Privacy Policy – Kup4Koła

This Policy applies to the public part of kup4kola.pl and provides the information required by Articles 13 and 14 GDPR. It does not cover detailed activities connected with the purchase, sale, financing, leasing, registration or servicing of a vehicle where we provide a separate notice.

1. Data controller

The controller of personal data processed in connection with the website is:

Controller: SONNE spółka z ograniczoną odpowiedzialnością
Registered office: ul. Gabriela Narutowicza 64
97-300 Piotrków Trybunalski, Polska
Registration details: KRS 0001098846 · NIP 7712931336 · REGON 528292229
Privacy contact: biuro@kup4kola.pl

2. What data do we process and why?

Website operation and security

The server receives technical data needed to display and protect the website, particularly the IP address, request date and time, requested address, browser-supplied information, and error or security-event data. We use them to deliver content, diagnose faults, prevent misuse and protect the website.

Contacting us

If you use a form or write to us, we process your name, email address, message, language, submission date and status, and subsequent correspondence. To protect the form, we also process a hash of the IP address, user-agent information and the reCAPTCHA result. Providing the form data is voluntary but necessary to submit and handle the enquiry.

First-party statistics without analytics cookies

We record page and vehicle views, searches (including the entered phrase), use of selected contact controls, the event that a form was submitted but not its contents, language, path, the relevant content or vehicle reference, date, approximate country, and a pseudonymous identifier created from the IP address, user-agent information and a secret value held by us. The statistics do not contain your name, email address or telephone number, do not use a browser-storage analytics identifier, and are not shared with an external analytics provider. The identifier can nevertheless distinguish repeat visits, so we treat these records as pseudonymous rather than anonymous.

Reviews and testimonials

For a testimonial submitted directly to us, we process its text, rating, language, moderation status and any optional display name or description. From our Google Business Profile we retrieve only the rating and review text. We do not retrieve or retain the reviewer name, profile photograph, Google review identifier or Google publication date. Every new or changed excerpt is moderated before publication.

3. Legal bases

Depending on the purpose, we process data on the basis of:

Article 6(1)(b) GDPR – taking steps at your request before entering into a contract, where the enquiry concerns a proposed transaction;
Article 6(1)(f) GDPR – our legitimate interests in operating and securing the website, answering enquiries, producing first-party statistics, presenting opinions about our business, and establishing, exercising or defending legal claims;
Article 6(1)(a) GDPR – consent to moderate and publish a testimonial submitted directly to us; consent may be withdrawn at any time;
Article 6(1)(c) GDPR – compliance with legal obligations, particularly handling requests under the GDPR.

4. How long do we keep data?

Ordinary technical data and logs are kept only for as long as needed to operate and protect the website. Data concerning a particular incident may be kept until the incident and any related proceedings are concluded.
Enquiries that do not lead to a contract are kept for up to 12 months after the matter is closed or the last substantive contact. Data connected with a contract, legal obligation or claim may be kept longer under applicable law and limitation periods.
Raw statistical events and their pseudonymous identifier are kept for up to 90 days. Aggregate totals that no longer allow a person to be singled out may be retained longer for trend analysis.
Testimonials submitted to us are kept for up to 6 months while pending, up to 3 months after rejection, and—if published—until consent is withdrawn, removal is requested or we stop using them.
Google review excerpts are refreshed from the source and are not kept for more than 30 days without a successful refresh. We also remove them if they disappear from the source or we uphold an objection.

5. Recipients and Google services

Data may be accessed by authorised personnel; providers of hosting, databases, backups, IT maintenance and security; nazwa.pl sp. z o.o. as our business-email provider; advisers bound by confidentiality; and public authorities where required by law. Providers acting on our instructions process data under appropriate agreements.

Our forms are protected by Google reCAPTCHA. The website may also present our location through Google Maps, content from our YouTube channel or other Google resources. Although the profile, map and videos concern our own business, the services are operated by Google and may process the IP address, browser and device information, interaction data, and necessary device-storage information. Google Ireland Limited may act as a separate controller to the extent stated in its own documents.

Google services may involve processing outside the European Economic Area, including in the United States. Where applicable, a transfer is based on a relevant European Commission adequacy decision, including the EU–US Data Privacy Framework if the recipient holds an active certification, or on appropriate safeguards such as Standard Contractual Clauses. You may contact us for information about the mechanism used.

Details of Google’s processing are provided in the: Google Privacy Policy · Google Terms of Service.

Browser storage and similar technologies are described separately in our Cookie Policy.

6. Your rights

Subject to the conditions of the GDPR, you have the right to:

access your data and receive a copy;
rectify inaccurate or complete incomplete data;
request erasure or restriction of processing;
data portability where Article 20 GDPR applies;
object, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR;
withdraw consent at any time without affecting earlier lawful processing.

To exercise a right, email biuro@kup4kola.pl. We may request only the information reasonably necessary to verify identity and protect data against unauthorised disclosure.

You may complain to the President of the Personal Data Protection Office (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, or to the supervisory authority for your habitual residence, place of work or the alleged infringement.