MotoX
← Back to home

Documents

Privacy Policy

How MotoX processes personal data.

Last updated:

This English version is a courtesy translation. The Polish version is the binding one.

1. General information

This Privacy Policy explains how personal data is processed in MotoX, available at motox.pl (the information site) and app.motox.pl (the workshop application).

The controller is Tesserakt sp. z o.o., ul. Cechowa 44B, 30-614 Kraków, Poland, NIP 6832091507, KRS 0000642152, e-mail: [email protected], tel. +48 534 454 299.

Tesserakt has not appointed a Data Protection Officer. For data protection matters, contact [email protected] directly.

2. Definitions

  • Service — the motox.pl website and the app.motox.pl application.
  • User — a person using the Service, in particular a member of a workshop team.
  • Workshop — the business that created an account and uses the application.
  • Workshop client — a person whose data the Workshop enters into the application.
  • GDPR — Regulation (EU) 2016/679.
  • Processor — a party that processes data on the controller’s behalf under a data processing agreement.

3. Roles of the parties

For account data, billing data, technical data and analytics data, Tesserakt is the controller.

For data about Workshop clients, vehicles, jobs, documents, attachments and SMS messages entered by the Workshop, the Workshop is the controller and Tesserakt acts as a processor under Article 28 GDPR. Tesserakt processes that data only on the Workshop’s documented instructions and only as needed to provide the Service.

Tesserakt does not use Workshop client data for its own marketing and does not sell it. The processing terms are set out in the agreement with the Workshop and can be made available on request.

4. What data we process

  • Account and team data: name or company name, e-mail address, role in the workshop, login and account security information.
  • Workshop data: name, company details, address, tax ID, REGON, phone, e-mail, logo, map coordinates and public workshop page settings.
  • Workshop client and vehicle data: name, phone, tax ID, address, vehicle details (make, model, registration number, VIN, mileage, technical data), service history, parts, actions, costs, consents, notes, documents and attachments.
  • Communication data: the content of SMS messages sent to Workshop clients, delivery status and related metadata.
  • Billing data: plan, payment history, invoices and subscription status. Card data is processed by the payment provider; Tesserakt does not store it.
  • Technical data: IP address, device and browser type, timestamps, security and diagnostic logs.
  • Analytics data: pages visited, traffic source, clicks, scrolling and approximate visit duration. Session replay also records mouse movement and navigation; form fields are masked.
  • Providing the Service and managing accounts — Article 6(1)(b) GDPR (contract).
  • Billing, invoices and tax obligations — Article 6(1)(c) GDPR (legal obligation).
  • Security, abuse prevention, diagnostics and analytics — Article 6(1)(f) GDPR (legitimate interests).
  • Marketing communication — Article 6(1)(a) GDPR (consent), where given. The site currently has no newsletter.
  • SMS messages to Workshop clients — the Workshop is the controller and is responsible for the legal basis and the wording of consents. Tesserakt delivers the message on the Workshop’s behalf.

6. Recipients

Data may be shared with parties that help us provide the Service:

  • hosting and infrastructure providers,
  • Hetzner — file and attachment storage,
  • SMSAPI — SMS delivery,
  • Resend — account-related e-mail,
  • Stripe — payments and subscriptions,
  • Umami (self-hosted at umami.tesserakt.dev) — analytics and session replay,
  • IT, accounting, legal and advisory providers where necessary and bound by confidentiality.

Recipients process data only as needed to provide the Service and under appropriate agreements. Data is not sold.

7. Transfers outside the EEA

Some providers, in particular Stripe and Resend, may process data outside the European Economic Area. Such transfers rely on an adequacy decision or the Standard Contractual Clauses approved by the European Commission, together with additional measures where required.

8. Retention

  • Account data — until the account is deleted, then up to 30 days while it is removed from backups.
  • Billing data and invoices — for the period required by tax law, generally five years from the end of the tax year.
  • Workshop client data — according to the Workshop’s instructions; after the agreement ends we delete it within 30 days unless the law requires longer retention.
  • Security logs — up to 90 days.
  • Analytics data and session recordings — up to 30 days.
  • Backups — up to 30 days, unless a longer period is required by the disaster recovery procedure.

9. Your rights

You have the right to:

  • access your data and receive a copy,
  • rectify your data,
  • erase your data,
  • restrict processing,
  • data portability,
  • object to processing based on legitimate interests,
  • withdraw consent at any time, without affecting the lawfulness of processing before withdrawal,
  • lodge a complaint with the Polish supervisory authority (UODO).

If the data concerns a Workshop client, contact the Workshop first; it is the controller. Tesserakt assists the Workshop in handling requests.

10. Security

We apply technical and organisational measures appropriate to the risk, including access control, separation of workshop data, encrypted connections, backups and least privilege. Only people and providers who need access to provide the Service can access the data.

11. Cookies and browser storage

The Service does not use cookies for marketing or behavioural advertising.

  • Session and preferences — the application may use essential browser storage to keep you logged in and remember settings such as language or theme.
  • Umami — analytics does not use cookies. It may use local browser storage to distinguish sessions.
  • Session replay — records clicks, scrolling, mouse movement and navigation. Form fields are masked and recordings are kept for up to 30 days.

You can restrict or block browser storage in your device settings. Some features may then stop working correctly.

12. Changes to this Policy

We may update this Policy when the law, our providers or the Service change. We will communicate material changes in the Service or by e-mail. The current version is always available on this page with its last-updated date.

13. Contact

  • Tesserakt sp. z o.o.
  • ul. Cechowa 44B, 30-614 Kraków, Poland
  • NIP 6832091507, KRS 0000642152
  • [email protected]
  • +48 534 454 299