1. Processing of Data of Customers with Flat-Rate Packages and Long-Term Contracts

Purpose of Data Processing	Scope of Data Processing	Legal Basis	Retention Period
Performance of the Agreement for the provision of tax, accounting, and legal advisory services	Identification data (first name, last name, company name, tax identification number, personal identification number, statistical number), contact details (address, e-mail, telephone number) and financial and accounting data necessary for the performance of the service.	Art. 6(1)(b) (Necessary for the performance of the contract)	For the duration of the contract.
Compliance with legal obligations (tax, accounting, reporting)	All accounting and tax documentation (invoices, VAT records, declarations).	Art. 6 sec. 1 lit. c (Legal obligation) resulting from the Accounting Act and the Tax Ordinance.	5 years from the end of the calendar year in which the tax payment deadline expired (for a given settlement period).
Determination, investigation or defense against claims	Identification data, financial data, correspondence, contract records.	Art. 6(1)(f) (Legitimate interest of the ADO)	Until the expiry of the limitation period for claims arising from the contract or civil law provisions (usually 3 or 6 years).

2. Data Processing in the Online Consultation Booking System

Purpose of Data Processing	Scope of Data Processing	Legal Basis	Retention Period
Handling consultation appointment bookings and pre-contractual activities	Name and surname, e-mail address, telephone number, selected date/time, description of the case/issue.	Art. 6(1)(b) (Pre-contractual measures taken at the request of the data subject).	1 year from the date of booking, if no contract for the Law Firm's services has been concluded, or until the claims related to the booking process become time-barred.
Unintentional acquisition of Sensitive Data (Art. 9 of the GDPR)	Information voluntarily disclosed by the User in the “Case description” field (e.g., health data related to benefits).	Art. 9(2)(f) (Investigation, establishment or defense of claims) or Art. 9(2)(a) (Explicit consent of the User, if necessary to handle the case).	For the period necessary to achieve the legal purpose.

NOTE REGARDING THE “CASE DESCRIPTION” FIELD: When using the “Case description” field in the booking form, the User is asked to minimize the scope of data disclosed, and in particular not to provide special category data (sensitive data referred to in Article 9 of the GDPR), unless it is absolutely necessary for an initial understanding of the problem. If such data is disclosed, the Law Firm will process it solely for the purpose of performing the order or on the basis of explicit consent.

The Law Firm strives to minimize the transfer of personal data outside the EEA.

External Services (e.g., Google Maps)

The website uses external services that may require a one-time transfer of your IP address outside the EEA (e.g., to the US), in particular the interactive Google Maps located in the contact section.

Legal basis for transfer: The transfer is necessary for the purposes of the legitimate interests pursued by the Controller (Article 6(1)(f) of the GDPR), consisting in providing Users with the possibility to quickly verify the location of the Law Firm and plan their journey.

The Controller ensures that the transfer is carried out in compliance with all legal safeguards, in particular through the use of Standard Contractual Clauses (SCC) approved by the European Commission.

The website only uses cookies that are necessary for its proper and secure operation.

1. Types of Cookies Used

The Law Firm does not use analytical or marketing cookies (including for profiling and targeted advertising purposes).

The Website uses only:

• Necessary (Technical) Cookies: These files are necessary to ensure the basic functions of the Website, including maintaining the User's session, remembering language preferences and technical settings, and ensuring security.

2. Legal Basis for the Use of Cookies

Data processing using necessary cookies is based on the legitimate interest of the Administrator (Art. 6(1)(f) of the GDPR), which is to ensure the secure and technically effective functioning of the Website and the booking system.

3. Managing Cookies

The User can manage cookies through their browser settings. However, blocking necessary cookies may cause the Website to malfunction and prevent the use of some of its features, including the booking system.

Every data subject has the right to:

• Access to data (Art. 15 of the GDPR): The right to obtain confirmation from the Controller as to whether their personal data is being processed and, if so, the right to access it and to obtain information about the purposes, categories of recipients, and storage period.
• Rectification of data (Art. 16 of the GDPR): The right to request the immediate rectification of inaccurate personal data and its completion.
• Right to erasure (Art. 17 GDPR – “Right to be forgotten”): This right may be exercised if the data is no longer necessary for the purposes for which it was collected. NOTE: This right is limited to the extent that data processing is necessary to fulfill a legal obligation (e.g., a 5-year retention period for accounting and tax records) to which the Controller is subject.
• Restrictions on processing (Art. 18 GDPR): The right to request restriction of data processing in cases specified in the GDPR (e.g., questioning the accuracy of data).
• Data portability (Art. 20 GDPR): The right to receive data in a structured, commonly used, machine-readable format (if processing is based on consent or a contract).
• Objection (Art. 21 GDPR): The right to object to data processing based on the legitimate interest of the Controller (Art. 6(1)(f) GDPR).

Right to lodge a complaint

If the data subject considers that the processing of personal data violates the provisions of the GDPR, they have the right to lodge a complaint with the supervisory authority in Poland:

President of the Personal Data Protection Office (UODO)
ul. Stawki 2, 00-193 Warsaw