The Terms and Conditions of the Sandbox Program at Biuro Informacji Kredytowej S.A. (hereinafter: “Terms and Conditions”) shall stipulate how the Sandbox Program is organized.
The objective of the Sandbox Program is to select entities implementing innovative financial solutions with the use of modern technologies and establish cooperation between Biuro Informacji Kredytowej S.A. and selected entities.
The following capitalized terms shall have the following meaning:
Applicant – it shall be understood as a natural person or legal person with their registered office within the European Economic Area or the United Kingdom of Great Britain and Northern Ireland , which applies to participate in the Sandbox Program.
Application – it shall be understood as the entire documentation provided by the Applicant.
BIK Group – it shall be understood as the following entities: Biuro Informacji Kredytowej S.A. with its registered office in Warsaw (02-679) at ul. Zygmunta Modzelewskiego 77 A, registered in the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register, under number 0000110015, holding NIP [Tax Identification Number] 9511778633 as well as Biuro Informacji Gospodarczej InfoMonitor S.A. (hereinafter: “BIG InfoMonitor”) with its registered office in Warsaw (02-679) at ul. Zygmunta Modzelewskiego 77 A, registered in the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register, under number 0000201192, holding NIP [Tax Identification Number] 526 274 43 07.
Client of the Sandbox Organizer – an entity which is a client of the Sandbox Organizer, taking advantage of the Solution as part of a Test.
Client of the Tester – an entity which is a client of the Tester, taking advantage of the Solution as part of a Test.
Confidential Information – it shall be understood as: any and all information related to the Solution (including Testes Solution), any other information related to the Sandbox Program marked as a trade secret of the Applicant or Tester, respectively, as well as information otherwise deemed confidential, related to the Sandbox, which may be transferred during the Sandbox Program or which has been or will be obtained by BIK otherwise in relation to the Sandbox Program, irrespective of whether it is transferred in an oral, written or any other form, including any and all notes, reports, analyses, compilations, forecasts, studies, summaries, and other materials.
Form – it shall be understood as an application form filled out with data, submitted via the website of BIK, constituting Appendix No. 1 to the Terms and Conditions.
Sandbox – it shall be understood as an IT environment used to conduct tests of innovative financial solutions, implemented with the use of modern technologies, made available to Testing Entities by BIK.
Sandbox Organizer, BIK – it shall be understood as Biuro Informacji Kredytowej S.A. with its registered office in Warsaw (02-679) at ul. Zygmunta Modzelewskiego 77 A, registered in the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register, under number 0000110015, holding NIP [Tax Identification Number] 9511778633.
Sandbox Program – it shall be understood as an initiative of the Sandbox Organizer under which the Sandbox is made available to Testing Entities.
Service Sheet – a document describing the type of data made available as part of a specific BIK OpenAPI service as well as the principles for using it by the Tester under the Sandbox Program.
Solution – it shall be understood as an innovative technological solution of the Tester / Applicant.
Test – it shall be understood as a process of verifying the trial implementation of the Solution under the Sandbox.
Tested Solution – it shall be understood as a Solution which has been tested under the Sandbox Program.
Tester – it shall be understood as a natural person or legal person with their registered office within the European Economic Area or the United Kingdom of Great Britain and Northern Ireland, which has been qualified to participate in the Sandbox Program.
An announcement of the recruitment of Testing Entities for the Sandbox Program shall be published on the BIK website. Recruitment for the Sandbox Program shall be conducted on a continuous basis.
In order to express their willingness to participate in the Sandbox Program, the Applicant shall fill out the Form and send documents and information indicated in Appendix no. 1 to the Terms and Conditions.
Applying Entities shall be qualified for the Sandbox Program in two stages:
Stage 1 – formal assessment of the Applicant (12 days of receiving the Application as prescribed in § 2 point 2),
Stage 2 – substantive assessment of the Applicant (7 days of the end of the formal evaluation with the possibility of extending this period in particularly complicates cases). A decision on eligibility of an Applicant for the Program shall be provided within 7 days of the substantive assessment.
