§ PRIVACY POLICY. //

2.2. Purpose: providing access to the Website

2.2.1. Scope of data: IP address.

2.2.2. Legal basis: Article 6(1)(f) GDPR, the Law Firm’s legitimate interest in making the Website available and ensuring its security.

2.2.3. Retention period: up to 6 months from collection. If the data is needed to defend against or pursue claims, until the limitation period for those claims expires.

2.3. Purpose: providing legal services under a concluded agreement

2.3.1. Scope of data: first name, surname, telephone number, email address, details of the business activity conducted, details of the employer, principal or client, position, and other data provided in connection with the matter.

2.3.2. Legal basis: Article 6(1)(b) GDPR, performance of a contract or steps taken before entering into it, where the client is the data subject; Article 6(1)(f) GDPR, the Law Firm’s legitimate interest in performing the contract with the client, where the data concerns the client’s employees, members of governing bodies, attorneys-in-fact or other persons connected with the matter; Article 6(1)(c) GDPR, obligations under the law; Article 9(2)(f) GDPR, where special categories of data (e.g. health data) are processed in the matter, to the extent necessary for the establishment, exercise or defence of legal claims.

2.3.3. Retention period: until the limitation period for claims connected with the legal assistance provided expires, and, for documents whose retention is required by law, for the period specified in the relevant provisions.

2.4. Purpose: organising meetings, including online and telephone meetings, and recording them

2.4.1. Scope of data: first name, surname, email address, telephone number, image and voice (in the case of a recording), and other data disclosed during the meeting.

2.4.2. Legal basis: Article 6(1)(f) GDPR, the Law Firm’s legitimate interest in organising meetings with clients, prospective clients and partners and in documenting arrangements made at the meeting. The Law Firm records a meeting only after informing participants at its start. A participant may object to the recording (Article 21 GDPR).

2.4.3. Retention period: organisational data until the matter to which the meeting related is concluded. Recordings until the commissioned services have been performed, and no later than 6 months after the matter is concluded, or until an effective objection. In the event of a dispute, until the limitation period for claims expires or the proceedings are concluded.

2.5. Purpose: partnership cooperation

2.5.1. Scope of data: first name, surname, email address, telephone number, details of the business activity conducted, details of the employer, principal or client, position.

2.5.2. Legal basis: Article 6(1)(b) GDPR, performance of a contract or steps taken before entering into it, where the partner is the data subject; Article 6(1)(f) GDPR, the Law Firm’s legitimate interest in performing the contract with the partner, where the data concerns the partner’s employees or representatives.

2.5.3. Retention period: until the limitation period for claims connected with the cooperation expires. Unless there is a justified suspicion that the data will be needed to defend against or pursue claims, the data is deleted no later than 6 months after the cooperation ends.

2.6. Purpose: sending legal alerts, the newsletter and other materials, e.g. e-books

2.6.1. Scope of data: email address and, if the User provides them, first name and company name.

2.6.2. Legal basis: Article 6(1)(a) GDPR, the User’s consent given when subscribing on the Website or in another way, e.g. when downloading an e-book; consent to receive commercial information by electronic means required by Article 398 of the Act of 12 July 2024 – Electronic Communications Law.

2.6.3. Retention period: until consent is withdrawn. After consent is withdrawn, the Law Firm may keep the email address and the record of consent until the limitation period for claims expires, in order to demonstrate that the mailing was lawful (Article 6(1)(f) GDPR).

2.7. Purpose: handling enquiries sent via the contact form, by email or by telephone

2.7.1. Scope of data: first name, surname, company name, email address, telephone number, the content of the message and data contained in attachments sent.

2.7.2. Legal basis: Article 6(1)(f) GDPR, the Law Firm’s legitimate interest in replying to the enquiry.

2.7.3. Retention period: up to 1 year from the end of the correspondence, or until a decision not to use the Law Firm’s services is taken, if that happens earlier.

2.8. Purpose: issuing invoices and keeping accounting records

2.8.1. Scope of data: first name, surname, company, NIP, REGON, business address, email address.

2.8.2. Legal basis: Article 6(1)(c) GDPR, a legal obligation incumbent on the Law Firm.

2.8.3. Retention period: for the period required by law, in particular Article 86 § 1 of the Tax Ordinance (5 years from the end of the calendar year in which the tax payment deadline expired) and Article 74 of the Accounting Act.

2.9. Purpose: traffic analysis and Website statistics

2.9.1. Scope of data: IP address, statistical cookies.

2.9.2. Legal basis: Article 6(1)(a) GDPR, the User’s consent given in the cookie banner.

2.9.3. Retention period: until consent is withdrawn or the data ceases to be useful.

2.10. Purpose: defending against and pursuing claims

2.10.1. Scope of data: first name, surname, email address and other data provided during cooperation.

2.10.2. Legal basis: Article 6(1)(f) GDPR, the Law Firm’s legitimate interest in defending against and pursuing claims, where there is a justified suspicion that the data will be needed for this purpose.

2.10.3. Retention period: until the limitation period for claims expires or the proceedings are finally concluded.

2.11. Providing the data needed to conclude and perform a legal services agreement or a cooperation agreement is a condition of concluding it. Providing invoice data results from tax regulations. In other cases, providing data is voluntary. Failure to provide data may make it impossible to reply to an enquiry, organise a meeting or send alerts and the newsletter.

2.12. The Website uses Google Analytics, provided by Google Ireland Limited. Statistical data may be transferred to Google LLC in the United States. The basis for the transfer is the European Commission implementing decision of 10 July 2023 finding an adequate level of protection under the EU-US Data Privacy Framework (Article 45 GDPR).

2.12a. Where another provider of IT, email or messaging services transfers data outside the European Economic Area, the transfer takes place on the basis of a European Commission decision finding an adequate level of protection (Article 45 GDPR) or standard contractual clauses (Article 46(2)(c) GDPR).

2.13. The Law Firm does not carry out profiling or automated decision-making on the basis of personal data.

2.14. The Law Firm may obtain personal data from sources other than the data subject: from a client or partner (the employer, principal or client of that person), from the opposing party, from courts and authorities, and from public registers, e.g. the National Court Register (KRS), CEIDG, land and mortgage registers. These are identification and contact data, data on the function or position held, and information relating to the matter. The Law Firm processes them for the purposes indicated in sections 2.3, 2.5 and 2.10.

2.15. The Law Firm does not provide the information referred to in Article 14 GDPR where the data is covered by attorney-client privilege (Article 14(5)(d) GDPR).

2.16. Information obtained in connection with the provision of legal services is covered by attorney-client privilege under Article 6 of the Act of 26 May 1982 – Law on the Bar.