MBKeyless.com Privacy Policy

English translation of the Polish version dated 26 September 2026 (translated 26 September 2026).

Updated on 26 September 2026. Odoo handles shop and cart data, Microsoft 365/Outlook handles correspondence, and backups are stored in OneDrive. Within the business, the owner has operational access; service providers may process data as necessary to supply their services.

This document explains what data we process when you use MBKeyless.com, buy from us, contact us or sign up for an availability notification. This policy is information about data processing. Reading it or accepting the Terms and Conditions does not constitute consent to marketing or optional cookies.

1. Controller and contact details

The data controller is Paweł Choszczyk, trading as Creman – Paweł Choszczyk, ul. Stefana Batorego 18/108, 02-591 Warsaw, Poland, tax ID (NIP) 9522260213.

For privacy matters or to exercise your rights, email shop@mbkeyless.com or write to the address above. You can also call +48 796 129 339.

2. What data we receive and where it comes from

• Purchase and delivery: identification and contact details, delivery and billing addresses, company details and tax ID if you provide them, order contents, amounts, currency, and payment and delivery information. We do not receive your full card number or security code; the payment provider handles those. We receive the information needed to associate and settle the transaction.
• Customer account: registration and login details, information entered in the account, order history and information needed to manage account access.
• Contact, complaint or repair: contact details, correspondence, purchase details, a description of the problem and any photos or vehicle information you voluntarily provide. Do not send identity documents or information unrelated to the matter.
• Availability notification: email address, selected car model, country, number of door handles of interest, answers in the form, and the content and circumstances of giving or withdrawing consent.
• Website use: IP address, browser and device data, language, dates and times of requests, pages visited, and session and cookie data. The scope depends on the functions used and your privacy settings.

We receive data mainly from you and your browser. Payment providers and carriers also provide transaction or shipment status. If someone else names you as the recipient of an order or a contact person, we receive the details needed for delivery or contact from that person.

3. Purposes, legal bases and retention

The legal bases below refer to Article 6(1) GDPR. We do not base all shop operations on consent: we process data needed for an order in connection with the contract and keep tax records because of a legal obligation.

• Orders, payment, delivery, repairs and arrangements before purchase: performance of a contract or steps taken at your request before entering into one — point (b). We keep data needed for this purpose while performing the contract. Afterwards, we retain the relevant part under legal obligations or the legitimate interest in claims described below.
• Customer account: performance of the account service contract — point (b); until you stop using or close the account. Purchase and settlement details may remain for the periods required for those separate purposes.
• Invoices, accounting, tax and customs records: legal obligation — point (c). As a rule, tax records are kept for five years from the end of the year in which the tax payment deadline expired. Special rules, including those for VAT OSS, may require ten years. The period may change because limitation is suspended or interrupted, or proceedings are ongoing.
• Complaints and consumer rights: performance of a contract and legal obligations — points (b) and (c), as appropriate to the matter. We process data while handling the case and retain documentation needed to show it was handled properly until the relevant claim limitation period ends.
• Other correspondence and contact with a company representative or parcel recipient: our legitimate interest under Article 6(1)(f) GDPR in replying and maintaining the relationship. The plan below describes implementation of retention periods; separate obligations and protection of claims may require retaining the relevant records.
• Availability notifications and email marketing: your consent — point (a), together with the prior consent required under Article 398 of the Polish Electronic Communications Law. We use data only within the scope stated at sign-up, until the consented information has been sent, the sign-up purpose ends or you withdraw consent sooner. Signing up for a specific product does not automatically sign you up to a general newsletter.
• Proof of giving and withdrawing consent and handling objections: accountability and legal obligations — point (c), and defence of claims — point (f). After unsubscribing, we may retain minimal proof of consent or withdrawal and information preventing another marketing contact for as long as needed to demonstrate compliance or defend claims. This does not permit further marketing or unnecessary retention of all correspondence.
• Security, shop maintenance and fault diagnosis: our legitimate interest in service continuity and prevention of abuse — point (f). We keep technical data until the diagnostic need ends or an incident is clarified; data about a specific breach may be needed longer to establish, pursue or defend claims.
• Optional video players, Google Analytics and Plausible analytics, and storage of visit source: consent under Article 6(1)(a) GDPR, insofar as personal data is processed. A provider may also act as a separate controller under its own notice. Section 6 and the cookie policy explain the details and withdrawal.
• Establishing, pursuing or defending claims: our legitimate interest in protecting rights — point (f); until the relevant claims become time-barred or proceedings end finally and their consequences are settled. Periods depend on the type of case; as a rule they are six years, and three years for business-related and recurring claims, subject to special provisions. This does not mean keeping all data for six years.

Providing data is voluntary, but fields marked required are needed for the chosen service. We cannot ship an order without delivery details or send a notification without an email address. Invoice details required by law are mandatory. Marketing consent and optional cookies are not conditions for purchase. Withdrawing consent does not affect the lawfulness of earlier processing.

We have adopted a retention plan: ordinary email inquiries — 24 months after the matter closes; abandoned carts — 90 days after the last activity; availability notifications — until notification or withdrawal, at most 12 months; ordinary backups — 90-day rotation; integration logs — 30 days. The deletion and rotation plan has not yet been implemented, and previously collected data requires review. These periods are not presented as an operating automatic deletion system. Purchase, tax, complaint and dispute records remain subject to the separate obligations described above. You can send a request concerning your data to shop@mbkeyless.com.

