01 Who processes your data
The data controller is the car workshop ALGO SERVICE, Horodelska 30, 03-522 Warszawa. The site lakiernia.algoservice.eu is the paint and body shop of that same workshop.
For any question about your data, write to [email protected] or call +48 507 808 605 — we answer in Polish, Russian, Ukrainian and English.
02 What data we collect
We collect exactly what we need to get back to you and estimate the repair:
- From the request form: your name and phone number — required; a description of the damage and photos — optional.
- The language of the page the request was sent from — so that we call you back in the language you are comfortable with.
- Technical details of the visit: the page address, where you came from, the approximate time of the visit.
- The IP address the request was sent from — we do not keep it. It is turned into a one-way fold that cannot be read back, and that fold is only used to check whether more than five requests an hour are coming from the same address. It lives for one hour and is then deleted.
- Advertising markers: the gclid and utm_* parameters from the page address, if you arrived through an advert. They are kept in the tab’s memory and are sent along with the request — they tell us which advertising brings in customers.
- Analytics data (Google Analytics 4 and Microsoft Clarity) — only if you pressed “Accept” in the cookie banner.
- If the job becomes an insurance repair — the details without which a claim cannot be settled: policy number, claim number, the car’s registration number and VIN, and the circumstances of the event.
03 Photos of the damage
The form lets you attach up to 8 photos, each up to 10 MB and up to 40 MB in total per request. It is optional, but photos let us assess the scope of the work in advance — you don’t have to drive across town just to get a preliminary answer.
Photos of a damaged car usually show more than the dent itself: the number plate, sometimes the scene of the accident, other cars, passers-by who happened to be there. We are aware of that, and we treat these photos as personal data rather than as pictures.
What we do with them, and what we do not do:
- We show them to the workshop foreman and the person preparing the quote — to nobody else.
- We do not store them on the site’s server at all: they go to the workshop’s working chat on Telegram and live there together with the request.
- We pass them to the insurance company — only if you have asked us to handle your claim: the insurer needs photos of the damage.
- We never publish them in the site gallery, on social media or in advertising. If we ever want to show your car “before and after”, we will ask you separately, and saying no changes nothing.
- We never hand them to anyone for their own advertising, and we never sell them.
- We do not run face recognition on them and do not look up number plates — we have no technology for that and never will.
04 Why, and on what legal basis
- To accept your request, assess the damage from the photos and prepare a quote — Article 6(1)(b) GDPR: steps taken at your request before entering into a contract.
- To contact you by phone or messenger — the same Article 6(1)(b).
- To carry out the repair and settle the claim with the insurance company — Article 6(1)(b): performance of a contract with you.
- To measure how the site and our advertising perform — Article 6(1)(a) GDPR: your consent, given in the cookie banner. You can withdraw it at any time.
- To protect the site from spam and abuse — Article 6(1)(f): our legitimate interest.
- To meet tax and accounting requirements once the work has been paid for — Article 6(1)(c).
05 Passing data to the insurance company
We promise a cashless repair: you don’t chase paperwork, we run the claim for you. In practice that means part of your data goes to the insurance company, and saying so honestly matters more than saying it nicely.
This happens only after you have signed an upoważnienie (a written authorisation for us to handle the claim). Until that authorisation exists, we write not a single line to the insurer: your request and its photos stay with us.
What goes to the insurer once you have authorised us:
- Your first name, surname and contact details, and the car’s details (registration number, VIN, make and model).
- The policy number and claim number, and the circumstances of the event.
- Photos of the damage and our estimate of the cost of the work.
- The correspondence as the case proceeds: the claim notification, arranging the inspection, the calculation, the repair invoice.
06 Who else receives data
We do not sell data and do not hand it to third parties for their own advertising. Access is given only to those without whom the site and the repair would not work:
- The hosting provider, on whose servers the site itself runs. Neither requests nor the photos you send are stored on it.
- Cloudflare — all of the site’s traffic runs through its network: it speeds up loading and shields the site from attacks. Technically, the data you send travels through it too.
