1. Data Controller

The controller of personal data processed in connection with the use of karasaki.pl is M.K. CARE Spółka z ograniczoną odpowiedzialnością (M.K. CARE sp. z o.o.) — the company operating the Karasaki brand, an independent importer of Japanese cars.

  • Registered seat: ul. Erazma Ciołka 25/U2, 01-445 Warszawa, Poland
  • KRS (commercial register): 0000725735 (District Court for the Capital City of Warsaw, 13th Commercial Division of the National Court Register)
  • NIP (tax ID): 5272845760
  • REGON (statistical no.): 369865240
  • Correspondence address and customer office: ul. Warszawska 8, 05-805 Otrębusy, Poland

You can contact us about any matter concerning your personal data:

2. What data we collect

The scope depends on how you use the site. In practice we process:

  • Contact data — name, email, phone number and the content of your message, when you email us, send a WhatsApp message or contact us about a specific auction listing.
  • Technical data — IP address, browser type, operating system, browser language, time of visit and pages visited. These are logged automatically on the hosting side (Vercel) for security and diagnostics.
  • Site preferences — selected language, currency, theme (light/dark) and your watchlist of cars. Stored in your browser's local storage and they don't identify you. If you sign in, your watchlist is additionally saved to your account so it works across your devices (section 3).
  • Account and alert data — email address, saved auction-alert criteria, consents given and the account event log, if you create an account or subscribe to alerts (details in section 3).
  • Analytics data — aggregated traffic statistics (Vercel Analytics, Vercel Speed Insights, Google Analytics 4) and conversion data (Meta Pixel), only if you consent.

3. User account, auction alerts and watched cars

If you use an account or alerts, we additionally process:

  • Account data — email address, optional name and the account event log (sign-ins, consents given, alert changes). You create the account and sign in with a link sent to your email address, without a password. Legal basis: art. 6(1)(b) GDPR (operating the account at your request).
  • Auction alerts — saved search criteria (make, model, years, price and similar) and your chosen email frequency. An alert only activates after you confirm the subscription by clicking a link in an email (double opt-in). Legal basis: art. 6(1)(a) GDPR. You can unsubscribe with one click in the footer of every message.
  • Watched cars — without signing in, the list lives only in your browser. After signing in we also save it to your account. If you have an account, we may send you a reminder that the auction of a watched car is about to end; you can switch these reminders off via the link in the footer of such a message.
  • Delivery and click log — we record the delivery status of every message we send and clicks on links in our messages, which pass through a redirect on our domain. We then store the message type, the link type and a pseudonymous identifier; this log does not contain your email address. Legal basis: art. 6(1)(f) GDPR (our legitimate interest: delivery reliability and assessing how useful alerts are). We delete this data after 30 days.

You can delete your account at any time by writing to biuro@karasaki.pl. We will delete it together with your alerts and the watchlist saved to the account.

4. Purposes and legal grounds

We process data for the following purposes and on the following legal grounds under the GDPR:

  • Handling enquiries and preparing an import quote — art. 6(1)(b) GDPR (pre-contractual steps) and art. 6(1)(f) GDPR (our legitimate interest in responding to correspondence).
  • Sending transactional emails (confirmations, auction alerts you subscribed to) — art. 6(1)(b) GDPR and art. 6(1)(a) GDPR (consent for alerts).
  • Securing, maintaining and operating the service — art. 6(1)(f) GDPR (legitimate interest).
  • Statistics, analytics and marketing — art. 6(1)(a) GDPR (your consent given on first visit or in the cookie settings). You can withdraw consent at any time; withdrawal does not affect the lawfulness of processing before withdrawal.
  • Compliance with legal obligations (accounting, tax, complaints) — art. 6(1)(c) GDPR.

5. Who we share data with

We use external providers who process data only on our instructions and under data processing agreements (art. 28 GDPR):

  • Vercel Inc. (USA) — hosting, CDN, Vercel Analytics, Speed Insights. Databases run in Frankfurt (EEA); aggregated statistics may be processed in the USA.
  • Neon, Inc. (Frankfurt region, EEA) — Postgres database.
  • ActiveCampaign / Postmark (USA) — transactional email delivery.
  • Google Ireland Limited (Ireland / USA) — Google Analytics 4. Only if you consent to analytics cookies.
  • Meta Platforms Ireland Limited (Ireland / USA) — Meta Pixel. Only if you consent to marketing cookies.
  • Logistics and customs partners (Japan, Poland, EU) — only when you commission an import and it is necessary to perform the contract (carrier, customs agent, domestic shipper).

6. International data transfers

Some of our providers (Vercel, Postmark, Google, Meta) are established or operate servers in the United States. Transfers take place on the basis of:

  • the European Commission adequacy decision under the EU-US Data Privacy Framework, or
  • standard contractual clauses (SCC) approved by the European Commission,

combined with additional technical safeguards (encryption in transit and at rest).

7. How long we keep data

  • Email and WhatsApp correspondence — up to 3 years from last contact.
  • Customer data from a concluded import contract — for the period required by tax and accounting law (up to 6 years from the end of the fiscal year).
  • Server logs — up to 30 days.
  • Cookies and local storage — until you withdraw consent or clear your browser storage.
  • Account, alert and watchlist data — until you delete the account or withdraw alert consent.
  • Email delivery and click log — up to 30 days.
  • Analytics data (GA4) — 14 months (default setting).

8. Your rights

Under the GDPR you have the right to:

  • access your data (art. 15 GDPR),
  • rectify your data (art. 16 GDPR),
  • erasure — the "right to be forgotten" (art. 17 GDPR),
  • restrict processing (art. 18 GDPR),
  • data portability (art. 20 GDPR),
  • object to processing based on legitimate interest (art. 21 GDPR),
  • withdraw consent at any time (art. 7(3) GDPR).

To exercise any of these rights, write to biuro@karasaki.pl. We respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority — in Poland the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

9. Cookies and local storage

karasaki.pl uses cookies and browser local storage:

  • Functional (no consent required — necessary): remembering language, currency, theme, watchlist, filter panel state and the sign-in session cookie if you have an account.
  • Analytics (with consent): Vercel Analytics, Vercel Speed Insights, Google Analytics 4 — help us understand how people use the site so we can improve it.
  • Marketing (with consent): Meta Pixel — measures the effectiveness of advertising in the Meta network.

Most browsers let you block and clear cookies in their settings. Disabling functional cookies may affect how the site works (e.g. reset your preferences on every visit).

10. Data security

We apply appropriate technical and organisational measures: HTTPS/TLS for transport encryption, encryption at rest on the infrastructure side, two-factor authentication for admin panels, need-to-know access and regular software updates.

11. Changes to this policy

We may amend this policy — particularly when laws, providers or the scope of processing change. The current version is always available at this URL, with the effective date shown at the top. For material changes we will notify you by email (if we have one).

12. Contact

For privacy matters please use our contact form or write directly to biuro@karasaki.pl.