01 Who Is the Data Controller
The controller of your personal data within the meaning of Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") is CLASSTRUCKS POLAND SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, registered in the Polish National Court Register under KRS 0000623355, NIP8351606502, with its registered office at Mszczonowska 35, 96-200 Rawa Mazowiecka, Poland("ClassTrucks Poland", "we").
This policy applies to personal data processed in connection with the website classtruckspoland.co, our enquiry and reporting forms, email correspondence [email protected], our WhatsApp business line +48 22 219 51 57, and the negotiation and execution of machinery transactions. It applies to buyers, sellers, dealers, their representatives and employees, website visitors and anyone who contacts us.
We have not appointed a statutory Data Protection Officer because our core activity does not involve large-scale systematic monitoring or large-scale processing of special-category data. Privacy matters are handled by our compliance function, reachable through the contact details in Section 15.
02 Data We Collect
2.1 Data you give us directly
- Enquiry data — name, company, email address, phone/WhatsApp number, country, destination, budget indications, machine interests and the content of your messages.
- Transaction data — billing details, company registration and VAT numbers, beneficial ownership information where legally required, signatures on transaction documents, delivery addresses and consignee details.
- Seller data — machine ownership documents, service records, bank account details for sale proceeds, and identification documents where anti-fraud checks require them.
- Report data — information you submit when reporting a listing, which may include your identity (optional) and evidence you provide.
2.2 Data collected automatically
- Technical data — IP address, browser type and version, device type, operating system, referral source, and pages visited, collected through server logs and cookies described in our Cookie Settings.
- Communication metadata — timestamps and delivery status of emails and WhatsApp messages exchanged with us.
2.3 Data from third parties
- Company registers (KRS, VIES, foreign commercial registers) to verify counterparties.
- Sanctions and fraud-prevention screening lists, where transaction value or risk profile requires screening.
- Shipping and inspection partners, who send us status information containing contact details of consignees and site contacts.
We do not intentionally collect special categories of personal data (health, beliefs, biometrics) and ask you not to send such data to us.
03 Purposes & Legal Bases
We process personal data only where a legal basis under Article 6 GDPR applies:
| Purpose | Data used | Legal basis |
|---|---|---|
| Responding to enquiries and quoting machines | Enquiry data, communication content | Art. 6(1)(b) — steps prior to a contract at your request |
| Concluding and performing sales, brokerage, inspection and shipping contracts | Transaction data, seller data | Art. 6(1)(b) — contract performance |
| Invoicing, accounting, VAT and customs compliance | Transaction data | Art. 6(1)(c) — legal obligation (Polish tax and customs law) |
| Counterparty verification, fraud prevention, sanctions screening | Identity and company data, screening results | Art. 6(1)(c) and 6(1)(f) — legal obligations and our legitimate interest in preventing fraud |
| Handling listing reports and platform safety | Report data | Art. 6(1)(f) — legitimate interest in marketplace integrity |
| Stock updates and market newsletters | Email address, machine interests | Art. 6(1)(a) — consent, withdrawable at any time via the unsubscribe link |
| Website analytics and improvement | Technical data | Art. 6(1)(a)/(f) — consent for non-essential cookies; legitimate interest for aggregate statistics |
| Establishing, exercising or defending legal claims | All relevant categories | Art. 6(1)(f) — legitimate interest |
Providing enquiry and transaction data is voluntary, but without it we cannot answer your enquiry or conclude a transaction. Data required by tax and customs law is mandatory once a transaction proceeds.
04 WhatsApp Communication
Our phone number +48 22 219 51 57 is operated exclusively as a WhatsApp Business line. When you message us on WhatsApp, your phone number, profile name and message content are processed by us, and independently by WhatsApp Ireland Ltd / Meta Platforms as described in WhatsApp's own privacy policy. Message content between you and us is end-to-end encrypted in transit by WhatsApp.
- We use WhatsApp for enquiry handling, availability confirmations, condition photos/videos and shipment status updates.
- We do not upload our full contact database to WhatsApp; conversations are initiated by you or with your agreement.
- Business-relevant WhatsApp exchanges (offers, confirmations) are archived alongside transaction records for the retention periods in Section 7.
- If you prefer not to use WhatsApp, every service is equally available by email at [email protected].