At Stage 1 of the qualification of entities intending to participate in the Sandbox Program, the Sandbox Organizer shall formally verify the information presented on the Applicant, including information required in accordance with Appendix No. 1 to the Terms and Conditions. The formal assessment shall consist in checking and verifying the completeness of the documents submitted in accordance with Appendix No. 1 to the Terms and Conditions as well as the fulfillment of formal requirements for qualification for the Sandbox Program, i.e.:
completeness of the Application submitted,
conducting business activity in the field of developing computer software, developing innovative technological solutions, or providing financial services,
no arrears with the payment of public levies,
absence on the List of Public Warnings of the PFSA.
Should it be determined that the Application is incomplete in the scope necessary to conduct the assessment at Stage 1 (lack of documents determined in Appendix No. 1 to the Terms and Conditions), the Sandbox Organizer shall inform the Applicant of the deficiencies determined and set a 7-day time limit for completing the missing information by the Applicant. Should the Applicant fail to send the required documentation within the time limit indicated above, the Sandbox Organizer shall inform the Applicant that they have not been qualified for the Sandbox Program.
At Stage 2 of the qualification of entities intending to participate in the Sandbox Program, the Sandbox Organizer shall substantively verify the information presented on the selected Applicant in the Form, taking the following into consideration:
innovativeness of the solution – an analysis of innovativeness shall be conducted by verifying whether the idea presented does not use or copy solutions that are commonly used on the market (in terms of product, service, operating model, etc.),
business potential of the implementation of the Solution on the market, also including the possibility of implementing it as part of the activity of the Sandbox Organizer,
stage of development of the Solution (implementation in a production environment, market opinion, market verification),
experience of the Applicant and their key employees with regard to developing and maintaining innovative technological solutions,
existing validation of the Solution,
whether no competitive activity is conducted against BIK and BIG InfoMonitor,
business model – assessment in terms of the following criteria:
competitiveness of the Solution – rendering it possible to differentiate the offer of the Applicant from the offer of their competitors, innovativeness, and degree to which is meets market needs,
recipients of the Solutions – who may be recipients of the Solution of the Applicant.
key resources needed to offer the Solution – assets (tangible and intangible) necessary to provide the clients with the Solution of the Applicant,
key partners – entities necessary for the Applicant to provide the assets indicated to clients (suppliers and cooperators),
key activities – activities necessary to provide the Solution to clients,
distribution channels – ways of providing the assets indicate to the group of clients of the Applicant.
Having conducted the assessments indicated in § 2 point 3, the Sandbox Organizer shall provide information on approval or rejection of the Applicant via electronic mail to the e-mail address indicated by the Applicant on the Form.
Should the Sandbox Organizer accept the participation of the Applicant in the Sandbox Program, acceptance by the Sandbox Organizer of the application sent by the Applicant as part of the Form along with acceptance of these Terms and Conditions shall be equal to the beginning of the cooperation with the Applicant under the Sandbox Program on the terms and conditions described in these Terms and Conditions.
The Applicant whose Application has been rejected shall have the right to appeal against the decision of the Sandbox Organizer with a request for reconsidering the Application. An appeal against the decision may be filed within 5 business days from the date of receiving information on rejection. The appeal against the decision shall be filed by electronic mail to the address indicated in the information on the rejection of the Application of the Applicant. The appeal against the decision shall contain arguments in favor of reconsidering the Application by the Sandbox Organizer.
The Sandbox Organizer shall consider the appeal against the decision with a request for reconsidering the Application within 14 business days. Should the arguments presented by the Applicant be deemed justified by the Sandbox Organizer, the Sandbox Organizer shall inform the Applicant of the result of considering the appeal and accepting or rejecting the Applicant applying for the role of a Tester under the Sandbox Program.
The Sandbox Organizer reserves the right not to qualify the Applicant for the Sandbox Program for reasons related to the safety of clients, personal data, or economic transactions, including counteracting money laundering and terrorism financing.
