Privacy policy regarding data processing and storage

Privacy and Cookies Policy

When you contact us, use the Service or access the services and electronic tools we offer, we process your Personal Data.

We respect your privacy and strive to apply the best practices in processing your Personal Data in such cases, particularly in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, commonly known as the General Data Protection Regulation (GDPR).

This Privacy and Cookies Policy explains who we are, how we process your Personal Data, which cookies we use, what your rights are in this regard and how you can contact us if needed.

The Privacy and Cookies Policy is for informational purposes only, meaning it does not constitute a source of legal obligations for you or the Service Provider (does not constitute a contract). Therefore, we reserve the right to amend this Privacy and Cookies Policy from time to time. The current version of the Privacy and Cookies Policy will be available at the following link.

Glossary – key terms.

Personal Data – any information related to you that we process. For example: name, surname, email address, phone number, etc.

Processing – any actions performed on Personal Data. For example: collection, storage, updating, deletion of data.

Service – a platform consisting of a network of interconnected web pages, accessible at www.rivolv.pl.

Who is the controller of your personal data?

The controller of Your personal data is Inter Cars S.A. with its registered office in Warsaw, at ul. Powsińska 64, 02-903 Warsaw, registered in the Commercial Register, maintained by the District Court for the Capital City of Warsaw in Warsaw, XIII Commercial Division of the National Court Register under the KRS No. 0000008734, NIP 118-145-29-46, REGON 014992887, e-mail address: sekretariat@intercars.eu. The Controller has appointed a Data Protection Officer, who can be contacted at the following email address: iod@intercars.eu and at the address of Inter Cars S.A. with its registered office in Warsaw, at ul. Powsińska 64, 02-903 Warsaw, with the note „DPO.”

What Personal Data do we collect, what is the purpose, retention period and legal basis for their processing?

VISITS TO THE WEBSITE

When you visit the Service, we may use cookies and other related technological solutions (for detailed information, see section VI of the Privacy and Cookies Policy), which help maintain the proper functioning of the Service, as well as analyse information about your activity within the Service. We process this data to improve the quality of the services we offer and enhance the operation of the Service. It may also happen that cookies (or similar technologies) help us adapt the content available through the Service to your interests (profiling). Depending on the current functionalities, we may use certain cookies for marketing purposes, both within the Service and across the websites of our business partners.

The legal basis for using cookies and similar technologies is, as a rule, your consent.

The legal basis for processing data collected through the use of cookies is our legitimate interest or that of a “third party” (Art. 6(1)(f) of the GDPR – including the need to ensure the highest quality of the content presented and sometimes marketing our or our partners’ products and services, with the understanding that in such cases, partners do not participate in processing your data. In cases where our partners may also have direct access to this information, the legal basis for such processing is your voluntary consent (Art. 6(1)(a) of the GDPR).

Personal Data is processed based on your consent, up to the moment it is withdrawn. Personal Data processed based on our legitimate interest may be stored until you object to its processing, except in cases where, despite your objection, we conclude that there are important, legally justified grounds for processing, overriding your interests, rights and freedoms or grounds for establishing, pursuing or defending claims.

The above does not apply in cases where the use of cookies and similar technologies is necessary for the proper functioning of the Service (to provide you with an electronically delivered service), in which case we rely on legal provisions and, accordingly, on the necessity of processing to perform a service contract (Art. 6(1)(b) of the GDPR). Your Personal Data is then processed for as long as necessary to achieve these purposes.

Information about the recipients of your Personal Data, including any potential transfer of your Personal Data to third countries (outside the European Economic Area), is detailed in section IV below.

The rights you have in connection with the processing of your Personal Data are described in detail in section V below.

CONTRACT CONCLUSION FOR SALES

When you decide to purchase our products, we process information related to placing orders and executing sales contracts. In order to conclude and perform the contract, we will require certain Personal Data, such as your name, surname, email address, mailing address, and billing details. Providing all information is voluntary; however, some data is necessary to conclude the sales contract, and failure to provide this information may result in the inability to conclude the contract.

