Privacy and cookie policy

1. Data controller and contact details

The data controller is Autotivo Sp. z o.o., Aleje Racławickie 10/5, 20-037 Lublin, Poland, registered in the Polish National Court Register under KRS 0000996184, tax identification number PL7393974196, REGON 523348385. For privacy enquiries and to exercise your rights, contact [email protected] or write to the postal address above.

2. The data we process

When you subscribe to the newsletter, we process your email address and the country associated with your subscription. We also keep information needed to administer the subscription and demonstrate consent, such as the date and source of the request, the version of the consent wording, the confirmation date and your subscription or withdrawal status. We obtain data directly from you and through your use of the form and website.

When you use the website, the technical infrastructure may process your IP address, request time and parameters, browser and device information, and error and security logs. Once you give the relevant consent, we also process the information described in the analytics and advertising measurement sections. If you contact us, we process the correspondence and the information you provide in it.

3. Newsletter and discount code

With your consent, we send an email announcing the store launch with a 15% discount code, followed by further newsletters featuring Autotivo offers, promotions and news. We use your country to tailor communications to the relevant market. The legal basis is consent under Article 6(1)(a) GDPR, together with the consent required under applicable electronic marketing rules.

After you submit your request, we send an email asking you to confirm your address. Your subscription becomes active once confirmed. Providing your email address and country is voluntary, but necessary to operate the newsletter for the relevant market. Newsletter consent does not include consent to analytics or advertising measurement.

You can unsubscribe at any time using the link in every marketing email or by contacting [email protected]. Unsubscribing is free and does not require you to log in. Withdrawing consent does not affect the lawfulness of earlier processing. Unsubscribing stops the Autotivo newsletter being sent to that address across all our country versions, unless you subsequently give fresh consent.

Detailed conditions for using the discount code are provided with the offer or when the code is issued. This policy explains the processing of personal data relating to the subscription.

4. Other purposes and legal bases

We use technical data to deliver and protect the website, detect misuse and resolve faults. The legal basis is Article 6(1)(f) GDPR, and our legitimate interest is keeping the service working safely and effectively. We use the same legal basis to respond to general correspondence, pursuing our interest in handling enquiries.

We handle requests to exercise individual rights and document consent to fulfil our obligations under data protection law, relying on Article 6(1)(c) GDPR. We process information necessary to establish, exercise or defend legal claims under Article 6(1)(f) GDPR. Our interest is protecting our rights and being able to demonstrate that our actions were lawful.

5. Google Analytics 4

With your consent, we use Google Analytics 4 to measure visits, how content is used and the effectiveness of the subscription form. Data may include online identifiers, device and browser information, pages visited, referral source, visit timing, events and approximate location. Connecting to the service also involves processing an IP address. This information may constitute personal data.

The legal basis is Article 6(1)(a) GDPR and consent to the relevant storage of or access to information on your device. We activate analytics tags after you consent to analytics. You can refuse or withdraw consent in the website privacy settings without affecting your ability to subscribe to the newsletter.

6. Google Ads measurement

With separate consent, we use Google Ads measurement to check whether Autotivo advertisements lead to website visits and newsletter subscriptions. Data may include advertising and cookie identifiers, information about an ad click, your device and browser, and actions on the website.

The legal basis is Article 6(1)(a) GDPR and consent to the relevant storage of or access to information on your device. We activate Google Ads measurement tags after you consent to advertising measurement. You can manage this consent in the website privacy settings. You can use the website and subscribe to the newsletter without giving this consent.

7. Cookies and consent choices

Cookies and similar technologies store information on your device or access information already stored there. We use necessary technologies to the extent required for the functions you request, security and remembering your privacy choices. Analytics and advertising cookies that require consent are activated according to your choices.

In the privacy panel, you can separately accept analytics and advertising measurement or reject both categories. Making no choice does not activate these tools. You can return to the panel at any time through the Privacy settings link in the footer. Refusing and withdrawing consent are as easy as giving it.

An up-to-date list of the cookies and similar technologies used, their providers, purposes and lifetimes is available in the privacy panel before you consent. A cookie's lifetime on your device is separate from the period for which data is retained in a provider's systems. We normally remember your consent choices for 6 months, unless you change them, remove the record from your device or the scope of processing changes materially.

