RaceFare — Privacy Policy
Effective date: 18 October 2026. Version 1.0.
1. Controller
The controller of your personal data is Firma Handlowa Kram Przemysław Stroiwąs, ul. Poznańska 21, 62-023 Borówiec, Poland, NIP 7773130990 ("we"). Contact for all privacy matters: hello@racefare.com. We have not appointed a data protection officer.
2. What we process, why, on what basis and for how long
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Delivering and securing the Site (hosting, CDN, protection against attacks) | IP address, date/time, requested URL, browser/device data, referrer, security events | Art. 6(1)(f) – our legitimate interest in running a secure site | Logs are kept by our hosting provider Cloudflare, not by us: on our plan, detailed request logs for up to 24 hours and sampled traffic and security analytics (which may include IP addresses) for about 30 days; after that they are deleted or kept only in aggregated form. Cloudflare may also use information about malicious traffic to protect its network, as described in its own privacy policy |
| Cookieless website statistics (Cloudflare Web Analytics) | A script from Cloudflare collects aggregated page-view data: page URL, referrer, browser and device type, country, and performance timings. It uses no cookies or local storage and does not build visitor profiles | Art. 6(1)(f) – our legitimate interest in understanding how the Site is used | Kept by Cloudflare, not by us: individual page-view records for 7 days, after which they are reduced to a sampled aggregate (about 10% of the original volume). Statistics are available to us for the previous 6 months |
| Newsletter and price alerts | Email address, subscription status, signup date/time and source (the page you signed up on and how you reached it), IP address and the approximate location derived from it, browser/device data, whether you open our emails and click links in them | Art. 6(1)(a) – consent (and your consent to receive commercial information by email under Polish electronic-communications law) | Until you unsubscribe; afterwards we keep a minimal record (email address, the date and source of the consent and the date of unsubscribing) to prove compliance and to make sure we do not email you again (Art. 6(1)(f)), for 6 years after you unsubscribe (the general limitation period for claims under Art. 118 of the Polish Civil Code) |
| Emails to us (questions, complaints, privacy requests) | Email address, name if given, message content | Art. 6(1)(f) – answering you; Art. 6(1)(c) – legal duties (complaints, GDPR requests) | Until the matter is closed, then up to 6 years (the general limitation period for claims under Art. 118 of the Polish Civil Code), unless the law requires a longer period |
| Affiliate links – attributing purchases to RaceFare and settling commissions | Click data (time, link, referral parameters, IP/browser data processed by the network), cookie identifiers; we receive only aggregated or pseudonymous commission reports | Clicking a link: Art. 6(1)(f) – legitimate interest in being paid for referrals. Partner script on our pages (described in section 4; loaded only after you accept in the cookie banner or switch on partner cookies in its settings): Art. 6(1)(a) – consent | Cookies: for the lifetime set by each network or partner, most commonly 30 days, although depending on the partner it ranges from a single session to 12 months (you can delete them in your browser at any time). Commission and accounting records: 5 years from the end of the calendar year in which the related tax became due (Polish tax law) |
| Consent records for cookies (cookie banner) | Your choice (partner cookies allowed: yes/no), a version number and the date, stored only in your browser's local storage (rf_consent) | Art. 6(1)(c) and (f) – demonstrating consent | 12 months from your choice, after which we ask you again; sooner if you change your choice or clear your browser's storage |
Providing data is voluntary. Without an email address you cannot receive the Newsletter; everything else on the Site works without giving us any data.
Trip calculator: your entries are processed only in your browser and are not sent to us.
3. Newsletter
We use beehiiv Inc. (USA) to collect signups and send emails. After signing up you will receive an email asking you to confirm your subscription; we send the Newsletter only after you confirm. Emails may contain commercial information, including affiliate links. We measure whether emails are opened and whether links in them are clicked (using a small image and redirected links), to improve the Newsletter; you can avoid this by blocking images in your email program or by unsubscribing. Links in our emails may also carry campaign parameters (UTM tags) that tell the destination website the visit came from our Newsletter. beehiiv processes your data only on our behalf and on our instructions; we do not use beehiiv's advertising network or its data-enrichment offerings. You can unsubscribe at any time via the link in every email or by writing to us; this does not affect processing carried out before withdrawal.
4. Cookies and similar technologies
Cookies are small files or other information stored on or read from your device.
- Strictly necessary: our hosting/CDN provider (Cloudflare) may set security cookies (e.g.
