At GoRush, protecting your privacy and personal information is an important part of the trust we build with our customers. We are committed to handling personal data responsibly, transparently and in accordance with the European Union's General Data Protection Regulation (GDPR) and applicable Polish data protection laws.
This Privacy Policy explains what information we collect, why we process it, how we protect it and what rights you have when using our website, customer platforms and services.
1. Data Controller and Contact Information
The controller responsible for processing your personal data is:
Company: GORUSH SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
Tax Identification Number (NIP): 8982289376
Registered Contact Address: Krakowiaków 68, 02-255 Warsaw, Poland
Email: info@gorush.pl
Website: https://gorush.pl
For any questions concerning your personal information, privacy rights or data processing, you may contact us using the email address above.
2. Personal Information We Collect
Depending on the services you request or use, GoRush may process the following categories of personal information:
Personal and contact details: Full name, email address, telephone number, residential address and other information necessary to identify or communicate with you.
Reservations and service information: Vehicle rental details, accommodation bookings, reservation dates, agreed prices, service history and relevant contractual information.
Account information: Login credentials, account activity, assigned services and information available through authenticated customer dashboards.
Payment and transaction records: Payment references, transaction confirmations, invoice details and relevant accounting information.
Technical and security information: IP addresses, access logs, connection details and information necessary to maintain platform security.
Customer support information: Messages, enquiries, correspondence and documents or images voluntarily shared during support conversations.
Identity documents or additional verification information are requested only when necessary for a particular service or applicable legal requirement.
We aim to collect only the information reasonably necessary for each specified purpose.
3. How and Why We Process Personal Data
We process personal information only where an appropriate legal basis applies under Article 6 of the GDPR.
Performance of a contract — Article 6(1)(b)
To respond to service requests before entering into a contract, manage reservations, provide vehicle rental and accommodation services, administer customer accounts and fulfil contractual obligations.
Compliance with legal obligations — Article 6(1)(c)
To maintain legally required financial records, issue invoices, comply with accounting and tax regulations and fulfil other applicable legal responsibilities.
Legitimate interests — Article 6(1)(f)
To protect our systems, prevent misuse, maintain proportionate security records, administer relevant support operations and establish, exercise or defend legal claims, subject to the rights and interests of individuals.
Consent — Article 6(1)(a)
Where consent is required, including for non-essential cookies, optional marketing communications and certain external media integrations.
You may withdraw your consent at any time. Withdrawal does not affect processing that was lawfully carried out before the withdrawal.
4. Information Processing Across Our Services
GoRush provides several services, each of which may require specific personal information.
Vehicle Rental and Reservations
We process customer identity and contact details, vehicle selections, rental periods, booking arrangements, payment information and vehicle handover documentation.
This information is used to manage reservations, prepare rental agreements, coordinate vehicle collection and return, and maintain records relevant to the service.
Accommodation and Hostel Services
Accommodation records may include guest contact information, selected room type, check-in and checkout dates, agreed prices, payment coverage and reservation status.
These records help us coordinate bookings, manage accommodation availability and fulfil relevant contractual or legal obligations.
Driver and Courier Customer Accounts
For customers using supported driver or courier services, authenticated dashboards may display earnings and payment records associated with their accounts.
Relevant authorised employees may access this information where necessary to administer the service, resolve discrepancies or provide customer support.
Towing and Vehicle Recovery
Towing enquiries may require contact information, vehicle details, collection and destination locations, and information about the requested recovery service.
Where a public towing tracking map is available, it displays only the latest reported position of the designated company service vehicle.
Customer identities, personal travel histories and historical customer routes are not published through this map.
5. Payments and Financial Information
Online card payments are processed through Stripe, an external payment service provider.
When making an online payment, your card information is submitted through the payment provider's secure payment interface.
GoRush receives the information necessary to identify and manage the transaction, such as payment references, confirmation status and relevant billing details.
GoRush does not store complete payment card numbers.
Financial and transaction information may also be processed by authorised accounting providers or disclosed to competent authorities when required by law.
6. Sharing Personal Information with Third Parties
We do not sell personal information to third parties.
Where necessary for the operation of our services, information may be shared with appropriate recipients, including:
Hosting and infrastructure providers.
Email and SMS delivery services.
Payment processing providers, including Stripe.
Accounting, legal and professional advisers.
External media, mapping and translation providers when their services are activated.
Public authorities when disclosure is required or otherwise permitted by applicable law.
Service providers processing information on our behalf are expected to use it only for authorised purposes and in accordance with applicable data protection requirements.
Some providers may process personal data outside the European Economic Area (EEA). Where GDPR international transfer rules apply, appropriate legal transfer mechanisms, such as European Commission adequacy decisions or Standard Contractual Clauses, are used as applicable.
7. Cookies, External Media and Translation Services
Our website may use necessary cookies to support essential functionality, account security and service operation.
Non-essential cookies and optional external integrations are activated in accordance with applicable consent requirements.