The BIK Sandbox shall be a copy of the production environment with a scope of data limited to the business specificity of the services provided under BIK Hub. Data provided under the Sandbox shall be permanently anonymized data and statistical data which cannot identify specific entities and natural persons. At the same time, such data shall reflect the full range of products from the production system within the scope of the services provided under BIK Hub. A business description of particular services provided under BIK Hub is available on the website http://bikhub.pl/ Technical specification is available on the BIK Hub Portal.
Access to the Sandbox shall be granted to Testing Entities in accordance with the technical specification of particular services included in Open Api after the Sandbox Organizer has previously accepted the Application submitted by the Applicant.
The Sandbox Organizer shall provide the Tester with appropriate identifiers and passwords. Access to the Sandbox shall be possible all around the clock, with technical support of the Sandbox Organizer provided on business days between 9.00 a.m. and 5.00 p.m. Contact details shall be provided to Applying Entities once their participation in the program has been confirmed.
The Tester may use the services provided under the Sandbox in any manner and without limitations unless it has been stipulated otherwise in the business specification.
Under the Sandbox, BIK may provide access to data from external registers.
The terms of and principles for providing data in all services have been described in the Service Sheets. Should the Tester be willing to use a specific service, they shall be obligated to accept the terms of providing data described in a given Service Sheet. Service Sheets shall be provided for approval after the Entity has been qualified for the Sandbox Program.
The Tester shall be solely responsible for any third party claims, including Clients of the Tester and Clients of the Sandbox Organizer, addressed towards the Sandbox Organizer, which have arisen in relation to the participation of the Tester in the Sandbox Program.
Should any claims related to the participation of the Tester in the Sandbox Program be addressed to the Sandbox Organizer or another entity participating in the Sandbox Program on the side of BIK, the Tester undertakes to release the Sandbox Organizer from liability, participate in court or administrative proceedings, repair any damage related thereto as well as to provide any support necessary to dismiss such claims.
The Sandbox Organizer or any other entity participating in the Sandbox Program on the side of BIK shall not be liable for any losses incurred by the Tester, entities associated with the Tester within the meaning of Article 11a(1)(5) of the Polish Act of 15 February 1992 on Corporate Income Tax, in relation to the participation of the Tester in the Sandbox Program.
The Sandbox Organizer shall be obligated to keep any and all Confidential Information which they obtain under the Sandbox Program strictly confidential.
The Sandbox Organizer or the Tester shall be entitled to disclose the Confidential Information if this is required by mandatory provisions of law or rulings of administrative bodies.
The Sandbox Organizer shall be entitled to provide the Confidential Information obtained from the Tester to their employees and associates as well as any other entities whose presence is necessary to conduct the Sandbox Program.
With regard to the persons indicated in § 5 point 3, the Sandbox Organizer and the Tester shall:
obligate such entities to keep confidentiality to the extent to which the Sandbox Organizer and the Tester are obligated to do so before the Confidential Information is made available to them,
be held liable for the actions and omissions of such entities as for their own actions.
The Sandbox Organizer shall have the right to make available (publish) any and all content covered by the Form of a given Tester for the purposes related to the implementation of the Sandbox Program or for promotional purposes, in particular Sandbox Organizer’s communications, on the website or in reports on the functioning of the Sandbox Program, including reports drawn up on a periodical basis.
Acceptance of the Terms and Conditions shall be equal to the Tester making a statement on the confidentiality obligation constituting Appendix No. 5.
The Tester shall determine both the testing period applied for, however, not longer than 3 months, and the scope of the Test in the Form.
When conducting the Test, the Tester may request the Sandbox Organizer to change the testing period and scope of the Test, however, the entire testing period may not be longer than 6 months.
The Tester shall be obligated to protect the identification data provided to them and not to disclose it to third parties.
During and after the Test, the Tester shall be obligated to refrain from:
copying any elements of the Sandbox,
decompiling the source code of the elements of the Sandbox,
violating or circumventing protection of the Sandbox,
entering personal data into the Sandbox,
taking actions which may be detrimental to the Sandbox Organizer or Clients of the Tester and Clients of the Sandbox Organizer.
