Personal data processing policy
Version dated 1 November 2026 · 2026-11-01.1
Data controller
The controller is GCAR KRAKÓW SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, address: ul. Gęsia 8/205, 31-535 Kraków, Polska. KRS 0001079944, NIP 6751793004, REGON 527402331. For data requests or withdrawal of consent, write to this address or call +48 516 701 072.
Data collected
The form collects your name, phone and city. Your chosen vehicle and calculator schedule are included where applicable, together with language, page address, form placement, enquiry ID, consent version and any UTM/gclid campaign parameters in the page URL. We do not request documents, health information or criminal record details through this form.
Purpose and legal basis
We use enquiry data to respond and discuss working together, based on your separate consent under GDPR Article 6(1)(a). Providing data is voluntary. Without consent the form is not sent, but you can call or message us yourself. Steps before a contract at your request may rely on Article 6(1)(b). Preventing abuse and protecting legal claims may rely on Article 6(1)(f). This consent does not cover marketing newsletters.
Recipients and external services
Authorised staff and necessary technical providers may access the data. Your enquiry is delivered to our team as a Telegram notification. Opening Telegram or WhatsApp separately uses those services under their own terms: telegram.org/privacy and whatsapp.com/legal/privacy-policy. These services may process data outside the EEA. The website is hosted by Vercel (Vercel Inc.); domain DNS is managed by Cloudflare. Provider data-processing information: vercel.com/legal/privacy-policy, vercel.com/legal/dpa and cloudflare.com/privacypolicy. The controller is responsible for the applicable contractual safeguards and legal basis for international transfers.
Retention
Enquiry data is retained until the enquiry is handled or consent is withdrawn, unless another lawful basis requires further processing. If a contract follows, applicable contractual and statutory retention periods apply. Minimal records may remain as necessary for legal obligations or legal claims. Working notifications follow the same deletion rules.
Your rights
You may request access, correction, deletion, restriction and, where applicable, portability, and object to processing based on legitimate interests. You may withdraw consent at any time without affecting the lawfulness of earlier processing. Use the controller contacts above. You may complain to Poland’s data protection authority, Prezes Urzędu Ochrony Danych Osobowych (uodo.gov.pl).
Security, cookies and automated decisions
The site does not make automated employment decisions or profile applicants. Its current implementation has no first-party advertising cookies or connected external analytics. Campaign parameters are read from the URL when submitting the form. Hosting infrastructure may process technical logs for operation and security. Do not submit documents or sensitive information through this contact form.