Privacy Policy

I. Introduction

This Privacy Policy applies to all products, services, content, functionality, technologies or features and all related websites, mobile applications, mobile sites or other online services or applications we offer (together, the "Services").

We respect your privacy and strive to follow best practices in processing your Personal Data — in particular in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR). This Privacy Policy explains who we are, how we process your Personal Data, what your rights are and how you can contact us if needed.

II. Data controller

The controller of your personal data processed in connection with services provided through the Service is: MORWA TRADE SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ with its registered office at Gen. Władysława Sikorskiego 20, 42-202 Częstochowa, Polska, registered in the District Court in Częstochowa, Commercial Division of the National Court Register, KRS: 0001030216, NIP: 9492260466, REGON: 524992639.

III. What data do we collect?

1. Data you provide to us

Registration and other account information

When you register to use our Services, we may collect the following information about you:

• if you sign in with a Google account: we collect your first name, last name, email address and the URL of your Google profile picture;
• if you register with your email address: your email address.

When you sign in via Google, that platform’s controller may process your data as a separate controller under its own rules (privacy policy).

Providing the above data is necessary to use the Services offered under the account. While using our Services, you may also voluntarily provide additional personal data to use other features of the Service, such as:

• first and last name;
• mobile phone number;
• address (country, region, city, street, building number, apartment number);
• profile picture;
• preferred language (e.g. Polish, English or Ukrainian);
• vehicle-related data and its technical and usage condition, in particular: vehicle photo, make, model, year of production, VIN, registration number, engine type, mileage, vehicle photos, technical inspection and insurance dates;
• Telegram chat ID for notifications;
• data related to your business activity (e.g. car service name, description, business address, opening hours, range of services, expense records).

You may also voluntarily provide the following additional data when using our Services:

• PESEL or NIP number, VAT payer status (for identification for settlements and issuing accounting documents, when required or when you choose to provide it);
• accounting documents issued via the Service: e.g. invoices, receipts, and data from invoices/receipts: invoice numbers, amounts, payment status, issuer and recipient details.

Providing data marked as required is necessary to create an account and use the Services. Not providing it may prevent registration, sign-in or use of the Services. Other data is voluntary; not providing it may only limit certain features.

Sharing data with car services

When using the Services you may share with car services the information needed to perform the service, including vehicle data and information related to the order or repair history. This data is shared with the car services you choose so they can perform the service.

Repair history and access by other car services

You may use features that store vehicle repair/service history in the Service. If you consent in the Service settings to sharing repair history with other car services, this data may be shared with them as necessary to provide services (e.g. to view repair history). Without consent, repair history will not be shared with other car services for this purpose.

Communication with the Service

If you contact us by chat, phone or email, we process the information you voluntarily provide during the conversation or correspondence with our staff or representatives.

2. Data we collect automatically when you use the Services

When you use our Service, some information about you is collected automatically.

Log data

We collect information related to sign-in and technical configuration, including device IP address, time zone and operating system. We also store data about your sign-in, such as registration date, last password change date and last successful sign-in date, as well as browser type and version.

Activity data

We collect information about your activity on the Service, in particular traffic sources, visit dates, search results, services viewed and ads (banners) you clicked, and your interactions with them. This also includes visit duration and the order of sections you view.

Ratings and reviews data

If you are a Customer, we collect data from the ratings and reviews you give. If you are a car service, we collect information from ratings and reviews you receive from customers. Ratings and reviews data — together with data of the persons who gave them (first name and vehicle make and model only) — is shared with users as part of the car service’s profile and with people browsing the Service. This is part of the Services for measuring user satisfaction, ensuring high quality of service, verifying conduct and maintaining high standards.

Location information

Depending on your device’s privacy settings, when you provide or use the Services, we may automatically obtain your current location. We use various means to determine it, including IP address, GPS, Wi‑Fi access points and cell towers. If we need access to location data, we will first show a pop-up asking for your consent or allowing you to deny access on your device.

Device data

We collect technical data about the device and software you use, including operating system version and unique identifiers. This may also include mobile network name, IP address, language settings, device make and model, browser type and version and certain technical parameters (e.g. fonts, system and browser time zone, available audio and video formats).

