Privacy Policy

Who we are

PackoLoopo is operated by POWER Rubber Robert Piotrowski, Moszna-Parcela 55A, 05-840 Brwinów, Polska, CEIDG, NIP 5342331435, REGON 365271408, contact: kontakt@packoloopo.com. We are the business responsible for your personal information (the “controller” under EU law).

PackoLoopo is available in the European Union, Norway and the United States. Because we are based in the European Union, we apply the EU General Data Protection Regulation (GDPR) to all users. The legal bases under the GDPR are given in parentheses below. If you live in California or another US state with a comprehensive privacy law, see also the sections for US residents below.

What information we process and why

1. Email address and name from your Google, Facebook or Apple account: signing in and running your account (Art. 6(1)(b) GDPR).
2. Account type, business name and VAT or tax identification number (if you provide them) and the language of emails: marking business listings and contacting you in your language (Art. 6(1)(b) GDPR).
3. Listing content, photos (without GPS data), town or city, country and approximate pickup point: publishing the listing (Art. 6(1)(b) GDPR).
4. Exact pickup address and directions: visible only to the author of the listing and the person who booked the pickup (Art. 6(1)(b) GDPR).
5. Bookings (time slot, name of the person booking): arranging the pickup between the users (Art. 6(1)(b) GDPR).
6. Content reports (reason, description, name and email of the person reporting), moderation decisions and account blocks: obligations under the EU Digital Services Act (Art. 6(1)(c) GDPR) and protecting users against abuse (Art. 6(1)(f) GDPR).
7. Ideas sent with the “Suggest an idea” form (content, optional email, page language): developing the service and replying to your message (Art. 6(1)(f) GDPR). We keep them for up to 2 years.
8. Only if you consent to marketing cookies: page views and actions on the site (viewing and adding a listing, booking), the cookie identifier, IP address and browser data collected by Meta Pixel. Purpose: measuring the effectiveness of PackoLoopo ads on Facebook and Instagram and showing ads to people who may be interested (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with the “Cookies” link in the page footer.
9. Only if you consent to cookies: page views, where you came from, approximate location (city, country), device and browser type and actions on the site, collected by Google Analytics 4. Purpose: usage statistics and improving the site (Art. 6(1)(a) GDPR). Google does not store the IP addresses of users in the EU. You can withdraw your consent at any time with the “Cookies” link in the page footer.

Who receives the information

1. Supabase (database, sign-in, photos; servers in Frankfurt, Germany, EU). Information of US users is therefore stored in the European Union.
2. The operator of the server running the website: Cyber_Folks S.A. (Polska).
3. The map provider (map tiles) and the OpenStreetMap Foundation (Nominatim address search, United Kingdom – a country with an EU adequacy decision). Your browser sends them the address you type or the point on the map.
4. The email provider (sending sign-in links).
5. Cloudflare, Inc. (Turnstile – protecting the sign-in and report forms against bots): browser data and IP address, on the basis of our legitimate interest in protecting the service against abuse (Art. 6(1)(f) GDPR); data may be transferred to the USA under the EU-U.S. Data Privacy Framework.
6. Anthropic PBC (USA) – automated assessment of the text and photos of new listings, as a processor under a data processing agreement; transfer to the USA on the basis of the EU-U.S. Data Privacy Framework or standard contractual clauses. The data is not used to train models.
7. Meta Platforms Ireland Ltd. (Ireland) – only after you consent to marketing cookies (Meta Pixel). For the collection and transmission of Pixel data we are joint controllers with Meta (Art. 26 GDPR); Meta then processes the data as a separate controller under its own privacy policy. Data may be transferred to Meta Platforms Inc. in the USA on the basis of an EU adequacy decision (EU-U.S. Data Privacy Framework).
8. Google Ireland Ltd. (Ireland) – only after you consent to cookies (Google Analytics 4), as a processor under Google's data processing terms. Data may be transferred to Google LLC in the USA on the basis of the European Commission's adequacy decision (EU-U.S. Data Privacy Framework).
9. Public authorities where the law requires it (e.g. an order to provide information under Art. 10 of the EU Digital Services Act).

How long we keep it

1. Account data, listings, photos and bookings: until the listing or the account is deleted.
2. Photos – exception: when a listing is deleted, 30 days after it is hidden by moderation or 90 days after it expires, we move its photos to a non-public archive and delete them after 6 months (for appeals and reports of violations). When you delete your account, we delete your photos immediately.
3. Reports and moderation decisions: 2 years after the decision, for appeals and possible legal claims. If the person who reported deletes their account, the report remains without a link to the account.
4. Ideas sent with the “Suggest an idea” form: up to 2 years.

Your rights

You have the right to access, correct and delete your information (the “Delete account” button under My account), to restrict processing, to data portability and to object to processing based on legitimate interest.

Under the GDPR you can file a complaint with the Polish data protection authority (Prezes UODO) or with the authority in the country where you live or work.

To exercise any of your rights, write to kontakt@packoloopo.com.

Cookies

Strictly necessary cookies keep you signed in and remember the language you chose and your cookie choice (pl_consent, 1 year). They do not require consent.