Google Maps and YouTube
Embedded Google Maps and YouTube content is loaded only after the relevant external-media consent has been provided.
When activated, these services may process technical information under their respective privacy policies.
Automatic Website Translation
Public website content may be processed through an automatic translation service when a visitor selects a different language.
Private customer dashboards, form values, confidential conversations and individual transaction records are excluded from this public-page translation mechanism.
Visitors should consult the relevant external provider's privacy information when using third-party services.
8. Live Customer Support and Conversations
When you contact our live support team, we may process the information you choose to provide during the conversation.
This may include your contact details, written messages, voluntarily uploaded images and technical connection information.
The information is used to answer enquiries, provide assistance, maintain service quality where applicable and prevent misuse.
Approximate IP Location
When IP geolocation is enabled, the connection IP address may be transmitted securely over HTTPS to ipwho.is to determine an approximate city and country.
This process does not request access to your device's GPS location and is not intended to identify your exact residential address.
Conversation Records and Attachments
A text transcript of the support conversation is sent to the email address you provide when the conversation ends.
Images shared during the conversation remain in protected chat storage rather than being included in the emailed text transcript.
Private support messages and attachments are excluded from the website's automatic public-page translation process.
9. Data Security and Access Controls
We apply appropriate technical and organisational measures designed to protect personal information against unauthorised access, accidental loss, alteration, disclosure or misuse.
Access to customer accounts, booking records, financial information and support conversations is restricted to authenticated users and authorised personnel according to their responsibilities.
We also maintain proportionate security records and access controls to help identify suspicious activity and protect our services.
Although we take reasonable precautions to safeguard information, no internet-based system can be guaranteed to be completely secure.
10. How Long We Retain Personal Information
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected or as required by applicable law.
Our general retention principles are:
Customer account information: Retained while the account and relevant services remain active, with applicable records retained longer where legally justified.
Enquiries and support records: Retained for the time necessary to resolve the request, manage related follow-up and address relevant claims.
Rental, accommodation and contractual documentation: Retained for applicable contractual obligations and legal limitation periods.
Accounting and tax records: Generally retained for five years from the end of the calendar year in which the relevant tax payment deadline occurred, subject to applicable legal extensions or pending proceedings.
Security and access logs: Retained for up to 180 days where justified by security needs, unless longer retention is legally required.
Identity verification records: Retained only to the extent and for the period necessary for the relevant transaction or legal obligation.
Information that is no longer necessary is deleted, anonymised or otherwise handled in accordance with applicable retention requirements.
11. Your Rights Under the GDPR
Under applicable data protection law, you may have the following rights:
Right of access: Request confirmation of whether we process your personal data and obtain access to relevant information.
Right to rectification: Request correction of inaccurate or incomplete personal information.
Right to erasure: Request deletion of personal data where the legal conditions for erasure are met.
Right to restriction: Request that certain processing activities be restricted in circumstances provided by law.
Right to data portability: Receive certain personal data in a structured, commonly used and machine-readable format where applicable.
Right to object: Object to processing based on legitimate interests, subject to applicable legal exceptions.
Right to withdraw consent: Withdraw consent for consent-based processing at any time.
Some information may need to be retained despite a deletion request when necessary to comply with legal obligations or to establish, exercise or defend legal claims.
We may request appropriate identity verification before disclosing personal information to prevent unauthorised access.
To exercise your rights, contact info@gorush.pl.
You also have the right to lodge a complaint with the Polish data protection supervisory authority:
President of the Personal Data Protection Office (UODO)
Website: https://uodo.gov.pl
12. Automated Decision-Making
GoRush does not carry out solely automated decision-making, including profiling, that produces legal effects or similarly significant effects on individuals within the meaning of Article 22 of the GDPR.
Automated website functions, account notifications, translation tools and reservation status updates are used to support service delivery and administration.
13. Information Required to Provide Our Services
Certain personal information is necessary for us to provide the services you request.
For example, vehicle reservations require appropriate booking and contact information, while invoicing may require billing details.
Failure to provide information necessary for a contract or legal obligation may prevent us from completing the requested service.
Optional marketing consent is not a condition of purchasing or using our contracted services.
We do not require customers to publish identity documents or sensitive personal information through publicly accessible website areas.
14. Updates to This Privacy Policy
We may update this Privacy Policy when our services, internal procedures, technology or applicable legal requirements change.
The latest version will be made available on our website.
Where material changes require additional notification or consent under applicable law, we will take the necessary steps.
15. Contact Us About Your Privacy
If you have questions about this Privacy Policy, wish to exercise your data protection rights or need clarification about how your personal information is handled, please contact us.
GORUSH SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
Email: info@gorush.pl
Address: Krakowiaków 68, 02-255 Warsaw, Poland
Website: https://gorush.pl
We are committed to addressing privacy-related enquiries responsibly and in accordance with applicable data protection requirements.
Your privacy matters. At GoRush, we believe reliable service starts with transparency, responsible data handling and respect for every customer.