ANNEX NO. 1 TO THE TERMS OF SERVICE FOR THE ELECTRONIC PROVISION OF SERVICES OF THE SERVICE 2.0 SYSTEM
PRIVACY POLICY
Effective from 26.10.2026
1. General provisions and definitions
The controller of the personal data collected through the Service 2.0 system is Service 2.0 Prosta Spółka Akcyjna, with its registered office in Poznań, ul. Święty Marcin 29/8, 61-806 Poznań, entered in the register of entrepreneurs of the National Court Register under KRS number 0001102708, whose registration files are kept by the District Court for Poznań – Nowe Miasto and Wilda in Poznań, 8th Commercial Division of the National Court Register, NIP 7831903174, REGON 528481031 (hereinafter: the “Controller”).
In matters relating to the protection of personal data, the Controller can be contacted at the email address: kontakt@serwis20.pl.
This Privacy Policy sets out the rules for processing data as part of the Services, provided electronically, of access to the Service 2.0 system in the SaaS (Software as a Service) model through (using):
The Website: the website at serwis20.pl.
The Panel: the administration panel at panel.serwis20.pl, which provides access to the Service and the management of the use of the Service
The App: the application used for the electronic provision of the services of the Service 2.0 system
The Connector: the “Service 2.0 Connector” extension for the Google Chrome browser, which integrates the Panel with the e-Catalogue of Inter Cars S.A.
The following terms have the meanings given below:
Workshop: an entrepreneur using the services of Service 2.0 under an Agreement concluded on the terms of the Terms.
User: a natural person who performs the steps of registering the Workshop in the Service 2.0 system, or who logs in to the Panel and uses it in the name and on behalf of the Workshop (e.g. the owner of the Workshop, a mechanic, a front-office employee).
Agreement: the agreement for the provision of services by electronic means concluded between the Controller and the Workshop on the terms set out in the Terms.
Terms: the terms of service for the electronic provision of services of the Service 2.0 system, which set out the rules for providing those services, including for using the Service 2.0 system, the Website, the Panel and the App.
Service: the service of access to the Service 2.0 system provided under the Agreement to the extent resulting from the purchased Package and the Terms.
2. The role of the Controller and the role of the Workshop
The operation of the Service 2.0 system involves two independent legal relationships concerning the processing of personal data:
The Controller as an Independent Controller: It decides independently on the purposes and means of processing Users’ data.
The Controller as a Processor: All data entered by the Workshop into the Service 2.0 system – concerning Workshop Clients, vehicles, suppliers and employees, as well as records of Users’ actions in the Panel, such as information on who created or changed an entry, and the statistics of individual Users – is processed by the Controller solely in the name and on the instructions of the specific Workshop. The Workshop is the controller of this data within the meaning of the GDPR. The Controller processes this data under the Data Processing Agreement (DPA), and Workshops’ clients or other data subjects to whom this data relates should contact the relevant Workshop directly in order to exercise their rights regarding their personal data.
3. Purposes, legal bases and periods of data processing
The personal data of Users and Workshops is processed to the extent, for the purposes and for the periods described below:
Registration and provision of services on the terms set out in the Terms:
Scope of data: The first name, surname, email address, telephone number, company name, NIP, REGON and business address of the Workshop; the first name and surname, email address and telephone number of the person carrying out the registration.
Legal basis: Article 6(1)(b) GDPR (processing necessary for the conclusion and performance of the Agreement) or Article 6(1)(f) GDPR (legitimate interest, in the case of Users who are not owners of the Workshop).
Period: For the duration of the Agreement.
User accounts:
Scope of data: First name, surname, email address, telephone number, password, an optional PIN code and the role or permissions assigned in the system (e.g. mechanic, manager, customer adviser).
Legal basis: Article 6(1)(f) GDPR (legitimate interest – ensuring a secure service and managing permissions).
Period: For as long as the account exists in the Panel, and no later than the date of expiry of the Agreement.
Financial settlements, accounting and tax obligations:
Scope of data: Company name, NIP, address, email address, data on the purchased subscription Package and its price.
Legal basis: Article 6(1)(c) GDPR (a legal obligation under the provisions of the Accounting Act and the VAT Act).
Period: 5 years from the end of the calendar year in which the tax payment deadline expired.
Handling electronic payments relating to the Agreement:
Scope of data: Transaction identifier, payment status, amount, email address.
Legal basis: Article 6(1)(b) GDPR (necessity for the performance of the agreement for the provision of the Service) and Article 6(1)(c) GDPR (compliance with a legal obligation to which the Controller is subject under tax and accounting law).
Period: 5 years from the end of the calendar year in which the deadline for paying the income tax relating to the payment expired.
Marketing consent to the transfer of data to Inter Cars S.A.:
If the Workshop gives separate, voluntary consent, its personal data in the form of first name, surname, company name, company address and email address may be shared by the Controller with Inter Cars S.A. for marketing purposes, only once, at registration. The legal basis for such processing is Article 6(1)(a) GDPR (consent of the data subject). This consent may be withdrawn at any time, which, however, does not affect the effectiveness and lawfulness of the earlier one-off sharing of this data at registration.
Once the data has been transferred, Inter Cars S.A. becomes an independent and separate controller of the transferred personal data and processes it for its own marketing and promotional purposes, in accordance with its own privacy policy, and Service 2.0 is not responsible for the processing operations performed by Inter Cars S.A. after the data has been shared on the basis of the Workshop’s consent.
