Privacy Policy

The controller of your personal data is UNIKAT Motorworks Sp. z o.o., ul. Ppłk. S. Skarżyńskiego 9, 54-530 Wrocław, NIP 894-295-79-14.

Privacy contact and data-subject requests: unikat@1of1.pl

Service enquiry form: name, phone number, motorcycle make, model and mileage, type of request and description, and optionally your email address, VIN, model year, warranty status and preferred contact method, together with the language and time of the enquiry. The form does not accept photos or other files.

WhatsApp is a separate, optional channel. Messages and photos you choose to send us via WhatsApp or ordinary email are received directly in those channels, not through the website form.

Spam protection: to block automated or repeated submissions, the form briefly keeps a pseudonymised identifier derived from your IP address with a secret key. The form does not store the IP address itself.

Technical data needed to deliver the website (e.g. IP address and browser type in the hosting provider's server logs).

Statistics: only if you consent to analytics cookies, Google Analytics 4 collects information about your visit (pages viewed, device and browser type, approximate location, and events such as submitting the form or tapping a phone, email or WhatsApp link). Without your consent Google Analytics is not loaded.

Answering a service or custom-build enquiry and preparing a quote or booking at your request — steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).

Answering other messages not aimed at concluding a contract (e.g. general questions, press or cooperation) and keeping enquiry records for the retention period — our legitimate interest in communicating with people who contact us and organising our work (Art. 6(1)(f) GDPR).

Protecting the form against spam and abuse — our legitimate interest in the security of the website (Art. 6(1)(f) GDPR).

Performing service work or a custom build — performance of a contract (Art. 6(1)(b) GDPR).

Accounting and tax obligations — legal obligation (Art. 6(1)(c) GDPR).

Website statistics with Google Analytics — your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the cookie settings without affecting earlier processing.

Establishing, pursuing or defending claims — our legitimate interest (Art. 6(1)(f) GDPR).

Where we rely on legitimate interests, you may object at any time on grounds relating to your particular situation.

Website hosting and form processing: Vercel Inc. (USA), our current hosting provider.

Enquiry database: Supabase, with the database hosted in Ireland.

Delivery of enquiry notifications to our service mailbox: Resend (Plus Five Five, Inc., USA), using its Irish sending region. Resend and some of its sub-processors are based in the USA, so access to or processing of data outside the EEA may still occur.

Email mailboxes: eHost.pl.

Google Analytics: Google Ireland Limited and Google LLC — only with your consent.

WhatsApp / Meta: only if you choose to contact us via WhatsApp; WhatsApp processes that communication under its own terms and privacy policy.

External accounting provider — only to the extent necessary to process invoices and accounting documents and fulfil accounting and tax obligations. The accounting provider does not receive submissions from the service enquiry form and does not have access to the service enquiries database.

Some of these providers are based in the USA or use sub-processors outside the EEA. Where data is transferred outside the EEA, it is protected by the EU-US Data Privacy Framework where the recipient is certified and/or by the European Commission's Standard Contractual Clauses included in the provider's data processing terms. We do not guarantee processing exclusively within the EEA. You can ask about these safeguards at unikat@1of1.pl.

Service enquiries that do not lead to an order: 6 months after the enquiry is closed, after which they are deleted following a documented procedure.

Enquiries that lead to a service order or custom project: for the duration of the contract and then for the periods required by tax and accounting law and until claims are time-barred.

Spam-protection identifiers: entries older than 24 hours are removed.

Enquiry notification emails in our mailbox follow the same periods.

Google Analytics 4: event-level data and user-level data are each retained for 14 months. The reset-on-new-activity option applies to user-level data only. These settings do not govern all aggregated standard Google Analytics reports, so not all analytics data is automatically deleted exactly 14 months after your last visit.

Emails and WhatsApp messages sent outside the form: for as long as needed to handle the matter, and no longer than the periods above.

You have the right to access, rectify, erase and restrict processing of your data, to data portability, to object, and to withdraw consent at any time without affecting prior processing.

You may lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw.

Providing data is voluntary, but required to answer your enquiry or perform the service. We do not use automated decision-making or profiling that produces legal effects.