1. Data Controller and Definitions

  1. The controller of the personal data of Customers / Users of the Online Store, also referred to as the Seller, is: TEST AND DRIVE SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, telephone: 519 124 595, Tax Identification Number (NIP): 9292036801, National Business Registry Number (REGON): 385883739.
  2. The Data Controller may be contacted:
    1. at the correspondence address: Lubuska 47, 66-016 Płoty;
    2. at the email address: testanddrive.eu
  3. User – a natural person who visits the website(s) of the Online Store or uses the services or features described in this Privacy and Cookies Policy.
  4. Customer – a natural person with full legal capacity, a natural person who is a Consumer, a legal person, or an organisational unit without legal personality that is granted legal capacity by law, who or which enters into a Distance Sales Agreement with the Seller.
  5. Online Store – the website operated by the Seller, available at the following web address(es): testanddrive.eu, through which a Customer/User may obtain information about Goods and their availability, purchase Goods, or request the provision of a service.
  6. Newsletter – information, including commercial information within the meaning of the Act of 18 July 2002 on the Provision of Services by Electronic Means (Journal of Laws of 2020, item 344), originating from the Seller and sent electronically to the Customer/User; receiving it is voluntary and requires the Customer’s/User’s consent.
  7. Account – a set of data stored in the Online Store and in the Seller’s ICT system relating to a particular Customer/User, their orders and the agreements they have entered into, which the Customer/User may use to place orders and enter into agreements.
  8. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

2. Purposes, Legal Bases and Duration of Data Processing

  1. For the purpose of performing the Distance Sales Agreement, the Seller processes:
    1. information about the User’s device to ensure that the services function properly: the computer’s IP address, information contained in cookies or other similar technologies, session data, web browser data, device data, and data concerning activity on the Website, including its individual pages;
    2. geolocation information, provided that the User has consented to the service provider accessing their geolocation. Geolocation information is used to provide more tailored product and service offers;
    3. Users’ personal data: first name, surname, registered office address, correspondence address, email address, telephone number, Tax Identification Number (NIP), bank account number, or other personal data necessary to complete a purchase and required by the Controller during the purchasing process.
  2. This information does not include data identifying Users, but, when combined with other information, it may constitute personal data and is therefore afforded full protection by the Controller under the GDPR.
  3. This data is processed in accordance with Article 6(1)(b) of the GDPR for the purpose of providing the service, i.e. performing the agreement for the provision of services by electronic means in accordance with the Terms and Conditions, and in accordance with Article 6(1)(a) of the GDPR on the basis of consent to the use of specific cookies or other similar technologies, expressed through the appropriate web browser settings in accordance with the Telecommunications Law, or on the basis of consent to geolocation. The data is processed until the Customer/User stops using the Online Store.
  4. The Controller undertakes to take all measures required under Article 32 of the GDPR, i.e. taking into account the state of the art, the cost of implementation, the nature, scope and purposes of processing, and the risk of varying likelihood and severity to the rights and freedoms of natural persons, the Controller implements appropriate technical and organisational measures to ensure a level of security appropriate to that risk.

3. Marketing Activities of the Controller

  1. The Data Controller may publish marketing information about its products or services on the Online Store website. The Data Controller displays this content in accordance with Article 6(1)(f) of the GDPR, i.e. on the basis of the Data Controller’s legitimate interest in publishing content related to the services provided and promotional campaigns in which the Data Controller is involved. At the same time, this activity does not infringe the rights and freedoms of Customers/Users, who anticipate, and may even expect, receiving content of this kind, or whose direct purpose in visiting the Online Store website(s) is to access such content.

4. Recipients of Users’ Data

  1. The Data Controller discloses Users’ personal data only to processors under personal data processing agreements concluded for the purpose of providing services to the Data Controller, such as website hosting and maintenance, IT services, marketing and PR services.

