Limited, including Google-related analytics and advertising technologies
• Meta Platforms Ireland Limited, including Meta-related advertising measurement technologies

Depending on the technologies activated, cookies may include `_ga`, `_gcl`-related identifiers, `_fbp`, and `_fbc`.

These technologies may collect information about website usage, interactions, device characteristics, and advertising attribution.

Certain information may be transferred outside the EEA, including to the United States, subject to applicable transfer safeguards.

Consent management

Non-essential analytics and advertising technologies are not activated before the required consent has been obtained.

Our cookie consent interface allows users to:

• Accept optional cookies
• Reject optional cookies using the "Essential only" option
• Manage cookie categories
• Change or withdraw previously provided consent

Consent preferences can be changed through Cookie settings available in the website footer.

When consent for optional tracking technologies is withdrawn, Rebiz disables the corresponding tracking technologies and takes steps to remove the relevant cookies within its technical control.

Information about cookie providers, purposes, and retention periods is provided through the website's cookie information and consent interface.

Withdrawing consent does not affect processing lawfully carried out before withdrawal.

Subject to the conditions and limitations established by applicable law, individuals have the following rights under GDPR.

Right of access

To obtain confirmation of whether personal data is processed and access relevant information.

Right to rectification

To request correction of inaccurate or incomplete personal data.

Right to erasure

To request deletion where the applicable legal conditions are satisfied.

Right to restriction

To request restriction of processing in circumstances provided by law.

Right to data portability

To receive applicable personal data in a structured, commonly used, machine-readable format.

Right to object

To object to certain processing based on legitimate interests, including related profiling.

Right to withdraw consent

To withdraw consent at any time where processing is based on consent.

Rights relating to automated decisions

To exercise applicable rights and safeguards concerning solely automated decisions under Article 22 GDPR.

Right to lodge a complaint

To submit a complaint to a competent data protection supervisory authority.

Requests may be submitted to info@rebiz.pro.

We may request reasonable information to verify identity before processing a request.

We generally respond within one month, subject to extensions permitted by GDPR.

Certain rights may be restricted where retention or processing is necessary to comply with applicable legal obligations.

Certain personal data is necessary to create an account, verify identity, establish a business relationship, or provide particular services.

Where information is required by law or necessary for the relevant contractual relationship, failure to provide it may prevent Rebiz from completing onboarding or providing the requested service.

Information collected for optional analytics or marketing purposes is not a condition of using essential website functionality.

The Rebiz platform may integrate with or provide access to third-party services, including financial institutions, verification providers, and external technology platforms.

These providers may process personal data independently under their respective privacy policies.

Rebiz is not responsible for processing activities independently determined by third-party controllers.

We encourage individuals to review the relevant privacy notices when engaging with these providers.

Rebiz is intended for adults acting in a business or professional capacity.

Our services are not directed at children, and children are not eligible to register for Rebiz accounts.

We do not knowingly collect personal data from children for account registration or service provision.

Where we identify processing involving children's personal data, we apply the relevant requirements of applicable data protection law.

We may update this Privacy Policy to reflect changes in our services, processing activities, technologies, or applicable legal requirements.

The current version will be available at:

https://rebiz.pro/privacy-policy

The date of the most recent update is shown at the beginning of this document.

Where legally required, additional notice or consent will be provided or obtained.

For privacy inquiries, requests relating to personal data, or questions about this Policy, contact:

REBIZ SERVICE SP. Z O.O.

al. Prymasa Tysiąclecia 83A lok. 133

01-242 Warszawa, Poland

KRS: 0001167335

NIP: 5273160998

Email: info@rebiz.pro

Website: https://rebiz.pro

Individuals may lodge a complaint with a competent data protection authority.

The supervisory authority in Poland is:

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Website: https://uodo.gov.pl

© 2026 Rebiz. All rights reserved.