Privacy policy
This is a translation provided for convenience. The legally binding version of this document is the Polish one.
This policy explains what personal data we collect, why, on what legal basis, and what rights data subjects have. It covers this website, the Black Ebike app, the Telegram bot, and service at our shop on ul. Wolska 84.
1. Data controller
The controller of personal data is Black-Ebike Viktor Holovatiuk, registered at ul. Zeusa 1, 01-497 Warszawa, NIP 5223353620, REGON 543221806.
Contact for data protection matters: golovatiuk2302@gmail.com, phone +48 729 441 556, postal address as above.
We have not appointed a data protection officer, as we are not required to. Data matters are handled directly by the controller at the address above.
2. This website collects nothing
The site you are reading is static:
- it has no forms and no input fields,
- it stores no cookies and keeps no visitor statistics,
- it loads nothing from external servers — fonts, images and scripts all come from our own server, so your IP address is not passed to any third party.
We only begin processing data when you contact us: by messenger, phone, e-mail or in person. Details are in the Cookie policy.
3. What we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Booking and performing the rental agreement | name, phone, e-mail, rental dates, chosen bike | Art. 6(1)(b) GDPR — performance of a contract | duration of the agreement, then until claims become time-barred |
| Verifying identity at handover | type and number of the ID document, data from it to the extent necessary | Art. 6(1)(b) and (f) GDPR — protection of property | the rental period and the limitation period; see the RODO notice for rentals |
| Accounting and settlements | invoice details, amounts, payment records | Art. 6(1)(c) GDPR — legal obligation (Accounting Act, Tax Ordinance) | 5 years from the end of the tax year |
| Handling repair requests | contact details, fault description, repair history | Art. 6(1)(b) GDPR | duration of the case and the limitation period |
| Booking notifications (confirmation, return reminder) | phone, Telegram account identifier | Art. 6(1)(b) GDPR | duration of the agreement |
| Marketing messages | e-mail or phone | Art. 6(1)(a) GDPR — consent | until consent is withdrawn |
| Establishing and defending claims | agreement and correspondence data | Art. 6(1)(f) GDPR — legitimate interest | until claims become time-barred |
Providing data is voluntary but necessary to conclude the agreement. Without it we cannot hand over a bike.
4. Who we share data with
Data goes only to parties we need in order to deliver the service:
- payment provider — PayPro S.A. (Przelewy24), ul. Pastelowa 8, 60-198 Poznań, KRS 0000347935 — handling online payments (BLIK, card, transfer); for the payer's data PayPro S.A. is a separate data controller (privacy notice: przelewy24.pl);
- SMS provider — sending text notifications;
- Telegram Messenger — if you contact us via chat or the app in Telegram; messages sent through that channel never contain data from identity documents — only a booking number and a link;
- hosting and infrastructure provider — storing system data;
- accounting office — tax settlements;
- authorities entitled under the law — at their request, within legal limits.
Each of these parties processes data under a data processing agreement and only to the extent required by the service they provide to us.
5. Transfers outside the European Economic Area
We store data on servers within the European Economic Area. If a particular service required a transfer outside the EEA, it would take place only on the basis of a European Commission adequacy decision or standard contractual clauses.
6. Your rights
You have the right to:
- access your data and obtain a copy (Art. 15 GDPR),
- rectification of incorrect or incomplete data (Art. 16),
- erasure where the purpose of processing has ended (Art. 17),
- restriction of processing (Art. 18),
- portability of data to another controller (Art. 20),
- object to processing based on our legitimate interest (Art. 21),
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)).
Send your request to golovatiuk2302@gmail.com. We reply within one month; for complex matters the deadline may be extended by a further two months, and we will inform you of this with reasons.
The right to erasure does not cover data we must keep under the law (such as accounting records) or data needed to establish or defend claims.
7. Complaint to the supervisory authority
If you believe we process data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.
8. Automated decisions and profiling
We do not make decisions solely by automated means and we do not profile customers. The automatic selection of the cheapest rental rate is based on the dates you give us, not on your personal data or behaviour.
9. Security
We apply technical and organisational measures appropriate to the risk: access is limited to authorised staff and to what their duties require, connections are encrypted, and particularly sensitive data — including data from identity documents — is stored encrypted and never appears in system logs or in messages sent by messenger.
10. Changes to this policy
We update this policy when the scope of our services or the law changes. The effective date and version number appear at the top of the document. A new version applies from the day it is published on this page.