Halo Rental System

Privacy policy

of the website halorentalsystem.com

1. GENERAL INFORMATION

This Privacy Policy sets out the rules for the processing of personal data of users of the website halorentalsystem.com (hereinafter referred to as the “Website”).

The controller of personal data is Halo Rental System spółka z ograniczoną odpowiedzialnością, with its registered office in Warsaw, Aleje Jerozolimskie 181B, 02-222 Warsaw (hereinafter referred to as the “Controller” or the “Company”).

The Controller attaches particular importance to the protection of the privacy of Website users and processes personal data in accordance with applicable laws, in particular:
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR).

2. CONTACT REGARDING PERSONAL DATA PROTECTION

In matters related to the processing of personal data, you may contact the Controller:
• electronically: rodo@halorentalsystem.com
• in writing: Aleje Jerozolimskie 181B, 02-222 Warsaw

The Controller has not appointed a Data Protection Officer. Data protection tasks are performed by a Data Protection Specialist designated by the Management Board.

3. SCOPE AND SOURCE OF PERSONAL DATA

The Controller processes personal data only to the extent necessary to achieve the purposes described in this Privacy Policy.

3.1. Data provided by the user

The Controller processes personal data voluntarily provided by users via forms available on the Website:

Contact form (general contact):
• first and last name,
• e-mail address,
• telephone number,
• message content.

Commercial inquiry form:
• first and last name,
• e-mail address,
• telephone number,
• company name,
• tax identification number (NIP),
• message content,
• information relating to the inquiry (e.g. type of vehicle, method of use, rental period, planned monthly mileage).

Providing data is voluntary; however, failure to provide it will prevent the Controller from responding to the submitted inquiry.

3.2. Data processed automatically

The Website does not use cookies, marketing tools, or external user-tracking systems.

The Controller does not conduct user profiling or behavioral analysis based on personal data.

4. PURPOSES AND LEGAL BASIS FOR DATA PROCESSING

Personal data are processed for the following purposes:

4.1. Handling inquiries submitted via forms

• Purpose: responding to user inquiries, conducting correspondence, providing information about the offer at the user’s request.
• Legal basis: Article 6(1)(b) GDPR – taking steps at the request of the data subject prior to entering into a contract.

4.2. Pursuing claims and defending against claims

• Purpose: protecting the Controller’s interests in the event of disputes, demonstrating the proper handling of correspondence or actions taken.
• Legal basis: Article 6(1)(f) GDPR – the Controller’s legitimate interest.

5. RECIPIENTS OF PERSONAL DATA

Personal data may be disclosed only to entities that support the Controller in its day-to-day operations, in particular:
• IT service providers,
• e-mail service providers (Microsoft 365).

These entities process data on the basis of data processing agreements or standard contractual terms, in accordance with Article 28 GDPR.

6. TRANSFER OF DATA TO THIRD COUNTRIES

Due to the use of Microsoft 365 services, personal data may be transferred outside the European Economic Area (e.g. to the United States).

Data transfers are carried out on the basis of:
• standard contractual clauses approved by the European Commission, or
• other mechanisms provided for in Chapter V of the GDPR, applied by the service provider.

7. DATA RETENTION PERIOD

Personal data are retained:
• for the duration of correspondence and, after its completion, for the period necessary to secure potential claims,
• no longer than until the expiration of limitation periods for claims arising from applicable laws.

After these periods, the data are deleted or anonymized.

8. RIGHTS OF DATA SUBJECTS

Data subjects have the following rights:
• the right of access to their data,
• the right to rectification,
• the right to erasure of data,
• the right to restriction of processing,
• the right to data portability,
• the right to object to the processing of data – in cases provided for by the GDPR,
• the right to lodge a complaint with the President of the Personal Data Protection Office (Poland).

Requests regarding the exercise of rights may be submitted by e-mail to: rodo@halorentalsystem.com.

9. LINK TO THE HALO PLATFORM

The Website contains a link enabling access to the Halo Platform – the Company’s operational system, functioning on a separate technological infrastructure (Pinquark platform).

Access to the Halo Platform takes place via redirection. Users’ personal data are not transferred through the Website at the login stage to the platform.

The rules for data processing within the Halo Platform are subject to separate regulations.

10. CHANGES TO THE PRIVACY POLICY

The Controller may amend this Privacy Policy in the event of changes in legal regulations or in the manner of operation of the Website. The current version of the Privacy Policy is always available on the Website.

Effective date: 5 December 2025