Privacy Policy

  1. 1.
    This Privacy Policy sets out the rules for processing personal data obtained through the website adwokatpiwko.pl (hereinafter: the “Website”).
  2. 2.
    The owner of the Website and, at the same time, the data controller is Kancelaria Adwokacka Adwokat Michał Piwko (Law Office of Attorney Michał Piwko), Tax ID (NIP): 663-188-98-65, hereinafter referred to as the Controller.
  3. 3.
    Personal data collected by the Controller through the Website is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), also referred to as the GDPR.
  4. 4.
    The Controller takes particular care to respect the privacy of Clients visiting the Website.

§ 1. Type of data processed, purposes and legal basis

  1. 1.
    The Controller collects information about natural persons performing legal acts not directly related to their business, natural persons conducting business or professional activity in their own name, and natural persons representing legal persons or organisational units without legal personality to which the law grants legal capacity, conducting business or professional activity in their own name, hereinafter collectively referred to as Clients.
  2. 2.
    Clients’ personal data is collected when they use the contact form service on the Website, for the purpose of performing a contract for services provided electronically. Legal basis: necessity for the performance of a contract for the provision of the contact form service (Article 6(1)(b) GDPR).

    The contact form is operated through the external service Web3Forms (web3forms.com). Data entered in the form is sent to Web3Forms and then forwarded by e-mail to the Controller’s address. Web3Forms processes this data as a processor, for the purpose of delivering the message to the Controller. The detailed rules on how this provider processes data are set out in its privacy policy, available at web3forms.com.

  3. 3.
    When using the contact form service, the Client provides the following data:
    • first name and surname,
    • e-mail address,
    • telephone number (optional field),
    • the content of the message.
  4. 4.
    While using the Website, additional information may be collected, in particular: the IP address assigned to the Client’s computer or the external IP address of the Internet provider, the domain name, the browser type, the time of access, and the type of operating system.
  5. 5.
    Navigation data may also be collected from Clients, including information about the links and references they choose to click or other actions taken on the Website. Legal basis – legitimate interest (Article 6(1)(f) GDPR), consisting in making it easier to use services provided electronically and improving the functionality of these services.
  6. 6.
    Providing personal data to the Controller is voluntary.

§ 2. Who the data is shared with or entrusted to, and how long it is stored

  1. 1.
    The Client’s personal data is transferred to service providers used by the Controller to run the Website. Depending on contractual arrangements and circumstances, service providers to whom personal data is transferred either follow the Controller’s instructions as to the purposes and means of processing such data (processors), or determine the purposes and means of processing themselves (controllers).
    1. 1.1.
      Processors. The Controller uses providers that process personal data solely on the Controller’s instructions. These include:
      1. 1.1.1.
        Cloudflare, Inc., based in San Francisco (USA) – provider of the Website hosting service,
      2. 1.1.2.
        Web3Forms – provider of the contact form handling service,
      3. 1.1.3.
        the Controller’s e-mail service provider,
      4. 1.1.4.
        entities providing accounting services to the Controller and, if implemented, providers of Website traffic analysis systems.
    2. 1.2.
      Controllers. The Controller uses providers that do not act solely on its instructions and themselves determine the purposes and means of using Clients’ personal data. They provide electronic payment and banking services. Google Ireland Limited, based in Dublin (Ireland), is also an independent controller with regard to the Google Maps map and the Google Fonts typefaces displayed on the Website.
  2. 2.
    Location. Service providers are based in Poland, in other countries of the European Economic Area (EEA) and in the United States. To the extent that personal data is transferred outside the EEA, the transfer is based on a European Commission adequacy decision (EU-U.S. Data Privacy Framework, Article 45 GDPR) or on standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR).
  3. 3.
    Clients’ personal data is stored:
    1. 3.1.
      Where the processing of personal data is based on consent, the Client’s personal data is processed by the Controller until consent is withdrawn and, after withdrawal, for a period corresponding to the limitation period for claims that the Controller may raise or that may be raised against it. Unless a specific provision states otherwise, the limitation period is six years, and for claims for periodic benefits and claims related to running a business – three years.
    2. 3.2.
      Where the processing of data is based on the performance of a contract, the Client’s personal data is processed by the Controller for as long as is necessary to perform the contract and thereafter for a period corresponding to the limitation period for claims. Unless a specific provision states otherwise, the limitation period is six years, and for claims for periodic benefits and claims related to running a business – three years.
  4. 4.
    Upon request, the Controller makes personal data available to authorised state authorities, in particular to the organisational units of the Public Prosecutor’s Office, the Police, the President of the Personal Data Protection Office, the President of the Office of Competition and Consumer Protection or the President of the Office of Electronic Communications.