Personal Data that is not required may help us improve our Service. We may also use this data for statistical purposes.

The purpose and legal basis for processing is to conclude and properly perform the sales contract (Art. 6(1)(b) GDPR) – for example, delivering the ordered products.

Your data may also be processed for marketing activities, such as presenting you with advertisements and offers (discounts), also customised to your interests based on profiling (pursuant to Art. 6(1)(f) GDPR, i.e. the legitimate interest of the Data Controller or a third party (the Data Controller’s or partners’ direct marketing).

Some of your Personal Data may also be processed for communication, administration and organisation within the Inter Cars Capital Group, for the purpose of handling and pursuing claims, as well as fulfilling legal obligations arising from relevant legal provisions, such as tax and accounting obligations. The legal basis for processing is, accordingly, our legitimate interest (Art. 6(1)(f) GDPR) or the necessity of fulfilling a legal obligation (Art. 6(1)(c) GDPR).

If you decide to leave a review regarding the contract concluded with us (if such an option is available within the Service), we will process your data to assess your satisfaction with our services and the Service. This will allow us to improve and enhance the quality of our business, which constitutes our legitimate interest (Art. 6(1)(f) GDPR).

If you have concluded a sales contract with us, we will process your Personal Data for the period necessary to fulfil the contract and usually for up to 6 years after its conclusion, particularly due to tax regulations.

The processing periods described above may be extended in connection with potential claims, including legal proceedings – for the duration of such proceedings and settlement and also if the law requires us to process certain types of data for a longer period. In any case, the longer retention period for Personal Data will apply.

Personal Data processed based on our legitimate interest may be stored until you object to its processing, except in cases where, despite your objection, we conclude that there are important, legally justified grounds for processing, overriding your interests, rights and freedoms or grounds for establishing, pursuing or defending claims.

Information about the recipients of your Personal Data, including any potential transfer of your Personal Data to third countries (outside the European Economic Area), is described in section IV below.

The rights you have in connection with the processing of your Personal Data are described in detail in section V below.

NEWSLETTER

Depending on the current functionalities of the Service, we may send you commercial information about us and our services (or our partners) through the selected communication channel, but only after obtaining your prior consent, including content customised to your interests based on profiling. The legal basis for processing your Personal Data for this purpose is our legitimate interest or the legitimate interest of our partners (Art. 6(1)(f) GDPR) – marketing purposes of ours or a third party.

Providing Personal Data is voluntary, but necessary to subscribe to the Newsletter.

We may also process your Personal Data for communication, administration and organisation within the Inter Cars Capital Group, as well as for handling and pursuing claims – the legal basis for processing is, respectively, our legitimate interest (Art. 6(1)(f) GDPR).

We may process your Personal Data for as long as necessary to carry out our marketing activities, unless you object to its processing. A longer period results from its retention in case of potential claims for the statute of limitations determined by law, in particular, the Civil Code, or from the duration and settlement of legal proceedings. In any case, the longer retention period for Personal Data will apply.

The rights you have in connection with the processing of your Personal Data are described in detail in section V below.

CONTACTING US

When you contact us, for example, via email, available forms, social media, etc., examples of Personal Data we may process include: Personal Data that identifies you (i.e. email address, IP address, etc.), metadata related to the contact (i.e. date of contact, duration of our conversation) and the content of our communication (i.e. email content). Your Personal Data is processed in order to respond to your inquiry, improve our communication, enhance the quality of customer service, as well as for marketing purposes. The purpose of processing depends on the nature of our communication, and therefore, in some cases, your Personal Data will be used to conclude the appropriate contract with you. If we already have an existing contract, it will be used to ensure appropriate support within the scope of our cooperation (i.e. handling your complaint).

In such cases, the legal basis for processing depends on the context of communication. If you contact us solely for general information, such as regarding the Service, we process your Personal Data based on our legitimate interest (arising from the aforementioned purposes; Art. 6(1)(f) GDPR). However, if your inquiry leads to the conclusion of a sales contract, the appropriate legal basis for processing will be Art. 6(1)(b) GDPR – taking steps at the request of the data subject prior to entering into a contract. If we already have a contract and you contact us regarding its performance, the legal basis for our actions is Art. 6(1)(b) GDPR – necessity for the performance of a contract.

