Privacy Policy

§1 Data controller

The controller of your personal data is Miland s.c., with its registered office at ul. Grzybowska 30/205, 00-863 Warszawa, Tax ID (NIP): 5273236856, Statistical ID (REGON): 545490350.

Contact with the Controller on all matters relating to personal data protection: email rodo@ariettacars.com.

§2 Data Protection Officer (DPO)

The Controller is not obliged to appoint a Data Protection Officer under Article 37 of the GDPR, as it does not carry out large-scale processing of special categories of data or large-scale regular monitoring of individuals.

Despite the lack of obligation, data subjects may contact the Controller at rodo@ariettacars.com on all matters relating to personal data protection.

§3 Purposes and legal bases of processing

Your personal data is processed for the following purposes and on the following legal bases:

(a) handling accounts in the Service (Rental Company accounts and the customer panel) and providing Service functions — Article 6(1)(b) GDPR (performance of a contract);

(b) forwarding Customer Inquiries to the chosen Rental Company — Article 6(1)(f) GDPR (legitimate interest in providing intermediary services);

(c) Service security and operation, cookieless visit statistics, attachment scanning, handling notices sent to the contact address and abuse prevention — Article 6(1)(f) GDPR (legitimate interest in protecting users and the Service), and, where required by law, Article 6(1)(c) GDPR;

(d) fulfilment of legal obligations, including tax and accounting — Article 6(1)(c) GDPR;

(e) pursuing or defending against legal claims — Article 6(1)(f) GDPR;

(f) notifications and marketing you ask for — Article 6(1)(a) GDPR (consent); you can unsubscribe from each message via the link it contains;

(g) Service usage statistics (Google Analytics and Cloudflare Web Analytics) — Article 6(1)(a) GDPR (consent given via the cookie banner);

(h) identifying the sources (e.g. a search engine, social media, an advertisement) through which Inquiries and notification sign-ups reach the Service — Article 6(1)(f) GDPR (legitimate interest in developing the Service and planning its promotion).

§4 Categories of data processed

Rental Company data: email address, hashed password (Argon2id algorithm), company name, contact phone, contact email, city, company description, rental terms and cancellation policy, and, once push notifications are enabled, the device subscription address and browser data.

Customer data (Inquiry): name and surname, email address, phone number (optional), Inquiry details (e.g. vehicle, dates, message), other data given in the Inquiry (e.g. company details) and further correspondence with the Rental Company.

Customer panel: email address, Inquiry and correspondence history, and reviews if you post any. When you sign in with Google: email address and name from your Google account.

Notification sign-ups: email address, the information you provide (e.g. the chosen vehicle) and technical data that protects against abuse.

Entry source (with an Inquiry or a notification sign-up): campaign parameters from the link you used to enter the Service (utm_source, utm_medium, utm_campaign, utm_term, utm_content, ref), the name of the website you came from and the address of the first Service page you visited. Until you close the tab, this information is held only in the open page's memory, and it reaches the Service together with the Inquiry or sign-up you send.

Data associated with correspondence attachments: file contents and its name, type, size, identifier and timestamps; data within a file depends on the content provided by the Rental Company. Notices sent to the contact address include the message content and the notifier's e-mail address.

Session data: session identifier, IP address, timestamps.

Technical data: IP address, browser and device information (within the scope of security logs).

§5 Recipients of data

Rental Companies — when a Customer submits an Inquiry, the Customer's data is forwarded to the Rental Company chosen by the Customer. The Rental Company becomes a separate controller of that data within the meaning of the GDPR and processes it solely to handle the given Inquiry and any resulting Rental Agreement. The Rental Company bears independent responsibility in accordance with its own privacy policy. Inquiries concerning demonstration offers that the Controller makes available in the Service for illustrative purposes (e.g. „Arietta Showcase”) are not forwarded to any Rental Company.

IT service providers (processors): Amazon Web Services EMEA SARL — application hosting (AWS Lightsail, eu-central-1) and private attachment storage (AWS S3, eu-central-1), and, when optional scanning is enabled, Amazon GuardDuty Malware Protection for S3 (eu-central-1), which analyses the file and its metadata. These services are subject to the AWS data-processing terms.

Email service providers (processors): Resend (Plus Five Five, Inc., USA) — sending emails from the Service, from infrastructure in eu-west-1 (Ireland); Zoho Corporation B.V. — hosting the Controller's contact mailboxes (Zoho EU data center).