IT security, system logs and telemetry:
Scope of data: IP address, timestamp (date and time of login/request), browser type and version, operating system, the User’s internal identifier and system error reports (crash analytics).
Legal basis: Article 6(1)(f) GDPR (legitimate interest – ensuring stability and network security and fixing failures efficiently).
Period: Server logs for 90 days; error reports for 90 days.
Establishing, pursuing and defending claims and handling legal requests:
Scope of data: Any data collected in the course of the cooperation that is necessary for legal purposes, for settling requests, and for pursuing and defending claims (including the content of GDPR requests and of notices under Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act – the “DSA”)).
Legal basis: Article 6(1)(f) GDPR (legitimate interest – protecting the Controller’s rights) and Article 6(1)(c) GDPR (handling requests under the GDPR and the Digital Services Act – DSA).
Period: Until the limitation period for the relevant claims expires.
4. Voluntary provision of data.
Providing registration data is voluntary, but it is a necessary condition for concluding the Agreement and activating the Panel. Providing data for invoices is a statutory requirement. Consent to the transfer of data to Inter Cars S.A. is entirely optional and voluntary.
5. The “Service 2.0 Connector” extension
The optional Connector extension is used to integrate orders in the external e-Catalogue of Inter Cars S.A. with the Panel. The plug-in operates on data of which the Workshop is the controller.
Scope of data: During the parts ordering process, the plug-in retrieves from the Panel the appointment identification data, the make and model of the vehicle and the first name and surname of the Workshop’s client.
Storage: The data is processed only temporarily in the cache memory (RAM) of the User’s browser. The tool does not save the data to disk and does not send it to the Service 2.0 servers. The data is deleted once the order is finalised.
External transfer: When moving to the basket in the e-Catalogue, the plug-in automatically adds the synchronisation code [S20 appointment number] to the comment field. This number is transferred to Inter Cars S.A. together with the order. No other data of Workshops’ clients related to their use of the Service 2.0 Connector extension is transferred.
6. Recipients of personal data
The personal data of Users and Workshops is transferred only to trusted third parties for the purpose of providing the Services:
Providers of hosting and dedicated cloud infrastructure (storage of databases and backups).
Providers of mailing systems for sending system notifications.
Providers of error diagnostics and telemetry tools.
External electronic payment operators, as separate controllers – for the purpose of executing and settling transactions.
Inter Cars S.A. (as regards the appointment number via the Connector or the data transferred where marketing consent has been given).
Public administration authorities and other state authorities authorised to receive it (including administrative and tax authorities and courts), including through the National e-Invoicing System (KSeF); in each case the transfer to these entities will take place in fulfilment of an obligation under the law.
7. Transfer of data outside the European Economic Area (EEA)
All databases are stored on servers in Europe. Due to cooperation with global IT providers linked to the USA, where technical support is needed, data transfers are safeguarded in accordance with the requirements of the GDPR:
By the Standard Contractual Clauses approved by the European Commission (in the case of the hosting provider).
By the EU-U.S. Data Privacy Framework (in the case of the provider of error analysis tools, which holds an active certification).
8. Cookies
The Website, the Panel and the App use cookies or alternative technologies for storing information on the user’s end device in order to provide the necessary functionality for logging in and maintaining the user’s session.
The Controller does not track Users’ activity for the purposes of marketing, behavioural profiling or the personalisation of advertising. The session of a logged-in User and the basic functions of the system are maintained using secure server-side architectural mechanisms.
9. Data security
The Controller applies technical and organisational measures that protect the personal data processed at a level appropriate to the risks associated with a cloud architecture. In particular:
All connections within the system, the Panel and the App are encrypted using the secure SSL/TLS protocol.
Access to the databases is restricted and encrypted, and the Controller makes backups regularly. Data deleted from the production system disappears irreversibly from the backups within no more than 30 days.
10. Rights of data subjects
Every data subject has the right to:
Access their data and receive a copy of it (Article 15 GDPR).
Rectification of data (Article 16 GDPR) — the Workshop and the User can correct or rectify most of the account data themselves, directly in the settings of the Service 2.0 system.
Erasure of data (Article 17 GDPR), where there is no basis for its further storage.
Restriction of processing (Article 18 GDPR).
Portability of the data (Article 20 GDPR) that the Controller processes on the basis of the Agreement or of consent given.
Withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl) or with another competent supervisory authority in the Member State of the European Union in which the person lives or works.
10.1 Right to object
The data subject has the right to object at any time — on grounds relating to their particular situation — to the processing of their data on the basis of the Controller’s legitimate interests (Article 21 GDPR). In that case, the Controller will stop processing the data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or grounds for the establishment, exercise or defence of legal claims.
Please send all requests to: kontakt@serwis20.pl.
11. Changes to the Privacy Policy
The Controller reserves the right to make changes to this Privacy Policy for important reasons, such as changes in the law, the implementation of new technological solutions or changes in the scope of the Services provided.
Users will be informed of any changes with appropriate notice (of no less than 14 days) by a message displayed in the Panel or by an email sent to the address assigned to the account.
12. Terms used in the Privacy Policy
All terms used but not defined in this Privacy Policy have the meaning given to them in the Terms.