Privacy Policy

Who processes your data, for what purpose and for how long, who we share it with and what rights you have. It covers the sakuramotors.pl website, the auction catalogue, forms, contact with us and car import agreements.

This is an English translation provided for convenience. In case of any discrepancy, the Polish version of this privacy policy prevails.

1. Data controller

1.1. The controller of your personal data is Karol Paszkiewicz, running a business under the name IMPORT USA - AUTO HANDEL KAROL PASZKIEWICZ, 30 Górczewska Street, 01-147 Warsaw, Poland, NIP (tax ID) 1251534107, REGON 367834637. We operate under the Sakura Motors and Bryki z Ameryki brands. In this policy we refer to ourselves as “we”.

1.2. This policy covers the sakuramotors.pl website together with the auction catalogue at aukcje.sakuramotors.pl, the forms on the website, contact with us by phone, email and WhatsApp, and car import agreements. We process data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and Polish law.

1.3. For matters concerning your data, email biuro@sakuramotors.pl, call +48 888 333 665 or send a letter to: ul. Górczewska 30, 01-147 Warszawa, Poland.

2. What data we process

2.1. When you visit the website, your browser automatically transmits technical data: IP address, browser type and version, operating system, the address of the page visited, and the date and time. This data is stored in the logs of the servers running the website and the auction catalogue.

2.2. When you submit a form, we process the data you enter in it:

• in the contact form: first and last name, phone number, email address and the content of your message;
• in an enquiry about an auction in the catalogue: first and last name, phone number, email address, the content of your message and the car you are asking about.

2.3. The forms on the website are protected against spam by Cloudflare Turnstile. To tell a person from a bot, it processes the IP address and technical data of the browser.

2.4. When you call us, send an email or a WhatsApp message, we process the data from that conversation: phone number, email address, first and last name or profile name, and the content of the correspondence.

2.5. When you become our client, we process the data needed to conclude and perform the vehicle purchase agency agreement: first and last name or company name, address, NIP (tax ID), contact details, bank account number and the data required in the documents for the purchase, transport, customs clearance and registration of the car.

2.6. If you consent to statistics or marketing cookies, we also collect information about how you use the website: cookie identifiers, pages visited, clicks and forms submitted, device type and approximate location (city, country) determined from the IP address. With your consent to statistics cookies we also record the course of the visit: cursor movements, clicks and scrolling, as described in section 8. With your consent to marketing cookies we send Google the email address or phone number from a form in hashed form, as described in section 6.

2.7. Providing data is voluntary. Without a phone number or email address we cannot reply to an enquiry, and without the data needed for the agreement we cannot conclude it.

3. Purposes and legal bases

3.1. We process data for the following purposes:

• operation of the website and the auction catalogue, their security, protecting the forms against spam and fixing faults – Article 6(1)(f) GDPR, i.e. our legitimate interest;
• replying to an enquiry from a form, a phone call, an email or a WhatsApp message – Article 6(1)(b) GDPR where it concerns steps taken at your request before entering into an agreement, and Article 6(1)(f) GDPR in other matters;
• concluding and performing the vehicle purchase agency agreement: bidding, settling the deposit, transport, customs clearance and documents – Article 6(1)(b) GDPR;
• issuing invoices, keeping accounts and fulfilling other obligations imposed by law – Article 6(1)(c) GDPR;
• keeping our own database of contacts with clients and people interested in importing a car, and informing them about our services – Article 6(1)(f) GDPR, i.e. direct marketing of our own services;
• sending commercial information by email, SMS, messenger or phone – only with your consent, Article 6(1)(a) GDPR in conjunction with Article 398 of the Polish Electronic Communications Law of 12 July 2024;
• website visit statistics in Google Analytics and analysis of how the website is used in Microsoft Clarity – Article 6(1)(a) GDPR, i.e. your consent;
• measuring the effectiveness of Google Ads advertising, including sending Google a hash of the email address or phone number from a form (Enhanced Conversions), and showing ads to people who have visited the website – Article 6(1)(a) GDPR, i.e. your consent;
• measuring the effectiveness of ads and showing ads to people who have visited the website (Meta Pixel) – Article 6(1)(a) GDPR, i.e. your consent;
• establishing, pursuing or defending claims – Article 6(1)(f) GDPR.

