Privacy and Cookie Policy of the Masterlease Group
Recitals
Whereas:
1. Protecting the privacy of customers and users of the Masterlease Group’s websites is very important.
2. The Masterlease Group companies limit the use and collection of information about website users to a level that is necessary to provide services at the highest level to customers and users.
The Company resolves to adopt the following Procedure.
§ 1
Purpose and application of the Policy
1. The Privacy Policy and Cookies Policy of the Masterlease Group apply wherever a Masterlease Group Company is a personal data controller and processes personal data. This includes the instanc-es where:
a) personal data obtained directly from the data subject are processed;
b) personal data has been obtained from other sources.
2. This Policy aims at highlighting the special importance that the Masterlease Group attaches to privacy protection for website users and at providing general information on the personal data processed and the use of cookies.
3. This document specifies which data are collected by the Masterlease Group companies and which rules apply to their processing.
§ 2
Definitions
1. Controller or Company– a company of the Masterlease Group. Information about companies of the Masterlease Group is available at masterlease.pl/grupa.
2. Personal data – any information related to a website user and identifying the user personally, by itself or in combination with other available information, e.g. e-mail address.
3. Masterlease Group – Capital Group with Prime Car Management S.A. as the controlling entity.
4. Processing – any activities and operations performed on personal data of users of websites, e.g. analysis for the purposes of provision of vehicle leasing/rental services.
5. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free move-ment of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
6. Websites – websites of the Masterlease Group:
a) www.masterlease.pl;
b) www.master1.pl;
c) www.masterbenefit.pl;
d) masterrent24.pl.;
7. User – any natural person visiting the websites of the Masterlease Group.
§ 3
Purpose of data processing
1. The Masterlease Group Companies process personal data in particular for the following purposes:
a) presentation of an offer of financing the rental or lease of the vehicle;
b) preparation of optimal terms and conditions of the vehicle sale, rental or leasing agreement;
c) performance of a concluded sale, lease or rental agreement and other services of the Mas-terlease Group companies;
d) preventing fraud, counteracting money laundering and terrorist financing;
e) ensuring the security of the services provided by the Masterlease Group;
f) ensuring compliance with the law, regulations and guidelines for the sector;
g) improvement of products and services offered by the companies of the PKO Bank Polski S.A. Capital Group (the current list of which is available at pkobp.pl);
h) sending personalized marketing messages;
i) analytics and profiling of users;
j) adjusting the website content to users’ interests and optimizing navigation of the website so that searching for content is convenient and intuitive;
k) managing interactions for the purposes of establishing, maintaining or developing relation-ships with customers/potential customers or vehicle users.
§ 4
Collection of data by the Masterlease Group
1. Masterlease Group, through the operation of its companies, manages data and collects information voluntarily provided by users of the Websites in relation to their use of the Websites listed in § 2 section 6.
2. In particular, the logs contain such data as the IP address of the device, time of the event, data about the downloaded content, referrer, user agent, cookies.
3. The Masterlease Group limits the use and collection of information about website users to the minimum required to provide services at the top level.
4. The Masterlease Group does not collect data on political or religious beliefs, health or ethnic origin.
5. The Masterlease Group does not collect or verify information on the age of website users. Persons without full legal capacity are not entitled, without the relevant consents obtained under applicable laws, to order or subscribe for services via websites of the Masterlease Group.
6. In the case of direct marketing, the Masterlease Group may send an offer of products and services provided by companies, adjusted to the needs and interests, in a manner to which the person has previously consented.
§ 5
References to other websites
1. Websites of the Masterlease Group may contain links (hyperlinks that, when clicked, direct the us-er of the Website to another website) to other websites that constitute a service provided by third parties and are therefore outside the control of the Masterlease Group. The Masterlease Group shall not be held liable for personal data protection practices applied by such websites
2. With reference to section 1 above, the Masterlease Group recommends the users to read the privacy statements available on the partners’ websites, especially if such websites collect person-al data.
