Privacy Policy

DRAFT — REQUIRES REVIEW BY RUSH SP. Z O.O.'S LAWYER BEFORE PRODUCTION. The text below is a solid GDPR-aligned draft but does not replace legal advice.

This Privacy Policy explains how we process the personal data of people who use the CARMA website and contact us through the contact form. Last updated: 16 September 2026. Consent version: rodo-2026-09.

1. Data controller

The controller of your personal data is RUSH Sp. z o.o., ul. Wejherowska 22/2, 03-538 Warszawa, NIP 5242999234, REGON 527854910. For data-protection matters contact us by email at kontakt@autocarma.pl, or by phone at +48 515 071 363. CARMA is a platform operated by RUSH Sp. z o.o.

2. Purpose and legal basis

We process your data SOLELY to respond to the enquiry you send through the contact form and to correspond with you about that enquiry.

The legal basis is your voluntary consent (Art. 6(1)(a) GDPR), given by ticking the relevant box in the form. Providing your data is voluntary but necessary for us to reply.

We do not carry out any marketing on the basis of this consent. The consent covers only the handling of your enquiry. Any future marketing consent would be collected separately and voluntarily.

3. Data we collect

In connection with handling your enquiry we may process the following data:

• full name,
• phone number (if provided),
• email address,
• the message content and the enquiry topic,
• technical data sent automatically: IP address and browser information (user-agent), collected for security and abuse prevention.

4. Retention period

We keep enquiry data for approximately 24 months from the last contact, so we can handle the matter and any follow-up questions.

Technical data (IP address and user-agent) is kept for a shorter period — approximately 12 months — after which it is deleted (anonymised). After the retention periods, data is deleted or permanently anonymised.

5. Your rights

In connection with the processing of your data you have the following rights:

• the right to access your data and obtain a copy,
• the right to rectification (correction) of your data,
• the right to erasure ("the right to be forgotten"),
• the right to restriction of processing,
• the right to withdraw consent at any time — without affecting the lawfulness of processing before withdrawal.

To exercise these rights, write to us at kontakt@autocarma.pl. Requests (including erasure) are currently handled manually, based on an email-address lookup. You also have the right to lodge a complaint with the Polish Data Protection Authority (PUODO).

6. Data recipients

Data may be entrusted to trusted processors only to the extent necessary to run the website and handle correspondence (e.g. our hosting provider and email provider), under data-processing agreements. We do not sell your data.

7. Consent versioning

The consent wording in the form is versioned. The current version is "rodo-2026-09". We record exactly which version of the consent text you accepted, together with the date it was given, so we can demonstrate what you consented to.

8. Cookies, browser storage and statistics

This site stores no cookies and writes nothing else to your browser's storage unless you consent to it. We use no third-party analytics, advertising or tracking services, and every asset on the site — including the typefaces — is served from our own server. Simply browsing the site therefore sends your IP address to no third party.

If we enable anonymous visit statistics in future, they will run only after you consent in the window shown on your first visit. Declining restricts nothing — the site works exactly the same. You can change your decision at any time via the “Privacy settings” link in the footer.

The only thing we store locally is your decision itself (the key “carma:consent”), held in your browser's local storage. It never reaches our server and cannot identify you.

9. Changes to this policy

We may update this Policy. Changes will be published on this page with a new update date and, where necessary, a new consent version number.