4. Cookies and the consent banner

4.1. Cookies are small files stored in your browser. The rules for their use are set out in Article 399 of the Polish Electronic Communications Law of 12 July 2024.

4.2. On your first visit we show the Cookiebot consent banner, a service of Usercentrics A/S. In the banner you choose which categories of cookies you agree to: preferences, statistics and marketing. Necessary cookies do not require consent.

4.3. Without your consent we only store what is strictly necessary for the website to work:

• your choice in the consent banner (the CookieConsent cookie, valid for up to 12 months), so that we do not ask for it on every visit;
• a Cloudflare security cookie (_cfuvid), which helps tell people from bots and disappears when you close the browser.

4.4. We only store statistics cookies (Google Analytics and Microsoft Clarity) and marketing cookies (Google Ads and Meta Pixel) after you consent in the banner. Without consent these tools do not store cookies.

4.5. Until you make your choice, Google’s tools run in Consent Mode: they neither store nor read cookies and send Google only signals without identifiers, which are used to estimate statistics in aggregate.

4.6. With your consent to marketing cookies, Google may use data from Google Analytics to measure and personalise Google ads.

4.7. You can change or withdraw your consent at any time in the cookie settings on the website, and delete cookies in your browser settings. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.

5. Google Analytics

5.1. With your consent we use Google Analytics 4, a service of Google Ireland Limited. The tool shows us how many people visit the website, where they come from, which pages they view and whether they submit forms. We look at this data in aggregate, without names, phone numbers or email addresses.

5.2. Google Analytics stores the _ga and _ga_ cookies with the website identifier, valid for up to 2 years. We keep detailed visit data in Google Analytics for 14 months.

5.3. We run the measurement tools through Google Tag Manager, a service of Google Ireland Limited. Tag Manager itself does not store cookies.

5.4. Google’s privacy policy: https://policies.google.com/privacy

6. Google Ads

6.1. With your consent to marketing cookies we use Google Ads, a service of Google Ireland Limited, including conversion tracking and remarketing. It shows us which Google ads lead to a form being submitted or to contact with us, so that we can manage them better and show ads to people who have visited our website.

6.2. Google Ads stores the _gcl_au and _gcl_aw cookies, valid for up to 90 days. They hold information about the ad click that brought you to our website.

6.3. We also use the Enhanced Conversions feature. When you submit a form after consenting to marketing cookies, the email address or phone number entered in the form is transformed with the SHA-256 hash function and only in that form sent to Google. Google compares this hash with the hashed data of its signed-in users to attribute the form submission to an ad click more accurately.

6.4. In Google Ads reports we see aggregate data, without names, phone numbers or email addresses.

6.5. The legal basis for this processing is your consent (Article 6(1)(a) GDPR). You can change or withdraw it at any time in the cookie settings on the website. Without consent Google Ads does not store cookies and data from the form is not sent to Google for this purpose.

6.6. How Google handles data in its advertising services: https://business.safety.google/privacy/

7. Meta Pixel

7.1. With your consent we use Meta Pixel, a tool of Meta Platforms Ireland Limited. The Pixel sends Meta information about the visit, for example the pages visited and the submission of a form, and stores the _fbp cookie valid for 90 days. This lets us measure the effectiveness of ads on Facebook and Instagram and show ads to people who have visited our website.

7.2. If you are logged in to Facebook or Instagram, Meta may link this information to your account. For the collection of data on the website and its transfer to Meta we are joint controllers with Meta Platforms Ireland Limited; after that Meta processes it as a separate controller.

7.3. Meta’s privacy policy: https://www.facebook.com/privacy/policy/

8. Microsoft Clarity

8.1. With your consent to statistics cookies we use Microsoft Clarity, a service of Microsoft Ireland Operations Limited. Clarity records the course of the visit: cursor movements, clicks and scrolling, and shows them to us as session replays and click maps. This lets us see which parts of the website are unclear or do not work. Text typed into form fields is masked in these recordings.

