Privacy Policy

1. Data Controller

The controller of personal data provided by you is GearCode Sp. z o.o., ul. Wiejska 1, 25-319 Kielce, tel. 41 201 07 55.

If you have provided us with personal data of your employees or associates, please note that this information clause also applies to them and should be made available to them by you.

2. Basic principles of data processing

The Controller declares that personal data is processed in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: GDPR), and in accordance with the Act on Personal Data Protection of 10 May 2018 (Journal of Laws 2018, item 1000).

3. Purposes and legal bases for processing personal data

Your personal data will be processed for the purpose of:

• a. concluding and performing the contract,
• b. providing services under the concluded contract or consent granted,
• c. fulfilling obligations arising from generally applicable laws,
• d. handling correspondence and customary forms of contact in current matters, including electronic communication and responding to enquiries submitted via electronic forms on the website www.gearcode.eu,
• e. financial and accounting services,
• f. archiving documentation,
• g. arising from the legitimate interests pursued by GearCode Sp. z o.o., in particular for the purpose of establishing, pursuing and defending mutual claims,

pursuant to Article 6(1)(a), (b), (c) and (f) GDPR.

4. Legal provisions forming the basis for processing

The Controller processes personal data on the basis of, inter alia, the following provisions:

• a. Act of 6 March 2018 – Entrepreneurs' Law, consolidated text, Journal of Laws 2023, item 221, as amended,
• b. Act of 13 October 1995 on the rules for registration and identification of taxpayers and remitters, consolidated text, Journal of Laws 2022, item 2500, as amended,
• c. Regulation of the Minister of Finance of 29 October 2021 on the issuance of invoices, Journal of Laws 2021, item 1979,
• d. Act of 14 June 2024 on the protection of whistleblowers, Journal of Laws 2024, item 928.

5. Scope of processed personal data

The Controller processes the following personal data: first name, last name, company name, business address, correspondence address (if applicable), NIP (tax identification number), data concerning the value of financial transactions.

6. Period of personal data processing

Your personal data will be processed for the duration of the contract, and thereafter for 5 years from the end of the calendar year in which the contract expired/was terminated, or until the expiry of mutual claims arising from the concluded contract, in accordance with generally applicable law.

Personal data from electronic contact forms will be processed for the period necessary to conduct the communication.

7. Recipients of personal data

Your personal data will be disclosed only on the basis of applicable law to authorised entities and authorities, and may also be entrusted to external entities providing services to GearCode Sp. z o.o., such as accounting, legal, IT, marketing and security services, solely on the basis of appropriate data processing agreements.

We share only the minimum scope of information and only when it is necessary.

8. Transfer of data outside the European Economic Area

Personal data collected from you will not be processed outside the European Economic Area.

9. Rights of data subjects

Please be advised that, depending on the legal basis for processing personal data, you have the following rights:

• a. the right to access your data, receive a copy thereof and to have it rectified,
• b. the right to erasure of data – if, in your opinion, we cannot process it,
• c. the right to restriction of processing – if, in your opinion, we hold inaccurate data or process it without justification, but you do not wish us to delete it because you need it to establish, pursue or defend claims, or when your objection is being considered, you have the right to demand that we restrict processing to storage or the performance of other operations agreed with you,
• d. the right to object to the processing of data for direct marketing purposes; upon submitting such an objection, we will cease processing data for that purpose,
• e. the right to object, due to your particular situation, to the processing of data for the purposes of our legitimate interests, under the conditions described above (other than direct marketing), and also when processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us. In such a case, please state your particular situation justifying our ceasing the processing covered by the objection. We will stop processing your data for those purposes, unless our grounds for processing override yours or processing is necessary for the establishment, pursuit or defence of claims,
• f. the right to data portability – i.e. the right to demand that your data be provided to you in a structured, commonly used format, as well as the right to request that we transmit it directly to another designated entity,
• g. the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office, at: Urząd Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, or another competent authority,
• h. the right to withdraw, at any time, any consent to the processing of personal data that we process on the basis of your consent. This does not, however, affect the lawfulness of processing carried out prior to the withdrawal of consent.

