The data controller within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) is Marta Pieszczek, registered in Gdańsk, 80-174, ul. Lubowidzka 52, NIP: 5842797510, REGON: 525127961.
GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
Website – the website operated by the Controller at: kprcars.pl.
User – any natural person visiting the Website or using one or more of the services or functionalities described in this Policy.
In connection with the User's use of the Website, the Controller collects data to the extent necessary to provide individual services. The detailed rules and purposes for processing personal data collected during the User's use of the Website are described below.
Personal data of all Users using the Website (including IP addresses or other identifiers and information collected via cookies) are processed by the Controller:
User activity on the Website, including personal data, is recorded in system logs (a computer programme used to store a chronological record of information about events and actions relating to the IT system used by the Controller to provide services). Information collected in the logs is processed primarily for purposes related to the provision of services. The Controller also processes it for technical and administrative purposes, to ensure the security of the IT system and to manage that system, as well as for analytical and statistical purposes – in this respect the legal basis for processing is the legitimate interest of the Controller (Art. 6(1)(f) GDPR).
The Controller processes Users' personal data for the purpose of carrying out marketing activities, which may consist of sending the User marketing content matching their interests (newsletter).
For this purpose, following the User's prior consent, the User's personal data provided on the Website – such as an e-mail address – will be transferred to the Controller's partner, GetResponse S.A., for the purpose of sending an e-mail containing content of interest to the User.
The Controller does not make automated decisions in relation to the User, and the User's personal data is not subject to profiling.
The Controller processes personal data of Users who have concluded a booking agreement with the Controller through the Website. In connection with the use of the booking service, the User is required to provide their first and last name (or company name and NIP number), e-mail address, phone number and password in order to correctly fulfil the service.
The Controller's Website uses "cookies". These are short text files saved on the User's computer, phone, tablet or other device. They may be read by the Controller as well as by systems belonging to third parties whose services the Controller uses (such as Google). Cookies typically contain the name of the website from which they originate, the length of time they are stored on the end device, and a unique number. More information about cookies is available at www.allaboutcookies.org.
The Website uses the following types of cookies:
– "essential" cookies, which enable the use of services available on the Website,
– security cookies,
– "advertising" cookies, which enable the delivery of advertising content tailored to the User's interests,
– "performance" cookies, used to obtain information about how Users use the Website,
– "functional" cookies, which enable the Website to remember the User's preferred settings.
Cookies used on the Website do not store personal data or other information collected from the User. The Website uses cookies to identify browser sessions, enabling the use of Website features. The use of cookies does not allow any personal or address data of the User or any confidential information from their device to be collected.
Cookies are used for the following purposes: maintaining service security and preventing fraud, improving page performance, recording visits for marketing and statistical purposes, enabling social media features, and supporting website personalisation (e.g. saving language settings). Cookies may also be used and placed by the Controller's partners – in such cases they are subject to the cookie or privacy policies of those parties.
The User consents to the processing of information contained in cookies by giving consent during their first visit to the Website via the displayed consent window. The User may consent to the processing of all data or only that which is necessary for the correct display of the Website.
A User who does not wish for cookies to be used in the manner described above may delete them manually at any time. For detailed instructions, please visit the website of the manufacturer of the browser you are using.
For Google Chrome: https://support.google.com/chrome/answer/95647?hl=en
For Mozilla Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer
For Safari: https://support.apple.com/kb/ph21411?locale=pl_PL
For Microsoft Edge: https://docs.microsoft.com/en-us/microsoft-edge/devtools-guide/debugger/cookies
For Internet Explorer, the Controller recommends switching to one of the browsers listed above. Instructions are available at: https://support.microsoft.com/en-us/help/17442/windows-internet-explorer-delete-manage-cookies
The Controller wishes to advise that disabling or restricting cookies may cause difficulties in using the Website and limit its functionality.
The Controller informs Users that it entrusts the processing of personal data to the following entities:
Within the EEA:
Within the Website, User data is processed by entities cooperating with the Controller which, in accordance with GDPR, are obliged to comply with privacy standards equivalent to those set out in this Policy.
Outside the EEA:
As some of the Controller's partners are based outside the European Union and are therefore treated as so-called third countries under GDPR, the Controller ensures that data is transferred to entities in the United States that apply standard contractual clauses.
The Controller thereby guarantees compliance with data protection standards equivalent to those of the GDPR, and the use of their technology by the Controller when processing personal data is lawful.
The period for which the Controller processes data depends on the type of service provided and the purpose of processing. As a general rule, data is processed for the duration of the service or agreement, until the given consent is withdrawn or an effective objection to data processing is raised in cases where the legal basis for processing is the legitimate interest of the Controller.
The data retention period may be extended where processing is necessary for the establishment, pursuit or defence of potential claims, and thereafter only where and to the extent required by law. Upon expiry of the retention period, data is irreversibly deleted or anonymised.
The User has the right to:
To the extent that the User's data is processed on the basis of consent, it may be withdrawn at any time by contacting the Controller.
The User has the right to object to the processing of their data for marketing purposes where processing is carried out in connection with the legitimate interest of the Controller, and – for reasons related to the User's particular situation – in other cases where the legal basis for data processing is the legitimate interest of the Controller (e.g. in connection with analytical and statistical purposes).
In connection with the provision of services, personal data will be disclosed to external entities, including in particular providers responsible for IT systems and entities affiliated with the Controller. The Controller reserves the right to disclose selected information about the User to competent authorities or third parties who submit a request for such information, based on an appropriate legal basis and in accordance with applicable law.
The Controller can be contacted by e-mail at: car@kprcars.pl or in writing at the Controller's registered address (ul. Lubowidzka 52, 80-174 Gdańsk).
This Policy is regularly reviewed and updated as necessary. The current version of the Policy was adopted and has been in force since 1 August 2023.