Legal information
Privacy policy
This policy explains what personal data we process when you send a quote request, write to us, call us or apply for a job, and what your rights are. This website uses no cookies or analytics tools.
- Controller
- Zbigniew Kubik „Firma Kubik”
- Last updated
- Contact
- biuro@firmakubik.pl
Data controller
The controller of your personal data is Zbigniew Kubik, a sole trader operating under the business name Zbigniew Kubik „Firma Kubik”.
- Business name
- Zbigniew Kubik „Firma Kubik”
- Address
- Mniszów 5, 32-120 Nowe Brzesko, Poland
- Tax ID (NIP)
- 682-100-76-44
- REGON
- 350913761
Contact details for data protection matters are in the Contact section.
What data we process
We process the data you give us:
- in the quote form: the loading and unloading points, loading date, trailer type, information about the load and notes, company name, full name, email address and — if you provide it — phone number;
- in emails and phone calls: contact details and the content of the correspondence;
- in job applications: data from your CV, including information about your driving qualifications and experience.
When you use the website, your browser also sends technical data, including your IP address. We describe it in the Technical data section.
Purposes, legal bases and retention periods
-
Quote
Preparing a quote and replying to your enquiry
- Legal basis
- Your consent (Article 6(1)(a) GDPR), which you give by ticking the consent box in the quote form. Consent is voluntary, but without it and the data in the form we cannot prepare a quote. You can withdraw your consent at any time, for example by email to biuro@firmakubik.pl. Withdrawing consent does not affect the lawfulness of processing before the withdrawal. If we conclude a contract, we continue to process the data to perform it (Article 6(1)(b) GDPR), and to establish, pursue or defend legal claims on the basis of Article 6(1)(f) GDPR.
- Retention period
- For as long as it takes to prepare the quote and discuss it or, if you withdraw your consent earlier, until you withdraw it. If we conclude a contract, for the same period as the contract data.
-
Contract
Concluding and performing a contract of carriage
- Legal basis
- Article 6(1)(b) GDPR — performance of the contract. Data of our business partners’ contact persons: Article 6(1)(f) GDPR. Accounting and tax records: Article 6(1)(c) GDPR.
- Retention period
- For the duration of the contract, and then until the limitation periods for claims and the retention periods required by tax and accounting law expire.
-
Correspondence
Emails and phone calls
- Legal basis
- Article 6(1)(f) GDPR — our legitimate interest in corresponding with you and answering your questions.
- Retention period
- For as long as needed to deal with the matter. Correspondence about a contract is kept for the same period as the contract data.
-
Recruitment
Driver recruitment
- Legal basis
- Article 6(1)(c) GDPR in conjunction with Article 22¹ of the Polish Labour Code, for the data an employer requires from a candidate under that provision. Data you provide beyond that: your consent (Article 6(1)(a) GDPR and Article 22¹a of the Polish Labour Code), given by sending your application. You can withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.
- Retention period
- Until the recruitment ends. If you consent to taking part in future recruitment, until you withdraw that consent.
-
Claims
Establishing, pursuing or defending legal claims
- Legal basis
- Article 6(1)(f) GDPR — our legitimate interest in protecting our rights.
- Retention period
- Until the limitation periods for claims expire.
Technical data: rate limiting, form protection and server logs
-
Form
Rate limiting
To protect the quote form against spam and abuse, the server remembers the IP address from which an enquiry was sent and the number of enquiries from that address. For an IPv6 address, it remembers only the first half (the /64 network prefix), which is shared by the devices in one network.
- Legal basis
- Article 6(1)(f) GDPR — our legitimate interest in protecting the website against abuse.
- Retention period
- In the server’s memory only — the IP address is deleted 15 minutes after the last enquiry. We do not save it to disk or add it to the enquiry email.
-
Form
Form protection (Cloudflare Turnstile)
When you start filling in the quote form, your browser loads the Turnstile service from Cloudflare’s servers. It checks that the form is being filled in by a person rather than a bot: it processes your IP address, browser data (the User-Agent header and TLS connection parameters) and the address of the page. We check the result — a single-use token — on our server before the enquiry is sent. Until you use the form, the website does not connect to Cloudflare.