__cf_bm) to protect the Site from bots and attacks. These do not require consent. - Affiliate tracking: when you click an affiliate link, the affiliate network and the partner site may set cookies on their own domains to record that you came from RaceFare. Their own privacy policies apply.
- Partner script (only with your consent): with your consent, we load the Travelpayouts “Drive” script (from
tp-em.com) on our pages. It measures and improves links to travel offers and may store or read identifiers on your device (e.g. a session cookie). It is not loaded until you give consent: by clicking “Accept” on the first layer of the cookie banner, or “Accept all” or switching on “Partner cookies (link measurement)” under “Settings” and clicking “Save choices”. “Reject” and “Settings” are on the same first layer as “Accept”. The partner toggle is off by default. If you reject, it is not loaded and the Site works the same. The “Necessary” category (always on) only stores your consent choice. - Your consent choice: saved in your browser's local storage (key
rf_consent, holding a version number, whether partner cookies are allowed (partner: true/false) and the date), not in a cookie, and never sent to us. You can change or withdraw your consent at any time via Cookie settings in the footer, which reopens the banner with the settings panel (switch off “Partner cookies” and save, or click “Reject”); after withdrawal the script is no longer loaded from your next page view. Identifiers it already stored can be removed in your browser settings. - Newsletter form: the signup form is provided by beehiiv and is loaded only after you click “Subscribe to price alerts”, or automatically if you have allowed partner cookies in the cookie banner. Before that, nothing from beehiiv is loaded on our pages. Once loaded, it may store on your device: on our domain,
bhv_attribution(up to 30 days; how you reached the Site, e.g. referring site, campaign parameters and landing page, passed to beehiiv with your signup) andbhv_…_subscribed(up to 12 months; hides the form after you subscribe); and on beehiiv’s domain, security and anti-bot cookies (e.g. Cloudflare, HUMAN) and beehiiv’s own measurement tools. Legal basis: your consent (Art. 6(1)(a) GDPR). - Apart from the newsletter form described above, we do not use analytics or advertising cookies; our website statistics (Cloudflare Web Analytics, see section 2) are cookieless.
You can delete or block cookies in your browser settings.
5. Recipients
We share data only as needed with:
- Cloudflare, Inc. – hosting, content delivery, security and cookieless website statistics (processor);
- beehiiv Inc. – newsletter delivery (processor);
- affiliate networks and partner sellers/travel providers – to attribute referrals and settle commissions; for click and cookie data they act as separate controllers under their own privacy policies;
- our email provider Migadu-Mail GmbH (Switzerland), accounting and legal advisers, and public authorities where the law requires it.
We do not sell personal data.
6. Transfers outside the EEA
- Cloudflare, Inc. (USA) is certified under the EU–US Data Privacy Framework, so transfers to it rely on the European Commission's adequacy decision for the USA of 10 July 2023 (Art. 45 GDPR); if that certification lapsed, Cloudflare relies on the European Commission's Standard Contractual Clauses.
- beehiiv Inc. (USA) is not certified under the Data Privacy Framework; transfers to it rely on the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), which form part of beehiiv's data protection addendum (Art. 46 GDPR).
- Our email provider Migadu-Mail GmbH is based in Switzerland, for which the European Commission has issued an adequacy decision, and stores email on servers in the EU.
- Affiliate networks and partners collect click and cookie data directly from your browser, as separate controllers, when you click an affiliate link or, with your consent, when the partner script loads. Some of them are established outside the EEA, including in countries without an adequacy decision (for example, the partner script provider named in section 4 is based in Hong Kong). Their own privacy policies describe how they protect your data.
You can ask us for more information about these safeguards and for a copy of the Standard Contractual Clauses.
7. Your rights
You have the right to: access your data, rectify it, erase it, restrict processing, data portability, object to processing based on legitimate interests, and withdraw consent at any time (without affecting earlier lawful processing). Write to hello@racefare.com. You may also lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, or with the authority in your EU country.
8. Automated decisions
We do not make decisions producing legal or similarly significant effects based solely on automated processing.
9. Children
The Site is not aimed at children. The Newsletter is intended for people aged 16 or over.
10. Changes
We will publish any changes here with a new effective date; subscribers will be informed of material changes by email. This Policy is published in English (racefare.com/privacy/) and Polish (racefare.com/pl/privacy/); both versions are equivalent in content.