8. Service providers and data recipients

We use Vercel Inc. in the United States to host the website, Cloudflare, Inc. in the United States to provide domain DNS services, and Resend, operated by Plus Five Five, Inc. in the United States, to store contacts and run email campaigns. Resend processes subscriber data on our behalf. Selecting a European sending region in Resend does not move the service's data storage from the United States.

Google Ireland Limited in Ireland provides Google Analytics to Autotivo. In connection with Google Ads, Google may also act as an independent controller. Under the relevant Google terms, the entity for EEA data is Google Ireland Limited, and for UK data covered by those terms it is Google LLC in the United States. Google's privacy policy and information about partner websites explain the processing carried out by Google.

Access may be granted, where necessary, to authorised personnel, IT and correspondence service providers, advisers and public authorities entitled to receive data by law. We engage processors under appropriate agreements. Each provider may have separate responsibilities for data it processes for its own purposes recognised by law.

9. Transfers outside the EEA

Using the services described above may involve processing data outside the European Economic Area, particularly in the United States. Resend processes contact data and information associated with email delivery in the United States.

Transfers rely on the appropriate mechanism provided by law: an adequacy decision, including the EU-US Data Privacy Framework where the transfer falls within the recipient's current certification, or appropriate safeguards, in particular the European Commission's standard contractual clauses and any required supplementary measures. Relevant UK transfer mechanisms apply to data subject to the UK GDPR.

You can request information about the safeguards applicable to a particular transfer and how to obtain a copy by contacting [email protected].

10. How long we keep data

We delete unconfirmed newsletter requests within 30 days. We maintain an active subscription until consent is withdrawn, the newsletter ends or 3 years have passed since confirmation or renewed confirmation, whichever occurs first.

We may retain limited evidence of consent, messages sent and unsubscribe handling in a restricted archive until the applicable limitation periods for claims or liability relating to those messages have expired, calculated under the applicable law. We review the need for retention at least once a year. If there is a specific dispute or proceeding, we retain necessary information until its final resolution and until it is no longer needed to protect our rights. Archived data is not used for further marketing.

We retain a minimal unsubscribe record, such as an email address and suppression status, for as long as necessary to respect the withdrawal and prevent further messages without fresh consent. We also review the continued need for this record.

We retain user and event data covered by the GA4 retention setting for 2 months, without resetting that period when the user returns. This setting does not cover standard aggregated reports. Cookie and advertising measurement identifier lifetimes are shown in the privacy panel. The retention period for Google Ads measurement data depends on its purpose: attributing conversions to campaigns, checking measurement accuracy, billing and preventing misuse, and on the retention rules of the relevant Google service. Data for which Google acts as an independent controller is retained under its data retention policy. The 2-month GA4 setting does not apply to Google Ads.

Technical logs are subject to retention periods determined by the log type and service configuration. We retain information about a specific incident for the time needed to investigate it and protect against claims. We keep correspondence while dealing with the matter, and afterwards only as necessary to fulfil obligations or protect rights. Backups are deleted in accordance with the relevant service's cycle and are not used for ongoing marketing messages.

11. Your rights

Subject to the conditions in the applicable law, you can request access, rectification, erasure and restriction of processing, and portability of data processed automatically on the basis of consent or a contract. You can withdraw consent at any time. You have the right to object to processing based on legitimate interests on grounds relating to your particular situation, and you may object to direct marketing at any time.

Send requests to [email protected]. If we have reasonable doubts about your identity, we may request the information needed to verify it. You also have the right to complain to a competent supervisory authority, particularly in the country where you normally live or work or where an alleged infringement took place. In Poland, this is the President of the Personal Data Protection Office.

12. Tailoring communications and automated decisions

The country associated with a subscription helps us tailor communications to the relevant market. The analytics and advertising measurements described in this policy assess the performance of the website and campaigns. In this context, Autotivo does not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

13. Information for the relevant market

Autotivo is a controller established in Poland. The EU GDPR applies to processing in the context of that establishment. Additional rights and requirements under mandatory laws applicable to you remain unaffected. The language version of the website does not limit those rights.

14. Changes to this policy

We update this policy when processing purposes, tools or legal requirements change. We publish the current version on the website with its revision date and communicate material changes in a way appropriate to their scope. We will ask for fresh consent before starting processing that requires it. When purchasing and customer account services launch, we will provide privacy information covering those services.