5. Transfers of Personal Data to Third Countries

  1. Personal data will not be processed in third countries.

6. Rights of Data Subjects

  1. Every data subject has the right:
    1. of access (Article 15 of the GDPR) – to obtain confirmation from the Data Controller as to whether their personal data is being processed. Where a person’s data is being processed, they are entitled to access it and obtain the following information: the purposes of processing, the categories of personal data, the recipients or categories of recipients to whom the data has been or will be disclosed, the data retention period or the criteria used to determine it, and the data subject’s right to request rectification, erasure or restriction of the processing of personal data and to object to such processing;
    2. to receive a copy of the data (Article 15(3) of the GDPR) – to obtain a copy of the data undergoing processing, with the first copy provided free of charge; for further copies, the Data Controller may charge a reasonable fee based on administrative costs;
    3. to rectification (Article 16 of the GDPR) – to request the correction of inaccurate personal data concerning them or the completion of incomplete data;
    4. to erasure (Article 17 of the GDPR) – to request the erasure of their personal data if the Data Controller no longer has a legal basis for processing it or the data is no longer necessary for the purposes of processing;
    5. to restriction of processing (Article 18 of the GDPR) – to request that the processing of personal data be restricted where:
      1. the data subject contests the accuracy of the personal data – for a period enabling the Data Controller to verify its accuracy,
      2. the processing is unlawful and the data subject opposes the erasure of the data, requesting restriction of its use instead,
      3. the Data Controller no longer needs the data, but the data subject requires it for the establishment, exercise or defence of legal claims,
      4. the data subject has objected to processing – pending verification of whether the controller’s legitimate grounds override the grounds for the data subject’s objection;
    6. to data portability (Article 20 of the GDPR) – to receive, in a structured, commonly used and machine-readable format, the personal data concerning them that they have provided to the Data Controller, and to request that this data be transmitted to another controller, where the data is processed on the basis of the data subject’s consent or a contract with them and the processing is carried out by automated means;
    7. to object (Article 21 of the GDPR) – to object, on grounds relating to their particular situation, to the processing of their personal data for the controller’s legitimate purposes, including profiling. The Data Controller will then assess whether there are compelling legitimate grounds for the processing that override the interests, rights and freedoms of the data subjects, or grounds for the establishment, exercise or defence of legal claims. If this assessment shows that the data subject’s interests override the controller’s interests, the Data Controller will be required to cease processing the data for those purposes;
    8. to withdraw consent at any time and without giving a reason; however, personal data processing carried out before consent was withdrawn will remain lawful. Withdrawal of consent will result in the Controller ceasing to process personal data for the purpose for which that consent was given.
  2. To exercise the rights listed above, the data subject should contact the Data Controller using the contact details provided and specify which right they wish to exercise and to what extent.

7. President of the Personal Data Protection Office

  1. The data subject has the right to lodge a complaint with the supervisory authority, which in Poland is the President of the Personal Data Protection Office, based in Warsaw at ul. Stawki 2, who may be contacted as follows:
  2. by post: ul. Stawki 2, 00-193 Warsaw;
  3. via the electronic submission inbox available at: https://www.uodo.gov.pl/pl/p/kontakt;
  4. Helpline: 606-950-000.

8. Data Protection Officer

  1. In all cases, the data subject may also contact the Controller’s Data Protection Officer directly by email or in writing at the Data Controller’s address provided in Section 1, point 2 of this Privacy and Cookies Policy.

9. Changes to the Privacy Policy

  1. The Privacy and Cookies Policy may be supplemented or updated in line with the Controller’s current needs in order to provide Customers/Users with up-to-date and reliable information.

10. Cookies

  1. The Online Store collects information about Customers, Users and their behaviour in the following ways:
    1. through information voluntarily entered in forms, for purposes arising from the function of each specific form;
    2. by storing cookies on end devices;
    3. through web server logs collected by the Online Store’s hosting provider (necessary for the website to function properly).
  2. Cookies are computer data, in particular text files, stored on the Customer’s/User’s end device and intended for use with the Online Store website. Cookies usually contain the name of the website from which they originate, the length of time they are stored on the end device, and a unique number.
  3. The Online Store uses cookies only after the Customer/User of the Store has given prior consent. Consent to the Online Store’s use of all cookies is given by clicking the “Close” button while the notice about the Online Store’s use of cookies is displayed, or by closing that notice.
  4. If the Customer/User of the Online Store does not consent to the Online Store’s use of cookies, they may select the “I do not consent” option, also available in the notice about the Online Store’s use of cookies, or change the settings of the web browser they are currently using (this may, however, cause the Online Store website to function incorrectly).
  5. To manage cookie settings, select a web browser/system from the list and follow the instructions: Internet Explorer, Chrome, Safari, Firefox, Opera, Android, Safari (iOS), Windows Phone.
  6. The legal basis for processing personal data obtained from cookies is the Data Controller’s legitimate interest in providing high-quality services and ensuring their security.
  7. The Online Store uses two main types of cookies: “session cookies” and “persistent cookies”. Session cookies are temporary files stored on the User’s end device until they log out, leave the Online Store or close the software (web browser). Persistent cookies are stored on the Customer’s/User’s end device for the period specified in the cookie parameters or until they are deleted by the Customer/User.

Functional Cookies (Required)

testanddrive.eu

monit_token: 365 days, cookie
Identifies the store customer.

shop_monit_token: 30 minutes, cookie
Identifies the store customer.

client: 1 day, cookie
Identifies the logged-in customer / the basket of a customer who is not logged in.

affiliate: 90 days, cookie
Stores the identifier of the partner that referred the visitor to the store.

ordersDocuments: cookie
Stores information about the document printing status.