The Tester may conduct the Test with the participation of Clients of Testing Entities in order to collect their opinions and analyze their behaviors, whereas:
The Tester may not take from Clients of Testing Entities any financial means or any other benefit of a financial nature for the Test or other activities conducted under the Sandbox Program,
The Tester may offer Clients of Testing Entities a financial consideration or other remuneration or a service in exchange for participating in the Test,
Clients of Testing Entities must be informed of a test nature of a service and shall be obligated to waive any claims related to the participation in the Test,
The Sandbox Organizer may request the Tester to present opinions of Clients of the Tester during and after the Test.
As part of the Test, the Tester may take advantage of substantive support provided by the Sandbox Organizer.
The Tester shall be obligated to provide the Sandbox Organizer with access to the IT environment used by the Tester as part of the Test of the Solution for the purposes of assessing whether the Solution operates safely and correctly.
The Tester shall be obligated to provide the Sandbox Organizer with access to the necessary technical documentation of the Solution.
The Tester shall be obligated to cooperate with the Sandbox Organizer when conducting the Test and following all instructions of the Sandbox Organizer related to the implementation of the Tests of the Solution.
The Tester may withdraw from the Sandbox Program at any time.
The Sandbox Organizer may decide to terminate the participation of the Tester in the Sandbox Organizer immediately if the Tester violates provisions of law or provisions of these Terms and Conditions.
As part of the Test, the Tester shall be obligated to provide cyclical reports on the progress in the works conducted. A cyclical report form shall be adjusted to the scope of tests and in line with Appendix No. 6 to the Terms and Conditions.
Detailed information concerning personal data processing can be found in Appendices No. 3 and 4 to the Terms and Conditions.
The Tester shall be obligated to ensure security of the information obtained as part of the participation of the Tester in the Sandbox Program and to apply guidelines, suitable for this type of information, obtained from BIK.
The Tester shall be obligated to ensure that the information obtained as part of the participation in the Sandbox Program shall only be accessible to authorized employees of the Tester for the purposes related to the participation in the Sandbox Program.
The Tester shall be obligated to inform the employees of the Tester referred to in §8 point 2 of applicable rules related to information security, arising out of the participation in the Sandbox Program, and to obligated them to keep confidentiality.
The Tester shall be fully liable for the actions and omissions of the entities indicated in § 8 point 2 as for their own actions.
The Tester shall be obligated to ensure the level of security of the devices used as part of the participation in the Sandbox Program in accordance with best practices and standards as well as to apply guidelines, suitable for this type of information, obtained from BIK. The Tester shall ensure at least the following:
physical protection of mobile devices,
supervision over software installed on mobile devices,
management of mobile device access rights,
protection of mobile devices from malware,
application of cryptographic techniques, which ensure security of data stored and transferred,
safe back-up,
protection against external interference, e.g. local firewall,
possibility of managing devices remotely.
The Tester shall be obligated to have necessary technical measures, sufficiently qualified staff, experience, and knowledge enabling them to participate in the Sandbox Program.
The Tester shall be obligated to ensure that any and all confidential information obtained as part of the participation in the Sandbox Program shall be transferred in a manner ensuring both security and confidentiality of such information and that such information shall only be transferred by means of encrypted messages, on encrypted carriers, or with the use of encrypted communication channels.
The Tester shall be obligated to ensure protection of the documentation indicated in § 8 point 7 of the Terms and Conditions in accordance with the best practices and guidelines, in particular:
documentation may only be made available to persons authorized to access such information based on an agreement with the Tester,
to mark the documentation with an appropriate clause according to the classification of information of the Tester,
documentation shall be stored in a repository ensuring that its confidentiality and integrity are protected,
must register events related to access to a safe repository and store safe records for no longer than 3 years.
The Sandbox Organizer shall be authorized to conduct controls of the equipment used by the Tester participating in the Sandbox Program.
Should any irregularities be identified during the control conducted, the Tester shall be obligated to remove such irregularities at their own cost within the time limit agreed upon with the Sandbox Organizer. Each time BIK requests so, the Tester shall render it possible to conduct a control of procedures and physical safeguards responsible for ensuring information security on the side of the Tester.
The Tester shall be obligated to provide a list of authorized employees referred to in § 8 point 2 above to the Sandbox Organizer at their request within 7 days of such a request.