Cookies

We use cookies to manage user sessions, remember language preferences and display relevant ads. Cookies are small text files stored on your device by the web server. They allow us to collect information such as visit date and time, browsing history, preferences or username. You can change your browser settings to block all or selected cookies or to show warnings when they are stored. Note that rejecting or blocking cookies may make some Services or features unavailable or not work properly. For more information see our Cookie Policy.

3. Data obtained from third parties or public sources

We may receive your personal data from third parties and from public sources and combine it with data we collect about you through our Services. This includes in particular:

• selected technical and usage information from analytics providers (e.g. Google Analytics 360) for statistics, usage analysis, improvement of Services and online marketing;
• address and contact data related to business activity from information providers (e.g. business intelligence and potential-contractor databases) and from public registers (e.g. CEIDG).

4. Children’s data

Our Service is intended for persons aged 18 and over. We do not knowingly collect personal data of persons under 18. If we learn that we have collected such data, we will delete it without delay.

IV. Integrations with third-party services

You may use integrations of the Service with third-party services (e.g. Google Calendar or Google Drive). If you enable an integration and grant the required permissions, the Service may share with the chosen service the data needed for the integration, e.g. save appointment information in your calendar or send documents (e.g. invoices) to the specified storage. The scope of data shared depends on the integration and permissions granted.

V. Purposes and legal bases for processing your personal data

We process your personal data only when permitted by law. This is most often when processing is necessary for the performance of a contract (by using our Services you enter into an electronic services agreement with us), when it follows from our legitimate interests — in particular in connection with direct marketing, developing and improving the Services and ensuring secure and efficient operation of the Service — or when necessary to comply with a legal obligation.

In certain cases we may also process your data on the basis of your consent. In that case we will inform you of the purpose and categories of data when obtaining consent.

Below we describe how we process your personal data and on what legal bases.

1. Processing to provide access and the Services

If you sign in with email, we use your name and email to confirm your identity as a user and to let you use the Service. If you voluntarily provide business-related data (car services), we process it to verify your status as a business and to display your business details correctly in your profile. We also use sign-in data to provide the Services.

For payments we use external payment providers who process transactions for our Services. Depending on the payment method we may ask for payment data (including card data), which we then pass to the payment provider to process the transaction. We do not store your card data.

We may suggest Services that may suit your needs. We may also use your email or the Telegram chat ID you provided to send information about the status of the service (e.g. repair progress).

We process the above data for the performance of the contract with you, and for marketing — also on the basis of our legitimate interest in offering you the Services.

2. Sharing data with car services and repair history within the Services

We may process and share with car services the data you provide in connection with the service, including vehicle data and information on the order and work performed. The legal basis is performance of the electronic services agreement.

If you use features that store repair/service history, this data may also be stored in the Service and shared with car services as necessary to provide the Services (e.g. to view repair history). Sharing repair history with other car services only takes place when you consent in the Service settings. The basis for such processing is your consent, which you may withdraw at any time without affecting the lawfulness of processing before withdrawal.

3. Processing to improve use of the Service and develop its features

We use data on your activity on the Service (e.g. how you move around the Service or click sequences) to improve the Services and better tailor the content shown. This allows us to improve search results, analyse how the Service is used and measure and report on the effectiveness of marketing campaigns (for internal analysis and partner settlements).

In certain cases we also use location data to personalise content — e.g. to show car services near you — and to measure your interactions with third-party ad banners. Access to device location depends on your device’s privacy settings and requires your consent there.

We process the above data for the performance of the contract with you, to improve the Services and on the basis of our legitimate interest in ensuring the Service runs smoothly, improving usability and developing new features. Where we use cookies or similar technologies that are not strictly necessary (e.g. analytics or marketing), the basis is your consent given via cookie settings/the consent banner.

4. Processing to improve quality of the Services

To improve the quality of our Services and maintain high standards of support, we analyse correspondence with you when handling requests and complaints and when answering your questions. This information may be used for internal quality assurance. We process personal data for these purposes on the basis of our legitimate interest in improving the Services and maintaining high standards.

5. Processing to ensure security of the Service

To manage the Service and ensure its security we use, among other things, your phone number, sign-in data and device unique identifiers. This information is used for diagnostics, analysis, testing, fraud prevention, maintaining IT systems, support, reporting and hosting. We also process data to establish, pursue or defend claims related to use of the Service and the Services. The legal basis is our legitimate interest.