__idsui: 1095 days, cookie
Required for the website’s so-called “light login” functionality.

__idsual: 1095 days, cookie
Required for the website’s so-called “light login” functionality.

__IAI_SRC: 90 days, cookie
Stores only the source from which the visitor reached the website.

login: cookie
Stores information about whether the user has logged in to the website.

CPA: 28 days, cookie
Contains information about variables for CPA / CPS programmes in which the website participates.

__IAIRSABTVARIANT__: 30 days, cookie
Variant identifier for A/B testing and IdoSell RS engine configuration.

basket_id: 365 days, cookie
The website user’s basket identifier, assigned for the duration of the current session.

page_counter: 1 day, cookie
Counts the pages visited.

LANGID: 180 days, cookie
Stores information about the language selected by the website user.

REGID: 180 days, cookie
Stores information about the website user’s region.

CURRID: 180 days, cookie
Stores information about the currency selected by the website user.

__IAIABT__: 30 days, cookie
Stores the A/B test identifier for testing and improving the store’s functionality.

__IAIABTSHOP__: 30 days, cookie
Stores the identifier of the store participating in an A/B test.

__IAIABTVARIANT__: 30 days, cookie
Stores the identifier of the variant randomly selected as part of the ongoing A/B test.

toplayerwidgetcounter[]: cookie
Stores the number of times a pop-up message has been displayed.

samedayZipcode: 90 days, cookie
Stores the website user’s postcode, which is required to offer the SameDay courier delivery service.

applePayAvailability: 30 days, cookie
Stores information about whether the Apple Pay payment method is available to the user.

paypalMerchant: 1 day, cookie
PayPal account identifier.

toplayerNextShowTime_: cookie
Stores information about when a pop-up message should next be displayed.

rabateCode_clicked: 1 day, cookie
Stores information about the dismissal of the bar displaying an active discount.

freeeshipping_clicked: 1 day, cookie
Stores information about the dismissal of the bar displaying free delivery information.

redirection: cookie
Stores information about the dismissal of the pop-up message suggesting a language for the store.

filterHidden: 365 days, cookie
When the option to collapse a product filter is clicked, stores information about which filter should remain collapsed after the product list is refreshed.

toplayerwidgetcounterclosedX_: cookie
Stores information about the dismissal of a pop-up message.

cpa_currency: 60 minutes, cookie
Contains information about the currency for CPA / CPS programmes in which the website participates.

basket_products_count: cookie
Stores information about the number of items in the basket.

wishes_products_count: cookie
Stores information about the number of items on the wishlist.

HOMELANDID: 180 days, cookie
Stores information about the visitor’s country.

remembered_shop_mfa: 365 days, cookie
CookieNameRememberedShopMfa

IAI S.A.

platform_id: cookie
Stores information about whether the website is being displayed in a mobile app.

paypalAvailability_: 1 day, cookie
Stores information about whether the PayPal payment method is available to the user.

ck_cook: 3 days, cookie
Stores information about whether the website user has consented to cookies.

IdoAccounts

accounts_terms: 365 days, cookie
Stores information about whether the user has given consent to use the IdoAccounts service.

express_checkout_login: 365 days, cookie
CookieNameExpressCheckoutLogin

Google

NID: 180 days, cookie
These cookies (NID, ENID) are used to remember the user’s preferences and other information, such as their preferred language, the number of results displayed on a search results page (for example, 10 or 20), and whether they want Google SafeSearch to be enabled. This cookie is also required to offer the Google Pay payment service.

Google reCAPTCHA

_GRECAPTCHA: 1095 days, cookie
This cookie is set by Google reCAPTCHA, which protects our website from spam submissions through contact forms.

PayPal

ts: cookie
This cookie is usually provided by PayPal and supports payment services on the website.

ts_c: 1095 days, cookie
This cookie is usually provided by PayPal and is used to prevent fraud.

x-pp-s: cookie
This cookie is usually provided by PayPal and supports payment services on the website.

enforce_policy: 365 days, cookie
This cookie is usually provided by PayPal and supports payment services on the website.

tsrce: 3 days, cookie
This cookie is usually provided by PayPal and supports payment services on the website.

l7_az: 60 minutes, cookie
This cookie is necessary for the PayPal login functionality on the website.

LANG: 1 day, cookie
This cookie is usually provided by PayPal and supports payment services on the website.

nsid: cookie
Used in connection with transactions on the Website. This cookie is required for secure transactions.

Analytics Cookies

IAI S.A.

__IAI_AC2: 45 days, cookie
A conversion tracking identifier (Activity Tracking) used to collect the history of sources leading up to an order, as well as the source to which the order is attributed under the last-click attribution model.