To exercise the above rights, please contact us by email at: [email protected], in writing to the Controller's registered address, or in person at GearCode Sp. z o.o., ul. Wiejska 1, 25-319 Kielce.

Before fulfilling our obligations, we will need to verify your identity.

10. Voluntary nature of providing data

Providing your personal data is voluntary and results from the concluded contract and the business cooperation, and the consequence of failing to provide data may be a partial or total inability to perform the contract by GearCode Sp. z o.o.

11. Profiling and automated decision-making

Your personal data will not be used for profiling or for making automated decisions in relation to you.

12. Contact regarding personal data

Regarding your personal data, you may contact us by sending a message to [email protected] or by post to: GearCode Sp. z o.o., ul. Wiejska 1, 25-319 Kielce.

1. What are cookies?

A 'cookie' is a small text file that a website saves to the computer or mobile device of a visitor when they browse it. In this way, the website can remember the visitor's actions and preferences for a period of time, such as username, language, font size and other display preferences, so the visitor does not have to re-enter them every time they return to the site or navigate from one page to another.

Source: https://europa.eu/european-union/abouteuropa/cookies_pl

2. What are cookies used for?

Cookies are computer data, in particular text files, stored in the end device of a website user.

• adapting the content of websites to the user's preferences and optimising the process of using websites – in particular, these files allow the user's device to be recognised and the website to be displayed in a manner tailored to their individual needs,
• creating statistics that help understand how users use websites, which makes it possible to improve their structure and content,
• maintaining the user's session after logging in, so that the user does not have to re-enter their login and password on each subpage of the website,
• delivering advertising content more tailored to users' interests.

Cookies are most commonly used to optimise the process of using websites. They are also used to collect statistical data that helps identify how users use websites, making it possible to improve their structure and content at a later stage.

Cookies may be used for:

3. How do we use cookies?

Cookies are most commonly used to optimise the process of using websites. They are also used to collect statistical data that helps identify how users use websites, making it possible to improve their structure and content.

Cookies can be divided into, among others, session cookies (temporary) and persistent cookies.

Session cookies are stored on the user's device until they log out of the website or close the web browser.

Persistent cookies are stored for a defined period of time, which is determined by a parameter contained in the cookie file. The user also has the option to manually delete all or selected cookies.

We also use third-party cookies from providers such as: Google, YouTube, Facebook.

4. Opting out of cookies

You can disable cookies at any time, as well as delete them using the appropriate settings in your browser.

Detailed information can be found in your browser's help section.

1. Roles of controller and processor

With respect to AI.Assistant provided directly by GearCode — including on the website www.gearcode.eu and in the demonstration automotive catalogue at catalog-gearcode.eu — the data controller is GearCode Sp. z o.o. The provisions of this chapter complement the information clause set out in Chapter I of this policy.

With respect to AI.Assistant embedded in GearCode products deployed at customer sites (in particular GC.Platform), the data controller is the GearCode customer, and GearCode acts as data processor pursuant to Article 28 GDPR. The detailed terms of processing are governed by the data processing agreement concluded with each such customer. This chapter sets out GearCode's standing policy principles applicable to those deployments.

2. No-training principle for artificial intelligence models on your data

The contents of conversations with AI.Assistant — regardless of the channel in which you use it — are not and will not be used to train or fine-tune any artificial intelligence models, whether models proprietary to GearCode's suppliers or publicly available models.

GearCode uses only those providers of language models that have contractually undertaken not to use the conversation contents transmitted to them to train artificial intelligence models. We apply this principle consistently across all deployments of AI.Assistant.

3. Purpose of processing and legal basis

We process the contents of conversations in order to respond to user enquiries and to develop and improve the quality of the AI.Assistant service.