§ 6
Contact forms and external advertising agencies
1. The Masterlease Group offers the users the option to contact us via electronic contact forms.
a) Using the form requires providing personal data necessary for contact and responding to the enquiry, in particular: first name, e-mail address, contact telephone number.
b) The user may also provide other data to facilitate the contact or handling of the enquiry.
c) Provision of data marked as mandatory is required in order for the enquiry to be accepted and processed, and failure to provide such data makes it impossible to process the enquiry.
d) Provision of other data is voluntary.
2. The Masterlease Group enables users of selected Websites to create an account.
a) To this end, the user is required to provide identification data, including contact details (i.e. in particular first name, surname, e-mail address), and failure to provide such data makes it impossible to create an account.
b) The created account may also be used for the performance of the agreement and for the purposes of mutual communication.
c) The provision by the user of personal data other than necessary for setting up and oper-ating an account is voluntary.
3. The Masterlease Group enables users to make transactions related to the vehicle financing through an electronic transaction system. The operation of this system entails the obligation for the user to provide certain personal data, in particular identification details (first name, surname) and contact details (e-mail address, telephone number) in order to provide the service involving the conclusion and performance of the agreement and to accept the rules of this system.
4. When viewing content of websites where advertisements of the Masterlease Group are dis-played, the online marketing tools used by the Controller may send cookie files to the user’s de-vice. This allows identification of the device upon future visits or the measurement of the user’s response to a given advertisement.
§ 7
Cookies Policy
1. Cookies are files saved on the user’s devices by websites visited by the user. Cookies are saved on the stor-age medium of the terminal device, e.g. a computer, tablet, mobile phone of the user, in order to facilitate navigation and to adjust the website to the user’s preferences.
2. Cookies are encrypted in such a way that unauthorized persons do not have access to them
3. The information contained in cookies contains data about the user’s activity on the Website.
4. The Controller may combine information collected on the basis of cookies with other personal da-ta held by the Controller.
5. Depending on the time for which cookies are kept, they are classified into the following catego-ries:
a) session cookies, temporary – not saved on the disc, necessary to maintain the proper func-tioning of the Website and measure the user session time;
b) persistent cookies – cookies that are not removed after closing the browser and can be used by the Website in the future. These include:
• cookies within a given domain (first party) – the Website sets up cookies only for its internal purposes;
• cookies in the external domain (third party) – the Website sets up cookies to be used in other Websites.
6. Depending on the purpose for which the Masterlease Group uses cookies, they can be classified into the following categories:
• Strictly necessary (essential) cookies
They are necessary for the functioning of the website and cannot be disabled in the Company systems. They are usually enabled only in response to user actions that consti-tute a service request, such as setting privacy preferences, signing in or filling out forms. The browser can be set up in such a way at to block or warn about these cookies, but some parts of the website will not work in such the case. These cookies do not store any personal data.
• Analytical cookies
They enable us to monitor visits and traffic sources, so we can measure and improve the website performance. They help determine which pages are the most and least popular as visitors move around. Information collected by these cookies is aggregated and thus remains anonymous. If the user does not allow these cookies to be used, there will be no information about the visit to the website.
• Marketing cookies
They can be set by our advertising partners through the Websites. They can be used by these companies to create a user interest profile and display personalized advertise-ments on other sites. They do not directly store personal data, but are based on the unique identification of the browser and internet hardware. If the user does not allow these cookies to be used, the user will see less personalized advertisements when browsing websites.
• Functional cookies
They allow for improved performance and personalization of the website. They may be set by the Company or by third party providers whose services have been added to our Websites. If the user does not allow these cookies to be used, some or all of these ser-vices may not work properly. The Masterlease Group profiles advertisements displayed both on external websites and on Websites of the Masterlease Group.
7. When carrying out analytical activities related to user activity on the Websites, the Masterlease Group cooperates with external partners (local or foreign). The partners provide the Masterlease Group companies with services consisting in monitoring, producing statistics and analyzing them. Activities in this respect are carried out on the basis of a legitimate interest of the controller, in order to optimize the Websites.
