Privacy Policy

1. Controller

The controller is [name / company], [address], e-mail: [contact@roado.eu]. Further details are in the Legal Notice.

No data protection officer has been appointed; if one is appointed, the contact details will be provided here.

2. Scope, purposes and legal bases

We process personal data only to the extent necessary, based on Art. 6(1) GDPR:

• Providing the website and server logs (IP address, date/time, requested resource, browser) for security and stability; basis: legitimate interest (f).
• Cookies / local storage: storing the chosen language (the "locale" cookie); basis: (f) or consent (a) where not strictly necessary.
• E-mail contact: handling your enquiry; basis: (b) or (f).
• Reviews and comments: the display name, content and IP address. The IP is used to prevent abuse and to operate the "recommend / don't recommend" thumbs (one vote per object per IP within 24 hours) and for moderation; basis: (f). Comments are moderated before publication.
• User-uploaded photos: stored together with who uploaded them, so the author can delete them; basis: (f) / (a).
• Owner accounts and e-mail magic-link sign-in: an e-mail address and a token valid for 5 minutes; basis: (b).

3. Hosting and recipients

We use the hosting provider [hosting provider name and address], which processes data on our behalf under a data processing agreement (Art. 28 GDPR). Data may be shared with IT service providers and with authorities where required by law.

4. Transfers outside the EEA

We process data within the EEA as a rule. Should a transfer to a third country occur in future, it will only take place subject to appropriate safeguards (e.g. standard contractual clauses).

5. Retention

We keep data no longer than necessary for the purposes for which it was collected, then delete or anonymise it. Server logs are deleted promptly; reviews are kept until deleted; contact data for the duration of handling and any limitation periods.

6. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interest, and to withdraw consent at any time (without affecting the lawfulness of prior processing).

You also have the right to lodge a complaint with a supervisory authority (in Poland: the President of the Personal Data Protection Office, UODO; in Germany: the competent state authority).

7. Automated decision-making

We do not make decisions based solely on automated processing that produce legal effects. Moderation may be assisted by AI tools in future; final decisions remain with the controller.

8. Changes

We may update this policy. The current version is always available on the website with the date of the last update.