Privacy policy

This Privacy Policy sets out how personal data obtained via the trackhouse.pl website is processed. We respect users’ privacy and process data in accordance with the GDPR.

§ 1. General provisions

1. This Privacy Policy sets out the rules for processing personal data obtained via the trackhouse.pl website (the “Website”).

2. The data controller is Trackhouse Supercar Rental, with its registered office at Izy Zielińskiej 22, 96-300 Żyrardów (VAT no.: [to be completed], business no.: [to be completed]), the “Controller”. For data-protection matters, contact concierge@trackhouse.pl.

3. Personal data collected by the Controller via the Website is processed in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR).

4. The Controller takes particular care to respect the privacy of users visiting the Website.

§ 2. Type and purpose of data processed

1. The Controller collects information about natural persons, sole traders and persons representing legal entities or organisational units, referred to collectively as “Users”.

2. Users’ personal data is collected when making a booking on the Website. The legal basis is the necessity of processing to conclude and perform the service agreement (Art. 6(1)(b) GDPR).

3. When booking on the Website the User provides: full name, email address, phone number and address details. Performing the rental agreement additionally requires identity-document and driving-licence data, presented at vehicle collection.

4. For entrepreneurs, the above scope may be extended to the company name and VAT number.

5. Providing personal data is voluntary, but failure to provide data marked as required prevents placing and fulfilling a booking.

§ 3. Sharing and entrusting data

1. The User’s personal data is shared with service providers used by the Controller to operate the Website.

2. Such providers either act on the Controller’s instructions as to the purposes and means of processing (processors) or determine those purposes and means independently (controllers).

3. Processors act solely on the Controller’s instructions and include, among others, providers of hosting, accounting, marketing systems and Website traffic analytics.

4. Providers acting as separate controllers provide, in particular, electronic-payment and banking services.

5. Personal data is stored for as long as necessary to perform the agreement and, thereafter, for a period corresponding to the limitation of claims (as a rule 6 years, and 3 years for periodic claims and claims related to business activity). Where the basis is consent, data is processed until it is withdrawn.

6. At the request of authorised state authorities (e.g. the Prosecutor’s Office, Police, the President of the UODO, UOKiK or UKE), the Controller discloses personal data to the extent required by law.

§ 4. Rights of data subjects

1. Right to withdraw consent: the User may withdraw any consent given at any time. Withdrawal takes effect from the moment it is made and does not affect the lawfulness of processing carried out beforehand.

2. Right to object: the User may object at any time to processing based on the Controller’s legitimate interest, including profiling. Opting out of marketing communications constitutes an objection to processing for that purpose.

3. Right to erasure (“right to be forgotten”): the User may request erasure of data, e.g. where it is no longer necessary for the purposes collected, where consent has been withdrawn, where an effective objection has been lodged, or where data is processed unlawfully.

4. Right to restriction: the User may request restriction of processing, e.g. where they contest the accuracy of the data (for the time needed to verify it, no longer than 7 days), where processing is unlawful, or where the data is needed to establish, exercise or defend claims.

5. Right of access: the User has the right to obtain confirmation as to whether their data is processed, access to it and information about, among other things, the purposes, categories of data, recipients and storage period.

6. Right to rectification: the User may request prompt rectification of inaccurate, and completion of incomplete, personal data.

7. Right to data portability: the User has the right to receive the data provided to the Controller in a structured, commonly used format and to transmit it to another controller, where technically feasible.

8. The Controller fulfils or refuses a request without undue delay, no later than within one month of receipt; in justified cases this period may be extended by a further two months, of which the User will be informed beforehand.

9. The User has the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) regarding infringement of their rights under the GDPR.

§ 5. Consent and marketing

1. With separate consent, the User’s data may be processed for direct marketing of the Controller’s own products and services, on the basis of Art. 6(1)(a) GDPR.

2. By using the Website, the User confirms that they have read the information on the processing of their personal data under Art. 13 and 14 GDPR set out in this privacy policy.

3. The Website uses essential cookies required for it to function and, with consent, analytics cookies. Consent can be managed in the browser settings.