1. Who is responsible for the data
The BCR Bilans application is operated by BCR Group Sp. z o.o., ul. Kowalska 5/203, 20-115 Lublin, Poland, National Court Register (KRS) 0001187674, Tax ID (NIP) 9462756777, REGON 542416175 ("BCR Group"). Data protection contact: roman.kachniuk@bcr-group.pl, tel. +48 459 567 480.
In the application BCR Group acts in two roles:
As a processor with regard to data contained in the client's accounting documents: data of the client's counterparties, sole traders, the client's employees and data from the client's bank accounts. The controller of this data is the client; BCR Group processes it on the client's behalf under the accounting services agreement and the data processing agreement concluded with it (Art. 28 GDPR). The client determines the purposes and legal bases of this processing; BCR Group is responsible for the manner of processing, its security and the selection of sub-processors.
As a controller with regard to data of the application's users (persons authorised by the client and BCR Group staff), security logs, and data processed to fulfil BCR Group's own legal obligations and to defend legal claims.
2. What BCR Bilans is
BCR Bilans is a Microsoft Teams application that BCR Group provides to its clients under an accounting services agreement. It brings the client's accounting documents into one place (invoices from the Polish national e-invoicing system KSeF, scanned documents, bank transactions) and supports the work of BCR Group accountants. Each client can access only its own company's data.
3. Data processed
User data (BCR Group as controller): name, business e-mail address issued by BCR Group, role in the client's company, Microsoft account identifier, sign-in and application event logs.
Data in the client's documents (BCR Group as processor):
- content of purchase and sales invoices retrieved from KSeF or uploaded as scans, including counterparty data (name, tax ID, address, account number), data of sole traders, line descriptions and amounts;
- data from the client's bank accounts: account numbers, balances, transaction history (date, amount, title, counterparty name and account), retrieved only after the client has given consent in its bank's own interface (section 7); the application cannot initiate payments or perform operations on the account;
- counterparty data from public registers: VAT status and account numbers from the Polish VAT taxpayer list, National Court Register (KRS) data, EU VAT status from VIES;
- the client's employee data, if the client uses this function: name, personal ID number (PESEL), contract data, payroll data, to the extent necessary for bookkeeping and settlements.
4. Purposes and legal bases
Processing on the client's behalf. Data in the client's documents is processed to keep the client's books, tax records and settlements: retrieving and organising documents, matching transfers to invoices, verifying counterparties, preparing postings and the registers required by law. The legal bases lie with the client as controller: performance of its contracts with counterparties and employees, its obligations under the Polish Accounting Act, tax laws and labour law, and its legitimate interest in the correct settlement of its business. BCR Group processes this data only to the extent and for the purposes set out in the agreement with the client.
BCR Group's own processing.
| Purpose | Legal basis (GDPR) |
|---|---|
| Granting and maintaining users' access to the application | Art. 6(1)(b) (agreement with the client the user represents) and Art. 6(1)(f) (legitimate interest: performing the agreement with the client towards the persons representing it) |
| Application security, event logs, abuse detection | Art. 6(1)(f) (legitimate interest) |
| Settlement of BCR Group's services with the client, archiving BCR Group's own records | Art. 6(1)(c) (Accounting Act, Tax Ordinance) |
| Establishing and defending legal claims | Art. 6(1)(f) |
- Purpose
- Granting and maintaining users' access to the application
- Legal basis (GDPR)
- Art. 6(1)(b) (agreement with the client the user represents) and Art. 6(1)(f) (legitimate interest: performing the agreement with the client towards the persons representing it)
- Purpose
- Application security, event logs, abuse detection
- Legal basis (GDPR)
- Art. 6(1)(f) (legitimate interest)
- Purpose
- Settlement of BCR Group's services with the client, archiving BCR Group's own records
- Legal basis (GDPR)
- Art. 6(1)(c) (Accounting Act, Tax Ordinance)
- Purpose
- Establishing and defending legal claims
- Legal basis (GDPR)
- Art. 6(1)(f)
5. Use of artificial intelligence
BCR Group uses large language models of a third-party provider (section 6) to read scanned documents, match transfers to invoices and prepare posting proposals. The model receives the content of the document or transfer and the dictionary data needed for the proposal. Every proposal is reviewed by a BCR Group accountant before it is entered into the books. The model provider acts as a sub-processor under a data processing agreement, processes data solely to return the result, does not use it to train its models, and retains inputs and outputs for no longer than 30 days for abuse detection unless zero retention has been agreed. The application does not make decisions about natural persons based solely on automated processing that would produce legal effects.