We set marketing cookies (Meta Pixel, e.g. _fbp, up to 90 days) only after you click “Accept” in the banner. Without consent, the Meta script is not loaded at all. You can change your choice at any time with the “Cookies” link in the footer.

We also set Google Analytics cookies (_ga and _ga_*, up to 2 years) only after you click “Accept”. Without consent, the Google script is not loaded.

We honor Global Privacy Control (GPC) signals sent by your browser: if your browser sends a GPC signal, we treat it as a request to opt out of the sharing of your personal information and do not load Meta Pixel or Google Analytics.

Notice to California residents (CCPA/CPRA)

This section applies to residents of California and supplements the rest of this policy, as required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA). [To be confirmed by counsel: whether the operator meets the CCPA applicability thresholds; this notice is provided in any case.]

Categories of personal information we collect (in the past 12 months and going forward): (1) identifiers – name, email address, account ID, cookie identifiers and IP address; (2) commercial information – your listings, bookings and pickups (including any price stated in a listing); (3) internet or other electronic network activity – page views, where you came from, actions on the site and browser and device data (analytics and Meta Pixel data only with your consent); (4) geolocation data – the town or city, country, approximate pickup point and exact pickup address you enter for a listing, and the approximate location (city, country) derived by Google Analytics with your consent; we do not collect precise location from your device, and photos are stored without GPS data; (5) audio, electronic, visual or similar information – the photos you add to listings; (6) professional or employment-related information – for business accounts, the business name and VAT or tax identification number; (7) other information you give us – content reports, appeals, ideas sent through the “Suggest an idea” form and the language of emails.

Sensitive personal information: we do not intentionally collect sensitive personal information as defined by the CCPA. Sign-in is handled through Google, Facebook, Apple or an email link; we do not store your passwords for those services. We use any personal information only for the purposes described in this policy and do not use or disclose sensitive personal information to infer characteristics about you.

Sources: directly from you (your account, listings, bookings, reports and messages); from the sign-in provider you choose (Google, Facebook or Apple – your name and email address); automatically from your browser and device (cookies and similar technologies, only with your consent for analytics and marketing; Cloudflare Turnstile for bot protection).

Business purposes: providing and running your account and the service, publishing listings and arranging pickups, communicating with you, moderating content and handling reports and appeals, security and protection against fraud and abuse (including automated pre-screening of new listings), complying with legal obligations, and – only with your consent – usage statistics, improving the site and measuring and showing PackoLoopo ads.

Retention: we keep each category of personal information for the periods described in “How long we keep it” above.

Disclosure to service providers: we disclose personal information for business purposes to the service providers and recipients listed in “Who receives the information” above (database and hosting, maps and address search, email delivery, bot protection, automated listing review and – only with your consent – Google Analytics and Meta). Other users see the information you publish in listings; the exact pickup address is shown only to the person who booked the pickup.

Sale and sharing: we do not sell personal information for money. Allowing Meta Pixel to collect information for ad measurement and targeted advertising may be considered “sharing” for cross-context behavioral advertising, and the use of Google Analytics may also be considered a “sale” or “sharing” under California law. [To be confirmed by counsel: classification of Google Analytics and Meta Pixel.] Both load only after you opt in through the cookie banner, and you can withdraw your consent at any time with the “Cookies” link in the page footer. We also honor Global Privacy Control (GPC) signals as a valid request to opt out of sale and sharing. We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age; we do not knowingly collect personal information of children under 16, and PackoLoopo is only for people aged 18 or older in the United States.

Your California rights: (1) the right to know and access the personal information we have collected about you, including the categories, sources, purposes and recipients; (2) the right to delete your personal information (you can also use the “Delete account” button under My account); (3) the right to correct inaccurate personal information; (4) the right to opt out of the sale or sharing of your personal information (through the “Cookies” link in the footer or a GPC signal); (5) the right to limit the use and disclosure of sensitive personal information – we do not use sensitive personal information beyond what is necessary to provide the service, so this right does not require any action from you; (6) the right not to be discriminated against for exercising any of these rights – we will not deny you the service, charge you a different price or provide a different quality of service because you exercised your rights.

How to submit a request: email kontakt@packoloopo.com with the subject “California privacy request” and state which right you want to exercise. To protect your information, we verify your identity by asking you to send the request from, or confirm it through, the email address linked to your PackoLoopo account; if you do not have an account, we may ask for information needed to match your request to the data we hold. You may use an authorized agent to submit a request on your behalf; we may require written, signed permission from you and may ask you to verify your identity directly with us. We confirm receipt within 10 business days and respond within 45 calendar days; if we need more time (up to a further 45 days), we will tell you why. [To be confirmed by counsel: whether a toll-free number or other additional request method is required.]

Residents of other US states

If you live in another US state with a comprehensive consumer privacy law (for example Colorado, Connecticut, Virginia, Texas or Oregon), you may have similar rights to access, correct, delete and obtain a copy of your personal information and to opt out of targeted advertising, the sale of personal information and certain profiling. You can exercise them by writing to kontakt@packoloopo.com, and you can opt out of targeted advertising at any time with the “Cookies” link in the footer or a GPC signal. If we deny your request, you may appeal by replying to our decision; we will respond to the appeal within the time required by your state's law. [To be confirmed by counsel: list of states and state-specific details.]