Google Maps

SID: 3650 days, cookie
These cookies contain digitally signed and encrypted records of the user’s Google Account ID and most recent sign-in time. The combination of these cookies (SID, HSID) allows Google to block many types of attacks, such as attempts to steal the contents of forms submitted through Google services.

Advertising Cookies

testanddrive.eu

RSSID: 180 days, cookie
An IdoSell RS user identifier used to display tailored product recommendations on the website.

__IAIRSUSER__: 60 minutes, cookie
An IdoSell RS user identifier used to display tailored product recommendations on the website.

  1. Cookies are used for the following purposes:
    1. generating statistics that help understand how Customers/Users of the Online Store use its web pages, enabling improvements to their structure and content;
    2. maintaining the Customer’s/User’s session after login, so that the Customer/User does not have to re-enter their username and password on every page of the Online Store;
    3. determining the Customer’s/User’s profile in order to display product recommendations and tailored content to them in advertising networks, particularly the Google network.
  2. Web browsing software (a web browser) usually permits cookies to be stored on the Customer’s/User’s end device by default. Customers/Users may change these settings. The web browser allows cookies to be deleted. It is also possible to block cookies automatically.
  3. Restrictions on the use of cookies may affect certain features available on the Online Store’s web pages.
  4. Cookies may also be placed on the Customer’s/User’s end device and used by advertisers and partners working with the Online Store.
  5. Cookies may be used by the Google network to display advertisements tailored to the way the Customer/User uses the Online Store. For this purpose, they may store information about the user’s navigation path or the time spent on a particular page: https://policies.google.com/technologies/partner-sites.
  6. We recommend that Customers/Users read these companies’ privacy policies to learn about the rules governing the use of cookies for statistical purposes: Google Analytics Privacy Policy.
  7. With regard to information about the Customer’s/User’s preferences collected by the Google advertising network, the Customer/User may view and edit information derived from cookies using the following tool: https://www.google.com/ads/preferences/.
  8. The Online Store website includes plugins that may transmit Customers’/Users’ data to controllers such as Google Maps, PayPal, Google reCAPTCHA, IdoAccounts, IdoSell, IAI S.A. and Google.
  9. To ensure the proper performance of the Distance Sales Agreement, the Data Controller may disclose Customers’/Users’ data to courier companies. The delivery methods currently available in the Online Store can be found at: https://shop-alco2go.com/pl/delivery.html.
  10. To ensure the proper performance of the Distance Sales Agreement, the Controller may disclose Customers’/Users’ data to online payment systems. The advance payment methods currently available in the Online Store can be found at: https://shop-alco2go.com/pl/payments.html.
  11. Further information about terms and privacy can also be found on the Google Privacy & Terms website.

11. Newsletter

  1. The Customer may consent to receiving commercial information electronically by selecting the relevant option in the registration form or, at a later time, in the appropriate tab. If such consent is given, the Customer/User will receive the Online Store’s information (Newsletter), as well as other commercial information sent by the Seller, at the email address they have provided.
  2. The Customer may unsubscribe from the Newsletter at any time by unchecking the relevant box on their Account page, using the form at https://shop-alco2go.com/pl/newsletter.html, clicking the relevant link included in each Newsletter, or contacting Customer Service.

12. Account

  1. The Customer/User must not post unlawful content, including reviews and other data, in the Online Store or provide such content to the Seller.
  2. The Customer/User gains access to the Account after registering.
  3. During registration, the Customer/User provides the account type or gender, first name, surname, company name, Tax Identification Number (NIP), details required to issue a sales document, shipping details and email address, and chooses a password. The Customer/User confirms that the information they provide in the registration form is true. Registration requires the Customer/User to read the Terms and Conditions carefully and to indicate in the registration form that they have read them and fully accept all their provisions.
  4. When the Customer/User is granted access to the Account, an agreement for the provision of services by electronic means relating to the Account is concluded between the Seller and the Customer for an indefinite period. The Consumer may withdraw from this agreement in accordance with the rules set out in the Terms and Conditions.
  5. Registering an Account on one of the Online Store’s websites also constitutes registration enabling access to the other websites through which the Online Store is available.
  6. The Customer/User may terminate the agreement for the provision of services by electronic means at any time with immediate effect by notifying the Seller by email or in writing at the Data Controller’s address provided in Section 1, point 2 of this Privacy and Cookies Policy.
  7. The Seller has the right to terminate the services agreement relating to the Account if it ceases to provide the Online Store service or transfers it to a third party, if the Customer/User breaches the law or the Terms and Conditions, or if the Customer/User has been inactive for 6 months. The agreement is terminated with seven days’ notice. The Seller may stipulate that registering an Account again will require the Seller’s permission.