6. Processing for marketing, contacts with third parties and authorities

B2B contacts

We may use your contact details and information about your business to promote our Services. We endeavour to inform you about data processing and, when required, obtain consent for marketing contact. You may object to processing of your data for marketing purposes at any time. We process the above data on the basis of our legitimate interest in marketing the Services and developing cooperation with businesses.

Contacts with authorities and third parties

If you represent entities that cooperate or are interested in cooperating with us, or you are a representative of the media or public authorities, we may process your data in connection with correspondence, business relations, conclusion or performance of contracts by your company/organisation, and handling requests or matters of public authorities. We process data for these purposes on the basis of our legitimate interest in conducting correspondence, concluding or performing commercial contracts and handling public administration matters.

7. Processing to fulfil legal obligations (tax, accounting and settlements)

To the extent necessary to fulfil legal obligations (in particular tax and accounting), we process your personal data related to settlements and accounting documentation (e.g. invoices or receipts) and related records. The basis is a legal obligation on the controller. Where we have no such obligation, we may process this data on the basis of your consent (e.g. when you have consented to the integration referred to in section 8 below and in section IV).

8. Processing for integrations with third-party services

If you use integrations with third-party services (e.g. Google Calendar or Google Drive), we process your data to enable and perform the integration, including to pass to the chosen service the data necessary for it (e.g. to save visit information in the calendar or send documents such as invoices to the specified storage). The basis is your consent, which you may withdraw at any time (e.g. via integration or account settings) without affecting the lawfulness of processing before withdrawal.

VI. Profiling and automated decision-making

To provide the Services we use automated data processing technologies, including profiling, which may result in automated decisions that significantly affect users. Automated decision-making, including profiling, is necessary for the performance of the electronic services agreement you have with us. The result is to show users listings that best match their needs, increasing the chance of a booking and meeting user expectations.

The Services work by analysing the information the user provides to find a car service, then matching suitable car services. We first check whether a given car service offers the requested service, then whether it operates at the user’s location and what the distance is.

In addition, car services may be profiled e.g. by category or location, average rating and reviews (including their number). Such profiling is necessary to provide the Services correctly. Where automated decisions may have legal effects on you or similarly significantly affect you, you have the right to obtain human intervention from the controller, to express your view and to contest the decision.

VII. Changes to the Privacy Policy

We may update this Privacy Policy from time to time. We will publish information about changes on this page and may also notify you by email or through the Service. If you do not accept the changes or options, you may close your account in account settings.

VIII. Your rights

Privacy laws give you certain rights in relation to the processing of your personal data. The scope of your rights depends on how and for what purpose we process your data.

To exercise your rights efficiently, please send requests to: support@garazh.eu, with "GDPR" in the subject line and indicating in the message which right you wish to exercise. This is only a recommended way to contact us — you may submit a request in another form and your rights will not be affected.

You have the right at any time to:

• access your Personal Data (including receiving information on which Personal Data is processed or a copy);
• request rectification and restriction of processing (e.g. if the data is incorrect) or erasure of Personal Data (e.g. if it was processed unlawfully);
• data portability of Personal Data you have provided to the controller that is processed by automated means on the basis of consent or contract, e.g. to another controller;
• withdraw any consent given to the controller at any time; withdrawal does not affect the lawfulness of processing before withdrawal;
• object to processing of Personal Data carried out for the legitimate interests of the controller or a third party (where there are no overriding legitimate grounds). If Personal Data is processed for direct marketing, you may object at any time to such processing, including profiling in that context — in that case the data may no longer be processed for that purpose;
• lodge a complaint with the President of the Personal Data Protection Office (details at: uodo.gov.pl). Of course, if you wish to comment on how we operate, we encourage you to contact us first.

Response time: We aim to respond to all justified requests within one month. If your request is particularly complex or you have made several requests, it may take longer; we will then inform you of the extension and keep you updated.

IX. Who we share your data with

To achieve the purposes described in this Privacy Policy we may share your personal data with certain categories of recipients. We share your data only as necessary for those purposes, and the recipients are obliged to ensure an appropriate level of security. Depending on the nature of the cooperation, recipients may act as processors (on our instructions) or as separate controllers (e.g. payment service providers).

