AutoControl Privacy Policy

Effective as of: October 12, 2026

Key information at a glance

The controller of your personal data is AutoControl Jacek Zarzycki, ul. Sicieńska 14, 85-374 Bydgoszcz, NIP 8541631348.

We use personal data primarily to:

• respond to inquiries and contact customers,
• agree on the scope and timing of services,
• perform service orders at the shop,
• process payments and issue sales documents,
• handle complaints,
• protect the website and form against abuse,
• fulfill obligations imposed by law.

We do not use data submitted through the form to send newsletters or for marketing without an appropriate legal basis.

In operating the website and serving customers, we may use services provided by entities such as Cloudflare, Google, WhatsApp, and PayPro/Przelewy24. Details are set out below.

For matters relating to personal data, you can contact us at:

[email protected]

§1. Data controller

1. The controller of personal data is:

   AutoControl Jacek Zarzycki
   ul. Sicieńska 14
   85-374 Bydgoszcz
   NIP: 8541631348

2. Contact details for the Controller:

   • email: [email protected]
   • phone: +48 608 361 762
   • mailing address: ul. Sicieńska 14, 85-374 Bydgoszcz.

3. This Policy explains the rules for processing personal data in connection with using the website ac-warsztat.com, contacting AutoControl, and using the Shop’s services.

§2. What data we may process

Depending on the method of contact and the type of service provided, we may process, in particular:

1. identification and contact data, such as:

   • first and last name,
   • phone number,
   • email address,
   • data necessary to issue an invoice;

2. vehicle data, such as:

   • make and model,
   • year of manufacture,
   • license plate number,
   • VIN,
   • information about technical condition, faults, completed repairs, or diagnostics, if needed to provide the service;

3. service order data, in particular:

   • the agreed scope of work,
   • information about parts,
   • an estimate or price,
   • the history of arrangements made,
   • information about vehicle pickup;

4. payment data, such as:

   • the amount,
   • the payment reference,
   • the transaction identifier,
   • the payment status;

5. data contained in correspondence, email messages, WhatsApp messages, and the contact form;

6. technical data related to use of the Website, such as:

   • IP address,
   • browser and device type,
   • operating system,
   • connection date and time,
   • information contained in technical logs,
   • technical data used to protect the Website against spam, bots, and other abuse.

7. Please do not provide special categories of data in the form or ordinary correspondence, such as information about health, origin, political opinions, or religious beliefs, unless it is genuinely necessary.

§3. Purposes and legal bases of processing

1. Inquiries and contact before a service is provided

If you contact us about a possible repair, diagnostics, a pre-purchase vehicle inspection, detailing, or another service, we process the data you provide to:

• respond to the inquiry,
• identify your needs,
• propose a possible scope of work,
• agree on an appointment,
• take steps before entering into a contract.

If the contact is intended to lead to a contract, the legal basis for processing is Article 6(1)(b) of the GDPR — taking steps at the request of the data subject before entering into a contract.

If the inquiry is general and is not directly intended to lead to a contract, the legal basis is Article 6(1)(f) of the GDPR — the Controller’s legitimate interest in conducting correspondence and handling inquiries.

2. Performance of services and service orders

We process data necessary to carry out repairs, diagnostics, the sale of parts, or another agreed service on the basis of Article 6(1)(b) of the GDPR — to enter into and perform a contract.

3. Sales documents, accounting, and taxes

We process data required to issue receipts and invoices, maintain accounting records, and fulfill tax obligations on the basis of Article 6(1)(c) of the GDPR — to comply with legal obligations imposed on the Controller.

4. Payment processing

We process data related to settling payment for a service to perform the contract on the basis of Article 6(1)(b) of the GDPR, and, to the extent required by accounting, tax, or other legal obligations, on the basis of Article 6(1)(c) of the GDPR.

When Przelewy24 is used, transaction data is also processed by PayPro S.A. under the rules described in §6.

