1. Data Controller

The data controller is: MSA INVESTMENTS SP. Z O.O.
Address: Nowowiejska 35, 46-073 Chrościna, Poland
Email: kontakt@gokartywroclaw.pl
Phone: +48 789 000 388

  1. Scope of Data Processing

2.1. The Controller processes personal data for the following purposes:

  • order fulfillment and service provision;
  • customer service and communication;
  • marketing, analytical and remarketing activities;
  • ensuring transaction security;
  • compliance with legal obligations (e.g., accounting and taxes).

2.2. Processed data includes:

  • name and surname;
  • residential or delivery address;
  • phone number;
  • email address;
  • invoicing data (VAT ID, company name, registered address);
  • IP address and activity data on the website;
  • order history and shopping preferences.
  1. Legal Basis for Data Processing

3.1. Personal data is processed in accordance with Regulation (EU) 2016/679 (GDPR), based on the following legal grounds:

  • Article 6(1)(b) GDPR – processing is necessary for the performance of a contract or to take steps at the request of the data subject prior to entering into a contract;
  • Article 6(1)(c) GDPR – compliance with a legal obligation (e.g., accounting, taxation);
  • Article 6(1)(f) GDPR – legitimate interests pursued by the controller, such as analytics, fraud prevention, direct marketing, and website optimization;
  • Article 6(1)(a) GDPR – data subject’s consent for marketing purposes (e.g., newsletter, advertising cookies).
  1. Data Recipients

4.1. Personal data may be disclosed to:

  • courier and logistics companies for order delivery;
  • payment operators, banks, and financial institutions;
  • IT, hosting, and marketing service providers;
  • public authorities and institutions authorized by law.

4.2. Personal data is not transferred outside the European Economic Area (EEA) unless the user consents or it is necessary for contract performance. In such cases, appropriate safeguards are applied (e.g., standard contractual clauses approved by the European Commission).

  1. Data Retention Period

5.1. Personal data is stored for the following periods:

  • as long as necessary to fulfill the contract and legal obligations (e.g., bookkeeping documents – 5 years);
  • until consent is withdrawn, if processing is based on consent (e.g., newsletter);
  • until the statute of limitations for claims under the contract expires (e.g., warranty – up to 6 years);
  • for direct marketing – until the user objects.
  1. User Rights

6.1. Every user has the right to:

  • access their personal data;
  • rectify (correct) their data;
  • delete data (“right to be forgotten”) in cases provided by law;
  • restrict data processing;
  • data portability to another controller;
  • object to data processing;
  • withdraw consent at any time (when processing is based on consent);
  • lodge a complaint with the President of the Personal Data Protection Office (UODO) in case of violation of data protection laws.

6.2. To exercise the above rights, the user may contact the controller by email at kontakt@gokartywroclaw.pl.

  1. Cookies and Tracking Technologies

7.1. The website uses cookies for:

  • improving website functionality;
  • traffic and analytics purposes;
  • marketing activities;
  • remembering user preferences;
  • personalizing content and advertisements.

7.2. Types of cookies used:

  • technical – necessary for the website to function;
  • analytical – for analyzing site usage;
  • marketing – for targeted advertising and remarketing.

7.3. Users can manage cookie settings in their browser and disable cookies, which may affect website functionality. Some browsers also offer a “Do Not Track” option.

  1. Data Security

8.1. The Controller implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, or unlawful processing.

8.2. These measures include:

  • data encryption;
  • secured servers and databases;
  • use of HTTPS protocol;
  • access control systems.
  1. Changes to the Privacy Policy

9.1. The Controller reserves the right to update this Privacy Policy.

9.2. Users will be informed about any significant changes via the website or by email at least 14 days prior to their effective date.

This Privacy Policy is effective as of: 01.01.2024