Privacy policy

1. Controller

The data controller is GoatSystem IT, tax ID 6762569813. For personal data matters write to kontakt@goatsystemit.pl.

2. What data we process

Vehicle data from public auctions: VIN, description, damage, mileage, price, place and date of sale, and photos. A VIN identifies a vehicle rather than a person, but combined with other information it may make it possible to identify the owner, so we treat it as personal data.

Data of removal service Customers: e-mail address, VIN, and payment information passed on by Stripe (no card details).

Data from GDPR requests: VIN, e-mail address, optionally name, and the content of the request.

Technical data: server logs (IP address, time, page address) kept for up to 30 days for security.

Statistics data, only if you consent to statistics: identifiers from Google Analytics cookies, pages visited, visit time, device and browser type, and approximate location (country, city) derived from your IP address. Google Analytics 4 does not store the full IP address.

3. Purposes and legal bases

Publishing the auction archive: the legitimate interest of the controller and users in access to vehicle history information (Article 6(1)(f) GDPR).

Performing the paid service: contract (Article 6(1)(b) GDPR). Billing and accounting: legal obligation (Article 6(1)(c) GDPR).

Handling GDPR requests and complaints: legal obligation and legitimate interest (Article 6(1)(c) and (f) GDPR).

Visit statistics (Google Analytics), to learn how you use the Site and what to improve: your consent (Article 6(1)(a) GDPR). You can withdraw consent at any time; this does not affect the lawfulness of processing before withdrawal.

4. Recipients

Data may be received by providers who help us run the Site: hosting and server infrastructure, and Stripe (payments). Stripe may transfer data outside the European Economic Area under standard contractual clauses.

If you consent to statistics, Google Analytics data is processed on our behalf by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) as a processor. Data may be transferred to Google LLC in the USA under the EU-U.S. Data Privacy Framework, in which Google participates, and standard contractual clauses.

We do not sell data or share it for marketing.

5. How long we keep data

Vehicle listings: until the listing is removed or an objection is upheld. The VIN of a removed listing stays on the block list so it is not added again.

Order and payment data: for the period required by tax law (5 years from the end of the tax year). GDPR requests: 3 years after the decision, in case of a dispute.

Statistics data in Google Analytics: up to 14 months, after which Google deletes it automatically. Google Analytics cookies expire after at most 2 years, or sooner if you withdraw consent and delete them in your browser.

6. Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability, and to object to processing based on legitimate interest (Articles 15–21 GDPR).

You can request removal of a listing that concerns you free of charge using the form at /data-request. We reply within one month and may ask for information confirming your link to the vehicle, e.g. part of the registration document with unnecessary data covered.

You may lodge a complaint with a data protection authority, in Poland the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).

You can withdraw your consent to statistics at any time, as easily as you gave it (details below).

7. Cookies and browser storage

The Site uses no advertising cookies. Google Analytics (cookies _ga and _ga_*) runs only after you click “Accept” in the cookie banner. Without consent the Google Analytics script is not loaded at all.

Your choice is saved in browser storage (localStorage) under the key vin-analytics-consent with the value granted (consent) or denied (refusal). Apart from that we only store your chosen theme (light or dark) and, while ordering, a technical key that prevents double payment. These need no consent because the Site cannot work without them.

How to withdraw consent: click “Cookie settings” in the page footer and choose “Reject”. Google Analytics stops working as soon as the page reloads. You can delete existing _ga cookies in your browser settings. Clearing site data in your browser also removes the saved choice, so the banner appears again.

Stripe's own terms apply on the Stripe payment page, which may include cookies needed for payment and fraud prevention.