§ 3. Cookies, IP address

  1. 1.
    The Website uses small files called cookies. They are saved by the Controller on the end device of the person visiting the Website, if the web browser allows it. A cookie usually contains the name of the domain it comes from, its “expiration time” and an individual, randomly selected number identifying the file. Information collected using files of this type helps to adapt the products offered by the Controller to the individual preferences and actual needs of people visiting the Website.
  2. 2.
    The Controller uses two types of cookies:
    1. 2.1.
      Session cookies: after the end of the browser session or after the computer is switched off, the saved information is deleted from the device’s memory. The session cookie mechanism does not allow any personal data or confidential information to be collected from Clients’ computers.
    2. 2.2.
      Persistent cookies: are stored in the memory of the Client’s end device and remain there until they are deleted or expire. The persistent cookie mechanism does not allow any personal data or confidential information to be collected from Clients’ computers.
  3. 3.
    The Controller uses its own cookies for the purpose of:
    1. 3.1.
      analyses, research and audience auditing, in particular to create anonymous statistics that help understand how Clients use the Website, which makes it possible to improve its structure and content.
  4. 4.
    The Controller uses third-party cookies for the purpose of:
    1. 4.1.
      displaying, on the information pages of the Website, a map showing the location of the Controller’s office, using the maps.google.com service (third-party cookie controller: Google Ireland Limited, based in Dublin, Ireland).
  5. 5.
    The cookie mechanism is safe for the computers of Clients visiting the Website. In particular, it is not possible for viruses or other unwanted or malicious software to enter Clients’ computers this way. Nevertheless, Clients can limit or disable cookie access to their computers in their browsers. If this option is used, the Website can still be used, except for functions that by their nature require cookies.
  6. 6.
    The Controller may collect Clients’ IP addresses. An IP address is a number assigned to the computer of a person visiting the Website by the Internet service provider. The IP number enables access to the Internet. In most cases it is assigned to the computer dynamically, i.e. it changes with each connection to the Internet, and for this reason it is commonly treated as non-personal identifying information. The IP address is used by the Controller when diagnosing technical problems with the server, creating statistical analyses (e.g. determining which regions generate the most visits), as information useful in administering and improving the Website, and for security purposes and the possible identification of unwanted automated programs that browse the Website’s content and place a load on the server.