6. Recipients
Sub-processors, acting on BCR Group's instructions under data processing agreements (the client authorises them in the data processing agreement and is informed of changes):
| Entity | Scope | Location |
|---|---|---|
| Microsoft Ireland Operations Ltd. | application and database hosting (Microsoft Azure, Poland Central region), Microsoft 365, Teams and SharePoint within the EU Data Boundary | European Union |
| Anthropic PBC | processing of document and transfer content by language models | United States; transfer based on Standard Contractual Clauses (Art. 46(2)(c) GDPR); a copy of the safeguards is available from the contact in section 1 |
- Entity
- Microsoft Ireland Operations Ltd.
- Scope
- application and database hosting (Microsoft Azure, Poland Central region), Microsoft 365, Teams and SharePoint within the EU Data Boundary
- Location
- European Union
- Entity
- Anthropic PBC
- Scope
- processing of document and transfer content by language models
- Location
- United States; transfer based on Standard Contractual Clauses (Art. 46(2)(c) GDPR); a copy of the safeguards is available from the contact in section 1
Independent controllers:
| Entity | Role |
|---|---|
| Enable Banking Oy (Finland), an account information service provider (AISP) supervised by the Finnish Financial Supervisory Authority | provides the client with the account information service based on the consent given at the bank and passes the data to the application; processes data under its own privacy policy |
| the client's banks | provide account data based on the client's consent |
| public authorities | recipients of data to the extent required by law |
- Entity
- Enable Banking Oy (Finland), an account information service provider (AISP) supervised by the Finnish Financial Supervisory Authority
- Role
- provides the client with the account information service based on the consent given at the bank and passes the data to the application; processes data under its own privacy policy
- Entity
- the client's banks
- Role
- provide account data based on the client's consent
- Entity
- public authorities
- Role
- recipients of data to the extent required by law
Data sources from which the application retrieves information: KSeF and the VAT taxpayer list (Ministry of Finance), the National Court Register (Ministry of Justice), VIES (European Commission), the client's banks via Enable Banking, documents provided by the client.
7. Bank account access
Account access is based on consent given by a person authorised on the account in the bank's own interface, using strong customer authentication. The scope of access covers only reading balances and transactions. Access remains active until withdrawn or until the expiry set by the bank; regulations require strong customer authentication to be renewed at least every 180 days, and the bank may require it more often. The application notifies the client before the renewal date. The client may withdraw access at any time: in the application (Settings → Banks → Disconnect), at its bank, or by writing to the contact in section 1. Withdrawal stops the retrieval of new data; data already recorded in the books remains there for the period required by law.
8. Retention
- Accounting documents, invoice data and bank data constituting the client's accounting evidence: for the period specified by the client in the data processing agreement, as a rule 5 years from the beginning of the year following the financial year they relate to, and for tax purposes until the tax liability becomes time-barred. After the agreement ends, data is returned to the client and deleted in accordance with section 9.
- The client's employee records, if processed: for the period required by labour law, as determined by the client.
- Communication between the client and the accountant in the application (questions, clarifications): as part of the accounting records, together with the documents it concerns.
- User data: for the duration of the agreement with the client and 3 years thereafter.
- Technical and security logs: 12 months.
- Database backups: up to 35 days; data deleted from the application disappears from backups after that period.
- Data passed to the language model provider: as described in section 5.
9. End of cooperation
Within 30 days of termination of the agreement with the client, BCR Group hands over the client's documents and statements in open formats (PDF, XML, CSV) or, on request, in an agreed format, and then deletes the client's data from the application, except for data BCR Group must retain under its own legal obligations (records of the service performed, settlements). In case of sudden termination, the client keeps read-only access to the application for 14 days to download its data, unless security requires immediate blocking; in that case data is handed over through another channel.
10. Data subject rights
Every data subject has the right of access, rectification, erasure, restriction, data portability and the right to object to processing based on legitimate interest, within the limits set by law, including the obligation to retain accounting evidence. For data contained in the client's documents, the proper addressee of a request is the client as controller; BCR Group forwards requests it receives to the client and supports the client in handling them. Requests concerning data for which BCR Group is the controller may be sent to roman.kachniuk@bcr-group.pl. Everyone has the right to lodge a complaint with the President of the Polish Personal Data Protection Office (uodo.gov.pl).
11. Security
Access to the application requires an account in BCR Group's Microsoft 365 environment with multi-factor authentication. Data is encrypted in transit and at rest. Data of individual clients is separated at the database level. Keys and credentials are stored in Azure Key Vault. BCR Group staff access is limited to the clients they serve and is logged. BCR Group notifies the client of a personal data breach without undue delay and no later than 48 hours after becoming aware of it.
12. Changes
Changes to this policy are announced in the application and on this page at least 14 days before they take effect. In case of discrepancies between language versions, the Polish version prevails.