8. There is also a small graphic file embedded in the Masterlease Group’s websites, which makes it possible to conduct (within the PKO BP S.A. Capital Group) analyses of traffic from published campaigns, user interactions on the Websites, remarketing activities.
9. The Masterlease Group may build a user profile on the basis of the databases collected by the Websites as part of their own cookies, as well as by combining them with other information held about the data subject. The possibility to build a user profile applies only to those persons who have consented to the use of cookies for analytical and marketing purposes.,
10. The Masterlease Group uses cookies in accordance with the user’s settings of the browser soft-ware installed on the device used. The user may verify whether they have authorized the use of cookies or not.
11. Information about cookies published by web browser manufacturers is available in the instruc-tions for their use.
12. Users who, having read the information available on the Websites, do not want cookies to remain stored in the web browser of the device should delete them from their browser after having visit-ed the Website.
13. During the first visits to the Masterlease Group Website, information about the use of cookies is displayed. From this level, the User may agree to save all cookies or choose their own prefer-ences by clicking the setup option. The user can restore their settings at any time, and can modify them in the cookie settings in the bottom left corner of the browser window. The Masterlease Group will exercise due diligence to make the settings effective upon the next time the site is loaded. In special situations, for technical reasons, beyond the control of the Masterlease Group, the withdrawal may take effect with a delay, justified by the execution of technical processes necessary to implement the user’s instruction. The user can also change their settings or disable cookies in their browser at any time. However, this may result in incorrect display of the content of the Masterlease Group Websites.
§ 8
Tools and technologies using cookies
The mode of operation and relevant categories of data for specific tracking technologies are presented below. Detailed information about cookies used by a given technology, including indication of the period of storage of cookies, is contained in the cookie settings. Cookie settings can be opened by clicking the cookie icon in the bottom left corner of the browser window.
1. Google Analytics
Websites of the Masterlease Group use Google Analytics, a service that analyses the use of dif-ferent versions of the website and helps make it more attractive to the user.
Information obtained based on Google Analytics cookies about the use of Masterlease Group Websites will usually be sent to and stored in a Google server in the USA. Due to the activation of IP anonymization on these websites, the IP address will first be shortened by Google within the Member States of the European Union or in other states – parties to the Agreement on the European Economic Area (EEA). The complete IP address will be transmitted to a server of Google in the USA and shortened there only in exceptional cases. The IP address transmitted by the browser within the frame of Google Analytics will not be combined with any other data of Google. On behalf of the operator of Websites of the Masterlease Group, Google will use such information to prepare reports on activities and to provide further services related to the use of Websites of the Masterlease Group addressed to and for the purposes of the operator of these Websites. More detailed information on the terms of use and on data protection is available at https://marketingplatform.google.com/about/analytics/terms/pl/.
| Supplier designation | Transfers to a third country | Third country |
|---|---|---|
| Google Ireland Limited, Gordon House 4 Barrow Street Dublin, D04 E5W5 Irelan | Yes | USA |
| Categories of data concerned | Purpose of processing | Legal basis for processing |
|---|---|---|
| Technical data such as: oper-ating system used, browser type and version, device (smartphone, tablet, etc.), date and time of accessing the website, etc. | Analysis of user behavior | point (a) of Article 6(1) of the GDPR |
| Data related to the user’s behavior on the website | Analysis of user behavior | point (a) of Article 6(1) of the GDPR |
| User ID, device ID | User ID, device ID | point (a) of Article 6(1) of the GDPR |
2. Google Ads
To draw attention to the services of the Controller, Google Ads are placed to display personalized, in-terest-driven and location-based online ads. The IP address anonymization option is controlled by in-ternal settings of Google Tag Manager that are not visible in the source code of this website. These in-ternal settings are designed to ensure anonymization of IP addresses.
Advertisements are displayed based on search phrases on sites in the Google advertising network. The Company is able to combine advertisements with certain search phrases. It may use cookies to place advertisements on the website based on previous user visits.
When clicking on an advertisement, Google sets a cookie on the user computer.
