Privacy policy

1. General provisions

This is an English translation provided for the reader's convenience. The Polish version of this privacy policy is the binding one, and it prevails in case of any discrepancy.

This privacy policy sets out how we process and protect personal data provided by users in connection with car rental services offered through the website.

The website means the site at quanta.pl together with its subpages, including any applications on it.

A user is anyone who uses the website in any way.

2. Data controller

The controller of your personal data is QUANTA CARS sp. z o.o., registered office in Warsaw, al. Jana Pawła II 80 lok. 15, 00-175 Warsaw, Poland, entered in the register of entrepreneurs kept by the District Court for the Capital City of Warsaw, 14th Commercial Division of the National Court Register (KRS), under number KRS 0000473412, share capital PLN 420,000, NIP (tax ID) 5532513487, REGON 243257050.

For matters relating to personal data, contact us at biuro@quantacars.pl or by post at our registered office address.

The controller has not appointed a data protection officer.

3. Purposes and legal bases of processing

We process your data for the following purposes:

• concluding and performing the rental agreement, including vehicle handover and return, settlement and damage handling: Article 6(1)(b) GDPR
• replying to a message sent through the contact form, by email or by phone, and preparing an offer: Article 6(1)(b) GDPR (steps taken at your request before entering into a contract) and Article 6(1)(f) GDPR (handling correspondence)
• complying with legal obligations, in particular tax and accounting obligations and the obligation to identify the driver of a vehicle at the request of an authorised body (Article 78(4) of the Road Traffic Act (Prawo o ruchu drogowym)): Article 6(1)(c) GDPR
• handling complaints: Article 6(1)(c) GDPR and Article 6(1)(f) GDPR
• establishing, pursuing and defending legal claims, and debt collection: Article 6(1)(f) GDPR
• protecting our property through GPS tracking of vehicles: Article 6(1)(f) GDPR
• measuring website traffic and advertising effectiveness, including showing ads to people who have visited the website: Article 6(1)(a) GDPR (consent given in the cookie banner)
• recruitment: Article 6(1)(b) GDPR, and for data provided beyond the required minimum, such as a photo, Article 6(1)(a) GDPR

Where we process data on the basis of our legitimate interest, you may object at any time on grounds relating to your particular situation.

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

Processing complies with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, GDPR) and with the Personal Data Protection Act of 10 May 2018 (ustawa o ochronie danych osobowych).

4. Data we process

In connection with a rental agreement we process the following data:

• first name and surname
• address: street, building number, flat number, town or city, postcode
• email address
• phone number
• series and number of your identity card or other identity document
• driving licence number and the categories it covers
• PESEL number (Polish national identification number)
• credit card number or bank account number

Providing this data is voluntary, but it is necessary to conclude and perform the rental agreement.

5. Where we get your data from

You give us most of the data yourself. Some of it we receive from others:

• from a renter who names another person as a driver in the agreement (name, identity document and driving licence details, contact details)
• from insurers, insurance brokers and assistance operators when they order a replacement vehicle in connection with a claim (name, contact details, claim number, vehicle details and delivery address)
• from public authorities and road operators in connection with traffic offences and road charges relating to the rented vehicle
• from GPS devices fitted in the vehicles

6. Data from devices in vehicles

Our vehicles are fitted with GPS tracking devices. We process data from these devices only to protect our property, that is to monitor the vehicle in case it is lost or stolen, to check whether the speed limit set in the rental terms has been exceeded, and to check the geographical limits agreed in the rental agreement.

Some vehicles are fitted with a device that allows them to be immobilised remotely. We use it only if the rental terms are breached.

The legal basis is our legitimate interest in protecting our property, that is Article 6(1)(f) GDPR, and the performance of the rental agreement. Details are set out in the rental terms, which you sign when you collect the vehicle.

7. Recipients of data

Your data may be received by:

• CorCode sp. z o.o., the provider of the booking and fleet management system, as a processor; the booking system runs on the corcode.com domain
• home.pl S.A. of Szczecin, the website hosting provider, as a processor
• providers of email and IT services, as processors
• the payment operator handling payments and deposit holds, to the extent needed to process payments
• the provider of GPS devices and the tracking platform, and the SMS gateway provider, as processors
• Google Ireland Limited, for Google Analytics and Google Ads, only after you give consent in the cookie banner
• Google Ireland Limited, for the reCAPTCHA service that protects our forms against automated submissions, when you fill in a form
• the provider of the Conpeek call centre system (chat and call-back requests on the website), as a processor, if you use the widget
• Microsoft Ireland Operations Limited, for Microsoft Clarity (click maps and visit recordings with form text masked), only after you consent to the “Statistics” category
• the OpenStreetMap Foundation, if you enter your own delivery address in the search box (described below)
• insurers, assistance operators and loss adjusters in connection with a claim or the rental of a replacement vehicle
• accounting firms, law firms and debt collection agencies
• authorised public bodies, at their request where it has a legal basis, in particular in fixed penalty proceedings concerning an offence committed with a rented vehicle

We do not sell data and we do not pass it on to anyone without a legal basis.

