The data controller responsible for the processing of personal data collected through this website and the Yowoxu Gisozi platform is the operator of yowoxu-gisozi.info, with its registered operational address at Storrady-Świętosławy 1B/56, Szczecin, Poland. Enquiries concerning data protection matters may be directed to [email protected] or by telephone to +48 91 487 37 54. Where required under applicable law, a data protection officer may be appointed and their contact details will be published on this page.
This Privacy Policy is issued in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation, hereinafter "GDPR"), as supplemented and implemented in Poland by the Act of 10 May 2018 on the Protection of Personal Data (Ustawa z dnia 10 maja 2018 r. o ochronie danych osobowych, Journal of Laws 2018, item 1000, as amended). Where the Act on Provision of Services by Electronic Means (Ustawa z dnia 18 lipca 2002 r. o świadczeniu usług drogą elektroniczną) applies to specific processing activities, its provisions are also observed.
The platform collects personal data in the following categories depending on the nature of the interaction: (a) Identity data, including full name and, where provided, business or trading name; (b) Contact data, including email address, telephone number and postal address; (c) Technical data, including IP address, browser type and version, operating system, referring URL, pages visited and session duration, collected automatically through server logs and analytics technologies; (d) Transaction data, relating to bookings made, equipment listed, rental periods and deposit transactions processed through the platform; (e) Communications data, comprising the content of messages sent through the contact form or through the platform's internal messaging functionality; (f) Preference data, including cookie consent choices and platform notification settings.
Personal data is processed for the following purposes, each supported by a specific legal basis under Article 6 GDPR: (a) To respond to enquiries submitted through the contact form — legal basis: Article 6(1)(b), processing necessary for steps taken at the request of the data subject prior to entering into a contract, or Article 6(1)(f), legitimate interests in communicating with prospective users; (b) To operate the marketplace platform, including processing bookings, generating rental agreements, facilitating deposit transactions and coordinating delivery logistics — legal basis: Article 6(1)(b), performance of a contract to which the data subject is party; (c) To comply with legal obligations applicable to the platform operator, including financial record-keeping requirements under Polish law — legal basis: Article 6(1)(c); (d) To analyse website usage patterns for the purpose of improving platform functionality — legal basis: Article 6(1)(f), legitimate interest, subject to cookie consent where analytics technologies are used; (e) To send service-related communications regarding bookings, agreements and platform updates — legal basis: Article 6(1)(b) or Article 6(1)(f) as applicable.
Personal data is retained for no longer than is necessary for the purposes for which it was collected. Contact enquiry data is retained for a period of up to 24 months from the date of the enquiry, unless a longer retention period is required by the establishment, exercise or defence of legal claims. Booking and transaction data, including generated rental agreements, is retained for a period of five years from the date of the completed rental transaction, in accordance with general limitation periods under the Polish Civil Code (Kodeks cywilny). Technical and analytics data is retained for a maximum of 26 months. Cookie consent records are retained for a period of 13 months from the date of consent. Where data is processed on the basis of consent, it is retained until consent is withdrawn or until the expiry of the retention period, whichever is earlier.
Personal data is shared with third parties only in the following circumstances: (a) With other users of the platform where sharing is necessary to facilitate a booking — for example, the renter's contact details are shared with the equipment owner for delivery coordination purposes, and vice versa, to the extent necessary and as documented in the rental agreement; (b) With service providers acting as data processors on behalf of the platform operator, including hosting providers, payment processing services and analytics providers, each bound by appropriate data processing agreements; (c) With competent authorities, courts or regulatory bodies where disclosure is required by applicable law or by a binding legal order; (d) In the event of a merger, acquisition or transfer of the platform's business, subject to appropriate notification to data subjects. The platform operator does not sell personal data to third parties for marketing purposes.
Where personal data is transferred to recipients located outside the European Economic Area, the platform operator ensures that appropriate safeguards are in place in accordance with Chapter V of the GDPR. Such safeguards may include standard contractual clauses approved by the European Commission, adequacy decisions, or other mechanisms recognised under applicable data protection law. Where transfers occur to service providers based in the United States, the platform operator verifies the applicability of the EU-US Data Privacy Framework or implements alternative transfer mechanisms as required.
Under the GDPR and applicable Polish data protection law, data subjects whose personal data is processed by the platform operator have the following rights: (a) The right to access personal data held about them (Article 15 GDPR); (b) The right to rectification of inaccurate or incomplete personal data (Article 16 GDPR); (c) The right to erasure of personal data in circumstances specified in Article 17 GDPR, subject to overriding legal obligations; (d) The right to restriction of processing in circumstances specified in Article 18 GDPR; (e) The right to data portability in respect of data processed by automated means on the basis of consent or contract (Article 20 GDPR); (f) The right to object to processing carried out on the basis of legitimate interests (Article 21 GDPR); (g) The right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal; (h) The right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland) where the data subject considers that processing infringes the GDPR or applicable national law.
The platform operator implements technical and organisational measures appropriate to the risk presented by the processing, in accordance with Article 32 GDPR. These measures include encryption of data in transit using TLS protocols, access controls limiting data access to authorised personnel, regular review of security practices, and procedures for detecting, reporting and investigating personal data breaches in accordance with Articles 33 and 34 GDPR. No security measure can provide absolute protection, and the platform operator cannot guarantee the security of data transmitted over public networks.
The platform does not subject data subjects to decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect them, within the meaning of Article 22 GDPR. Automated processes used within the platform, such as the generation of rental agreements and availability calendar management, are operational functions that do not constitute automated decision-making of this kind.
The Yowoxu Gisozi platform is intended for use by adults and businesses. The platform does not knowingly collect personal data from persons under 18 years of age. Where it comes to the attention of the platform operator that personal data has been collected from a minor without appropriate parental or guardian consent, steps will be taken to delete that data as promptly as practicable.
This Privacy Policy may be updated from time to time to reflect changes in applicable law, platform functionality or data processing practices. The date of the most recent revision is indicated at the top of this document. Where changes are material, the platform operator will take reasonable steps to notify registered users. Continued use of the platform following publication of a revised policy constitutes acknowledgement of the updated terms, subject to any additional consent requirements under applicable law.