The Sandbox Organizer shall be entitled to store data obtained during the Test for a period necessary to achieve the goals of the Sandbox, i.e. for 5 years of the end of Tests.
The Sandbox Organizer shall store the data of the Tester which has finished tests in the Sandbox for the period of 5 years of the end of a Test.
The Sandbox Organizer shall store the data of the Applicant for the duration of the Sandbox Program.
The Sandbox Organizer may process data indicated in § 9 point 1 and § 9 point 2 as well as § 9 point 3 within BIK Group.
The results subject to intellectual or industrial property rights as well as the results not subject to such protection, created as a result of the participation of the Tester in the Sandbox Program, shall be owned by the Tester. The Tester shall have all the rights to use the intellectual property used under the Sandbox Program subject to § 30, whereas the results referred to in the preceding sentence shall not be understood as the Sandbox Organizer’s instructions with regard to the Solution which are given during the Test, elements of the test environment of the Sandbox Organizer as well as any other information provided by the Sandbox Organizer to the Tester.
The Sandbox and changes thereto resulting from the activities of the Sandbox Program, including in particular any and all elements of the test environment, shall be subject to exclusive intellectual and industrial property rights of the Sandbox Organizer. The Tester shall acquire neither intellectual and industrial property rights nor other rights to the Sandbox nor any data provided by BIK.
The Sandbox Organizer shall have the priority right with regard to the implementation of the Tested Solution (including a possibility of purchasing or obtaining an exclusive license for the Tested Solution) for the period of twelve months of the end date of the Test of the Solution.
Should the Tester intend to commercialize the Tested Solution (i.e. market it as a service, offer a license for software, transfer copyright, or in any other form) before the deadline indicated in § 11 point 1, the Tester shall be obligated to notify the Sandbox Organizer of this intention by delivering letter electronically (e-mail address: bikhub@bik.pl) and offer covering the planned form of commercial implementation of the Tested Solution. Within 45 calendar days of receiving the offer, the Sandbox Organizer may make a written statement on exercising the priority right or a statement on waiving the priority right.
Should the Sandbox Organizer makes the statement on waiving the priority right or fail to make any statement at all, the Tester shall be entitled to commercialize the Tested Solution freely on the terms stipulated in the offer referred to in § 11 point 2 with a proviso that possible commercial implementation of the Tested Solution by a third party may not be carried out on the terms that are more favorable than those constituting the subject matter of the offer addressed to the Sandbox Organizer by the Tester in accordance with § 11 point 2. Should the Tester intend to have the Tested Solution implemented commercially by a third party, along with the offer addressed to the Sandbox Organizer, the Tester shall send a template of an agreement with such a third party as well as financial terms agreed upon.
Should the Sandbox Organizer make the statement on exercising the priority right, the Tester along with the Sandbox Organizer shall commence negotiations of detailed terms of commercialization of the Tested Solution within 7 days of receiving the statement by the Tester.
The negotiations referred to in § 11 point 4 may not last longer than 90 days.
The Tester shall be obligated to refrain from commercializing the Tested Solution for the period referred to in § 11 point 1 within the scope and on the terms other than those stipulated in the offer referred to in § 11 point 2.
Should it be determined that the activity of the Tester with regard to the participation in the Sandbox Program is conducted in violation of law or poses a threat to the interest of the Clients of Testing Entities, BIK may:
limit the scope of activities conducted by the Tester under the Sandbox Program;
demand that the Tester remove the irregularities identified within a specified time limit;
suspend access of the Tester to the test environment until the irregularities identified are removed;
terminate the cooperation with the Tester under the Sandbox Program with immediate effect.
Any matters not regulated by these Terms and Conditions shall be governed by the provisions of the law commonly applicable in the territory of the Republic of Poland.
The Sandbox Organizer reserves the right to amend the Terms and Conditions at any time. Information on the amendment to the Terms and Conditions as well as the Terms and Conditions amended shall be published by the Sandbox Organizer on the BIK website.
The Terms and Conditions shall be available in electronic form on the website belonging to the Sandbox Organizer.