Privacy Policy

Data Protection Notice

Alphabet Polska Fleet Management Data Protection Information

The expectations of our potential and existing customers as well as other users of vehicles under contract with us as high standards of our services are the main guideline of our activities, which aim to establish and maintain lasting business relationships. One of the most important aspects of these relationships is the preservation of the confidentiality and integrity of the personal data we process. The purpose of this “Data Protection Notice” clause is a description of our actions in ensuring compliance with applicable data protection standards.

For the purposes of this clause, terms such as “personal data”, “data controller”, “processing” and “controller” will have meanings such as those adopted in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation; hereinafter referred to as 'GDPR').

Changes to our Data Protection Notice

Alphabet may modify or update this clause as necessary to reflect customer feedback and changes to our products and services. If we make changes, we will also update the “last update” date at the top of this page. In case of material changes to a clause or in how Alphabet processes your personal data, we will notify you by posting a notice of such changes before they occur or by sending a notification directly. We encourage you to browse this page regularly to learn more about how Alphabet Poland uses and protects your personal information.

From the sections below, you will learn how we collect, process and use personal information of our customers and potential customers.

Date of last update: 22 October 2024.

Who is responsible for the processing of personal data?

The controller of your personal data provided in connection with cooperation with us in for the needs of: using the vehicle covered by our services, using our websites or provided in the form available on these websites is Alphabet Polska Fleet Management Sp. z o.o. z o.o. z registered office at Wołoska 22a Street, 02-675 Warsaw, entered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, XIII Commercial Division of the National Court Register, under number 0000032610 having NIP 5262544241, with capital Company 75 189 500,00 zł (hereinafter referred to as: Alphabet Polska).

By clicking on the links on the Alphabet Polska website, you may be redirected to third party websites or services and thus outside any indirect or direct control of Alphabet Polska, in which the processing process, including collection personal data is carried out in accordance with the principles set out by these entities, e.g. in the privacy policy applicable to these services or applications.

What personal data does Alphabet Polska process and collect?

Alphabet Polska processes the following information about you:

which you provide in order to conclude an agreement with Alphabet Polska in the form on our website, in the claim form or in response to our activities in the field of direct marketing or satisfaction surveys with our services: i.e. name, surname, company, job, email address, telephone number, registration number vehicle, information about driving rights, information from the damage event, feedback on our services, the content of the request or inquiry, as well as data obtained from you as a result of the execution of your request or inquiry
obtained from third parties, which are: an insurance company providing information about the method or extent of elimination of the damage, the vehicle supplier providing information about the place and date of delivery of the vehicle, our partner who performs the service concerning the operated vehicle covered by the contract with us , a body shop arranging to repair the vehicle after it has been damaged. These entities provide us with the following data: name, surname, company, position, e-mail address, telephone number, vehicle registration number, how to deal with damage and repair, place and time of collection of the prepared vehicle, location of the vehicle (if a GPS system has been installed) in the situation of reporting theft or necessity of redress, information contained in the content of the inquiry or request.

Where does the personal data processed by Alphabet Polska come from?

Alphabet Polska processes the personal data provided directly by you, provided by your employer in connection with the execution of a lease agreement (or any other contract that connects us with your employer) or the liquidation of damage relating to the vehicle covered by the contract, as well as received from third parties such as importers, vehicle distributors, car repair shops, insurance undertakings.

Transfers of data to third countries (outside the EEA) and how they are protected

The data may be transferred by entities acting on behalf of Controller to further entities with headquarters outside the European Economic Area, in particular in the United States of America. The data controller has exercised due diligence to ensure appropriate data security regardless of the place of processing. Detailed information regarding data transfers outside the European Economic Area is provided by the data protection officer.

How does Alphabet Polska process your personal data?