Providing Personal Data is voluntary but necessary for effective communication with us.

If your Personal Data was collected solely in connection with our current communication, we may process it, depending on the category of the information, for a period ranging from a few days to several months (more detailed inquiries and conversations that may be relevant for future contact).

Personal Data processed based on our legitimate interest may be stored until you object to its processing, except in situations where, despite your objection, we conclude that there are valid, legally justified grounds for processing that override your interests, rights and freedoms or grounds for establishing, pursuing or defending claims.

The principles of protection and use of Personal Data by social media platforms, which you may use to contact us, are described in their privacy policies. For example, information on the processing of Personal Data by Instagram can be found on the following page: https://privacycenter.instagram.com/policy/?section_id=0-WhatIsThePrivacy.

Information about the recipients of your Personal Data, including potential transfers of your Personal Data to third countries (outside the European Economic Area), is described in point IV below.

The rights you have in connection with the processing of your Personal Data are described in detail in point V below.

PROCESSING OF DATA OF OUR CONTRACTORS AND THEIR EMPLOYEES / CONTRACTUAL PARTNERS

If you are our contractor or an employee/contractual partner of our contractor, we may process your identification, contact and contract-related data, including, in particular, your name, the name of the entity employing you, contact phone number, email address, your position/authority and any correspondence with us. If you are a party to an agreement concluded with us, we will also process your registration data or information related to our settlements.

Personal data will be processed for the following purposes:

Data Subject	Purpose na Legal Basis		Storage Period
Contractor being a natural person conducting business activity		1. Conclusion and performance of the contract (legal basis – art. 6(1)(b) GDPR). 2. Accounting and tax settlements based on a legal obligation of the Controller (legal basis – art. 6(1)(c) GDPR). 3. Communication, administration and organisation within the Inter Cars Capital Group, as well as defense against claims and the pursuit of potential claims arising from the performance of the contract – i.e. legitimate interest of the Controller (legal basis – Art. 6(1)(f) GDPR). 4. Communication for purposes related to marketing initiatives organised by the Controller, particularly contests, promotions and other similar activities (legal basis – Art. 6(1)(f) GDPR) – where required, after obtaining the necessary consent from the Controller.	Personal data will be processed for the period necessary to perform the contract. Personal data will also be processed for the period required by law (including the Accounting Act), until an effective objection is raised against processing based on legitimate interest, as well as until the limitation period for any claims arising from the contract (for a maximum period of 6 years as specified in the Civil Code). The longest data processing period applies.
Representatives, including the proxies of the contractor		1. Conclusion and performance of the contract (legal basis – Art. 6(1)(b) GDPR). 2. Verification of the identity of the person entering into the contract on behalf of the contractor, communication, administration and internal organisation within the Inter Cars Capital Group, as well as defense against claims and the pursuit of potential claims arising from the execution of the contract – i.e. the legitimate interest of the Controller (legal basis – Art. 6(1)(f) GDPR). 3. Communication for purposes related to the marketing initiatives organised by the Controller, particularly contests, promotions and other similar activities (legal basis – Art. 6(1)(f) GDPR) – when required, after the Controller has obtained the necessary consents.	Personal data will be processed for the period necessary to perform the contract. Personal data will also be processed for the period required by law (including, among other things, the Accounting Act), until the effective objection to processing based on the legitimate interest, as well as the limitation period for any claims arising from the contract (for a maximum period of 6 years, as stipulated by the Civil Code). The processing period will be determined by the longest data retention period.
People designated by the contractor for contact related to the performance of the contract		1. Execution of the contract concluded by the Controller, communication, administration and internal organisation within the Inter Cars Capital Group, as well as defense against claims and pursuing any claims arising from the execution of the contract – this constitutes a legitimate interest of the Controller (legal basis – Art. 6(1)(f) GDPR). 2. Communication for purposes related to marketing initiatives organised by the Controller, including contests, promotions and other similar activities (legal basis – Art. 6(1)(f) GDPR) – in situations where required, after obtaining the necessary consents from the Controller.	Personal data will be processed for the period necessary to perform the contract. Personal data will also be processed for the period required by applicable law (including the Accounting Act), until an effective objection is made to the processing of data based on a legitimate interest and until the statute of limitations for any claims arising from the contract expires (for a maximum period of 6 years, according to the Civil Code). The longest data processing period will determine the processing duration.

