Tutek Rental Privacy Policy
1. Controller and contact details
The controller of your personal data is Tomasz Antoniszyn, trading as SPEC Tomasz Antoniszyn under the Tutek Rental brand, ul. Wejherowska 61/1, 54-239 Wrocław, Poland, NIP (tax identification number) 8943177673, REGON (business registration number) 520636669.
For personal data matters and to exercise your rights, contact kontakt@tutekrental.pl or write to the address above. Telephone: +48 451 039 757.
This policy covers use of the Tutek Rental website and application, contact with us, and the handling of enquiries, agreements, collections and returns. It also covers customer representatives and persons authorised to collect or return Equipment, whether we record their data in the application, correspondence or paper documentation.
2. What data we collect and where it comes from
The scope of the data depends on the matter concerned. We process identification and contact details, addresses, company details and tax identification numbers, information about enquiries and rentals, payments, deposits, the handover and return of Equipment, correspondence, declarations, signatures, authorisations, and records relating to complaints and damage. These records may include photographs of the condition of the Equipment and its accessories.
We obtain data primarily from you. We may receive details of a representative or a person collecting or returning Equipment, in particular their name, telephone number and scope of authorisation, from the customer, their company or an authorised representative. We may check company details and authority to act in public registers, such as CEIDG or KRS. If you voluntarily provide a portfolio or references, we use them only to the extent necessary for the agreed assessment of rental terms.
Where we obtain someone's data indirectly, we provide the information required by the GDPR no later than our first contact with that person or the first disclosure of their data and, in all cases, within the statutory time limit, generally within one month, unless a statutory exception applies. A customer naming that person does not replace our duty to provide this information.
When you use the website, we also process technical data, such as your IP address, browser and device information, the time and course of the connection, and security-related events. We collect additional data about website use in accordance with the consent rules described below.
3. Identity verification and rental security
We verify identity, authority to act and necessary details in accordance with the General Rental Terms and Conditions (OWW). When verifying the Hirer or their representative, we record the type and number of only one identity document and the fact that verification took place. We do not retain, copy or scan identity documents. We do not require photographs of them to be sent to us.
We may ask to see a second photographic identity document only where there are justified doubts, including in the case of foreign nationals. We do not record its number. Any proof of address is for inspection only, without making a copy; unnecessary details may be concealed. The identity document of a person who is only collecting Equipment is used to compare their identity with the authorisation.
Verification and risk assessment serve to protect the Equipment, prevent misuse and safeguard claims. We consider verified information, the customer's explanations, the history of our dealings, and the value and security of the Equipment. Decisions about deposits, refusal of a new rental or restrictions on further business are made by a person. You may request an explanation, correction of the data and a reassessment.
For agreements signed remotely, we process the signed document, the data contained in the qualified electronic signature and certificate, and the outcome of checks of the signature and authority to act. We do not use additional identifiers from the certificate for other purposes unless they are necessary for those purposes.
4. Purposes and legal bases
Enquiries, preparing and performing an agreement, settling the rental, and contact with a person who is a party to the agreement: Article 6(1)(b) GDPR, meaning steps taken at your request before entering into an agreement and performance of the agreement.
Contact with representatives and authorised persons, and general correspondence unrelated to entering into an agreement: Article 6(1)(f) GDPR. Our legitimate interest is efficient communication and management of our business dealings.
Accounting and tax documents, statutory obligations concerning complaints, withdrawal from agreements and the exercise of data rights: Article 6(1)(c) GDPR, in conjunction with the relevant tax and consumer legislation and the GDPR.
Verification of identity and authorisations, protection of property, individual risk assessment, documentation of the condition of Equipment, and the establishment, exercise and defence of claims: Article 6(1)(f) GDPR. Our legitimate interest is secure rental and protection of Tutek Rental's rights.
Website security, prevention of spam, misuse and attacks, and diagnosis of errors: Article 6(1)(f) GDPR. Our legitimate interest is the secure and proper operation of our services.
Optional analytics, advertising measurement and personalisation, and optional external content: your consent under Article 6(1)(a) GDPR. Storing information on and accessing information from your device is also governed by Article 399 of the Polish Electronic Communications Law.
5. Is providing data mandatory?
Providing data is voluntary, but data marked as required is necessary to handle the relevant enquiry, enter into or perform an agreement, hand over Equipment securely, or comply with a legal obligation. Without it, we may be unable to carry out the relevant activity; the reason for and scope of the required data depend on the activity. Invoice details are required to the extent prescribed by law.
