Privacy policy and cookies
How we process personal data and what we do (not) store on your device. We write it in plain language, but with the legal bases given.
This page is an English translation of the privacy policy, provided for your convenience. The Polish version is the legally binding one.
1. Data controller
The controller of your personal data is:
- Motokofeina,
- address: ul. Pruszkowska 20a, 05-830 Nadarzyn,
- email: info@motokofeina.pl, phone: +48 796 14 16 24.
For personal data matters, use the email or phone number given above. The company's contact details are on the Company details page.
This policy applies to the motokofeina.pl website. The shop sklep.motokofeina.pl operates separately and has its own rules. Links to Facebook, Instagram, YouTube and TikTok lead to external services, which have their own privacy policies.
2. What data and where from
We receive data primarily from you, when you contact us:
- direct contact (phone, WhatsApp, email): name, phone number, email address, motorcycle details (make, model, year) and the content of the message, to the extent that you provide them;
- forms on the site: the contact form (enquiry) and the "Join the network" form (a workshop's application, on the Workshop network page). We collect the data that we ask for in the form fields. In the contact form: name, phone and/or email, motorcycle details, the selected service and the message. In the "Join the network" form: workshop name, city, whether the workshop has a dyno (yes or no), name, phone and/or email and the message. We also save each submission on the server so that it is not lost if the email system fails. To protect the form against abuse (spam, bots), with each submission we additionally save the IP address (together with connection data passed on by intermediary servers) and the browser identifier (user agent), and to limit the number of submissions from one address we briefly keep data about their count (for IPv6 addresses we count them together for the whole /64 subnet). If you give an email address in the form, we will send it an automatic confirmation that the enquiry (or the workshop application) has been received. It has fixed content and does not contain data from the form; when a very large number of submissions arrive in a short time, we may skip it (abuse protection). The forms are also protected by Cloudflare Turnstile: before the form is sent, your browser connects to Cloudflare, which, on the basis of signals from the browser and the connection (including the IP address), checks whether the form is being filled in by a human and not by a bot. When the form is sent, we pass Cloudflare the result of this check and your IP address for confirmation, and with the submission we save only whether the verification succeeded;
- technical data: like any web server, the hosting provider and Cloudflare record in their logs, among other things, the IP address, the date and time, and the address of the requested page;
- visit statistics: we use Cloudflare Web Analytics, which counts visits in aggregate and does not use cookies (details in section 8).
Providing data is voluntary, but without it we will not be able to reply to your enquiry or carry out your order. We do not make decisions about you by automated means and we do not build your profile.
3. Purposes and legal bases
We process data for the following purposes (GDPR, that is Regulation 2016/679):
| Purpose | Legal basis |
|---|---|
| replying to an enquiry, preparing a quote, steps taken at your request before entering into a contract | Art. 6(1)(b) GDPR |
| carrying out an order (service, servicing, reflash, fitting) | Art. 6(1)(b) GDPR |
| keeping books and accounting records, tax settlements | Art. 6(1)(c) GDPR (legal obligation) |
| establishing, pursuing and defending claims; security and correct operation of the site (server logs; protecting the form against abuse on the basis of the IP address and browser identifier); aggregate statistics; contact with workshops interested in the network; presentation of the workshop network on the site | Art. 6(1)(f) GDPR (legitimate interests of the controller) |
Our legitimate interest is being able to defend against claims, protecting the site against abuse and attacks, and knowing which content is read.
4. Recipients of data
Data may go to entities that help us run the site and the business:
- webd.pl: the hosting provider, on whose servers the site runs and the form submissions are saved;
- Cloudflare: speeding up and protecting the site (CDN), protecting forms against bots (Cloudflare Turnstile), Cloudflare Web Analytics statistics. Cloudflare may process data outside the European Economic Area, including in the USA, on the basis of the mechanisms provided for in the GDPR (including adequacy decisions or standard contractual clauses);
- the email service provider: runs the info@motokofeina.pl mailbox, so it sees the messages you send to it;
- the accounting office: receives accounting documents related to orders;
- public authorities and courts, if the obligation results from the law.