8.2. Clarity stores the _clck cookie (valid for up to 12 months) and the _clsk cookie (valid for 1 day).

8.3. Microsoft’s privacy statement: https://privacy.microsoft.com/en-gb/privacystatement

9. Google Fonts, WhatsApp and social media

9.1. The auction catalogue loads fonts from the Google Fonts service. To download them, your browser connects to Google’s servers and sends them your IP address. The basis is our legitimate interest in displaying the website legibly (Article 6(1)(f) GDPR).

9.2. The WhatsApp buttons open a conversation in the messenger run by WhatsApp Ireland Limited. We use the data from the conversation to reply to you, and WhatsApp processes it under its own rules: https://www.whatsapp.com/legal/privacy-policy-eea

9.3. Our profiles on Facebook, Instagram, TikTok and YouTube and Google Maps are reached through ordinary links. The website does not embed these services’ plugins, so it sends them nothing until you click a link. After that, the rules of the given service apply.

10. Who we share data with

10.1. We entrust data to providers who help us run the website and the business. They process it only on our instructions, under data processing agreements:

• Webflow, Inc. – website hosting and handling of the contact form;
• home.pl S.A. – the auction catalogue server;
• Google Ireland Limited – email and the spreadsheet of catalogue enquiries (Google Workspace), Google Tag Manager and Google Analytics;
• Microsoft Ireland Operations Limited – Microsoft Clarity;
• Usercentrics A/S – the Cookiebot consent banner and storing your choice;
• Cloudflare, Inc. – protecting the website and forms against bots;
• providers of accounting, IT and legal services.

10.2. To the extent needed to perform the agreement, we share clients’ data with the parties we import the car with: the broker and auction houses in Japan, forwarding companies and shipping lines, the customs agency, and transport and courier companies.

10.3. Google Ireland Limited (Google Ads and Google Fonts), Meta Platforms Ireland Limited and WhatsApp Ireland Limited receive data to the extent described in sections 6, 7 and 9.

10.4. We also share data with public authorities where the law requires it, for example the tax office or the National Revenue Administration during customs clearance.

11. Transfers of data outside the EEA

11.1. Some providers, including Webflow, Cloudflare, Google, Meta and Microsoft, may process data in the United States. The basis for the transfer is the European Commission decision of 10 July 2023 on the EU-U.S. Data Privacy Framework for providers that participate in it, and in other cases the standard contractual clauses approved by the European Commission.

11.2. When performing the agreement, a client’s data may be sent to the broker and auction houses in Japan. In its decision of 23 January 2019, the European Commission found that Japan ensures an adequate level of personal data protection.

12. How long we keep data

12.1. We keep data for as long as needed for the purpose for which we collected it:

• technical data in server logs – up to 90 days, unless it is needed to investigate an incident or defend claims;
• enquiries from forms and correspondence that did not lead to an agreement – up to 24 months from the last contact or until you object;
• client data – for the duration of the agreement and, after it ends, until claims become time-barred;
• invoices and accounting documents – 5 years from the end of the calendar year in which the tax payment deadline passed;
• data in the contact database – until you object, for no longer than 24 months from the last contact;
• detailed visit data in Google Analytics – 14 months;
• visit recordings in Microsoft Clarity – up to 30 days, and aggregate data up to 13 months;
• data processed on the basis of consent – until it is withdrawn.

13. Your rights

13.1. Within the limits of the GDPR, you have the right to:

• access your data and receive a copy of it;
• rectify your data;
• erase your data;
• restrict processing;
• data portability for data we process on the basis of consent or an agreement;
• object to processing based on our legitimate interest, and to direct marketing always and without giving a reason;
• withdraw consent at any time.

13.2. To exercise these rights, email biuro@sakuramotors.pl. We will reply without undue delay, and within one month at the latest.

13.3. You can also lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.

14. Automated decisions and profiling

14.1. We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (Article 22 GDPR).

14.2. If you consent to marketing cookies, Google and Meta may choose the ads shown to you based on your activity. Such personalisation does not affect the terms of our services.

15. Changes to the policy

15.1. We update the policy when the law, our services or the tools used on the website change. The current version is always on this page.

Last updated: 1 October 2026