- Legal basis
- Article 6(1)(f) GDPR — our legitimate interest in protecting the form against spam and abuse.
- Retention period
- We do not store the token. Cloudflare processes this data on our behalf and, to improve its bot detection, also as a separate controller (Cloudflare’s privacy policy for Turnstile).
-
Server
Server logs
The server and the proxy server that handles its traffic may record basic information about requests in technical logs: IP address, date and time, page address, response code and browser type.
- Legal basis
- Article 6(1)(f) GDPR — our legitimate interest in keeping the website secure and fixing faults.
- Retention period
- For as long as needed for these purposes. We do not combine logs with other data or use them to analyse traffic.
Do you have to provide data?
Providing data is voluntary. Without the data marked as required in the form and your consent to its processing we cannot prepare a quote, and without the data required by law we cannot conclude a contract or carry out recruitment.
Recipients of data
We entrust data only to companies that support us technically. They process it on our behalf, under data processing agreements and only to the extent needed to provide their services:
- our server provider (VPS hosting), on which the website runs — it processes data in the European Economic Area;
- Plus Five Five, Inc. (USA), which operates the Resend service — the quote form uses it to deliver enquiries to our mailbox;
- Cloudflare, Inc. (USA) — the provider of the Turnstile service, which protects the quote form against bots;
- Microsoft — the provider of Microsoft 365 email, where we receive emails, including enquiries from the form;
- companies that provide IT services to us, such as server and email administration.
We may also disclose data to public authorities where the law requires it.
Transfers outside the EEA
The website’s server is in the European Economic Area (EEA). Outside the EEA, data is processed by:
- Resend (Plus Five Five, Inc.) — it stores the enquiries from the quote form that it delivers to our mailbox, and information about their delivery, in the United States;
- Microsoft — it may process data, including the content of emails, outside the EEA, for example in the United States;
- Cloudflare (Turnstile) — it may process form verification data, including your IP address, outside the EEA, for example in the United States.
Transfers to the United States are based on the European Commission’s adequacy decision under the EU-US Data Privacy Framework, in which all three companies participate, and on standard contractual clauses adopted by the Commission.
You can obtain a copy of these safeguards by writing to biuro@firmakubik.pl.
Your rights
You have the right to:
- access your data and receive a copy of it;
- have your data rectified;
- have your data erased;
- restrict processing;
- receive and transfer the data we process on the basis of a contract or consent (data portability);
- object to processing based on our legitimate interest — see Right to object;
- withdraw your consent at any time, for example by email, without affecting the lawfulness of processing before the withdrawal.
To exercise these rights, write to biuro@firmakubik.pl or send a letter to the controller’s address.
Right to object
On grounds relating to your particular situation, you may object at any time to the processing of your data based on our legitimate interest (Article 6(1)(f) GDPR). This applies to emails and phone calls, data of our business partners’ contact persons, legal claims, rate limiting, form protection (Cloudflare Turnstile) and server logs.
If you object, we will stop processing this data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.
Send your objection to biuro@firmakubik.pl or by post to the controller’s address.
Complaint to the supervisory authority
If you believe that we process your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (UODO, uodo.gov.pl (external website, opens in a new tab)) or with the supervisory authority in the European Economic Area country where you live or work or where the alleged infringement took place.
Automated decisions and profiling
We do not make decisions based solely on automated processing of data, and we do not carry out profiling.
Changes to this policy
If we change the way we process data, we will update this page and the date at the top.
Contact
Send questions about personal data and requests concerning your rights to the controller:
- biuro@firmakubik.pl
- Phone
- +48 663 651 167
- Office hours
- Mon–Fri 08:00–17:00, Sat 09:00–14:00, Sun closed
- Address
- Zbigniew Kubik „Firma Kubik”, Mniszów 5, 32-120 Nowe Brzesko, Poland