With this technology, Google and the Company, as their client, obtain information that the user has clicked on advertisement and has been redirected to the Company’s websites. Such information shall only be used for statistical analysis to optimize advertisements. The Company does not receive any personally identifiable visitor information. The statistics provided to the Company by Google contain the total number of users who have clicked on a given advertisement and, where applicable, whether they have been redirected to the subpage of the Company’s website by means of the so-called conver-sion tag. These data may be used by the Company to determine the search phrases in case of which the Company’s advertisements were clicked particularly frequently and advertisements that led to us-ers contacting the Company using a contact form.
| Supplier designation | Transfers to a third country | Third country |
|---|---|---|
| Google Ireland Limited, Gordon House 4 Barrow Street Dublin, D04 E5W5 Irelan | Yes | USA |
| Categories of data concerned | Purpose of processing | Legal basis for processing |
|---|---|---|
| Technical data such as: oper-ating system used, browser type and version, device (smartphone, tablet, etc.), date and time of accessing the website, etc. | Display of advertisements for customer segments | point (a) of Article 6(1) of the GDPR |
| User behavior data | Display of advertisements for customer segments | point (a) of Article 6(1) of the GDPR |
3. Facebook (currently Meta)
As part of user-based online advertising, Masterlease Group Websites also use products made availa-ble by Meta Platforms Ireland Ltd. (refers to Facebook platform).
By user-based adaptation of online advertising, it is possible to define target groups of users who will see advertisements on the Facebook network. Facebook selects users on the basis of profile infor-mation provided by them, as well as based on other data transmitted when using Facebook. When the user clicks on the advertisement and then is redirected to the Company’s website, Facebook receives information that the user clicked on the advertising banner using an integrated Facebook pixel on the Company’s website, as well as the Facebook API conversion. As a general rule, this generates an irre-versible and non-personal hash from user data that is transferred to Facebook for analytical and mar-keting purposes. To this end, a Facebook cookie is set. It collects information about activities on the Websites (e.g. about the behavior when browsing the Website, about the pages visited, etc.). Addition-ally, the user IP address is saved and used to display advertisements for specific locations.
In case of granting consent to the aforementioned data processing, Facebook will also have access to the data. In particular, apart from Meta Platforms Ireland Limited, Meta Platforms Inc. may also have access to user data.
Please note that Facebook may use data pertaining to the user’s behaviors made available by the Company, as well as the user’s email address, for its own purposes. Consent to Facebook targeting may be withdrawn via the Masterlease Group Websites.
| Supplier designation | Transfers to a third country | Third country |
|---|---|---|
| Meta Platforms Ireland Lim-ited 4 Grand Canal Place Grand Canal Harbour, Dublin 2 DUBLIN, 2 Ireland | Yes | USA |
| Categories of data concerned | Purpose of processing | Legal basis for processing |
|---|---|---|
| Technical data such as: oper-ating system used, browser type and version, device (smartphone, tablet, etc.), date and time of accessing the website, etc. | Display of advertisements for customer segments | point (a) of Article 6(1) of the GDPR |
| Data related to user behavior | Display of advertisements for customer segments | point (a) of Article 6(1) of the GDPR |
4. YouTube
Websites of the Masterlease Group use tools provided by YouTube that store functional cookies. YouTube cookies, among other things, record a unique identifier for the purpose of statistics on what videos the user watched on YouTube.
| Supplier designation | Transfers to a third country | Third country |
|---|---|---|
| Google Ireland Limited, Gordon House 4 Barrow Street Dublin, D04 E5W5 Irelan | Yes | USA |
| Categories of data concerned | Purpose of processing | Legal basis for processing |
|---|---|---|
| Data to estimate user capacity on websites with embedded YouTube videos. | Display of advertisements for customer segments | point (a) of Article 6(1) of the GDPR |
| Data related to the behavior of users of the website | Display of advertisements for customer segments | point (a) of Article 6(1) of the GDPR |
§ 9
Data sharing
1. The Company of the Masterlease Group, which is the Controller, may make personal data avail-able to other companies of the Masterlease Group, within the framework of the signed agree-ments, in order to enable users to use the same services at any place.