Portfolios, references and additional professional information are voluntary. Refusing consent to analytics, advertising or external content does not prevent you from submitting an enquiry or renting Equipment. Reading this policy and accepting the OWW do not constitute consent to marketing or unrestricted data processing.
6. Who receives your data
We disclose data only to the extent necessary for the relevant purpose. We use Google Workspace for email and documents, skillhost.pl for hosting and maintaining the application, and wFirma.pl for invoicing and accounting. The providers of these services are, respectively, the relevant Google entity specified in the service agreement, SkyPass Solutions sp. z o.o., and Web INnovative Software sp. z o.o.
The application also provides for Resend, supplied by Plus Five Five, Inc., to send automated messages about enquiries and agreements, and Cloudflare Turnstile to protect forms against automated abuse. Resend receives the recipient's details, the message content and necessary delivery information where that service is used to send the message. Once Turnstile is activated, Cloudflare receives technical connection and browser data needed to assess security. Cloudflare processes this data on our behalf to protect the form and also acts as a separate controller for improving bot detection, in accordance with the Turnstile Privacy Policy.
Recipients may also include authorised persons handling rentals, IT, accounting and legal service providers, banks and providers of the selected payment method and, where needed, repair services and experts, providers of agreed transport, or parties handling the lawful recovery of debts. Public authorities, including courts and the police, receive data where there is an appropriate legal basis.
Processors acting on our behalf work under the required agreements and our instructions. Entities carrying out their own obligations and purposes, such as banks or public authorities, may be separate controllers.
At your request, we provide you with an Equipment valuation and contact details for an insurance intermediary. Requesting a valuation does not, in itself, result in your data being disclosed to the intermediary.
7. Cookies, browser storage and maps
The website and application may store information in cookies and browser storage, including localStorage and sessionStorage. Necessary mechanisms support, among other things, the cart, saving the form, remembering privacy choices and security. They do not require consent only to the extent that they are genuinely necessary for transmission or for a service you request.
In the application, the cart is stored locally until it is cleared or the website's data is deleted in the browser. The draft form is kept in session storage and remains valid for up to 4 hours after the last save. Privacy choices are remembered for 180 days. Expiry does not always mean that a record is immediately physically deleted from browser storage.
We activate optional mechanisms only after the appropriate consent has been given. You may refuse, choose categories or withdraw consent in the website's privacy settings. Withdrawal does not affect the lawfulness of earlier processing.
The embedded Google map is loaded after consent to external content or after you select a one-time map load, preceded by information about the data transfer. Google then receives at least connection data, including your IP address and browser information. You can use the address provided in text without loading the map.
Deleting the website's data in your browser may clear the cart, form and saved preferences. It does not, however, replace a request to erase data held by us or our providers.
8. Planned analytics and advertising tools
We plan to introduce Google Analytics 4, Google Ads, Meta Pixel and Meta Conversions API. These tools have not yet been activated in the new application. The description below explains their planned uses; it does not mean they are currently operating or that reading this policy constitutes consent.
Google Analytics 4 is intended to provide statistics on website use, such as page visits, viewing Equipment, adding it to the cart and submitting enquiries. Once activated, it will operate after consent to analytics. The planned scope includes browser identifiers, events, basic device data and approximate location. We do not plan to send form contents, names, email addresses or identity document numbers to GA4.
Google Ads is intended to measure advertising effectiveness and reach people who have shown interest in our offering again. Meta Pixel and Meta Conversions API are intended for similar purposes in Meta services, including Facebook and Instagram. Pixel sends events from the browser, while Conversions API sends them from our server. Server-side transmission does not remove the requirement for appropriate consent.
Once advertising tools are activated, and subject to marketing consent, activity data, advertising identifiers and technical data may be used to match events, create audiences and personalise advertisements. Providers may link them with information held in their own services. This profiling is used to select advertisements; it will not be the basis for an automated refusal to rent or determination of a deposit.
Services for users in the EEA are generally provided by Google Ireland Limited and Meta Platforms Ireland Limited. Joint controllership may arise where the purposes and means of collecting and transmitting events to Meta are jointly determined. Before activation, we will provide the relevant scope and the essence of the arrangement; regardless of the allocation of responsibilities, rights may be exercised against either joint controller.
