Effective from 1 November 2026.
We take care of your data. Below we explain in plain language who processes it, why, on what legal basis and what rights you have. This applies to goldencar.pl and to contacting us through forms, phone, e-mail, chat and the on-site assistant.
1. Data controller
The controller of your personal data is Pentagon Strategy Sp. z o.o., ul. Świętej Teresy od Dzieciątka Jezus 5/9, 91-348 Łódź, NIP 726-265-79-34, REGON 362758699, KRS 0000581241 (“Pentagon Strategy”, “we”). The company is the issuer and owner of the GoldenCar, ProfessionalCar, HubCar and TripPack brands; “Golden Car” is the marketing name used on this website.
Contact for personal data matters: kontakt@goldencar.pl or +48 664 10 20 25. We have not appointed a data protection officer; write to the address above on any data matter.
2. What data we process and why
- Rental, booking, business, transport, partnership, franchise and ambassador enquiries: name (or company name), phone, e-mail, message, dates, chosen car, pick-up point, planned trip and, for companies, tax ID. Purpose: answering the enquiry, preparing an offer and steps taken at your request before a contract. Basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) (our legitimate interest in handling enquiries).
- “Write to us” form, phone, e-mail, WhatsApp, adviser chat: contact details and message. Purpose: replying and handling your matter. Basis: Art. 6(1)(f) GDPR, or (b) where it concerns a contract.
- Rental contract and its performance: data necessary for the contract, settlements, deposit and vehicle documents, as described in the contract and terms. Basis: Art. 6(1)(b) and (c) GDPR (e.g. accounting and tax obligations).
- Establishing, exercising and defending claims, fraud prevention and site security: Art. 6(1)(f) GDPR.
- Technical data (IP address, browser type, time of visit) in server logs for security and proper operation: Art. 6(1)(f) GDPR. We do not store IP addresses in enquiry content.
- Own marketing: only with your consent or in connection with your enquiry. You may withdraw consent at any time.
3. Whether you must provide data
Providing data is voluntary, but without contact details (phone or e-mail) we cannot answer. Your name in the “Write to us” form is optional. The consent ticked at a form concerns contact about your enquiry; it is not a marketing consent.
4. Recipients
- hosting and infrastructure: Vercel Inc. (USA, EU servers),
- e-mail provider: dhosting (Poland),
- adviser chat: tawk.to (loaded only after you click “Chat with an adviser”),
- on-site AI assistant: Anthropic (USA); the conversation text is sent to it, please do not share sensitive data,
- our internal Golden One system used for enquiries, bookings and settlements,
- partners involved in rentals: accounting, legal advisers, insurers, service and roadside assistance and, for network rentals, the partner or franchisee renting the car from that point, to the extent necessary,
- public authorities where the law requires.
5. Transfers outside the EEA
Some providers (Vercel, Anthropic, tawk.to) may process data in the USA. We rely on safeguards provided by the GDPR, in particular standard contractual clauses or the European Commission adequacy decision (Data Privacy Framework) where applicable. You may obtain a copy of the safeguards by writing to us.
6. Retention
- enquiries without further cooperation: up to 12 months from last contact,
- rental and settlement data: until claims become time-barred; accounting and tax documents for the period required by law (usually 5 years from the end of the tax year),
- chat and assistant conversations: up to 12 months unless related to an ongoing matter,
- consent-based data: until withdrawn,
- server logs: usually up to 30 days.
7. Your rights
You have the right to access, rectify, erase, restrict, port your data and to object to processing based on our legitimate interest. Where processing is based on consent you may withdraw it at any time without affecting earlier processing.
To exercise your rights write to kontakt@goldencar.pl. You may also lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.
8. Automated decisions and the AI assistant
We do not make decisions about you solely by automated means that would have legal effects. The on-site AI assistant answers questions and can prepare an enquiry, but it does not confirm bookings or conclude contracts; our adviser always confirms the offer and availability. Do not share document numbers, payment cards or passwords with the assistant.
9. Cookies
Cookies and browser storage are described separately on the “Cookies” page.
10. Security
We use encrypted connections (HTTPS), restrict access to people who need it and keep secrets out of the website code.
11. Changes
If our data processing rules change we will update this page and the date at the top.