This policy explains what personal data we process when you use the Carzonely mobile and web application (iOS, Android, the dashboard at pulpit.carzonely.pl) and the carzonely.pl website, why we process it and what rights you have. Carzonely is used by car wash customers and by car wash staff and owners (“Users”).
1. Data controller
The controller of your personal data is ENAPPIA Sp. z o.o., based in Wrocław, Poland, ⟨ul. …, 5x-xxx Wrocław⟩, VAT ID ⟨NIP⟩, KRS ⟨KRS⟩ (“we”, “us”). Privacy contact: ⟨kontakt@carzonely.pl⟩.
Bookings concern services performed by the car wash you choose. For performing the wash itself (vehicle intake, payment, receipt or invoice), the car wash processes your data as a separate controller.
2. Data we process
| Category | Scope | Purpose |
|---|---|---|
| Account data | first and last name, email, phone number, preferred language | account creation, sign-in, contact |
| Booking data | vehicle (make, model, plate, segment), selected service, date and time, status, price, visit history, loyalty program participation | fulfilling bookings and services |
| Billing data (optional) | company name, VAT ID, invoice address | issuing an invoice or receipt on request |
| Messages | messages exchanged between customer and car wash about a booking | service-related communication |
| Notifications | device token (FCM/APNs) | push notifications about booking status |
| Location (optional) | approximate device location — only with consent | finding the nearest car wash on a map |
| Technical and diagnostic data | device information, crash and error logs, IP address | security, diagnostics, improving the app |
| Car wash staff | name, email, role, activity history in the dashboard | staff account management, security |
| Website form | full name, email, car wash name, city, message | replying to your inquiry, product demo |
We do not process payment card data in the app — payment happens directly at the car wash.
3. Legal bases (GDPR)
- Art. 6(1)(b) — performance of a contract (account, bookings, statuses, loyalty program).
- Art. 6(1)(f) — legitimate interests (security, diagnostics, service communication, replying to inquiries, legal claims).
- Art. 6(1)(a) — consent (push notifications, location). You can withdraw it at any time in your device or app settings.
- Art. 6(1)(c) — legal obligation (e.g. accounting records, where applicable).
4. Recipients and processors
We share data with the car wash you book (to the extent needed for the booking) and with trusted providers processing it on our behalf under data processing agreements:
| Provider | Role | Location / safeguards |
|---|---|---|
| Supabase | database hosting and authentication | EU infrastructure |
| Google Firebase Cloud Messaging | push notification delivery | possible transfer outside the EEA — Standard Contractual Clauses / Data Privacy Framework |
| Sentry | error and crash monitoring | ⟨region⟩ — Standard Contractual Clauses |
| Cloudflare | hosting and protection of the web part | Standard Contractual Clauses / Data Privacy Framework |
| ⟨Formspree⟩ | website contact form | ⟨USA — Standard Contractual Clauses⟩ |
We do not sell personal data and do not share it with third parties for their own marketing.
5. International transfers
Some providers (e.g. Google, Sentry) may process data outside the European Economic Area. Such transfers rely on Standard Contractual Clauses approved by the European Commission or other GDPR-compliant mechanisms (Art. 44–49).
6. Retention
- Account and booking data — while you use the app and up to ⟨24 months⟩ after your last activity or until account deletion.
- Billing data — for the period required by law (generally 5 years from the end of the tax year).
- Website inquiries — until the conversation ends, no longer than ⟨12 months⟩.
- Diagnostic logs — short-term, up to ⟨90 days⟩.
7. Your rights
You have the right to access, rectify, erase, restrict and port your data, to object to processing and to withdraw consent. To exercise them, email ⟨kontakt@carzonely.pl⟩. You may also lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa).
8. Account and data deletion
You can request deletion of your account and related data at any time by emailing ⟨kontakt@carzonely.pl⟩ from the address linked to your account. We act without undue delay, except for data we must retain by law.
9. Security
We use technical and organizational measures appropriate to the risk, including encryption in transit (HTTPS/TLS) and role-based access control.
10. Children
The app is not intended for children. We do not direct our services to persons under 16 and do not knowingly collect their data.
11. Website, cookies and analytics
The carzonely.pl website does not use marketing cookies, and fonts are served from our own server.
12. Changes
We may update this policy. Material changes will be announced in the app or by email. The current version is always available at carzonely.pl/en/privacy. In case of discrepancies, the Polish version prevails.
13. Contact
ENAPPIA Sp. z o.o. — ⟨ul. …, 5x-xxx Wrocław⟩ — ⟨kontakt@carzonely.pl⟩