Privacy and cookie policy

Data Controller

This document ("Privacy Policy") describes how GRAND AUTOMOTIVE POLAND sp. z o.o. with its registered office in Warsaw, at ul. Stanisława Witkiewicza no. 14, apt. 105, 03-305 Warsaw, entered in the Register of Entrepreneurs of the National Court Register under KRS number: 0001028105, holding NIP: 1133091516 and share capital of: PLN 2,074,700.00 ("We/Controller") processes personal data ("Data") of persons visiting our website located at: https://maseratipolska.com.pl ("Website") or persons using the services provided by us.

We care about your privacy

Therefore, whenever we process your Data, we ensure that it is processed in accordance with applicable law and with the highest standards of privacy and security. Above all, we process your Data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ("GDPR"). We apply rigorous technical and organizational measures to secure all Data processed by us against loss, destruction or unauthorized access by third parties.

Source of Data acquisition

We may obtain Data from you or from our contractor in connection with negotiating, concluding, implementing or archiving a contract concluded with us. We may also process Data that we have obtained from publicly available sources, e.g., National Court Register, Central Registration and Information on Economic Activity, social media portals, websites of business entities. The Data we obtain, depending on the purposes of their processing, may include in particular:

• basic identifying data (name and surname, company name),
• contact data (phone number, email, correspondence address),
• data concerning identification numbers (ID card series and number, PESEL, NIP),
• vehicle information (vehicle identification number (VIN), model, purchase date, service history, etc.),
• billing data (e.g., bank account number).

Some Data we obtain automatically

Our Website may also automatically collect some Data, e.g., through browser cookies, pixels, web server logs, beacons and other technologies. Information we collect in this way may include:

• (a) Data about your device, including IP address, subscription information, device settings, connections to other devices, browser characteristics, current software version, random, temporary and resettable device identifiers, such as personalized service identifier and advertising identifiers, including Google advertising identifier;
• (b) Data about your use of the Website, including Data about clickstreams, your interactions with websites (such as visited websites, searched keywords and used applications and features), Data about payments made within websites, pages that led or directed you to the Website, dates and times of using it; and user's use of third-party sites, applications and features that are linked to our services;
• (c) Data about your use of third-party websites, applications and features that are linked to Our services.

Purposes and legal bases for Data processing

• (a) Service provision. We process Data for the purpose of fulfilling a contract concerning services provided by us: sale or service activities of Maserati brand cars. The legal basis for such processing is the performance of a contract concluded with you (Art. 6(1)(b) GDPR). Data will be processed no longer than necessary for implementation, correspondence exchange, in connection with the concluded sales or vehicle service contract until the completion of its implementation, but no longer than 5 years from the end of the tax year in which the tax obligation arose.

  (b) After-sales service. We process Data for the purpose of contacting you in connection with service campaigns and any activities related to proper operation of the car purchased by you. The legal basis for such Data processing is the legally justified interest of the controller (Art. 6(1)(f) GDPR), which consists in caring for the technical condition of your car as part of service care. Data will be processed until you effectively file an objection regarding our processing of your Data.

  (c) Data of representatives of our contractors. We process Data for the purpose of concluding or performing a contract between us and an entity with which you are associated or which you represent (e.g., contractor or other entity contacting us). The legal basis for processing is the Controller's legitimate interest in the form of implementation of concluded contracts (Art. 6(1)(f) GDPR). The retention period for such data processing lasts until the performance, termination or expiration of the contract concluded with the given entity.

  (d) Recruitment. We process Data sent to us as part of recruitment processes conducted by us or on our behalf. The legal basis for processing is: (a) in the case of information specified in the Labor Code, it is the fulfillment of a legal obligation incumbent on the Controller (Art. 6(1)(c) GDPR); (b) in other cases, processing is necessary for concluding a contract with you (Art. 6(1)(b) GDPR); as well as (c) information not related to your qualifications or professional achievements (e.g., photo, interests) we process on the basis of Art. 6(1)(a) GDPR (consent); and (d) information being special category data that you voluntarily provided to us in connection with the recruitment process, we process on the basis of Art. 9(2)(a) GDPR (consent). We process the provided Data for the purpose of conducting recruitment for the position indicated by us in the job advertisement from the moment of receiving the application until the end of recruitment, but no longer than for 6 months from its receipt. If you have given consent to processing your Data by us in future recruitment processes, we will process the Data until you withdraw this consent, but no longer than 24 months from the time of giving it.

  (e) Handling your requests. We will process Data to respond to your requests or complaints. The legal basis for Data processing is the controller's legitimate interest (Art. 6(1)(f) GDPR). This legitimate interest is enabling us to properly handle your request or complaint. The retention period for such processing lasts until the expiration of claims arising from requests or complaints submitted by you.

  (f) We process Data for the purpose of providing you with our marketing information through various channels depending, among others, on the consent given by you resulting from Art. 398 of the Electronic Communications Law. The legal basis for such Data processing is the legally justified interest of the controller (Art. 6(1)(f) GDPR), which consists in enabling contact with you for the purposes of promoting our activity. Data will be processed until you effectively file an objection regarding our processing of Data.