5. Complaints

We process data provided in connection with a complaint:

• to perform the contract or settle payment under it — Article 6(1)(b) of the GDPR,
• to the extent that handling a complaint is required by legal obligations — Article 6(1)(c) of the GDPR,
• to establish, pursue, or defend claims — Article 6(1)(f) of the GDPR.

6. Establishing, pursuing, and defending claims

Data may be processed to the extent necessary to establish, pursue, or defend claims related to a completed service, payment, complaint, or use of the Website.

The legal basis is Article 6(1)(f) of the GDPR — the Controller’s legitimate interest in protecting its rights.

7. Website security

Technical data, including IP addresses and information contained in logs, may be processed to:

• ensure proper operation of the Website,
• prevent attacks,
• detect errors,
• protect the Form against spam and bots,
• prevent abuse.

The legal basis is Article 6(1)(f) of the GDPR — the Controller’s legitimate interest in ensuring the security of the Website and communications.

8. Technologies requiring consent

If a Website feature requires information to be stored on or accessed from the user’s device and is not necessary to provide a service requested by the user, it is enabled after appropriate consent has been obtained.

If such a technology also involves personal data processing based on consent, the legal basis is Article 6(1)(a) of the GDPR.

§4. Contact form

1. The Form available on the Website is intended for sending an inquiry to AutoControl.

2. Through it, we may receive:

   • first name,
   • phone number,
   • an optional email address,
   • vehicle make and model,
   • an optional year of manufacture,
   • a description of the problem,
   • information about the preferred contact method.

3. Providing data is voluntary, but failure to complete fields marked as required may make it impossible to handle the inquiry.

4. If email is selected as the preferred contact method, an email address is necessary to respond in that way.

5. Confirming that you have read the Privacy Policy is not consent to data processing and does not constitute a legal basis for processing.

6. Data from the Form will not be used to send marketing information merely because the user submitted an inquiry.

§5. Contact by phone, email, and WhatsApp

Phone contact

If you contact us by phone, we may process your phone number and information provided during the conversation to the extent necessary to handle the matter.

Email

Messages sent to [email protected] are handled using Google services.

For users and services associated with the European Economic Area, most consumer Google services are provided by Google Ireland Limited.

WhatsApp

If you choose to contact AutoControl through WhatsApp, your data is processed both by AutoControl to handle your messages and by the WhatsApp service provider in accordance with its own rules.

For users in the European Region, the service is provided by WhatsApp Ireland Limited.

Use of WhatsApp is voluntary. AutoControl can also be contacted by phone, email, or the Form.

§6. Przelewy24 payments

1. AutoControl may allow payment for an agreed service or goods through the Przelewy24 system.

2. Przelewy24 is operated by:

   PayPro S.A.
   ul. Pastelowa 8
   60-198 Poznań
   KRS 0000347935
   NIP 7792369887

3. To initiate and settle a payment, PayPro may receive information necessary to process the transaction, such as the amount, payment reference or identifier, and other data required for the chosen payment method.

4. PayPro S.A. is a separate controller of the Payer’s data for the payment services it provides.

5. Detailed information about data processing by PayPro is provided in the information notice for Payers made available by Przelewy24.

§7. Cloudflare and Website security

1. AutoControl uses Cloudflare infrastructure and security services.

2. In connection with operating the Website, Cloudflare may process, in particular:

   • IP addresses,
   • information about HTTP requests,
   • browser and device information,
   • technical logs,
   • data transmitted through systems operating within Cloudflare infrastructure, if needed to provide the relevant service.

3. The Form may be protected by Cloudflare Turnstile.

4. Turnstile analyzes technical signals used to distinguish real users from automated traffic, including IP address, TLS fingerprint, User-Agent header, and site identifier.

5. AutoControl does not use Turnstile for advertising or to create marketing profiles of users.

6. If a particular Cloudflare configuration uses technically necessary cookies or similar mechanisms to protect the Website, they are used only to the extent required for security or to provide a feature requested by the user.

