This Privacy Policy describes how the moto.free service processes Users' personal data, in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and the Polish Act of 18 July 2002 on the provision of electronic services. It supplements the Service's Terms. Using the Service and providing personal data are voluntary — however, without the data marked as required it is not possible to create an Account or publish a listing.
1. Data Controller
The controller of personal data is SRCODE MAREK ANSELM, ul. Ficowskiego 8 m. 28, 01-747 Warszawa, Polska, NIP 7282566198, REGON 100443421. For all matters concerning personal data you may contact us at [email protected] or in writing at the address above. The controller has not appointed a data protection officer — the GDPR does not require one for the scope of activity conducted.
2. Scope of Data Processed
When you register an Account we process your email address, user name and password, which is stored only as a cryptographic hash (argon2id) — we do not know your password. When you sign in with Google or Facebook, those providers give us your email address, name and account identifier. In your profile and listings we additionally process your phone number if you provide one, the listing content with photos and the approximate location of the vehicle (coordinates you pick on the map). Messages sent in chat between Users are stored so that they can be delivered and displayed. Server logs record the IP address, date, requested address and response status. We do not collect special categories of data, we do not profile Users and we do not make decisions about them by solely automated means.
3. Purposes and Legal Bases
We process data: to create and maintain your Account, publish listings and operate chat and paid services — under Article 6(1)(b) GDPR (performance of a contract); to settle payments, issue invoices and keep accounting records — under Article 6(1)(c) GDPR (legal obligation); to keep the Service secure, prevent abuse and fraud, moderate listings and establish, pursue or defend claims — under Article 6(1)(f) GDPR (legitimate interest of the controller); to handle requests and complaints — under Article 6(1)(b) and (f) GDPR. Should we offer notifications or a newsletter in the future, these will be sent solely on the basis of separate consent (Article 6(1)(a) GDPR), which may be withdrawn at any time.
4. Data Recipients
Data contained in a listing (including the user name, the phone number if provided, and the vehicle location) is by the nature of the service publicly visible to everyone visiting the Service. Otherwise we share data only with entities that process it on our behalf or receive it as independent controllers: the provider of the server infrastructure the Service runs on; Resend (email delivery provider); PayPro S.A. (Przelewy24) — the payment operator, which receives the data needed to complete a transaction, including card data submitted directly to the operator; Google and Meta (Facebook) if you use their sign-in; the OpenStreetMap Foundation, which receives your IP address when map tiles are loaded and addresses are looked up. Data may be disclosed to public authorities where required by law. Where a provider is located outside the European Economic Area, transfers are made on the basis of standard contractual clauses approved by the European Commission.
5. Retention Period
Account data is kept for as long as the Account exists. An Account may be deleted at the User's request at any time and, in line with the Terms, after at least 36 months of inactivity. Listing content is kept for the publication period and for as long as needed to handle any complaints. Data required to settle payments and accounting records are kept for 5 years from the end of the tax year in which the tax obligation arose. Server logs are kept for no longer than 12 months. After these periods data is deleted or anonymised, unless longer retention is necessary to establish, pursue or defend claims — in which case it is kept until those claims become time-barred.
6. Your Rights
You have the right to access your data, rectify it, erase it, restrict its processing, port it and object to processing based on the controller's legitimate interest, as well as the right to withdraw consent at any time where processing is based on consent — without affecting the lawfulness of processing carried out before withdrawal. We handle requests promptly and no later than one month from receipt; an email to [email protected] sent from the address linked to your Account is enough. You also have the right to lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland, if you consider that the processing infringes the GDPR.
7. Cookies
The Service uses only cookies necessary for it to work: a session cookie holding the sign-in token (valid for 30 days), cookies remembering the selected language and colour theme, and a cookie recording that the cookie notice was dismissed (valid for 12 months). We use no analytics, advertising or tracking cookies and we do not share data about your activity with ad networks. You can change cookie settings or delete stored cookies in your browser — disabling the necessary cookies makes signing in to an Account impossible.
8. Changes to this Privacy Policy
This Privacy Policy may change if the law, the scope of services provided or the tools used change. We will announce any material change on the Service and, for registered Users, additionally by email, at least 14 days in advance. The current version of the Policy is always available at this address.