Cloudflare, Inc. (USA) — domain handling, protection and acceleration of traffic to the Service (IP address and browser data, among others, pass through the Cloudflare network) and, with your consent in the cookie banner, visit statistics (Cloudflare Web Analytics).

Google Ireland Limited — Service usage statistics (Google Analytics) and sign-in with a Google account, if you choose it.

Browser push services (Google, Mozilla, Apple, Microsoft) — delivering push notifications to Rental Companies that enable them.

§6 Transfers to third countries

Data is stored within the European Economic Area (AWS: Frankfurt; email sending via Resend: Ireland; Zoho mailboxes: EU data center).

Resend, Cloudflare and Google are based in the USA, and traffic through the Cloudflare network and administrative operations of service providers may involve data transfers outside the EEA. To that extent, the Controller uses Standard Contractual Clauses of the European Commission (SCC) and the Data Privacy Framework (DPF).

§7 Data retention periods

Inquiry and correspondence data: 3 years from sending the Inquiry or, if the rental ends later, until it ends (the limitation period for claims, Article 118 of the Polish Civil Code).

Attachments: a file not linked to a sent message may be deleted after its document is archived and 30 days have passed, provided it is not needed to preserve correspondence or handle a report. An attachment sent in correspondence remains linked for as long as that correspondence is retained; a report or legal obligation may justify longer retention of necessary data. Once the purpose ends, data is deleted or anonymised, subject to legal obligations and the establishment or defence of claims.

Correspondence about notices sent to the contact address: for up to 3 years from the notice, after which it is deleted unless further storage is required by law or necessary to establish, pursue or defend claims.

Rental Company account data: for the duration of the account and 5 years after closure — accounting obligations under Article 74 of the Polish Accounting Act.

Customer panel data: for as long as the Customer's Inquiries are kept.

Login session data: until logout or session expiry, at most 8 hours.

Technical and security logs (events, partially masked IP address, browser data): 30 days.

Data processed on the basis of consent: until consent is withdrawn.

Push notification subscriptions: until disabled or expired.

§8 Your rights (Articles 15–22 GDPR)

You have the following rights:

(a) right of access (Article 15 GDPR) — to obtain a copy of processed data and information about processing;

(b) right to rectification of incorrect or incomplete data (Article 16 GDPR);

(c) right to erasure — the „right to be forgotten” (Article 17 GDPR), unless another legal basis exists for further processing;

(d) right to restriction of processing (Article 18 GDPR);

(e) right to data portability in a structured, commonly used format (Article 20 GDPR);

(f) right to object to processing based on legitimate interest (Article 21 GDPR);

(g) right to withdraw consent at any time — without affecting the lawfulness of processing carried out before withdrawal (Article 7(3) GDPR).

To exercise these rights, contact the Controller at: rodo@ariettacars.com.

§9 Right to lodge a complaint

You have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (PUODO).

Correspondence address: ul. Stawki 2, 00-193 Warszawa.

Email: kancelaria@uodo.gov.pl, website: www.uodo.gov.pl.

§10 Automated decision-making and profiling

The Controller does not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect data subjects within the meaning of Article 22 GDPR.

§11 Cookies

The Service uses cookies necessary for its proper operation:

(a) ARIETTA_SESSION — logged-in Rental Company session identifier (httpOnly, Secure, SameSite=Lax, lifetime 8 hours);

(b) cookie-consent — storage of your cookie decision (lifetime 12 months);

(c) NEXT_LOCALE — remembers the selected interface language;

(d) theme — remembers the selected interface theme (light/dark), lifetime 12 months.

(e) ARIETTA_RENTER_SESSION — logged-in Customer session identifier in the customer panel (httpOnly, Secure, SameSite=Lax, lifetime 8 hours);

The above cookies and interface settings kept in browser storage are necessary for the Service to work and do not require consent (Article 399 of the Polish Electronic Communications Law of 12 July 2024).

Google Analytics and Cloudflare Web Analytics start only after you consent via the cookie banner. Google Analytics then sets the _ga and _ga_* cookies, which expire after 2 years; Cloudflare Web Analytics uses no cookies. You can change your choice via the cookie settings in the footer.

You can block cookies in your browser settings. Blocking necessary cookies may prevent the use of Service functions requiring login.

§12 Changes to the Privacy Policy

The Controller reserves the right to amend this Policy. Significant changes will be notified in the Service with 14 days' notice.

The current version of the Policy enters into force on 08.10.2026.