Your personal data will be processed for the purpose of communication in connection with the sending of: request for quotation, complaints, questions regarding the ongoing operation of vehicles covered by contract with us, inquiries about authorization to leave abroad, questions about delivery or collection of the vehicle, damage notification, the purpose of performing activities as a result of the submitted questions, the vehicle user satisfaction survey, in order to fulfil your agreement with Alphabet Polska, in order to market Alphabet Polska's own products and services (in particular for direct marketing, in traditional by letter form, as well as by e-mail and telephone [provided that you express appropriate consents to the use of your e-mail address or telephone address]) and for analytical, statistical, archival purposes, accounting for the performance of data processing obligations personal, exercise or defense of claims, based on a legitimate interest and, where necessary, also on consent.

Alphabet Polska also uses the Matomo service provided by InnoCraft Ltd. Matomo uses cookies, which are in the form of text files installed on the hard drive of your terminal device, to enable users to analyze how this website is used. The information generated by this type of cookie (including IP address) is collected and stored by Matomo on servers located in the European Union in order to assess the use of the website. Based on this data, activity reports are created for the needs of site administrators.

Detailed information on the processing of personal data in connection with the use of cookies can be found in the Cookie Policy.

Providing data is a requirement of Alphabet Polska only to the extent necessary to enable you to contact Alphabet Polska and submit your inquiry or request or conclude and perform the contract. If you do not provide us with your data enabling you to contact you, Alphabet Polska will not be able to comply with your request or request. To the rest, the provision of data is voluntary.

Data will not be subject to profiling within the meaning of Article 4 (4) of the GDPR.

Legal basis for processing personal data

We only process your personal data if this is in accordance with applicable law. Below we cite the purposes and legal bases of data processing, which are only a sample list:

Consent (Article 6 (1) (a) and Article 7 of the GDPR) — only if you have given your consent voluntarily and through your active action. You may revoke your consent at any time, however, this cancellation does not affect the lawfulness of the processing of personal data that took place before its cancellation.
Execution of the contract/taking actions aimed at the performance of the contract (Art. 6 par. 1 lit. b) of the GDPR).
Implementation of obligations imposed on Alphabet Polska by applicable law (Art. 6 para. 1 lit. c) of the GDPR), in particular obligations arising from the Tax Code Act, the Accounting Act, provisions on sanctions.
Pursuing the legitimate interests of Alphabet Polska (Art. 6 para. 1 lit. f) — in particular to respond to your inquiry, improve the quality of services provided, marketing Alphabet Polska's own products and services, detect fraud, anti-money laundering and terrorist financing, redress, enforcement of rights of Alphabet Polska. Processing on this basis is carried out after considering the interests and fundamental rights and freedoms enjoyed by you in each individual case.

Who does Alphabet Polska share your personal data with?

Alphabet Polska may transfer your personal data to entities carrying out their own tasks or related to the performance of contracts concluded by Alphabet Polska, i.e. car repair shops, depository companies, logistics companies, insurance agents, IT service providers, marketing service providers and car dealers cooperating with Alphabet Polska, which Alphabet Polska uses in the performance of contracts, on the basis of separate contracts concluded in writing, and also to entities from the BMW Group for internal administrative purposes of the Group BMW. In any case, Alphabet Polska makes data available to third parties only if they have a legal basis for processing them, e.g. in connection with vehicle insurance in a given insurance company.
Alphabet Polska may also transfer your personal data to entities carrying out public tasks (in the scope of performing these tasks), in those situations where such obligation will result from the law.
With your prior consent, Alphabet Polska will also be able to share personal data with BMW Group entities for marketing purposes of these entities, including the presentation of products and services offered by these entities.

What rights do you have in relation to data processing by Alphabet Polska?

You have the following rights under the GDPR:

the right to access data (Article 15 of the GDPR),
the right to rectification of data (Article 16 of the GDPR),
the right to erase data (Article 17 GDPR),
the right to restrict data processing (Article 18 of the GDPR),
the right to data portability (Article 20 of the GDPR),
the right to object to data processing (Article 21 GDPR),
the right to withdraw consent to data processing (Article 7 (3) of the GDPR).

