Privacy and cookie policy

1. Data controller

The controller of your personal data is GCAR spółka z ograniczoną odpowiedzialnością, ul. Elektronowa 2, 03-219 Warszawa, Poland, KRS 0000906044 (Sąd Rejonowy dla m.st. Warszawy w Warszawie, XIV Wydział Gospodarczy KRS), NIP 5242920528, REGON 389191808 (“G CAR Partner”, “we”).

For any personal data matters, email fymanager1@gmail.com or call +48 780 909 959 (Mon–Fri, 9:00–17:00).

This policy covers the gcarpartner.pl website, the application forms on it and cookies. The Polish version of the policy prevails.

2. What data we collect

• Form data: first name, phone number, city, and the car you chose or your interest in rent-to-own.
• Application details: the page and language version it was sent from, date and time.
• Visit source, if you came from an ad: campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and ad click identifiers (gclid, gbraid, wbraid, fbclid).
• Technical data: IP address, browser and device type — in hosting logs and, with your consent, in analytics and advertising tools.
• The content of calls and messages if you contact us by phone or messenger.

Documents needed for the contract (driving licence, ID, certificates) are not collected through the website — you hand them over at the park when signing the contract.

3. Purposes and legal bases

• Contacting you about your application, matching a car and preparing a rental or rent-to-own contract — Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract).
• Handling applications in our CRM, notifying park staff and identifying which source or campaign an application came from — Art. 6(1)(f) GDPR (our legitimate interest: handling candidates efficiently and assessing ad performance).
• Website visit statistics (Google Analytics) — Art. 6(1)(a) GDPR (your consent).
• Measuring and delivering ads, including remarketing (Google Ads, Meta Pixel) — Art. 6(1)(a) GDPR (your consent).
• Website security and spam protection, and establishing, exercising or defending legal claims — Art. 6(1)(f) GDPR.

Providing data in the form is voluntary, but without your name and phone number we cannot contact you.

4. Who receives your data

We do not sell your data. We share it only with service providers we use, and only as far as needed to handle your application or run the website:

• Bitrix24 — the CRM where we store and handle applications (data stored in the European Union, in Frankfurt).
• Telegram — the messenger through which park staff are notified of a new application: city, form, chosen car and the application number in the CRM, without your name or phone number. Your name and phone are sent there only if the application could not be saved in the CRM.
• G PARK — the system we use to work with drivers and manage the fleet (data stored in the European Union, in Sweden, on Google Cloud servers).
• Cloudflare — website hosting and form processing.
• Google (Google Ireland Limited) — Google Tag Manager, Google Analytics, Google Ads; analytics and advertising data only with your consent.
• Meta (Meta Platforms Ireland Limited) — Meta Pixel (Facebook, Instagram); only with your consent.
• Binotel — the chat and call widget on the website and call tracking; the widget loads only with your consent to marketing cookies.

Data may also be received by providers of our accounting, legal and IT services and by public authorities where required by law.

5. Transfers outside the European Economic Area

Some providers (Google, Meta, Cloudflare) may process data on servers outside the EEA, including in the USA.

Transfers to the USA are based on the European Commission adequacy decision of 10 July 2023 (EU–US Data Privacy Framework) for providers certified under it, and on standard contractual clauses approved by the European Commission and included in these providers' terms (Art. 46(2)(c) GDPR).

Telegram Messenger Inc. is based outside the EEA and is not covered by these mechanisms. That is why our Telegram notifications do not include your name or phone number. The exception is a CRM failure: then we send them so that your application is not lost; this transfer is necessary for steps taken at your request before entering into a contract (Art. 49(1)(b) GDPR).

Binotel processes data in Ukraine, which has no European Commission adequacy decision. The widget loads only if you consent to marketing cookies; this consent also covers the transfer of data to Binotel in Ukraine despite the absence of such a decision and the related risks (Art. 49(1)(a) GDPR). You can withdraw consent at any time in the cookie settings.

You can request information about the safeguards these providers use at fymanager1@gmail.com.

6. How long we keep data

• Applications that did not lead to a contract — up to 12 months from the last contact.
• Data of drivers we have a contract with — for the term of the contract, then until the limitation periods for claims and the tax and accounting obligations expire.
• Data processed on the basis of consent — until consent is withdrawn.
• Google Analytics data — up to 14 months; cookies — for the periods listed in section 8.

7. Your rights

You have the right to:

• access your data and receive a copy;
• have your data corrected;
• have your data erased or its processing restricted;
• data portability;
• object to processing based on our legitimate interest;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal — change your cookie consent with the “Cookie settings” button in the site footer;
• lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa).

To exercise these rights, email fymanager1@gmail.com. We do not make decisions about you based solely on automated processing that would have legal effects.

8. Cookies

Cookies are small files stored in your browser. Necessary cookies are always on; the others are set only after you consent in the cookie banner. Until you consent, Google tools run without storing cookies (Google Consent Mode).

You can change your choice at any time with the button below or in the site footer. You can also delete cookies in your browser settings.

Cookie settings

9. Changes to this policy

We may update this policy, for example when our tools or the law change. The current version is always on this page, with the date of the last change at the top.