With respect to AI.Assistant provided directly by GearCode, the legal basis for processing is Article 6(1)(f) GDPR — the legitimate interest of the controller in handling enquiries from visitors to the website and developing the service offered.

With respect to AI.Assistant deployed at GearCode customers, the legal basis for processing is determined by the customer as data controller. GearCode, acting as processor, processes data solely on the documented instructions of the controller.

4. Recipients of data and place of processing

We transmit the contents of conversations to external providers of language models, who act towards GearCode as processors on the basis of data processing agreements meeting the requirements of Article 28 GDPR.

The contents of conversations and the data associated with them are processed exclusively within the European Economic Area — in accordance with the principle set out in point I.8 of this policy.

The contents of conversations may be periodically reviewed by a designated team at GearCode Sp. z o.o. solely for the purpose of assessing the quality of AI.Assistant and introducing improvements to the service. Access to the contents of conversations is limited to a narrow group of authorised employees, in accordance with the principle of least privilege.

5. Nature of the interaction with the AI system and automated generation of responses

Please be informed that AI.Assistant is an artificial intelligence system and that the responses it provides are generated automatically by a language model. This information satisfies the obligation set out in Article 50(1) of Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 (AI Act).

The automated generation of responses by AI.Assistant does not constitute automated decision-making producing legal effects concerning you or similarly significantly affecting you within the meaning of Article 22 GDPR.

You may contact a GearCode employee at any time through the contact channels indicated on the website www.gearcode.eu.

6. Retention period

We retain the contents of conversations conducted via AI.Assistant provided directly by GearCode for the period necessary to achieve the purposes set out in point 3, and in any event no longer than 36 months from the end of the conversation.

With respect to AI.Assistant deployed at GearCode customers, the retention period is determined by the data controller (the customer) and governed by the data processing agreement.

7. Recommendations regarding the content of conversations and rights of data subjects

We ask that you do not enter into AI.Assistant conversations any special categories of personal data within the meaning of Article 9 GDPR — in particular data concerning health — or personal data of third parties. If such data are nevertheless entered, they will not be used for purposes other than responding to the enquiry.

The rights of data subjects set out in point I.9 of this policy apply equally to processing within AI.Assistant provided directly by GearCode. With respect to deployments of AI.Assistant at GearCode customers, those rights are exercised through the data controller (the customer), in accordance with the data processing agreement.

8. Vehicle identification in automotive catalogues

In our automotive catalogues — including the demonstration version available at catalog-gearcode.eu — AI.Assistant enables vehicle identification based on the registration number or VIN. In countries where there is no access to public registries enabling such identification, we use our own GearCode identification database.

This database is built by AI.Assistant users. Before each new entry, AI.Assistant asks the user for a conscious confirmation of linking the registration number or VIN to a specific vehicle. Without such confirmation, the entry is not added to the database — the user may refrain from the linkage at any time.

The database contains only technical vehicle data (including registration number, VIN, make, model, parameters) and is not associated with personal data of vehicle owners or users. GearCode does not take actions aimed at associating this data with any specific natural person.

The shared identification database is maintained exclusively for catalogues provided under a GearCode subscription in a shared (multitenant) model. Clients using a dedicated subscription have full data separation in this regard — their vehicle identifiers are not combined with the shared database.

The legal basis for processing in the vehicle identification database is Article 6(1)(f) GDPR — the legitimate interest of the controller in providing and developing the automotive catalogue service. Each entry addition is consciously confirmed by the user, and the database itself is not linked to any specific natural persons — therefore the processing has minimal impact on the rights and interests of natural persons. Data in the database is retained indefinitely, for as long as it serves the purpose of operating the catalogue.

Given the absence of linkage between the database content and any specific natural person, the realisation of the right to erasure (Article 17 GDPR) is limited with respect to this database — we are unable to identify which entry relates to a given person. In case of any doubts, please contact us at [email protected].