Privacy Policy

1. Data controller

The controller of your personal data is:

[NAZWA FIRMY / IMIĘ I NAZWISKO], [ULICA I NR, KOD POCZTOWY, MIEJSCOWOŚĆ, KRAJ], NIP: [NIP], REGON: [REGON] (the "Controller" or "SelfDriveStories").

For personal data matters, contact us by email: contact@selfdrivestories.com. The Controller is not required to appoint a Data Protection Officer; for all GDPR matters please use the email above.

2. What data we process

• Contact form: name, email address, planned travel dates, number of people, and message content (and any other data you voluntarily provide).
• Email, WhatsApp, or phone contact: data contained in the correspondence, including a phone number (e.g. if you message us via WhatsApp).
• Service delivery / clients: data necessary to deliver agreed services and to ship the welcome pack, e.g. full name and delivery details (address or selected InPost parcel locker).
• Technical data: IP address, server logs, device and browser information, cookie identifiers, and statistical data about use of the Website.

3. Purposes and legal bases

• handling inquiries, contact, and preparing offers - Art. 6(1)(b) and (f) GDPR;
• delivering agreed own services and shipping the welcome pack - Art. 6(1)(b) GDPR;
• website statistics and analytics (Google Analytics) - Art. 6(1)(f) GDPR (legitimate interest: measuring and improving the Website); you can object by blocking analytics cookies in your browser;
• ensuring Website security and establishing, pursuing, or defending claims - Art. 6(1)(f) GDPR;
• complying with legal obligations (e.g. tax, accounting), where applicable - Art. 6(1)(c) GDPR.

4. Cookies and third-party tools

The Website uses cookies and resources from external providers:

• Necessary - ensuring the website works correctly (including preferences and security).
• Analytics - Google Analytics 4 (Google Ireland Ltd / Google LLC). Cookies such as _ga, _ga_* are used for anonymous traffic statistics. You can block them in your browser settings or via Google's opt-out add-on.
• Embedded resources that may transmit your IP address to the provider: Google Fonts and Material Symbols (Google), the Leaflet maps library loaded from a CDN (unpkg), and OpenStreetMap map tiles (OpenStreetMap Foundation).
• Google reCAPTCHA (Google Ireland Ltd / Google LLC) - the contact form and the reservation form are protected by reCAPTCHA v3, which - to prevent spam and abuse - analyses how the site is used and processes data such as your IP address and device/browser information. The use of reCAPTCHA is subject to the Google Privacy Policy and the Google Terms of Service.
• External links - clicking links to Instagram or WhatsApp (Meta) means those services' privacy policies apply.

You can change cookie settings in your browser at any time. Restricting cookies may affect some Website functions.

5. Data recipients

Data may be entrusted to or shared with parties supporting the operation of the Website and delivery of services, in particular: hosting and email providers, Google (analytics, fonts), CDN providers, OpenStreetMap (maps), the courier operator InPost (parcel lockers) for shipping the welcome pack, and the Partner (Melbic (melbic.com)) to the extent necessary to arrange the rental. Such sharing takes place under agreements and only to the extent necessary to provide the services.

6. Transfers outside the EEA

We generally aim to use solutions within the European Economic Area (EEA). However, some providers (e.g. Google, Meta) may process data outside the EEA, including in the USA - in which case appropriate GDPR safeguards apply, such as the Data Privacy Framework or Standard Contractual Clauses (SCC).

Vehicle rental takes place in Namibia (outside the EEA). If you use our intermediation, data necessary to arrange the rental may be transferred to the Partner in Namibia - on the basis of necessity to perform a contract or take steps at your request (Art. 49(1)(b) GDPR) or other appropriate safeguards.

7. Retention period

Inquiry data is kept for as long as needed to handle the contact and prepare an offer, and then for the limitation period of any potential claims. Client data is kept for the duration of service delivery and the periods required by law (e.g. tax and accounting). Statistical data (Google Analytics) is retained according to the tool's configuration, and technical logs for a period justified by system security. Data processed based on consent is kept until consent is withdrawn.

8. Your rights

You have the right to: access, rectification, erasure, restriction of processing, data portability, objection (where the basis is legitimate interest), withdrawal of consent at any time (without affecting the lawfulness of prior processing), and to lodge a complaint with a supervisory authority - in Poland, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).

9. Voluntary provision and automated decisions

Providing data is voluntary but necessary to receive a response to your inquiry and to deliver services. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you; analytics is used for statistical purposes only.

10. Policy updates

This Privacy Policy may be updated due to legal, technical, or organisational changes. The current version is always published on this page.