Privacy policy
Effective from 31 October 2026. This is an English translation for convenience – the Polish version is legally binding.
1. Data controller
The controller of personal data is MULTICARS KOMPLEX SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, ul. Zarzecze 74, 24-100 Puławy, Tax ID (NIP) 7162831841 (“we”). Data protection contact: [email protected].
2. What data we collect and why
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| E-mail, name, password (encrypted) | Running the account, e-mail confirmation, password reset, reminders about expiring listings | Art. 6(1)(b) – account agreement | Until the account is deleted |
| Phone, town, listing content and photos | Publishing the listing and letting buyers contact the seller | Art. 6(1)(b) – agreement | Until the listing or account is deleted |
| Content of a listing report and (optionally) the reporter's e-mail | Handling the report, replying | Art. 6(1)(c) – DSA obligations; (f) – site security | Up to 2 years after handling |
| Name, e-mail, (optionally) phone and the content of a message to the seller | Forwarding the message to the seller by e-mail – we do not store the content on the site | Art. 6(1)(b) – fulfilling your contact request | Not stored (only a message counter for the listing) |
| E-mail and search filters (alerts about new listings) | Sending e-mails with new listings (after confirmation via a link) | Art. 6(1)(a) – consent | Until you unsubscribe (link in every e-mail) |
| IP address, server logs | Security: protection against intrusion, spam and bots harvesting numbers | Art. 6(1)(f) – legitimate interest | Logs – according to the hosting provider's log rotation (a few weeks); attempt counters – up to 1 hour |
We show a listing's phone number only after clicking “Show number”, to make it harder for bots to harvest it.
3. Who we share data with
- DNCT – hosting of the website, database and e-mail (processor acting on our behalf).
- Cloudflare – a network that speeds up and protects the site; it sees visitors' IP addresses. Transfers outside the EEA are based on standard contractual clauses / the EU-US Data Privacy Framework.
- Public authorities – only when required by law.
We do not sell data and do not use it for advertising.
4. Cookies and browser storage
We use only necessary cookies: the login session (deleted when you close the browser) and the cookie remembering your chosen language (mc_lang, 1 year). Your list of favourite listings is stored only in your browser (localStorage) and is never sent to us. We do not use analytics or advertising cookies, so we do not show a consent banner. We only count aggregated, anonymous visit statistics (day, page language and where the visit came from, e.g. Google, Facebook or a QR code on a poster) – without cookies, without IP addresses and without identifying anyone.
5. Your rights
You have the right to access your data, rectify it, erase it (you can delete your account yourself in the “Account” section), restrict processing, data portability and to object to processing based on legitimate interest. Write to [email protected] – we will reply within one month.
You can also lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.
6. Security
Passwords are stored only in encrypted form (bcrypt), the connection to the site is encrypted (HTTPS) and the number of login attempts is limited.