4. Data recipients and services used

We share data with entities involved in the chosen service, only as far as needed to provide it. These include:

• Odoo — shop hosting, accounts, orders, forms and system messages;
• BaseLinker (Base) — order and shipment handling, and inFakt — invoicing and accounting;
• Microsoft 365 — email and storage of business records;
• integration infrastructure providers, including GitHub Actions — running processes that pass order information between systems;
• Stripe, PayPal and banks — according to the payment method chosen; some data is processed by them as separate controllers, for example to meet financial obligations and prevent fraud;
• carriers including DPD and FedEx, and customs clearance providers — depending on the delivery country and method;
• Google — Google Analytics and optional YouTube players;
• technical support, accounting and legal advisers, and authorised public bodies where disclosure has an appropriate legal basis.

Payment providers, carriers and service providers may act as processors for us or as separate controllers, depending on the purpose and legal basis. Their own notices: Odoo, Stripe, PayPal, Microsoft, Google. You may ask us for information about recipients of your data.

5. Transfers outside the European Economic Area

Use of international IT and payment services and deliveries outside Europe may involve transfers of data outside the EEA, including to the United States. This also includes access by the staff and subcontractors of cloud providers. We do not claim that all data remains exclusively in Poland or the EEA.

A transfer requires a basis under Chapter V GDPR: a European Commission adequacy decision, including for eligible certified recipients under the EU–US Data Privacy Framework, or appropriate safeguards such as the Commission's standard contractual clauses, together with a transfer assessment and supplementary measures where needed. Choosing a foreign service alone does not remove these requirements.

In individual cases involving delivery you have ordered outside the EEA, the exception in Article 49 GDPR for a transfer necessary to perform a contract may apply within the limits of that provision. It does not replace safeguards for ongoing use of cloud services.

You may request details of the basis for a specific transfer and a copy of the safeguards applied at shop@mbkeyless.com; protected information may need to be redacted from the copy provided.

6. Cookies, analytics and external content

Essential cookies maintain the session, cart, login and security and remember language and privacy choices. Other storage of or access to information on your device requires prior consent under the Polish Electronic Communications Law; the GDPR also applies when personal data is processed.

A YouTube player starts only after separate consent beside that particular video. Google/YouTube then receives, among other things, your IP address, browser data and playback information, and may set cookies for the service, advertising and measurement. You can stop the video and withdraw consent with the button below the player. A separate banner choice concerns Google Analytics, Plausible and Odoo visit-source measurement. Consent to one purpose is not consent to the other. Refusal does not prevent purchase. Analytics starts only after consent, without granting Google advertising consents. Fonts are hosted locally in Odoo.

The Cookie Policy and settings list cookies, purposes and lifetimes and explain how to change and withdraw consent. A “Cookie settings” link is available in the footer. Withdrawal does not affect the lawfulness of earlier processing.

Google Analytics (Google) and Plausible hosted by Odoo start after consent to measure visits, traffic sources and website use. Google Analytics may process visited page addresses, device and browser data, cookie identifiers and interaction events. User and event data retention in GA is set to 14 months; this is not the lifetime of cookies or all aggregate reports. The _ga and _ga_* cookies support measurement; their default lifetime is up to 2 years and may renew during use. Your browser may shorten it. Withdrawing consent removes these cookies from our domain. We do not grant Google advertising consents. In Google Analytics, automatic site-search, form-interaction and browser-history pageview measurement are disabled. Our Plausible code does not set measurement cookies; it sends event data, page address, visit source and screen width to Odoo. The provider also receives connection data, including the IP address. We do not send form contents or information identifying an order to analytics. Website fonts are hosted locally in Odoo.

7. Your rights

• You may request access to your data and a copy of it, and correction of inaccurate or incomplete data.
• You may request deletion or restriction of processing in the cases set out in the GDPR. Deletion does not automatically cover records we must still keep by law.
• You may receive data you provided to us on the basis of consent or a contract in a structured, commonly used, machine-readable format and transmit it to another controller if processing is automated. You may request direct transmission where the conditions are met.
• You may object at any time to direct marketing, including related profiling. After an objection, we no longer process data for that purpose.
• Where we rely on a legitimate interest, you may object for reasons relating to your particular situation. Further processing requires us to demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or grounds for establishing, pursuing or defending claims.
• You may withdraw consent at any time. To stop notifications, email shop@mbkeyless.com or use an unsubscribe method provided in a message. No reason is needed and withdrawal does not affect fulfilment of your order.
• You may complain to the President of the Polish Personal Data Protection Office (UODO) or a competent supervisory authority, in particular in the country of your habitual residence, work or the alleged infringement.

We answer requests without undue delay, generally within one month. For a complex request or a large number of requests, the period may be extended by two further months; we inform you of the extension and reason during the first month. If we have reasonable doubts, we may ask for further information necessary to confirm your identity, not excessive data. Exercising these rights is generally free of charge.

8. Automation and policy changes

Systems automatically process, among other things, order statuses, payments and adjustment of currency or tax to the delivery country. We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects within the meaning of Article 22 GDPR. Automatic technical operations do not mean complaints are decided automatically.

We update this policy when laws, services or processing change. The date of each new version appears at the start. Changing the text alone neither replaces any required new consent nor legalises use of data for an incompatible purpose. We inform you of material changes to the use of your data as required by law.