Your data has been obtained directly from you or from your employer/entity you represent. The provision of personal data is voluntary; however, providing this data is a condition for concluding a contract or allowing you to carry out the tasks specified in the contract (failure to provide the data will prevent our cooperation).

Information about the recipients of your personal data, including any transfer of your data to third countries (outside the European Economic Area), has been described in section IV below.

Your rights related to the processing of your personal data are described in detail in section V below.

Who has access to your personal data?

Access to your personal data may be granted only to entities that support us in operating the Service based on appropriate agreements, such as IT service providers or those providing tools enabling our communication, conducting marketing campaigns, our advisors, including legal advisors, transport service providers, accounting services and payment processors, as well as entities within the Inter Cars Capital Group.

All these entities have access only to the information necessary for their activities.

If you decide to post a review that will be published on our Service (availability depending on the current functionality of the Service), the group of recipients of your personal data disclosed in this review will be unlimited. Of course, it is up to you whether and which data will be disclosed in the review you post.

Some of the entities providing us with solutions may be located outside the European Economic Area (EEA). In every case of data transfer outside the EEA, we implement the required security measures, including, for example, standard data protection clauses adopted by the European Commission, with appropriate safeguards in place. You can obtain a copy of the security measures we apply regarding the transfer of personal data to a country outside the EEA by contacting us.

Your rights regarding the processing of your personal data

To efficiently exercise your rights, please send any requests to the email address provided in the glossary, using the subject line “GDPR Request” and specifying which right you wish to exercise in the content of the email. The instructions in the previous sentence are only recommendations, not requirements. Contacting us in any other way will not result in the loss of the rights listed below.

At any time, you have the right to:

access your personal data (including, for example, receiving information about which personal data are being processed or obtaining a copy of them);
request rectification or restriction of processing (i.e. if the personal data are incorrect) or deletion of personal data (i.e. if they have been processed unlawfully);
portability of personal data that you provided to the Controller and which are processed in an automated manner, based on consent or contract, to another controller;
withdraw any consent previously given to the Controller at any time, noting that the withdrawal of consent does not affect the lawfulness of processing carried out by the Controller before the consent was withdrawn;
object to the processing of personal data carried out for the purpose of pursuing the legitimate interests of the Controller or a third party (if there are no other overriding legal grounds for processing). If personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing purposes, including profiling, insofar as the processing is related to such direct marketing – in such cases, personal data should no longer be processed for these purposes.
lodge a complaint with the President of the Personal Data Protection Office (a detailed description of the complaint procedure is available at: https://uodo.gov.pl/pl/83/155). Of course, if you wish to provide feedback on how we operate, we encourage you to contact us first.

What are “cookies” and other similar technological solutions? How and for what purposes do we use them?

Cookies are small data files that are stored on your device when you visit the Service. They store information about how you use the Service. We use cookies and other technological solutions to recognise you as a returning user, improve the quality of our service, collect statistical data and for marketing purposes. We also process them to analyse the popularity and effectiveness of our offers.

The technology we use for cookies (or similar functionality) collects information about each person visiting the Service.

The information collected in cookies does not always constitute Personal Data as defined by the GDPR. However, some information, depending on its content and how it is used, may be associated with a specific person and thus be considered Personal Data.

Of course, you can change how you use cookies, including blocking or deleting them entirely through your web browser or mobile app settings. However, please note that such actions may prevent or significantly hinder the proper functioning of our Service, for example by slowing down its performance, so we recommend not disabling them in your browser or app.

We always provide information, clearly explaining to our users which specific cookies we use and for which purposes, during their first visit to our Service.