§ 4. Rights of data subjects

  1. 1.
    Right to withdraw consent – legal basis: Article 7(3) GDPR.
    1. 1.1.
      The Client has the right to withdraw any consent they have given.
    2. 1.2.
      Withdrawal of consent takes effect from the moment consent is withdrawn.
    3. 1.3.
      Withdrawal of consent does not affect the processing carried out by the Controller lawfully before its withdrawal.
    4. 1.4.
      Withdrawal of consent does not entail any negative consequences for the Client, but it may prevent further use of services or functionalities that the Controller may lawfully provide only with consent.
  2. 2.
    Right to object to data processing – legal basis: Article 21 GDPR.
    1. 2.1.
      The Client has the right to object at any time – on grounds relating to their particular situation – to the processing of their personal data, including profiling, if the Controller processes their data on the basis of a legitimate interest, e.g. marketing of the Controller’s products and services, keeping statistics on the use of individual functionalities of the Website, making the Website easier to use, and satisfaction surveys.
    2. 2.2.
      Unsubscribing by e-mail from marketing communications concerning products or services will constitute the Client’s objection to the processing of their personal data, including profiling, for these purposes.
    3. 2.3.
      If the Client’s objection proves justified and the Controller has no other legal basis for processing the personal data, the Client’s personal data whose processing the Client objected to will be deleted.
  3. 3.
    Right to erasure (“right to be forgotten”) – legal basis: Article 17 GDPR.
    1. 3.1.
      The Client has the right to request the erasure of all or some of their personal data.
    2. 3.2.
      The Client has the right to request the erasure of personal data if:
      1. 3.2.1.
        the personal data is no longer necessary for the purposes for which it was collected or processed,
      2. 3.2.2.
        they have withdrawn a specific consent, to the extent that the personal data was processed on the basis of their consent,
      3. 3.2.3.
        they have objected to the use of their data for marketing purposes,
      4. 3.2.4.
        the personal data is processed unlawfully,
      5. 3.2.5.
        the personal data must be erased to comply with a legal obligation under Union law or the law of the Member State to which the Controller is subject,
      6. 3.2.6.
        the personal data was collected in connection with the offering of information society services.
    3. 3.3.
      Notwithstanding a request for erasure of personal data, in connection with an objection or withdrawal of consent, the Controller may retain certain personal data to the extent that processing is necessary for the establishment, exercise or defence of legal claims, as well as to comply with a legal obligation requiring processing under Union law or the law of the Member State to which the Controller is subject. This applies in particular to personal data including: first name, surname and e-mail address, which are retained for the purpose of handling complaints and claims related to the use of the Controller’s services, and additionally the residential/ correspondence address and order number, which are retained for the purpose of handling complaints and claims related to concluded sales contracts or the provision of services.
  4. 4.
    Right to restriction of processing – legal basis: Article 18 GDPR.
    1. 4.1.
      The Client has the right to request the restriction of processing of their personal data. Until it is considered, submitting the request prevents the use of certain functionalities or services whose use would involve processing the data covered by the request. The Controller will also not send any communications, including marketing communications.
    2. 4.2.
      The Client has the right to request the restriction of the use of personal data in the following cases:
      1. 4.2.1.
        when they contest the accuracy of their personal data – the Controller then restricts its use for the time needed to verify the accuracy of the data, but no longer than 7 days,
      2. 4.2.2.
        when the processing of data is unlawful and, instead of erasure, the Client requests the restriction of its use,
      3. 4.2.3.
        when the personal data is no longer necessary for the purposes for which it was collected or used, but the Client needs it for the establishment, exercise or defence of legal claims,
      4. 4.2.4.
        when they have objected to the use of their data – the restriction then applies for the time needed to consider whether, due to their particular situation, the protection of the Client’s interests, rights and freedoms overrides the interests pursued by the Controller in processing the Client’s personal data.
  5. 5.
    Right of access to data – legal basis: Article 15 GDPR.
    1. 5.1.
      The Client has the right to obtain confirmation from the Controller as to whether it processes their personal data and, if so, the Client has the right to:
      1. 5.1.1.
        access their personal data,
      2. 5.1.2.
        obtain information about the purposes of processing, the categories of personal data processed, the recipients or categories of recipients of the data, the planned period of storage of the Client’s data or the criteria for determining that period (where it is not possible to specify the planned processing period), the rights the Client has under the GDPR and the right to lodge a complaint with a supervisory authority, the source of the data, automated decision-making, including profiling, and the safeguards applied in connection with the transfer of the data outside the European Union,
      3. 5.1.3.
        obtain a copy of their personal data.
  6. 6.
    Right to rectification – legal basis: Article 16 GDPR.
    1. 6.1.
      The Client has the right to request that the Controller rectify without delay any inaccurate personal data concerning them. Taking into account the purposes of processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement, by sending a request to the e-mail address indicated in § 5(2) of this Privacy Policy.
  7. 7.
    Right to data portability – legal basis: Article 20 GDPR.
    1. 7.1.
      The Client has the right to receive the personal data they have provided to the Controller and then transmit it to another data controller of their choice. The Client also has the right to request that the Controller transmit the personal data directly to such a controller, where technically feasible. In such a case, the Controller will send the Client’s personal data as a CSV file, which is a commonly used, machine-readable format that allows the data received to be transmitted to another data controller.
  8. 8.
    When the Client exercises any of the above rights, the Controller fulfils the request or refuses to fulfil it without undue delay, and in any event no later than one month after receiving it. If, however, due to the complex nature of the request or the number of requests, the Controller is unable to fulfil the request within one month, it will fulfil it within a further two months, having first informed the Client, within one month of receiving the request, of the intended extension and the reasons for it.
  9. 9.
    The Client may submit complaints, enquiries and requests to the Controller regarding the processing of their personal data and the exercise of their rights.
  10. 10.
    The Client has the right to lodge a complaint with the President of the Personal Data Protection Office (Poland) regarding an infringement of their right to the protection of personal data or other rights granted under the GDPR.

§ 5. Changes to the Privacy Policy

  1. 1.
    The Privacy Policy may change, and the Controller is not obliged to give notice of such changes.
  2. 2.
    Questions concerning the Privacy Policy should be sent to: michal.piwko11@gmail.com

This is an English translation provided for convenience. In case of any discrepancies, the Polish version of the Privacy Policy prevails.