06 International Transfers
As an export-focused business, some processing necessarily involves recipients outside the European Economic Area — for example a shipping line's destination agent, a buyer's bank, or destination customs brokers.
- Transfers necessary for the performance of your contract (Art. 49(1)(b) GDPR) — e.g. sending consignee details to a carrier delivering to your country — take place on that basis.
- Transfers to IT providers outside the EEA are covered by the European Commission's Standard Contractual Clauses or an adequacy decision (e.g. the EU–US Data Privacy Framework for certified US providers).
- WhatsApp communication involves Meta group infrastructure, covered by Meta's EU data transfer mechanisms.
You may request a copy of the relevant safeguards through the contact details in Section 15.
07 Retention Periods
| Data category | Retention period | Reason |
|---|---|---|
| Enquiries that do not lead to a transaction | 24 months after last contact | Follow-up on machinery requirements; then deleted or anonymised |
| Transaction and invoicing records | 5 years from the end of the tax year | Polish Accounting Act and Tax Ordinance |
| Export/customs documentation | 5 years | Union Customs Code record-keeping |
| Contracts and claim-relevant correspondence | 6 years | Limitation periods for business claims under the Polish Civil Code |
| Newsletter consent records | Until withdrawal + 3 years | Demonstrating consent compliance |
| Listing reports and safety investigations | 5 years from case closure | Fraud pattern detection, legal defence |
| Server logs | Up to 12 months | Security monitoring |
After the applicable period, data is deleted or irreversibly anonymised in the next scheduled purge cycle.
08 Your GDPR Rights
Subject to the conditions of the GDPR, you have the right to:
- Access (Art. 15) — obtain confirmation of processing and a copy of your data.
- Rectification (Art. 16) — correct inaccurate or incomplete data.
- Erasure (Art. 17) — deletion where data is no longer needed and no legal retention duty applies.
- Restriction (Art. 18) — limit processing during disputes about accuracy or lawfulness.
- Portability (Art. 20) — receive data you provided in a machine-readable format, where processing is based on contract or consent.
- Objection (Art. 21) — object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent (Art. 7(3)) — with effect for the future, without affecting prior processing.
To exercise any right, contact us via Section 15. We respond within one month, extendable by two further months for complex requests, and we may need to verify your identity before releasing data. Exercising your rights is free of charge except for manifestly unfounded or excessive requests.
09 Data Security
We apply technical and organisational measures proportionate to the risk, including:
- TLS encryption for all website traffic and email transport encryption.
- Access controls on transaction records restricted to staff who need them for their role.
- Verified corporate banking channels with dual control on outgoing payments.
- Regular backup routines with restore testing, and patch management on our systems.
- Staff awareness procedures for phishing and payment fraud — the most common attack vector in machinery trading.
In the event of a personal data breach likely to result in a risk to your rights, we will notify the Polish supervisory authority within 72 hours and affected individuals without undue delay, as required by Articles 33–34 GDPR.
11 Children's Data
The Platform is a business-to-business service for professional machinery trade and is not directed at children. We do not knowingly process data of anyone under 18. If you believe a minor has provided us personal data, contact us and we will delete it.
12 Automated Decisions & Profiling
We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Sanctions and fraud screening may use automated list matching, but any resulting decision — declining or conditioning a transaction — is always reviewed by a human before it takes effect.
Newsletter segmentation (e.g. sending excavator stock updates to contacts who enquired about excavators) is basic preference matching, which you can object to at any time.
13 Complaints & Supervisory Authority
If you believe we process your data unlawfully, we ask you to contact us first so we can resolve the issue directly. You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl — or with the authority of your habitual residence or place of work in the EU.
14 Updates to This Policy
We review this policy at least annually and update it when our processing, providers or the law changes. The current version with its effective date is always available at classtruckspoland.co/privacy. Material changes affecting ongoing relationships are communicated by email or a website notice before they take effect.
15 Contact for Privacy Requests
| Controller | CLASSTRUCKS POLAND SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ |
|---|---|
| Postal address | Mszczonowska 35, 96-200 Rawa Mazowiecka, Poland |
| Email (preferred for requests) | [email protected] |
| WhatsApp (messages only) | +48 22 219 51 57 |
Please mark privacy requests clearly (e.g. subject "Privacy request — access") and include enough information for us to locate your records, such as the email address or phone number you used to contact us.