8. Address search

If you enter an address in the search box that is not one of our locations, your browser sends it to the Nominatim geocoding service run by the OpenStreetMap Foundation (St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom) to find the coordinates the booking system needs.

Along with the address, the OpenStreetMap Foundation receives your IP address and basic information about your browser, as with any connection to a server. It processes this data as a separate controller under its own privacy policy: osmfoundation.org/wiki/Privacy_Policy.

If you do not want to use this feature, choose a location from the list or give us the address by phone.

9. Transfers of data outside the European Economic Area

Some recipients process data outside the EEA:

• Google LLC (USA), for Google Analytics and Google Ads, only after you give consent; the transfer is based on the European Commission's adequacy decision for organisations participating in the EU-US Data Privacy Framework, with standard contractual clauses as a supplementary safeguard
• Google LLC (USA), for the reCAPTCHA service when you fill in a form; the transfer is based on the European Commission's adequacy decision for organisations participating in the EU-US Data Privacy Framework, with standard contractual clauses as a supplementary safeguard
• Microsoft Corporation (USA), for Microsoft Clarity, only after you give consent; the transfer is based on the European Commission's adequacy decision for organisations participating in the EU-US Data Privacy Framework, with standard contractual clauses as a supplementary safeguard
• the OpenStreetMap Foundation (United Kingdom), when you use the address search; the transfer is based on the European Commission's adequacy decision for the United Kingdom

You can obtain information about these safeguards by writing to the address given in the "Data controller" section.

10. Retention period

We process data relating to the rental agreement for the term of the agreement, then until the limitation period for claims expires and for as long as tax and accounting laws require.

We keep contact form messages and correspondence for as long as needed to deal with the matter and, if an agreement is concluded, for the term of that agreement and the limitation period for claims.

We keep GPS data for as long as needed to protect our property, and longer only when it is needed as evidence in a specific case.

We keep data processed on the basis of consent until you withdraw it.

11. Automated decisions and profiling

We do not make decisions about you based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you.

If you consent to advertising cookies, Google may add your browser to a group of people who have visited our website and show you our ads on other sites. This does not affect your rental terms.

12. Your rights

Under the GDPR you have the right:

• to access your data and obtain a copy of it
• to have your data rectified
• to have your data erased
• to restrict processing
• to object to processing
• to data portability
• to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal; you can change your cookie consent through the "Cookie settings" link in the website footer
• to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw

To complete, update, rectify or erase your data, contact us by email or by registered letter to our registered office address.

You may object to the processing of your data at any time. We will stop processing it for those purposes unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the data is needed to establish, pursue or defend legal claims.

13. Security

Data transfer and authentication take place over an encrypted connection.

We apply technical and organisational measures that protect the data we process in a way appropriate to the risks and to the categories of data concerned. In particular, we protect data against disclosure to unauthorised persons, removal by an unauthorised person, processing in breach of the law, and alteration, loss, damage or destruction.

We send information, promotional and offer messages by email only if you give separate consent.

14. Cookies

The website stores information on your device (cookies and browser storage) only as described in the cookie policy. Until you give consent, we do not store analytics or advertising cookies and we do not send any data to Google. The exception is reCAPTCHA: when you start filling in a form, your browser connects to Google, which assesses whether the form is being sent by a person (IP address, browser information and how the page is used). The legal basis is our legitimate interest in protecting the forms against spam, Article 6(1)(f) GDPR.

Like any website, the server logs the IP address and time of each connection for the security of the website. The contact form stores a hash of your IP address to limit the number of automated submissions.

Some cookies and the identifiers stored by measurement tools are personal data within the meaning of the GDPR, so storing them requires your consent.

A detailed list of cookies, their purpose and retention period is set out in the cookie policy.

You can change or withdraw your consent at any time through the "Cookie settings" link in the website footer. You can also block cookies in your browser settings: the website will keep working and will simply stop collecting traffic data.

15. Final provisions

If this privacy policy changes, we will publish the relevant changes on the website.

Matters not covered by this policy are governed by the applicable provisions of Polish law.