  (g) Archival purposes. We process your Data for archival purposes to document the conclusion and implementation of sales transactions or provision of service services in connection with obligations arising from tax regulations (Art. 6(1)(c) GDPR). Data will be processed for the period specified in tax regulations, but no longer than 5 years from the end of the year in which the tax obligation arose.

  (h) Pursuing and defending claims. We process Data for the purpose of pursuing or defending our claims or interests. The legal basis for such processing is the Controller's legitimate interest (Art. 6(1)(f) GDPR). This legitimate interest is pursuing claims or defending rights belonging to the Controller. Data is stored for the period of existence of the legally justified interest realized by us, but no longer than the limitation period for claims (the basic limitation period for claims is six years).

  (i) Website analysis and personalization. We process Data for the purpose of personalizing content and analyzing the Website and network traffic. For this purpose, we use cookies. The legal basis for processing is the legitimate interest realized by the Controller (Art. 6(1)(f) GDPR), consisting in analyzing user activity to optimize provided services. The storage period for such data lasts until you effectively file an objection to their processing, but no longer than necessary for the purposes of such processing.

Voluntary provision of Data

Providing Data is voluntary. However, without receiving the necessary Data, we may not be able to conclude a contract, implement some services or activities commissioned by you.

Data recipients

In some situations, we may be forced to disclose your Data to third parties, such as:

• (a) external service providers - we hire other companies and individuals to perform tasks on our behalf. Examples include providing marketing support, providing legal and accounting services. Such external service providers have access to Data to the extent necessary to perform their functions, but cannot use them for other purposes. In addition, they must process personal data in accordance with the provisions of data processing entrustment agreements and applicable data protection regulations;
• (b) public authorities - in connection with proceedings conducted by them based on relevant legal provisions.
• (c) entities associated with us – Maserati S.p.A. being the manufacturer of the vehicle to which the services provided by us relate, and FSO S.A. being the owner of the Controller. Information clauses regarding personal data processing by Maserati S.p.A. can be found on the website at: https://www.maserati.com/pl/pl/others/legal. The information clause regarding personal data processing by FSO S.A. can be found on the website at: https://www.fso-sa.com.pl/wp-content/uploads/2019/07/Zasady-Ochrony-Danych-Osobowych-FSO.pdf

Transfer of data to countries outside the European Economic Area

We do not transfer and do not plan to transfer Data outside the European Economic Area.

Your rights

In connection with our processing of Data, you have a number of rights, such as:

• the right to request access to your Data from us, the right to rectify or delete them ("right to be forgotten");
• the right to object for reasons related to your particular situation, if we process Data based on legally justified interest. However, we will continue to process this Data to the necessary extent, in case of a justified reason;
• the right to transfer or restrict Data processed in connection with contract performance or based on your consent;
• if the basis for Data processing is your consent, you have the right to withdraw this consent at any time. Withdrawal of consent does not affect the lawfulness of our processing of Data that we performed based on consent before its withdrawal.

If you believe that our processing of Data violates the law, you may file a complaint with the President of the Personal Data Protection Office.

Automated decision-making

We do not make decisions in an automated manner, including through profiling.

Contact with us

We take the issue of processing your Data seriously, therefore we have appointed Vitalii Studennykov to serve as Data Protection Officer.

If you have any questions, comments regarding Data protection or if you would like to exercise your rights under GDPR, please contact us at: IOD@gapoland.com. When contacting Us, please remember to provide your contact details and preferred form of contact. This way we will respond to your questions or requests more efficiently.

Cookies

Our Website uses cookies. Cookies are small text files that are placed on the user's computer by the websites they visit. They are commonly used to ensure better or more efficient operation of online services. The use of cookies is currently a market standard. Cookies may come from us ("first-party cookies") or from third parties whose services we use ("third-party cookies").

Some information stored in cookies (e.g., regarding user preferences), especially when combined with other information about the user, may be treated as personal data. Personal data collected through cookies may be processed only for the purpose of implementing specific functions on your behalf. This data is encrypted in a way that prevents access to it by unauthorized persons.

It should be remembered that some functionalities may not work properly if cookies are disabled.

We use the following types of cookies:

Necessary cookies – these files must be installed to ensure basic website functions. They are necessary to gain access to specific website functionalities such as contacting us or sending documentation in a form, allow the website to remember the visitor's preferences and choices made by them on the site, including username, region and language.

• Analytical cookies – Analytical cookies help us understand how users use our website. Data is collected anonymously and serves as a basis for introducing improvements aimed at ensuring optimal user experience. For example, when we see that searches conducted by visitors to our site take too long, analytical cookies allow us to move a given element to a place where it will not be overlooked.

Managing consent for cookie use through browser settings:

Most web browsers are configured to automatically accept cookies. However, you can change your browser settings so that cookies are blocked, in whole or in part, e.g., to block third-party cookies, or so that the user receives a message every time cookies are sent to their device. Guidelines on how to control cookies in popular browsers can be found below.

Google Chrome

Mozilla Firefox

MacOS Safari

Microsoft Edge

More information can be found at: http://www.aboutcookies.org/ or http://www.cookiecentral.com/faq/.

Current version of the Privacy Policy

The Privacy Policy constitutes current information for 2025 regarding our processing of Data. Its content may change if we change the way we process them.