This Privacy Policy explains how we process the personal data of people visiting this website and which files are stored in your browser. The list of files in section 5 comes from a measurement taken on the live site, not from the providers' documentation.
1. Data controller
The controller of your personal data is CARTEST Sp. z o.o., ul. Logistyczna 9, Natolin, 05-825 Grodzisk Mazowiecki, Poland.
Contact for data protection matters: cartest@cartest.pl, +48 605 335 804.
2. What data, and on what basis
Contact form. We process the data you enter yourself: name, e-mail address, phone number and the content of your message. The basis is our legitimate interest in answering your enquiry (Art. 6(1)(f) GDPR) and, where the enquiry concerns entering into a contract, taking steps at your request before concluding it (Art. 6(1)(b) GDPR). Providing the data is voluntary, but without an e-mail address we have no way to reply.
Form protection. Every submission is checked for automated traffic. The basis is our legitimate interest in protecting the site against abuse (Art. 6(1)(f) GDPR).
Traffic statistics. We collect data about how the site is used only after you have given consent in the cookie consent window (Art. 6(1)(a) GDPR). You may withdraw consent at any time by reopening the cookie settings. Withdrawal does not affect the lawfulness of processing carried out beforehand.
Technical data. Regardless of consent, the site receives your IP address, browser information and the requested page address. Without them your browser could not connect to the server at all. The basis is our legitimate interest in delivering and securing the site (Art. 6(1)(f) GDPR).
3. Who we share data with
Below we name every party that has access to data in connection with running this website.
Cloudflare - website hosting and content delivery network. All traffic passes through this infrastructure, so the IP addresses of every visitor are processed. Cloudflare also provides the mechanism protecting the contact form, which analyses the IP address, connection characteristics and browser header; it has no access to the contents of the form.
Resend (legal entity: Plus Five Five, Inc., United States) - delivery of contact form messages to our mailbox. The full content of your submission passes through this provider.
Google Ireland Limited - Google Tag Manager and Google Analytics 4. This applies only to people who have consented to analytics files.
Important regarding Google Tag Manager: the container loads on every visit, before your decision, with all categories defaulting to denied. This means that before you click anything in the consent window, your browser opens a connection to Google's servers and passes them your IP address. Until consent is given, however, no analytics or advertising files are stored - we have confirmed this by measurement.
4. Transfers outside the European Economic Area
Some of the parties named above process data outside the EEA, including in the United States. Transfers take place on the basis of standard contractual clauses approved by the European Commission and, to the extent the provider holds the relevant certification, on the basis of the adequacy decision concerning the Data Privacy Framework.
5. Cookies and similar technologies
We group files into three categories. Necessary files are not subject to consent, because without them the site or the contact form stops working. Analytics and marketing files are stored only after you consent.
We currently use no marketing files at all.
| File | Category | Provider | Purpose | Retention |
|---|---|---|---|---|
cartest_consent | necessary | CARTEST | Remembers your choice in the consent window | 182 days |
cartest_cms_session | necessary | CARTEST | Keeps editors signed in to the content panel; editors only | 12 hours |
cf_chl_*, __cf_bm | necessary | Cloudflare | Protects the form against automated submissions; created only when the form is used | a few weeks |
_ga, _ga_* | analytics | Google Ireland Limited | Traffic statistics: visits, sources, popular pages | 13 months |
We measured the retention of the Google files on the live site. Google's documentation states two years for these files, but the actual value follows the measurement property's setting and in our case is 13 months.
The full list by category is also available in the cookie settings window, reachable from every page of the site.
6. How long we keep data
We keep correspondence from the contact form for as long as needed to deal with the matter, and then for the limitation period of any potential claims. Cookies live as long as stated in the table above, or until you delete them in your browser settings.
7. Your rights
You have the right to access your data, to rectify, erase or restrict its processing, the right to data portability, and the right to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time.
You also have the right to lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.
To exercise these rights, write to cartest@cartest.pl.