Privacy and cookies
Version: 10 October 2026
Information about customer data, bookings and optional website analytics.
ul. Adama Mickiewicza 37/58, 01-625 Warszawa · NIP 5252963835 · KRS 0001046531 · REGON 525840386 · Kapitał zakładowy: 5 000 zł · Sąd Rejonowy dla m.st. Warszawy w Warszawie, XIV Wydział Gospodarczy KRS
Workshop and contact: Marii Skłodowskiej-Curie 77A, 59-300 Lubin
+48 666 992 555 · lubinwarsztat@gmail.com
1. Controller and data
The controller is VIVA AUTO GROUP sp. z o.o.; contact details are below. Customer service uses necessary contact and invoice details, vehicle data such as VIN, registration and mileage, work orders and work/approval history. Technical photographs document condition and repairs; publishing identifiable people or customer data requires a separate basis. We do not request unnecessary identity-document copies.
2. Purposes and lawful bases
Enquiries, bookings and contract performance: GDPR Art. 6(1)(b). Accounting and legal obligations: (c). Business contacts, approval records, legal claims and security: (f), legitimate interests in service and business protection. Optional analytics: (a), consent. Order/invoice data needed for performance are required; declining analytics does not restrict service. Repair-related communication is not consent to advertising.
3. Recipients and external services
Necessary data may be shared with authorized staff, IT suppliers, ROAPP for booking and work orders, invoicing/accounting suppliers and legally entitled bodies. OpenAI Sites and Cloudflare infrastructure serve the website and may receive IP and technical connection data. ROAPP opens on a separate site. Google Maps and email are links, not embedded tracking; provider terms apply after following them. Data are not sold.
4. Google Analytics and consent
GA4 (G-P5Z312HZQQ) starts only after “Allow analytics”. We measure page views and phone, booking, email and map clicks. A booking click is not a confirmed appointment. Events contain no form fields, VIN, customer phone or message content; page URL query parameters are removed. Google may process cookie identifiers, browser data and approximate location. Google Signals and ad personalization are off. Rejecting is equally available; withdraw through “Cookie settings” in the footer, without affecting previous lawful processing. Google Ads (AW-18504299384) starts only after “Analytics and ad measurement”. Booking clicks are secondary actions valued at 0 PLN, not confirmed appointments. Measurement may process ad click identifiers and _gcl_* cookies (typically up to 90 days). Ad personalization and enhanced conversions remain off. You can choose analytics only or reject both purposes.
5. Retention and cookies
The local viva-consent-v2 choice lasts 180 days, then we ask again. Analytics _ga and _ga_* cookies can last up to 2 years, renewed by Google. Withdrawal blocks further events and deletes accessible domain cookies. Order and approval records are retained through performance and the applicable legal-claim period. Tax records normally remain until tax limitation, usually 5 years from the end of the year in which tax payment was due, subject to statutory extensions. Enquiries without an order are removed 12 months after closure unless needed for a specific claim. GA4 user/event retention is 2 months; aggregate reports may remain longer. Infrastructure providers set technical log retention in their service policies.
6. Transfers and rights
Some suppliers, including Google, may process data outside the EEA. Appropriate GDPR Chapter V mechanisms apply, such as a valid adequacy decision or standard contractual clauses; ask the controller for details and copies of safeguards. You may request access, correction, erasure, restriction and portability where legally applicable, and object to processing based on legitimate interests. Withdraw consent or complain to the President of UODO (uodo.gov.pl). Send requests to the controller’s email; the normal response period is one month, subject to lawful extension. The website makes no solely automated decisions with legal effects.
Google: Privacy · Data processing terms · OpenAI · Cloudflare