Privacy policy

This is an English translation provided for information. In case of discrepancies, the Polish version prevails.

1. Data controller

The controller of personal data is MAC FOR HIRE sp. z o.o., with its registered office in Warsaw, ul. Puławska 107B/9, 02-595 Warsaw, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0000770766 (District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register). Tax ID (NIP): 5213855610, REGON: 382524419.

Contact in personal data matters: kontakt@mbazaar.pl, phone +48 22 100 46 33. The controller has not appointed a data protection officer.

2. What data we process and why

Situation Data Purpose Legal basis Retention
Inquiry form (device list) company name, tax ID (NIP) or EU VAT number, first and last name, e-mail, phone, selected devices and notes preparing an offer, contact about the inquiry Art. 6(1)(b) GDPR (steps prior to entering into a contract at the person’s request) and (f) (legitimate interest: contact with a company representative) 24 months from submission, then automatic deletion
Contact form first name, phone, e-mail, message replying to the message Art. 6(1)(f) GDPR 24 months from submission
E-mail and phone correspondence data provided in the message or call handling the contact Art. 6(1)(f) GDPR 24 months from the last message, unless the correspondence concerns a concluded contract
Visit statistics (Google Analytics 4) — only with consent cookie identifiers, approximate location derived from the IP address (GA4 does not store IP addresses), device and browser information, pages visited statistics of website use Art. 6(1)(a) GDPR (consent) until consent is withdrawn; data in GA4 up to 14 months
Google Ads performance measurement (form and call conversions) — only with consent ad click identifier (_gcl_* cookies), information that a form was submitted or a call was made to a Google forwarding number (time, duration, caller’s area code), device information assessing the effectiveness of our ad campaigns Art. 6(1)(a) GDPR (consent) until consent is withdrawn; cookies up to 90 days (conversion window in the Ads account: 90 days)
Ads on Meta (Facebook, Instagram): measurement and remarketing — only with consent _fbp and _fbc cookie identifiers, address of the page visited, browser and device information, IP address, events: page view, inquiry sent (Lead), contact form sent (Contact). We do not share form data (name, e-mail, phone) measuring the effectiveness of our ads on Meta and showing our ads to people who visited the website Art. 6(1)(a) GDPR (consent) until consent is withdrawn; _fbp cookie up to 90 days. Further processing by Meta under its own terms
Concluding and performing a contract (rental, leasing, buyback, IT services) data from the inquiry and the contract performance of the contract, settlements Art. 6(1)(b) and (c) GDPR the period required by tax and accounting law
Protecting the website against abuse keyed hash (HMAC) of the IP address, without storing the plain address limits on the number of submissions, spam protection Art. 6(1)(f) GDPR 48 hours
Web server logs (hosting) IP address, date and time, address of the page visited, browser information keeping the website running and secure, detecting abuse Art. 6(1)(f) GDPR for the period set by the hosting provider
Pursuing claims data needed to establish or defend claims legal protection Art. 6(1)(f) GDPR until the claims are time-barred

Providing data is voluntary, but without the data marked as required in a form we cannot reply to the inquiry.

3. Recipients of data

Data may be shared only with entities that operate the website and communication for us, under data processing agreements:

  • website hosting: INCITATUS sp. z o.o. (ul. Leopolda Staffa 2, 05-520 Konstancin-Jeziorna, Poland), which provides and administers our hosting account, and — as a sub-processor — Shock Hosting LLC (371 Hoes Lane, Suite 200, Piscataway, NJ 08854, USA), on whose server in Warsaw the website runs and inquiries are stored;
  • e-mail and office services provider: Google Ireland Ltd (Google Workspace), under the accepted data processing terms (Cloud Data Processing Addendum);
  • Google Ireland Ltd (Google Analytics 4 and Google Ads), only to the extent of the consents you give (statistics, marketing);
  • Meta Platforms Ireland Ltd (Merrion Road, Dublin 4, Ireland), only with consent to “Ads on Meta”. For the collection and transmission of data by the Meta pixel we are joint controllers with Meta (Art. 26 GDPR) under the Meta Business Tools Terms (section on GDPR and joint controllership). Meta is responsible for further processing in line with its privacy policy. You may also exercise your rights regarding processing by Meta directly with Meta;
  • financing companies (leasing, rental): GRENKELEASING sp. z o.o. (ul. Abpa Antoniego Baraniaka 88, 61-131 Poznań, Poland) and LeaseLink sp. z o.o. (ul. Grochowska 306/308, 03-840 Warsaw, Poland). We share data only when you decide on financing and ask us to prepare an application, to the extent needed to assess it. The financing company then processes the data as a separate controller under its own privacy notice;
  • legal and accounting advisers, to the extent necessary to provide their services to us.

4. Transfers outside the EEA

Website data is stored on a server in Poland. The hosting provider (Shock Hosting LLC), Google and Meta have their seats or affiliates in the USA and may access data from outside the EEA, e.g. for server administration or technical support. Such transfers are based on the European Commission’s adequacy decision (EU–US Data Privacy Framework) where the recipient is covered by it, or on the standard contractual clauses adopted by the Commission. You can obtain a copy of the safeguards by writing to the address in section 1.

5. Cookies and browser storage

  • The website does not use cookies to function.
  • The inquiry list (“Your inquiries”) is stored only in your browser’s storage (localStorage) for 30 days. It does not reach us until you submit the form, and you can clear it at any time.
  • Your choice in the consent banner is stored in your browser’s storage (localStorage) for 12 months, so that we do not ask on every visit. It does not reach us.
  • Fonts and images are served from our server. The website does not connect to Google Fonts or other external servers.
  • Statistics (Google Analytics 4) are enabled only with your consent in the banner shown on your first visit. Without consent, the Google Analytics script is not loaded and no cookies are stored. GA4 stores the _ga and _ga_<identifier> cookies (up to 2 years). You can change or withdraw your consent at any time using the “Cookie settings” link in the website footer.
  • Marketing (Google Ads) is enabled only with your consent. We measure whether a visit from our Google ad ended with an inquiry, a contact form or a phone call. Visitors who came from an ad may then see a Google forwarding number instead of our number: the call reaches us, and Google records that a call took place (time and duration of the call, area code). Google Ads stores the _gcl_au and _gcl_aw cookies.
  • Ads on Meta (Meta pixel) are enabled only with your consent to this category. The pixel measures the effectiveness of our ads on Facebook and Instagram and allows us to show them to people who visited the website (remarketing). It stores the _fbp and _fbc cookies. We do not use “advanced matching”, i.e. we do not share with Meta any data entered in forms.
  • In Google we do not use remarketing or ad personalisation (the ad_personalization signal is always off). We do not use session recording tools.

6. Your rights

You have the right to:

  • access your data and receive a copy;
  • rectify your data;
  • erase your data;
  • restrict processing;
  • data portability (for processing based on a contract or consent);
  • object to processing based on legitimate interest;
  • withdraw consent at any time where processing is based on it, without affecting the lawfulness of processing before withdrawal;
  • lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).

To exercise your rights, write to the address given in section 1.

7. Automated decisions and profiling

We do not make decisions based solely on automated processing and do not profile website users.

8. Security

We use an encrypted connection (HTTPS). Form data is stored outside the public directory of the server in encrypted form — the key to read it is not stored on the server. Only authorised persons have access to the data. Our application logs do not contain personal data. The website files are continuously checked for unauthorised changes.

9. Changes to this policy

We announce changes by publishing a new version on this page. This version applies from: 26 October 2026