§8. Google Maps

1. The Website may allow users to display an interactive Google Maps map to help them find AutoControl’s premises.

2. The map is not necessary to use the Website. Users can obtain the Shop’s address without enabling it.

3. Google Maps is loaded only after consent has been given in the Website’s global privacy settings. Once consent is given, the map may load automatically on pages where it is available. Before consent is given, we do not create an embedded map or retrieve its resources from Google.

4. When Google Maps is enabled, the browser connects directly to Google services. Google may then receive, among other things:

   • IP address,
   • device and browser information,
   • the date and time of the request,
   • the referring page’s address,
   • identifiers and information stored through cookies or similar technologies, depending on the device, browser, and Google account configuration.

5. Google’s Privacy Policy sets out the detailed rules for Google’s further processing of data.

6. Not consenting to enable the map does not limit the ability to use the rest of the Website or contact AutoControl.

7. The Shop’s address and a standard “Get directions” link are available regardless of consent to the embedded map. Clicking this link takes the user to the external Google Maps service, which loads only after the user deliberately selects the link.

§9. Cookies and similar technologies

1. The Website may use cookies or similar technologies to the extent necessary to:

   • ensure proper operation of the Website,
   • provide security,
   • operate Form security measures,
   • remember technical settings necessary for the service to function.

2. Under Article 399 of the Polish Electronic Communications Law, storing information on or accessing information on a user’s device generally requires prior information and consent.

3. Consent is not required if storing or accessing information is necessary to:

   • transmit an electronic communication, or
   • provide an electronic service requested by the user.

4. Technologies necessary for the operation and security of the Website are always active and cannot be disabled in privacy settings. The only currently optional service is embedded Google Maps, enabled only with the user’s consent. We do not set optional analytics or marketing cookies.

5. On the first visit, the user may choose “Necessary only” or “Accept.” “Accept” means consent to load Google Maps. The choice is stored locally in the browser, together with the settings version, under the key autocontrol_privacy_v1. This record is used solely to respect privacy preferences and is not used to track the user. After the record is removed from the browser or the settings version changes, a choice may be required again. If the browser blocks storage, the choice may not be retained after leaving the page.

6. The choice can be changed at any time through “Privacy settings” in the Website footer by enabling or disabling Google Maps and saving the settings. After consent is withdrawn, the embedded map is removed and replaced with a neutral area displaying the Shop’s address; subsequent visits to the Website do not load it. Giving consent again allows the map to be loaded again. Withdrawing consent stops further use of the embedded map but does not reverse the transfer of data to Google that occurred before withdrawal.

7. Withdrawing consent does not affect the lawfulness of actions taken before withdrawal.

8. If AutoControl introduces new analytics tools, marketing tools, or other technologies requiring consent in the future, this Policy and the consent management mechanism will be updated accordingly before those tools or technologies are enabled.

The selected website theme (light or dark) may be stored locally in the browser under the key autocontrol_theme_v1. This storage is used solely to retain the user’s interface preferences and is not used for tracking, analytics, or marketing.

§10. Data recipients

Data may be disclosed to the following categories of recipients only to the extent necessary for a specific purpose:

1. IT infrastructure, hosting, and security providers, particularly Cloudflare;

2. email service providers, particularly Google services;

3. messaging service operators, if the user chooses that method of contact, particularly WhatsApp;

4. payment operators, particularly PayPro S.A./Przelewy24;

5. providers of accounting, legal, or IT services, if access to data is necessary to perform those services;

6. parts suppliers or subcontractors working with the Shop, only if sharing specific information is necessary to provide the agreed service;

7. public authorities and other authorized entities, if disclosure is required by law.

Entities processing data on the Controller’s behalf are required to safeguard it appropriately and process it in accordance with the relevant agreements and applicable law.

§11. Transfers of data outside the European Economic Area

AutoControl’s use of global technology services may involve processing some data outside the European Economic Area.

Cloudflare

Cloudflare states that its services may involve processing data outside the EEA. Depending on the legal basis and destination of the transfer, mechanisms provided for in the GDPR may be used, particularly adequacy decisions, the EU–U.S. Data Privacy Framework, or the European Commission’s Standard Contractual Clauses.

