Privacy notice

Who is responsible

The controller of your personal data is MRServices, ul. Ekologiczna 3, 05-816 Reguły, Poland, tax ID (NIP) 5833067752, the operator of CarCostByState ("we"). Because we are based in the European Union, we handle all visitors' data under the EU General Data Protection Regulation (GDPR), wherever you live.

Privacy questions and requests: privacy@carcostbystate.com.

What we process and why

Using the calculators. The prices, trade-in values and other amounts you enter are calculated in your browser. They are not sent to us or stored by us.

Browsing the site. To deliver pages and protect the site from attacks, our hosting and content delivery provider processes your IP address, browser details and the pages you request. We do not use these to build a profile of you. Legal basis: our legitimate interest in running a secure website (GDPR Art. 6(1)(f)).

E-mails to us. If you write to us, we process your e-mail address, your name if you give it, your message and our replies, to answer you. Legal basis: taking steps you asked for (Art. 6(1)(b)) or our legitimate interest in answering messages (Art. 6(1)(f)).

Advertising. We show ads served by Google AdSense, run by Google Ireland Limited for visitors in the European Economic Area and Switzerland and by Google LLC elsewhere. To serve and measure ads and to prevent fraud, Google and its advertising partners process your IP address, device and browser details, the page you are on and identifiers stored in cookies. Ads can be personalized, meaning based on your earlier visits to this and other websites, or non-personalized, meaning based on the page and your general location. Google decides how it uses this data and acts as a separate controller under its own privacy policy. Legal basis: your consent where the law requires it (GDPR Art. 6(1)(a)), otherwise our legitimate interest in funding a free website (Art. 6(1)(f)).

We do not sell your personal data for money, and we do not use it for automated decisions about you. We ourselves do not see or receive the data Google collects through ads.

Cookies and similar technologies

We set no cookies of our own and use no local storage. Our hosting provider may set its own security cookies to tell people from bots. We use no analytics or social-media cookies.

Third-party vendors, including Google, use cookies to serve ads based on your earlier visits to this website or other websites. Google's advertising cookies let Google and its partners serve ads to you based on your visits to this site and other sites on the internet. Where the law requires your consent to these cookies, we ask for it before they are set, and you can withdraw it at any time.

You can turn off personalized advertising in Google's My Ad Center, and opt out of personalized ads from other participating vendors at aboutads.info. You can also block or delete cookies in your browser settings. How Google uses data from sites that show its ads is explained at policies.google.com/technologies/partner-sites.

Who processes your data for us

• Cloudflare, Inc. (United States), our hosting and content delivery provider, which serves the site and protects it from attacks.
• Cloudflare, which forwards e-mail sent to our addresses, and our mailbox provider, where we read and answer it.

Google, which serves the ads, is not our processor: it decides itself how it uses data from ads, as described above.

These providers may be in the United States, outside the European Economic Area. Transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses in the provider's data processing terms. We may also disclose data when the law requires it, for example to a court or authority.

How long we keep data

• Server and security logs: as long as our provider keeps them for security, normally a few weeks.
• Advertising cookies: for the period Google sets for each cookie, as described in Google's cookie information, unless you delete them sooner.
• E-mails: up to three years after our last exchange, to handle follow-up questions and any claims, unless you ask us to delete them sooner and no legal reason requires us to keep them.

Your rights

Under the GDPR you can ask for access to your data, its correction or deletion, restriction of processing and a copy in a portable format, and you can object to processing based on our legitimate interest. Write to privacy@carcostbystate.com; we answer within one month. You can also complain to a supervisory authority, in Poland the President of the Personal Data Protection Office (UODO), or to the authority where you live.

If you live in a US state with its own privacy law, such as California, you have similar rights to know about and delete your data. Some of these laws treat personalized advertising based on cookies as "selling" or "sharing" personal data. You can opt out of it with the Google and aboutads.info links above, by blocking third-party cookies in your browser, or by writing to privacy@carcostbystate.com.

Changes

We will post any change here with a new date. Questions: hello@carcostbystate.com.