Privacy Policy
Last updated: 28 April 2026
1. Who is the controller of your data
The controller of your personal data is:
ALFA BUS 26 Limited Liability Company (Spółka z ograniczoną odpowiedzialnością)
- Legal form: Limited liability company under Polish law
- Registered office: ul. Oskara Kolberga 9, 25-516 Kielce, Poland
- KRS (National Court Register): 0001200396
- Tax ID (NIP): 9592087180
- Statistical Number (REGON): 543015395
Data protection contact:
- E-mail: biuro@muszkieter.pl (with subject "GDPR")
- Phone: +48 693 440 585
- Postal address: ul. Oskara Kolberga 9, 25-516 Kielce, Poland
2. What data we process
Depending on the form of contact and the scope of cooperation, we process the following categories of data:
- Identification and contact data: first name, last name, company name, e-mail address, phone number, billing address,
- Order data: route, date, number of passengers, vehicle type, special requests,
- Billing and tax data: Tax ID, invoicing data, payment history,
- Technical data: IP address, browser type, operating system, cookie identifiers, website activity (see Cookie Policy),
- Contact form and live chat data: message content, conversation history with our consultant,
- Voluntarily provided data: e.g. reviews, comments, data of accompanying persons in group bookings.
We do not knowingly collect data of persons under 16 years of age. For school trips, students' data is provided to us by the organiser (school), acting as a separate controller.
3. Purposes and legal basis
| Purpose | Legal basis (GDPR) | Retention period |
|---|---|---|
| Preparing quotes, return contact, booking | Art. 6(1)(b) — necessity for entering into / performing a contract | Until end of negotiations + 12 months |
| Performing the rental contract | Art. 6(1)(b) — contract performance | Duration of the contract |
| Issuing invoices, accounting, taxes | Art. 6(1)(c) — legal obligation (Polish Accounting Act, Tax Ordinance) | 5 years from the end of the financial year |
| Pursuing / defending against claims | Art. 6(1)(f) — legitimate interest of the controller | 6 years (limitation period) |
| Marketing of own services (newsletter, offers) | Art. 6(1)(a) — consent | Until consent is withdrawn |
| Website analytics (Google Analytics 4) | Art. 6(1)(a) — consent (cookies) | 14 months or until consent is withdrawn |
| Live chat (Tawk.to) | Art. 6(1)(a) — consent + (f) — handling the inquiry | Until consent withdrawn / 12 months |
| Website security, fraud prevention | Art. 6(1)(f) — legitimate interest | 12 months |
4. Recipients of your data
Your data may be transferred to the following categories of recipients, exclusively to the extent necessary and on the basis of appropriate data processing agreements (Art. 28 GDPR):
Technical infrastructure providers:
- Vercel Inc. — website hosting (USA, Standard Contractual Clauses)
- Google LLC — Google Analytics 4, Google Search Console (USA, Data Privacy Framework)
- Tawk.to Ltd. — live chat (USA / EU, Standard Contractual Clauses)
- Anthropic, PBC — blog content generation (USA, Standard Contractual Clauses)
Business service providers:
- Accounting office / accountant
- Accounting and invoicing software providers
- Banks processing payments
- Postal and courier operators
- Law firms (when necessary)
- Insurance companies
Public authorities — only when required by law (e.g. Social Insurance Institution, Tax Office, law enforcement).
We do not sell your data to any third parties.
5. Transfers outside the European Economic Area (EEA)
Some of our providers (Google, Vercel, Tawk.to, Anthropic) are based in the United States. Data transfers are carried out on the basis of:
- European Commission's adequacy decision for the USA (Data Privacy Framework) — for Google,
- Standard Contractual Clauses (SCC) approved by the European Commission — for the others.
You can obtain a copy of the safeguards by contacting us at biuro@muszkieter.pl.
6. Your rights
Under GDPR you have the following rights:
- Right of access (Art. 15) — you may obtain a copy of your data,
- Right to rectification (Art. 16) — you may request correction of your data,
- Right to erasure / "to be forgotten" (Art. 17) — in specific situations,
- Right to restrict processing (Art. 18),
- Right to data portability (Art. 20) — in a machine-readable format,
- Right to object (Art. 21) — particularly to marketing,
- Right to withdraw consent at any time (Art. 7(3)) — withdrawal does not affect the lawfulness of processing carried out before withdrawal,
- Right to lodge a complaint with a supervisory authority — President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, www.uodo.gov.pl. You may also lodge a complaint with the supervisory authority in your country of residence.
To exercise these rights, write to biuro@muszkieter.pl with subject "GDPR" — we will respond within 30 days.
7. Is providing data mandatory
Providing data is voluntary, but to the extent necessary to conclude a contract (e.g. to issue a quote, book a coach, issue an invoice) — without such data, the service cannot be performed.
Providing data for marketing purposes is fully voluntary.
8. Profiling and automated decision-making
We do not make decisions about you based solely on automated processing (including profiling) that would have legal effects or similarly significantly affect you (Art. 22 GDPR).
We use website analytics (Google Analytics 4) only for statistical purposes — in a way that does not allow us to identify a specific person.
9. Cookies
The website uses cookies. Details are described in a separate document: Cookie Policy.
You may change your preferences at any time by clicking "Cookie settings" in the website footer.
10. Changes to this Privacy Policy
This Policy may be updated. We will inform you of any material changes in a visible manner on the homepage and by e-mail (if we have your address). The current version is always available at: www.wynajem-autobus.pl/en/polityka-prywatnosci.
Previous versions are available on request (e-mail: biuro@muszkieter.pl).
Version 1.1 — 28 April 2026