- Google Ireland Ltd. — Google Analytics 4 and Google Ads, only after your consent in the cookie banner.
- Microsoft Ireland Operations Ltd. — Microsoft Clarity (heat maps), only after your consent.
- Elfsight — the Google reviews widget in the “Reviews” section. When that section loads, your browser connects to Elfsight and Google servers.
- Telegram — the whole request goes to the workshop’s working chat there and is kept in it: your name, your phone number, the description of the damage and the photos.
- The workshop’s request management system, if it is connected — for the paint shop it is not connected at the moment.
- Suppliers of parts and materials — to the extent needed to order a part for your car.
- Our accountants and the tax authorities — for the documents on paid work, as the law requires.
07 Transfers outside the EEA
Google and Microsoft may process data on servers outside the European Economic Area, including in the United States. Such transfers take place under the European Commission’s standard contractual clauses and within the EU–US Data Privacy Framework.
Telegram — a service of Telegram FZ-LLC — processes data on servers outside the European Economic Area. This concerns you directly: the whole request, photos included, is kept in the chat there, so we would rather say it plainly than leave it buried.
The site itself runs on a server in the European Union (Amsterdam), but no requests and no photos of the damage are stored on it.
08 How long we keep it
- A request, together with its photos, arrives in the workshop’s working chat on Telegram and stays in that conversation until somebody deletes it by hand — nothing there disappears on its own.
- On the site’s own server the request is not kept at all — neither the text nor the photos.
- If you ask us to delete your data, we delete the message with the request and the photos from that conversation.
- Documents on paid work — 5 years, as Polish tax law requires.
- Analytics data — for the retention periods of Google Analytics 4 and Microsoft Clarity, normally up to 14 months.
- Your choice in the cookie banner stays in your browser until you clear the site data yourself. Once you have cleared it, the banner asks again.
09 Your rights
Under the GDPR you have data subject rights, and we are obliged to honour them. An email to [email protected] is enough:
- To find out what data we hold about you and to receive a copy of it.
- To have inaccurate data corrected.
- To have data erased — the “right to be forgotten”. In practice that means we delete the message with your request and the photos from the Telegram chat. You can also ask us to delete only the photos and keep the request itself.
- To restrict the processing or to object to it.
- To receive your data in a machine-readable format and transfer it to another provider.
- To withdraw your consent to analytics at any time — this does not affect the lawfulness of processing carried out before the withdrawal.
- To withdraw the authorisation to handle your claim — after that we stop corresponding with the insurer about your case.
- To lodge a complaint with the supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office), ul. Stawki 2, 00-193 Warszawa.
10 Cookies and browser storage
Before you consent, the site sets no advertising or analytics cookie at all: Google Consent Mode v2 is enabled with everything denied by default. The Google script itself does load straight away, but until you consent it sets no cookie and creates no identifier — all that leaves the page is an anonymous signal that it was opened.
What the site keeps in your browser:
- algo_consent — your choice in the cookie banner. Without it the banner would appear on every page.
- algo_src and algo_ref — the advertising marker and the source of the visit; they live only until you close the tab.
- Google Analytics 4 and Google Ads cookies (_ga, _gcl_*) — set only after you press “Accept”.
- Microsoft Clarity cookies — likewise only after consent.
11 How to opt out or erase everything
Clear the site data in your browser settings — the stored consent goes with it and the banner will ask again. You can also install Google’s browser add-on to opt out of Google Analytics.
The request form works without consent to analytics: declining cookies breaks nothing. You need not attach photos at all — simply describe the damage in words, or come in for an inspection.
12 Automated decision-making
We take no automated decisions with legal effects. No algorithm assesses your photos or sets a price: the preliminary estimate from the photos is always given by a person, and the final cost we name only after inspecting the car in the workshop.
We do no profiling: the data from your request is not used to draw conclusions about you or to tailor a price to you.
13 Changes to this policy
If the data we collect or the list of recipients changes, we will update this page and correct the date at the top. The current version is always at this address.