Before activation, we will update information about the actual scope of data, recipients, retention periods, cookies and consent settings. We will not begin sending contact details for advertising matching, including in the form of cryptographic hashes, without prior information and appropriate consent. Hashing does not make the data anonymous. We do not use document numbers, identity verification data or agreement contents for advertising tools.
We do not send newsletters or direct advertising messages. Messages concerning an enquiry, agreement, collection, return or complaint are used to handle that matter.
9. Transfers outside the EEA
Using international providers, particularly Google, Resend and Cloudflare, and Meta once advertising is activated, may involve processing outside the European Economic Area, including in the USA. This also includes access by the provider's authorised personnel and subcontractors.
A transfer requires a basis under the GDPR: a European Commission adequacy decision, where it covers the transfer, or appropriate safeguards, in particular standard contractual clauses and supplementary measures where needed. The EU–US Data Privacy Framework may serve as a basis only for entities with valid certification covering the relevant scope. Resend's data processing agreement provides for processing in the USA and the use of standard contractual clauses.
Information about the basis for a particular transfer and a copy of the relevant safeguards, or how to obtain them, are available on request at kontakt@tutekrental.pl.
10. How long we retain data
We retain enquiries and ordinary correspondence that do not lead to an agreement for the time needed to handle the matter and for up to 6 months after it is closed. If a dispute arises or it becomes necessary to demonstrate what was agreed, we retain only the necessary data under the rules applicable to claims.
We retain records of agreements, handovers, returns, settlements and complaints for the time needed to perform and settle the agreement and, subsequently, to the extent necessary until the applicable limitation periods for claims expire. The period depends on the type of claim and events affecting how it runs. If proceedings are brought, we retain necessary evidence until they are finally concluded and the pursuit or enforcement of the claim is complete.
We retain accounting and tax documents for the period required by the relevant legislation. The duty to retain an invoice does not, by itself, justify retaining all identity document data or all correspondence for the same period.
We retain verification data only for as long as it is necessary to perform and settle the rental securely and protect specific claims. We do not retain it indefinitely solely in anticipation of a future rental. We review information used to restrict further business at least every 6 months and delete it when it no longer justifies the restriction; other grounds for retaining necessary evidence are assessed separately.
We retain ordinary technical and security logs on our side for up to 90 days. We may preserve information about a specific incident for the time needed to investigate it and protect claims. We retain evidence of consent being given or withdrawn and of required information being provided, to the extent necessary, for the time needed to demonstrate compliance with the law and defend against related claims.
Section 7 specifies the validity periods for records stored in your browser. We will provide the periods for planned analytics and advertising tools before they are activated. When the grounds for retention cease to apply, we delete the data or irreversibly anonymise it; backups follow an established overwrite cycle and are not used for continued ordinary use of deleted data.
11. Your rights
Subject to the GDPR, you may obtain access to your data and a copy of it, and request rectification, erasure or restriction of processing. If we process data by automated means on the basis of consent or an agreement, you may also request data portability to the extent provided by law.
You may object, on grounds relating to your particular situation, to processing based on our legitimate interest. We will then stop processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of claims. An objection to direct marketing, including related profiling, does not require reasons and results in processing for that purpose being stopped.
You may withdraw consent at any time, as easily as you gave it. These rights are not unconditional: for example, a request for erasure does not cover data still needed to comply with a legal obligation or protect claims.
We respond to requests without undue delay, generally within one month. In the cases provided for by the GDPR, we may extend this by a further two months, informing you of the reason within the first month. If we have justified doubts, we may request information necessary to confirm your identity, proportionate to the risk.
You may lodge a complaint with the President of the Polish Personal Data Protection Office (UODO). Contacting us first is not a condition for lodging a complaint. Information on complaints is available from UODO.
12. Security and data on storage media
We restrict access to authorised persons and apply technical and organisational measures appropriate to the risks. We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.
Before returning Equipment, make your own backup of any materials you need and permanently erase data from the storage media, in accordance with the OWW. We do not provide data archiving or recovery services. We do not use data left on media for advertising or ordinary rental operations. If we discover such data, we restrict access and take the steps needed to erase it securely or investigate the incident. The OWW do not exclude obligations arising from personal data protection law.
We update this policy when processes, tools or legislation change. A new purpose requiring consent requires appropriate consent to be obtained; changing the policy text alone does not replace it.