Privacy policy of autoszczech.ch
Rules for processing Users’ personal data, including information about the controller, purposes and legal bases, and data subjects’ rights.
This Privacy Policy sets out the rules for processing personal data of users of the autoszczech.ch website (the “Service”).
The Controller takes particular care to protect the privacy of people using the Service and to ensure the security of processed personal data.
§1. Personal data controller
The personal data controller is:
The Controller is responsible for processing personal data in accordance with applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
For matters related to personal data protection, contact the Controller at [email protected].
§2. Personal data processing principles
Personal data is processed lawfully, fairly and transparently.
The Controller applies appropriate technical and organisational measures to protect data against loss, unauthorised access, alteration or disclosure.
Personal data may be accessed only by persons authorised by the Controller.
The Service can be browsed without providing personal data.
§3. Purposes and legal bases of processing
Users’ personal data may be processed for the following purposes:
- providing services through the Service, including handling enquiries and contacting users — on the basis of Article 6(1)(b) and (f) GDPR;
- fulfilling legal obligations, such as accounting and tax obligations — Article 6(1)(c) GDPR;
- sending commercial information or a newsletter — solely on the basis of freely given consent (Article 6(1)(a) GDPR);
- establishing, pursuing or securing possible claims — Article 6(1)(f) GDPR.
Providing personal data is voluntary, although in some cases it may be necessary to use specific functions of the Service.
§4. Scope of processed data
The Controller processes only data necessary for the specified purposes.
The processed data may include the following categories:
- identification and company data, including account type, first name, surname, PESEL, company name, NIP, optional REGON and representative details;
- contact and address details, including e-mail, telephone number and full address;
- account and security data, including preferred language, protected password hash, session identifier, IP address and security logs;
- Service activity data, including bid history, amounts and timestamps, accepted document versions, watched and wanted vehicles, messages, purchaser details and case history;
- newsletter data, including e-mail address, language, and the date and wording of consent or withdrawal.
IP addresses may be used for technical, statistical and Service security purposes.
§5. Rights of data subjects
Every person whose data is processed has the following rights:
- the right to access data and receive a copy;
- the right to rectification;
- the right to erasure (the ‘right to be forgotten’);
- the right to restriction of processing;
- the right to data portability;
- the right to object to processing;
- the right to withdraw consent at any time where processing is based on consent;
- the right to lodge a complaint with the President of the Polish Personal Data Protection Office.
These rights may be exercised by contacting the Controller at [email protected].
§6. Data recipients
Personal data may be disclosed to entities entitled to receive it under applicable law.
Data may also be entrusted to entities cooperating with the Controller, such as IT, hosting, accounting or marketing service providers, solely under appropriate data processing agreements.
Personal data is not transferred to third countries or international organisations.
§7. Data retention period
Data is retained for the period appropriate to its purpose:
- account and profile data — while the account exists and for up to 30 days after an effective deletion request, except where claims or law require retention;
- bids, auction results, cases, messages and purchaser details — for 6 years after the case is closed;
- watched and wanted vehicles — until removed by the User or the account is closed;
- security logs and administrative history — for 12 months;
- active login session data — for 7 days;
- active newsletter subscription data — until unsubscribe, and a minimal record of consent or withdrawal — for 3 years;
- dispute-related data — until the dispute ends or the relevant claims become time-barred.
After the applicable period, data is deleted or anonymised in accordance with applicable law.
The system automatically ranks bids according to the auction rules, but the final fulfilment decision is not made solely by automated means and depends on the external auction result and the seller’s decision.
The Controller reserves the right to amend this Privacy Policy. The current version will always be published in the Service.
The Privacy Policy takes effect on the date of its publication.
§8. Cookies
The Service uses only a cookie necessary for signing in, maintaining the User’s session and protecting the account.
The session cookie is stored for 7 days, uses HttpOnly and SameSite=Lax, and also Secure in production.
The Service does not use analytics, advertising or profiling cookies. If they are introduced, this Privacy Policy will be updated and any required consent will be obtained before they are stored.