You may exercise these powers when:

with regard to the request to rectify data: the data is incorrect or incomplete;
with regard to the request for deletion: the data is no longer necessary for the purposes for which they were collected by Alphabet Polska; you withdraw your consent to the processing of data; you object to the processing of these data beforehand; the data is processed unlawfully; should be removed in order to comply with the obligation under the law;
in relation to the request to restrict data processing: the data is incorrect — for the period allowing Alphabet Polska to check the accuracy of your data; the data is processed unlawfully, but you will not want them to be deleted; Your data is no longer needed Alphabet Polska, but you may need to defend or pursue claims; or you object to the processing of data — until you determine whether legitimate grounds override the grounds of objection;
in relation to the request for data transfer: the processing is carried out on the basis of your consent or contract concluded with you and this processing is carried out automatically.

If it is considered that the data processing by the Controller violates the provisions of the GDPR, you have the right to lodge a complaint with the supervisory authority, i.e. the President of the Office for Personal Data Protection with its registered office in Warsaw (00-193) at Stawki 2 Street.

Where do the personal data processed by Alphabet Polska come from?

Alphabet Polska processes the personal data provided directly by you, provided by your employer in connection with the execution of a lease agreement (or other agreement connecting us) or elimination of damage relating to the vehicle covered by the contract, as well as received from third parties such as importers, vehicle distributors, car repair shops, insurance companies in the scope specified in the section “What personal data does Alphabet Polska process and collect?” above.

How does Alphabet Polska protect your personal data?

Alphabet Polska uses various tools to ensure the security of your personal data, such as encryption or verification tools in accordance with the current state of the art, to protect and maintain security, integrity and access to data.

We cannot guarantee 100% protection against unauthorized access in the event of data transfers over the Internet and within the website, but we can assure you that we, as well as our partners and service providers, make the utmost effort to protect your personal data, in consent applicable data protection rules, by physical, electronic and other processing security measures resulting from the current state of the art. Among other things, we use:

authorization of access to your data in accordance with the principle of “need-to-know” (i.e. access based on the principle of necessary knowledge,
Firewall IT protection system to provide protection against unauthorized access, for example by hackers,
constant monitoring of access to IT systems, in order to detect and prevent misuse of personal data.

If you have received a password from us and have access to certain areas of our website or other portals, applications, services at our disposal, you are responsible for maintaining the confidentiality of your password and compliance with all procedures security with which you have been acquainted with by us, in particular, we ask you not to transfer your password to third parties.

How long will Alphabet Polska process your personal data?

Your personal data will be processed as long as between Alphabet Polska and you or Alphabet and the entity from whom he received your personal data (in particular the employer or the principal) there will be a legal relationship.

After the termination of this relationship, Alphabet Polska will process your personal data for as long as the relevant legal provisions permit, in particular imposing obligations in the field of retention of tax and accounting records and in the scope of limitation of claims.

Alphabet Polska will also take into account the expectations of the competent data protection authority when determining the data processing period.

How can you contact Alphabet Polska?

Alphabet Polska has appointed a Data Protection Officer - Aleksandra Chrzanowska, e-mail address: daneosobowe@alphabet.pl.

The Administrator has also appointed a Deputy Data Protection Officer, who can be contacted at the same e-mail address. In order to exercise your rights in accordance with the above information, including the withdrawal of consents to the processing of personal data, and in any matters related to the processing of personal data, please contact Alphabet Polska at +48 22 820 55 55 or e-mail address: kontakt@alphabet.pl or with the Data Protection Officer at +48 22 820 56 01 or e-mail address: daneosobowe@alphabet.pl.

Below you will find detailed information on the processing of personal data in connection with the entry into force of the Act of 14 June 2024 on the protection of whistleblowers.