Privacy Policy

§1. Data Controller

The controller of your personal data is Jan Wojciechowski, conducting business under the name Central Parking P66, ul. Elizy Orzeszkowej 6b, 05-822 Milanówek, Poland, NIP (tax ID): 529 186 78 11.

Contact: biuro@centralparking.pl | Tel: +48 690 49 19 19

§2. What Data We Collect

In connection with the provision of parking services, we collect the following personal data:

• First and last name
• Technical data (server logs) — IP address, browser type and version, date and time of visit, pages visited. Collected automatically by the hosting server (home.pl); legal basis: Art. 6(1)(f) GDPR (legitimate interest — security and technical diagnostics).
• Phone number
• Email address
• Vehicle registration number
• Date and time of reservation
• Flight number (required to coordinate airport transfer)
• Payment data (processed by an external payment system — we do not store card details)

§3. Purpose and Legal Basis of Processing

We process your data for the following purposes:

• Performance of contract (Art. 6(1)(b) GDPR) — processing reservations and transfers
• Legal obligation (Art. 6(1)(c) GDPR) — fulfilment of tax and accounting obligations
• Legitimate interest (Art. 6(1)(f) GDPR) — site security (CCTV monitoring), customer communication
• Consent (Art. 6(1)(a) GDPR) — marketing, if you have given consent

§4. Who We Share Data With

Your data may be shared with:

• parksystem.online — reservation system embedded on the /en/reservation/ page; processing of parking reservations
• Payment service providers (Przelewy24, PayU, Stripe) — payment processing
• Insurance companies — third-party liability (OC) insurance handling
• Google Ireland Limited / Google LLC — web analytics (Google Analytics 4); details in §7
• home.pl S.A. (ul. Zbożowa 4, 70-653 Szczecin, Poland) — hosting provider; server logs and website files are stored on home.pl servers located in Poland. A Data Processing Agreement (Art. 28 GDPR) is in place with home.pl S.A. Data is not transferred outside the EEA.
• Public authorities — only as required by applicable law

We do not sell your personal data to third parties.

§5. How Long We Retain Data

• Reservation data — 5 years from the end of the reservation (tax requirements)
• Contact data — until consent is withdrawn or the business relationship ends
• CCTV recordings — 30 days
• Vehicle photo documentation — 30 days after the end of the reservation

§6. Cookies

The centralparking.pl website is a static site and does not set its own cookies. Cookies may appear only after you give consent in the cookie banner — they then come from embedded third-party services. Without consent none of these services load, and the site works normally.

Services that set cookies (consent required):

• Functional — reservation & pricing system (parksystem.online)
  On the /en/reservation/, /en/pricing/ and /potwierdzenie/ pages, parksystem.online widgets are embedded. After you give consent, parksystem.online sets its own cookies: technical (form session token, CSRF protection) and PostHog analytics (e.g. ph_phc_*_posthog) used to analyse widget usage. These cookies are set by a third party. Legal basis: Art. 6(1)(a) GDPR (consent).
• Functional — Google Maps
  On the /en/location/ page and the home page, a route map is embedded. After you give consent, Google may set its own cookies. Legal basis: Art. 6(1)(a) GDPR (consent).
• Analytics — Google Analytics 4
  Only with your consent. Details in §7.

You can change or withdraw your consent at any time — click “Cookie settings” in the site footer. Withdrawing consent reloads the page and disables the given service. You can also delete cookies in your browser settings. Deleting parksystem.online cookies during a reservation may prevent you from completing it.

§7. Google Analytics 4 — Analytics Tool

Our website uses the Google Analytics 4 (GA4) service provided by:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (data processor for EEA users)
• Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (parent company)

What Google Analytics 4 Collects

GA4 processes pseudonymous data, including:

• User identifier (generated by GA4, not linked to personal data)
• IP address — anonymised by Google before storage (last octets truncated)
• Device and browser information (type, version, screen resolution)
• Operating system
• Approximate location (country, city — based on truncated IP, no precise geolocation)
• Traffic source (referrer, UTM parameters)
• Pages visited, session duration, interaction events (clicks, scrolling)

GA4 does not collect name, surname, email address or phone number via the analytics script.

GA4 Cookies

• _ga — identifies unique users; expires after 2 years
• Google Analytics 4 ID — stores session state; expires after 2 years

Legal Basis and Consent

Data processing by GA4 takes place solely on the basis of your freely given consent (Art. 6(1)(a) GDPR). GA4 analytics cookies are activated only after consent is given in the cookie banner. You may withdraw your consent at any time — simply delete GA4 cookies in your browser settings or use the opt-out options below.

Data Transfer to the USA — Legal Mechanism

Google LLC is certified under the EU–US Data Privacy Framework (European Commission Implementing Decision of 10 July 2023, C(2023) 4745). The transfer of data to the USA takes place on the basis of Art. 45 GDPR (adequacy decision). The current list of certified organisations is available at: dataprivacyframework.gov.

An additional safeguard is provided by the Standard Contractual Clauses (SCC) adopted by the European Commission, incorporated into Google's data processing terms.

How to Opt Out of GA4 Tracking

• Install the Google Analytics Opt-out Browser Add-on
• Delete _ga and _ga_* cookies in your browser settings and do not consent again
• Google Ads settings: myadcenter.google.com

Google Privacy Policy: policies.google.com/privacy

§8. Your Rights (GDPR)

Under the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR) — you may request a copy of your data
• Right to rectification (Art. 16 GDPR) — you may correct inaccurate data
• Right to erasure (Art. 17 GDPR) — "right to be forgotten"
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR) — to processing based on legitimate interest
• Right to withdraw consent (Art. 7(3) GDPR) — at any time, without affecting the lawfulness of processing prior to withdrawal

We will respond to your request without undue delay and no later than one month from receipt (Art. 12 GDPR).

To exercise any of these rights, contact us: biuro@centralparking.pl

§9. Data Security

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, modification, disclosure or destruction. Data is transmitted using encrypted SSL/TLS connections. Access to data is restricted to authorised persons bound by confidentiality obligations.

§10. Complaints

You have the right to lodge a complaint with a supervisory authority. In Poland, the competent authority is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl. You may also contact the supervisory authority in your country of residence.

§11. Changes to This Policy

We reserve the right to amend this Privacy Policy. We will notify you of significant changes by email or via a notice on the website. The current version is always available at Privacy Policy.