On our Service, we use two types of cookies (or other similar technological solutions): session cookies, which are stored on your computer or mobile device until the software is turned off, and persistent cookies, which remain on your device for a specified period according to cookie settings or until manually deleted from your browser/app.

Depending on the case, we may use the following types of cookies (or similar solutions):

technical – necessary for the proper functioning of the Service and available functionalities within the Service; these cookies are not used to track visitors to the Service;
analytical/performance – used to analyse your behavior within the Service, for statistical and analytical purposes; they help us achieve our legitimate goals regarding improving how our website works; for example, by ensuring users can easily find what they are looking for;
marketing (depending on the current functionalities of the Service) – used to analyse your behavior; they provide information allowing us to identify you, including for marketing purposes on third-party websites; depending on the current functionalities of the Service, we may use this information, considering your choices and preferences, to make our website and the ads displayed on it more relevant to your interests. We may also share this information with third-party entities for this purpose.

It is possible that we cooperate with other companies in their marketing (advertising) activities. For this cooperation, your browser or other software installed on your device may also store cookies from third parties involved in marketing activities, which may become the controller of your Personal Data (these are called third-party cookies). Cookies sent by these entities are intended to present you with only those ads that match your individual interests and needs. We believe that displaying personalised ads can be more attractive to you than ads that are not relevant to your needs. Without these cookies, this would not be possible, as the companies we cooperate with deliver advertising content to you.

We may use the following entities or services of entities that apply cookies in the Service:

Google AdWords
Google AdSense
Google Ads
Google Analytics

the service concerns Google LLC or its affiliated entity (these are entities belonging to the Google group of companies, including those providing services for consumers in the European Union, such as Google Ireland Limited, Google Commerce Ltd, Google Payment Corp, and Google Dialer Inc).

DoubleClick
Meta Platforms, Inc. or its affiliated entities

These entities, due to the use of their own cookies in the Service, may become controllers of your Personal Data. More information about the cookies of these entities can be found in their privacy policies.

The detailed purposes of using cookies are described in the Consent Management Platform (CMP), which is available here. You will also find information about our trusted partners and the reasons for processing your data.

Cookie Management

You may change how you use cookies at any time by managing your consent through the privacy settings in our Service via the CMP or through your browser settings. To do this, you need to modify the privacy settings within the Service using the CMP or through your browser. In particular, you may withdraw your previously given consent; however, this will not affect the lawfulness of processing carried out based on the consent before its withdrawal.

If you wish to manage your cookie preferences within our Service, we provide a tool that displays all types of cookies, along with their descriptions and allows you to decide which types of cookies you accept. You can easily change these settings at any time through the dedicated functionality available under the “Manage cookies” button, which is visible throughout your use of our Service at the bottom of the page. You may also click here at any time to view or manage your cookie settings.

Most browsers also offer features that allow you to view and delete cookies. Please note that disabling or blocking certain cookies may prevent or significantly hinder the proper functioning of our Service, for example, by slowing it down.

Browser developers provide help pages regarding cookie management for their products. More information can be found below:

Google Chrome
Internet Explorer
Mozilla Firefox
Safari (Desktop)
Safari (Mobile)
Android Browser
Opera
Opera Mobile

For other browsers, please refer to the documentation provided by the browser developer.

Consent Management Platform (CMP)

We use a Consent Management Platform to facilitate the exercise of your rights under the GDPR.

You can view the Consent Management Platform and set your cookie preferences using it. CMP allows you to:

- obtain detailed information about the cookies we use in the Service and about our trusted partners;
- give and withdraw consent for the use of optional cookies by us and our trusted partners;
- object to the processing of optional cookies by our trusted partners based on their legitimate interests.

The Consent Management Platform will appear as a cookie banner during your first visit to the Service. During subsequent visits, you can change your selected settings by going to the Privacy Policy of the respective Service and clicking “Manage cookies”.

The Consent Management Platform will remember your consents or objections. Based on them, we will make the Service available to you. At any time, you can review your settings and make changes.

Last update of the Privacy and Cookies Policy: 02.01.2025