Google

Google maintains infrastructure worldwide. For transfers outside the EEA, it uses mechanisms provided for under applicable law, depending on the particular service and destination of the transfer.

WhatsApp

WhatsApp may use global infrastructure in which some data may be processed outside the EEA. The provider states that it uses transfer mechanisms provided for under applicable law.

Detailed information about safeguards used by individual providers is available in their current privacy policies and data transfer documents.

§12. Data retention periods

Data is not retained longer than needed for the purpose for which it was collected, unless a longer period is required by applicable law or is necessary to protect the Controller’s rights.

In particular:

1. inquiries that did not result in a contract — we retain these for no longer than 12 months after correspondence ends, unless earlier deletion is possible or further retention is necessary in connection with claims;

2. data related to performance of a service order — for the duration of the contract’s performance, and afterward for the period needed to settle payment for the service and until the applicable limitation periods for claims expire;

3. accounting and tax documents — for the period required by the relevant tax and accounting regulations;

4. complaints — for the time needed to handle them, and afterward for the period necessary to demonstrate how the matter was resolved and until any applicable time limits for claims expire;

5. payment data — for the period needed to settle the transaction and the period required by law; PayPro retains its own data in accordance with its policy and legal obligations;

6. technical logs and security data — for the period justified by security needs, technical troubleshooting, or incident analysis; if data is needed to clarify a specific event, it may be retained until the matter is concluded;

7. information about consent given for optional technologies — for the period necessary to apply that consent and the period needed to demonstrate compliance with legal obligations.

Once there is no longer a basis for further processing, data is deleted or anonymized unless its continued retention is required by law.

§13. Rights of the data subject

Depending on the legal basis and circumstances of processing, you may have the right to:

1. obtain information about whether we process your data;

2. access your data and receive a copy;

3. have inaccurate data corrected;

4. have incomplete data completed;

5. request deletion of data in cases provided for in the GDPR;

6. request restriction of processing;

7. data portability, if processing is based on consent or a contract and is carried out by automated means;

8. object, if processing is based on Article 6(1)(f) of the GDPR, on grounds relating to your particular situation;

9. withdraw consent at any time, if the particular processing is based on consent;

10. lodge a complaint with the President of the Personal Data Protection Office.

Not all of these rights apply in every case. Their scope depends on the legal basis and circumstances of the particular processing.

Requests concerning your rights may be sent to:

[email protected]

We may request additional information if it is genuinely needed to verify the identity of the person making the request.

§14. Automated decision-making and profiling

1. AutoControl does not make decisions concerning customers that produce legal effects or similarly significantly affect them based solely on automated data processing.

2. AutoControl does not use customer data for marketing profiling based on information from the Form or a service order.

3. Cloudflare Turnstile uses automated analysis of technical signals to assess whether an interaction comes from a real user or an automated system. This mechanism serves Website security, rather than assessing the customer or making decisions about provision of the service.

§15. Data security

1. The Controller applies technical and organizational measures appropriate to the nature of the data processed and the associated risks.

2. Access to data is granted only to persons or entities that need it to perform assigned tasks or provide services.

3. However, use of the Internet always involves some risk, so users should also use up-to-date software and appropriate security measures on their devices.

§16. Voluntary provision of data

1. Providing data in the Form and during ordinary contact is generally voluntary.

2. Failure to provide data needed to handle an inquiry may make it impossible to respond or arrange a service.

3. If particular data is necessary to enter into or perform a contract, failure to provide it may make it impossible to enter into or perform the Service Order.

4. Data required by law, such as data needed to issue a particular accounting document, must be provided to the extent required by the relevant regulations.

§17. Changes to the Privacy Policy

1. The Policy may be updated, in particular, in the event of:

   • changes in law,
   • changes in how the Website operates,
   • the introduction of new services or technology providers,
   • changes in how data is processed.

2. The current version of the Policy is always available on the Website.

3. The effective date of the current version appears at the beginning of the document.