We may share data with third parties, including companies outside the EEA, that support us in providing the Services and running our business (e.g. product development, customer support, fraud detection). Any transfer outside the European Economic Area ("EEA") is subject to appropriate safeguards described in section X or to a data transfer agreement with appropriate technical and organisational measures.

The controller may share user personal data with partners acting as separate controllers, for remuneration, only for the purposes stated when obtaining consent and only on the basis of the user’s voluntary consent. The user may withdraw consent at any time in privacy settings, without affecting the lawfulness of sharing before withdrawal.

Processors / IT subcontractors

We use external providers, in particular IT solution providers, who support us in maintaining, monitoring and developing the Service and the Services. These providers may be located in the EEA or outside it.

Third-party service providers (including payments)

For payment handling we use external payment service providers (e.g. PayU S.A., PayPal, Inc.). Depending on the method and flow of payment, they may receive data necessary for the transaction, such as phone number, email, address, ID number, cardholder name, cardholder address, card type and expiry date, and KYC information where required for payment for our Services.

Car services

We share with car services the data you provide in connection with the service, when you use their services or contact them via the Service. The scope depends on the Service’s features and the data you provide (including vehicle data). If you use repair/service history features, this data may also be shared with other car services as necessary (e.g. to view repair history).

Integration providers

If you use integrations, your data may be passed to the providers you integrate with (e.g. Google). Those entities may process data under their own rules and privacy policies.

Accounting, audit and legal service providers

We may share your data with providers of accounting, audit and legal services when necessary for our business or legal obligations.

Mergers and acquisitions

We may decide to sell, transfer or merge part of our business or assets, or to acquire or merge with other entities. In such cases the new owner may process your personal data in accordance with this Privacy Policy. We will take steps required by law, including notifying you of changes and allowing you to decide whether to continue using the Services.

Law enforcement, supervisory bodies and other entities

We may disclose your data to law enforcement, supervisory authorities, public authorities, entities performing public tasks or acting on their behalf and other entities when required by our legal obligations.

X. Transfer of data to third countries

Some providers we use may be based outside the European Economic Area (EEA). Whenever data is transferred outside the EEA, we apply the required safeguards, including standard contractual clauses adopted by the European Commission and appropriate additional measures. You may obtain a copy of the safeguards for transfer of Personal Data outside the EEA by contacting us.

XI. How long we keep your data

We keep your personal data for as long as necessary for the purposes for which it was collected, including to comply with legal obligations (e.g. tax and accounting) and for reporting. When determining the retention period we consider in particular the scope and nature of the data (including any special categories), the risk of unauthorised use or disclosure, the possibility of achieving the purposes in another way and the requirements of data protection law.

We keep account-related data while the account is active, to provide the Services in accordance with the Terms and for marketing. After account deletion we delete data without undue delay, as soon as technically possible. Depending on the Services you used and the systems where your data is stored, deletion may take up to 3 months from the request. This may be due to backup overwrite cycles or processes in our systems. During this time access to the data is restricted or blocked.

After account closure we may still keep your personal data to the extent and for the period necessary to comply with legal obligations or for our legitimate interests (e.g. fraud prevention). We then keep only the data relevant for those purposes and delete it after the relevant retention or limitation periods or once the legal obligation is fulfilled. This may apply in particular to settlement, correspondence and request/complaint handling data.

To protect the Service and prevent fraud we may keep selected data on closed accounts, such as listing history, IP address, moderation information and user history, for 12 months from account closure. Cookie-related data is kept for the "lifetime" of the respective cookies or until you delete them. For more information see our Cookie Policy.

Anonymised and aggregated statistical data that does not identify the user (i.e. is not personal data) may be kept indefinitely, in particular for analytical and statistical purposes.

XII. Links to third-party websites

Our Service may contain links to websites or applications of third parties. If you follow such a link, note that those services operate under their own rules and have their own privacy policies. We have no control over them and are not responsible for their content or practices. We encourage you to read the privacy policy of each site or app you visit after leaving our Service.

XIII. Contact

If you wish to contact us about the processing of your personal data, email us at: support@garazh.eu.

XIV. Supervisory authority

If you consider that the processing of your personal data infringes the law, you have the right to lodge a complaint with the competent supervisory authority, i.e. the President of the Personal Data Protection Office (PUODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw.

---

Last update of the Privacy Policy: see the date at the top of this page.