Information on the processing of personal data
Below is the information required by Article 13 of the GDPR — Regulation (EU) 2016/679 of 27 April 2016. It concerns the data you enter in the booking form.
1. Who controls your data
The data controller is Łukasz Jaroszewicz, prowadzący działalność gospodarczą pod firmą LUCAS-VAG-MOTORS Łukasz Jaroszewicz, ul. Kościuszki 6, 17-250 Kleszczele.
On matters concerning personal data you can reach us by e-mail (rezerwacja@lucas-vag-motors.pl), by phone (+48 505 475 292) or by post to the workshop address.
2. What data we collect
Through the booking form we collect: your name — so we know who is coming; phone number — to confirm the slot; e-mail address — to send the confirmation; home address — required to issue the sales document for the service; vehicle details and fault description — if you provide them; IP address and submission time — to limit abuse of the form.
Fields marked with an asterisk are mandatory. The rest are optional.
3. Purpose and legal basis
Handling the booking and contacting you about it — your consent (Art. 6(1)(a) GDPR) and steps taken at your request before entering into a contract (Art. 6(1)(b)). Performing the service and settling payment — performance of the contract (b) and tax and accounting obligations (c). Protection against abuse of the form — the legitimate interest of the controller (f).
4. How long we keep the data
Booking data is kept for 3 years from the date of the visit (the limitation period for claims relating to the service). Accounting documents are kept for the period required by tax law — five years from the end of the calendar year in which the tax payment fell due.
5. Who we share data with
We do not sell your data or share it for marketing. Access is limited to: the hosting provider running this site and the booking database; the e-mail provider; the accountancy office — for sales documents only; state authorities, where required by law. Data is not transferred outside the European Economic Area. Exception: reading the registration certificate, described in section 12.
6. What other visitors can see
Nothing beyond the fact that an hour is taken. The public calendar shows no name, phone number, address, car make or type of repair. That information is visible only in the workshop admin panel, protected by a login and password.
7. Your rights
You have the right to: access your data and obtain a copy; rectify inaccurate or incomplete data; have your data erased; restrict processing; data portability; object to processing based on legitimate interest; withdraw consent at any time — withdrawal does not affect the lawfulness of processing before it.
To exercise any of these, write to rezerwacja@lucas-vag-motors.pl or call us.
8. Complaint to the supervisory authority
If you believe we process your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.
9. Profiling and automated decisions
We do not profile you and we make no automated decisions about you.
10. Cookies
This site uses no tracking or advertising cookies. We store only: a cookie holding your chosen language, and a technical session cookie that protects the booking form against abuse. The Google Maps directions map loads only after you click — only then can Google set its own cookies. Web fonts are served from our own server, so simply opening the page does not send your IP address to any third party. We also keep anonymous visit statistics: the page opened, the hour, the type of device, the browser language and the country. No cookie is set for this and your IP address is not stored — to count people rather than clicks we use an irreversible hash that changes every midnight, so you cannot be recognised the next day. The country is determined on our own server from public address-allocation data, so your IP address never reaches any outside company. Detailed entries are deleted after six months.
11. Customer account and cars in the account
If you create an account, we additionally store: your e-mail address and password (as a cryptographic hash — nobody, including the workshop, knows your password), contact details, details of your cars (make, model, registration number, VIN, inspection and insurance dates), document scans you upload, and your visit and invoice history. The legal basis is the account agreement (Art. 6(1)(b) GDPR); inspection and insurance reminders are based on your consent, which you can switch off in your account. We keep the data for as long as you have an account; you can delete it yourself under “My details”. Accounts not confirmed within 30 days are deleted automatically.
12. Reading the vehicle registration certificate
When booking an appointment, on your own account, or — at your request — by a member of staff, a photo can be taken of your registration certificate so that the car details (VIN, registration number, make, engine size, power, fuel) are filled in automatically. The photo is then sent for automatic reading to Anthropic PBC (USA), which processes it on our behalf for this purpose only. This is the only case in which data leaves the European Economic Area, and it is based on standard contractual clauses approved by the European Commission (Art. 46 GDPR). A photo taken in the booking form is deleted the moment the details have been read — no trace of it is left. A photo added to a car on your account is kept with that car so that our staff can consult it when ordering parts; we store it together with the car's other documents and delete it together with them. If you would rather it was not kept, tell us during your visit and it is deleted as soon as the details have been read. If you prefer, we will type the details in by hand.