2. The Masterlease Group company, which is the Controller, may make personal data available to other entities, i.e.:
a) PKO Bank Polski S.A. (“Bank”) and in particular PKO Leasing S.A. (PKOL) with its registered office in Warsaw, to pursue legitimate interests of the Company, the Bank and PKOL, result-ing from the rights of the parties to exchange information aimed at preventing fraud or at ef-fective risk management within the capital group of the Bank, in connection with the gener-ally applicable regulations. As a result of making the data in question available by the Com-pany, the Bank/PKOL will become an independent controller and will process the data for the purposes indicated in this section. The principles of data processing by the Bank/PKOL and your rights arising therefrom are described on the website of the Bank/PKOL in the data protection (GDPR) tab;
b) in case of granting consent to the use of cookies for marketing purposes by entities of the PKO Bank Polski S.A. Capital Group (the current list is available at pkobp.pl) in relation to the preparation of their offer or organization of marketing campaigns.
3. In justified instances, the Company of the Masterlease Group may entrust the processing of data to other entities, in accordance with applicable laws.
4. In order to execute the transaction, the Company of the Masterlease Group may share the per-sonal data of users with dealers, entities providing maintenance, repair and painting, insurance, logistics and marketing services, which shall process these data on behalf of the Company of the Masterlease Group in order to implement the agreement, subject to appropriate security measures.
5. The Company of the Masterlease Group may disclose anonymized data (i.e. those that do not identify specific users) to third-party service providers, trusted partners or research agencies in order to improve the overall quality and efficiency of services provided by the Controller or the above entities, or else to participate in scientific research of wide-ranging social benefit.
6. The Company of the Masterlease Group may, if legally permissible, transfer the personal data of users to courts, law enforcement authorities, regulatory authorities or law firms if this is neces-sary to ensure legal compliance or the establishment, exercise or defense of legal claims.
§ 10
Data storage period
1. The Company of the Masterlease Group shall store personal data of users of the websites for the period necessary to achieve the purposes for which the data were collected or for which they are processed or for the period necessary to secure the legal interests of the Company of the Mas-terlease Group.
2. The Company of the Masterlease Group shall store personal data to the extent necessary to en-sure compliance with applicable laws.
§ 11
Security
1. The Company of the Masterlease Group has implemented reasonable, adequate business, eco-nomic, physical, technical and organizational measures to protect personal data against acci-dental or illegal destruction or accidental loss, alteration, unauthorized disclosure or access and any other forms of illegal processing.
2. The Company of the Masterlease Group has implemented appropriate policies and procedures for the protection of personal data and IT infrastructure.
3. The Company of the Masterlease Group manages personal data in accordance with internal se-curity and privacy requirements.
4. Methods of contact with the Personal Data Officer:
a) by e-mail to: iodo@masterlease.pl;
b) by post to the address: ul. Polanki 4, 80-308 Gdańsk.
§ 12
Control by the website user
1. The Company of the Masterlease Group shall ensure the exercise of rights of natural persons, on terms described in the procedure on the exercise of rights of natural persons and the process in the case of security breaches concerning the processed personal data, as available at masterlease.pl.
2. In particular, the Company of the Masterlease Group shall ensure that each Website user:
a) has the right to resign from any previously requested advertising information received from the Company of the Masterlease Group (newsletters, e-mails containing commer-cial information);
b) has the right to request deletion of information about the given data subject from the da-tabase of the Company of the Masterlease Group;
c) has the right to suspend information sent by electronic mail or otherwise;
d) has the right to withdraw the given consent at any time;
e) has the right to modify their personal data provided to the Company of the Masterlease Group at any time.
3. The user who will exercise their right to object should log out of all devices and delete cookies.
§ 13
Final provisions
The privacy policy of the Masterlease Website may be amended as a result of the development of the Internet technology, potential amendments to the personal data protection law and the devel-opment of the Website.