Privacy policy

The controller of your personal data is:

• MOBILNY SERWIS TIR Andrii Prots
• ul. Brukowa 1, 68-320 Jasień, Polska
• NIP 928 212 03 22, REGON 544690673

For anything about your personal data, write to kontakt@mechtir.com. We have not appointed a data protection officer.

Here we describe what personal data we process in connection with the mechtir.com website, why, how long we keep it and who other than us has access to it.

We process personal data, such as a phone number or the place where your truck is standing, when you enter it and send it in the “Request a callback” form or in the quote request form for companies. Simply browsing the website does not require you to give any data. However, on every visit to the website our hosting and security provider, Cloudflare, processes the technical data needed to run and protect it (described in parts 4 and 6).

Request a callback. Required: your phone number and the place where you are standing. You can type the place yourself or use the “Use my location” button; the button only works after you allow it in your browser, and the coordinates first go only into the form field on your device. We receive them only when you send the form. Optional: the fault symptoms you tick.

Quote request for companies. Required: company name, contact person, phone, email, number of vehicles and scope (breakdown repairs, scheduled servicing or both). Optional: vehicle makes and routes.

With every request we also save the language of the website, the page it was sent from and the time it was sent.

Why. To call you back, to find out whether and how we can help you on the road, and to prepare a quote for a company.

Legal basis. If, as an individual, you ask us to contact you in order to prepare or conclude a repair contract, we process the data to take steps at your request before entering into a contract (Article 6(1)(b) GDPR). If you contact us on behalf of a company or as its employee and you are not a party to the planned contract, the basis is our legitimate interest in handling the enquiry and starting cooperation with the company (Article 6(1)(f) GDPR).

Giving the data is voluntary, but without a phone number and the place where you are standing we cannot call you back. Instead of the form you can always call us or message us on WhatsApp.

We do not accept photos through the form. You can send photos of the fault on WhatsApp (part 7).

To stop the forms being used by bots and for sending spam:

• We do not save the full IP address in the request database. For 1 hour we keep a hash of the IP address created with a secret key and use it only to limit the number of requests from one place. Such a hash may still be personal data, so we treat it as personal data.
• After your first click into a form field, Cloudflare Turnstile loads, which helps tell a person from a bot. It runs in a frame from a Cloudflare server (challenges.cloudflare.com) and processes technical browser data under Cloudflare’s rules. Sometimes it asks you to tick an “I am human” box.

The legal basis is our legitimate interest in protecting the website and the forms from misuse (Article 6(1)(f) GDPR).

• “Request a callback” requests: 90 days from sending, then they are deleted automatically from our database.
• Quote requests from companies: 12 months from sending, then they are deleted automatically from our database.
• IP address hash for spam protection: 1 hour.
• Technical server logs (Cloudflare Workers Logs): 3 days. They contain the form type, a shortened request ID and error codes. They do not contain the content of the request, the phone number or the IP address, but the shortened ID makes it possible to link an entry to a specific request.
• Email notifications of requests (part 6): we delete messages about “Request a callback” requests from the mailbox, including the bin, no later than 90 days after receiving them, and messages about company quote requests no later than 12 months after receiving them. Technical copies at the email provider are deleted under its own rules.

If a contract is concluded, or the data is needed to establish, pursue or defend claims, we will move the necessary information to separate records and keep it for the period required for that purpose, including under tax and accounting rules.

Cloudflare, Inc. processes data on our behalf under a data processing agreement (Cloudflare DPA). It provides the website hosting, the form handling, the request database (Cloudflare D1, database location: Western Europe), the forwarding of email notifications (Cloudflare Email Routing) and the form protection (Cloudflare Turnstile).

Email (Gmail). Every request also arrives as an email notification in the business owner’s Gmail mailbox: phone number, place and symptoms, and for a company quote request also the company name, contact person and email. Gmail is a free email service that we use on Google’s terms; for users in the European Economic Area its provider is Google Ireland Limited. We have not concluded a separate data processing agreement with Google. Google processes data in this service under its own privacy policy: policies.google.com/privacy.

Transfers of data outside the European Economic Area. Cloudflare and Google belong to groups based in the USA, so data may be transferred or made available outside the EEA to the extent needed to provide their services. The basis for such a transfer is the European Commission’s adequacy decision under the EU-US Data Privacy Framework (to the extent of the provider’s certification) or the standard contractual clauses adopted by the European Commission, together with additional safeguards where required.

We do not sell personal data and we do not pass it to other companies for their own marketing purposes.

The “Call” buttons and the phone numbers open the phone app on your device. The WhatsApp buttons open WhatsApp (Meta Platforms); the conversation there, including any photos you send, is subject to WhatsApp’s rules. The map link created when you use the “Use my location” button leads to Google Maps. These are ordinary links: the website does not connect to these companies or send them your data until you yourself open their app or website.

You have the rights set out in the GDPR, including the right to access your data, to have it corrected, erased and to restrict its processing. In the cases provided for in the GDPR you can also ask for your data to be transferred and object to processing when it is based on our legitimate interest. If processing is based on consent, you can withdraw it at any time; this does not affect the lawfulness of processing before you withdrew it.

For anything about your data, write to kontakt@mechtir.com. We will reply without undue delay and no later than within one month. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), the Polish supervisory authority.

When we change the way we process data, we will update this policy and its version. If the change concerns tools that need your consent, we will ask for your consent again before the new processing starts.