If you write to us via WhatsApp, you are using a separate service from Meta, which has its own privacy policy and processes data on its own terms.
We do not sell data and do not pass it to advertising companies. Workshops from our network are a separate matter, described in section 7.
5. Retention period
- enquiries and correspondence: until the end of the correspondence, and then for 12 months (in case of follow-up questions and possible claims);
- form submissions saved on the site's server (data from the fields, plus the IP address and browser identifier): at the latest 400 days (about 13 months) after the submission is received, regardless of whether the correspondence continues; we delete the copy of the email with the submission in the server's outgoing mailbox after 30 days; we delete data about the number of submissions from one IP address (abuse protection) within 24 hours. Correspondence in the email inbox is subject to the period from the previous point;
- accounting documents: for 5 years from the end of the tax year in which the tax obligation arose;
- data needed to defend claims: until the claims become time-barred, if such a need arises;
- server logs and statistics: for the period set by the providers (webd.pl, Cloudflare), necessary to ensure the security and operation of the site.
After these periods we delete or anonymise the data.
6. Your rights
Under Arts. 15–21 GDPR you have the right to:
- access your data and receive a copy of it (Art. 15),
- rectification of data (Art. 16),
- erasure of data (Art. 17),
- restriction of processing (Art. 18),
- data portability (Art. 20),
- object to processing based on legitimate interests (Art. 21).
To exercise your rights, write to info@motokofeina.pl. We will reply without undue delay, at the latest within a month.
You also have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.
7. Partner workshops as separate controllers
You contact a workshop from the network directly. The data that you give it is processed by it as a separate controller, under its own privacy policy. Motokofeina does not receive this data and is not responsible for its processing by the workshop.
On the site, including the network map, we publish contact details of workshops belonging to the network. These may be personal data of people running a sole-trader business. We publish them in order to present the network, on the basis of Art. 6(1)(f) GDPR. A workshop may at any time ask for its data to be changed or removed by writing to info@motokofeina.pl.
8. Cookies and storage on your device
The rules on storing information on your device and gaining access to it follow from Article 399 of the Polish Electronic Communications Law (PKE).
- The site does not set any cookies for visitors. We do not use analytics, advertising or tracking cookies, we do not set advertising pixels and we do not use Google Analytics. Because there is nothing to reject, we do not show a consent banner.
- The administration panel (address /panel, not available to visitors) uses a single session cookie,
mkpanel. We set it only for the site administrator after login; it is necessary for the panel to work, available only over HTTPS and invisible to scripts on the page. The cookie is a session cookie (the browser deletes it when closed), and the session expires on logout, after 30 minutes of inactivity or at the latest after 8 hours. Visitors who do not log in to the panel do not receive it. - Cloudflare Web Analytics counts visits in aggregate, without cookies and without storing anything on your device.
- Cloudflare Turnstile works only on pages with a form (contact, workshop network): a Cloudflare script checks in the browser the signals needed to tell a human from a bot. It is necessary to send the form and is not used for tracking or advertising.
- Cloudflare technical cookies, e.g.
__cf_bm: Cloudflare may set them to protect the site against bots and attacks. They are valid for a short time (usually about 30 minutes) and are necessary for the secure operation of the site. - Links to YouTube and other services: the site has no embedded players or plugins from YouTube, Facebook, Instagram or TikTok, only links. Thumbnails and titles of videos from our YouTube channel are fetched by our server and served from motokofeina.pl, so merely displaying the home page does not connect you to YouTube; you connect to it only after clicking a video. Clicking a link takes you to the given service (e.g. YouTube, owned by Google), which has its own privacy policy and may store its own cookies.
You can delete or block cookies at any time in your browser settings. Blocking the Cloudflare technical cookies may, in an extreme case, make it harder to display the site.
9. Changes to the policy
We update the policy when our rules for processing data change (e.g. new forms are added) or the law changes. The current version is always at this address.
Date of the last update: 30 October 2026.