In accordance with Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), we provide the following information on how we process personal data.

I. Data controller

The controller of personal data is legal counsel (radca prawny) Paweł Iwaniak, who runs Kancelaria Radcy Prawnego Paweł Iwaniak (the “Law Office”), address for correspondence: ul. Głowackiego 35/61, 20-060 Lublin, Poland, tel. +48 501 367 504, e-mail: kontakt@obslugaprawna.pro. You can contact the controller using these details in all matters relating to personal data.

II. Purposes and legal bases of processing

We process personal data in order to:

  1. respond to enquiries sent via the contact form, by e-mail or by phone and take steps prior to entering into a contract – Article 6(1)(b) GDPR (where the enquiry concerns entering into a contract) or Article 6(1)(f) GDPR (the controller’s legitimate interest in responding);
  2. provide legal assistance and perform the contract with the client – Article 6(1)(b) GDPR;
  3. comply with the controller’s legal obligations, in particular tax and accounting obligations – Article 6(1)(c) GDPR;
  4. establish, pursue or defend claims – Article 6(1)(f) GDPR;
  5. compile statistics on visits to obslugaprawna.pro and ensure its security – Article 6(1)(f) GDPR and, for non-essential cookies, on the basis of consent (Article 6(1)(a) GDPR);
  6. send information about the Law Office’s services and the newsletter – on the basis of consent (Article 6(1)(a) GDPR);
  7. conduct recruitment – Article 6(1)(b) and (c) GDPR in conjunction with Article 221 of the Polish Labour Code and, for data provided voluntarily beyond what the law requires, on the basis of consent (Article 6(1)(a) GDPR).

III. Recipients of data

Data may be disclosed to entities that support the Law Office and process data on its behalf, in particular providers of hosting, e-mail and IT services, the accounting office and providers of analytics tools (Google). Data may also be disclosed to courts, authorities and other entities where required by law or necessary to handle a client’s matter.

IV. Transfers outside the European Economic Area

The use of Google tools may involve the transfer of data to the United States. Such transfers are based on the European Commission’s adequacy decision (EU-U.S. Data Privacy Framework) or on standard contractual clauses approved by the European Commission.

V. Retention period

  1. Data provided in an enquiry that did not lead to a contract – until the enquiry has been answered and then for the limitation period of any claims.
  2. Client data – for the duration of the legal assistance and then for the limitation period of claims and the period required by tax and accounting law, but no longer than 10 years after the matter has been concluded.
  3. Data processed on the basis of consent – until consent is withdrawn.
  4. Data of job applicants – until the end of the recruitment process and, with the applicant’s consent, for future recruitment, for no longer than 12 months.

VI. Rights of data subjects

Every data subject has the right to:

  1. access their data and obtain a copy;
  2. rectification;
  3. erasure;
  4. restriction of processing;
  5. data portability;
  6. object to processing based on the controller’s legitimate interest;
  7. withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

Requests can be sent by e-mail to kontakt@obslugaprawna.pro or by post to the Law Office’s address. These rights may be limited by the legal counsel’s duty of professional secrecy.

Every data subject also has the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland) if they consider that the processing of their data infringes data protection law.

VII. Provision of data

Providing data is voluntary but necessary to respond to an enquiry, enter into and perform a contract, or take part in recruitment. Providing data required by law is mandatory.

VIII. Automated decision-making

Personal data are not used for automated decision-making, including profiling.

IX. Final provisions

In matters not regulated herein, the GDPR and the Polish Act of 10 May 2018 on the protection of personal data apply. Details on cookies are set out in the Cookies policy, and on the website in the Privacy policy.

Last updated: 9 November 2026.

Leave a comment