PRIVACY AND COOKIES POLICY
OF THE KANCELARIA-KARPIUK.PL WEBSITE

§ 1. General information

1. This Privacy and Cookies Policy sets out the rules for the processing of personal data and the rules concerning cookies on the website available at www.kancelaria-karpiuk.pl (the "Website").

2. The controller of personal data is:

Krystian Karpiuk Kancelaria Radcy Prawnego
ul. Wschodnia 24/3, 62-030 Luboń, Poland (correspondence address)
Tax identification number (NIP): 6692176958
e-mail: biuro@kancelaria-karpiuk.pl
telephone: +48 508 584 278

hereinafter the "Controller".

3. The Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), the Polish Personal Data Protection Act and other applicable provisions of law.

§ 2. Contacting the Controller

On matters relating to the protection of personal data you may contact the Controller:

1. by e-mail: biuro@kancelaria-karpiuk.pl

2. by telephone: +48 508 584 278

3. by post to: ul. Wschodnia 24/3, 62-030 Luboń, Poland

§ 3. Purposes and legal bases of processing

Contact through the contact form
Data is processed in order to handle correspondence and to respond to the enquiry.
Legal basis: Article 6(1)(f) GDPR (the legitimate interest of the Controller consisting in handling correspondence).

Contact by telephone or e-mail
Data is processed in order to handle correspondence and to conduct communication.
Legal basis: Article 6(1)(f) GDPR.

Steps taken prior to entering into a contract
Where the enquiry concerns cooperation or the provision of legal assistance.
Legal basis: Article 6(1)(b) GDPR.

Compliance with legal obligations
In particular obligations arising from tax and accounting provisions or from the rules governing the practice of the profession of attorney-at-law (radca prawny).
Legal basis: Article 6(1)(c) GDPR.

Establishment, exercise or defence of claims
Legal basis: Article 6(1)(f) GDPR.

§ 4. Scope of data processed

The Controller may process in particular:

1. first name and surname,

2. e-mail address,

3. telephone number (where provided voluntarily),

4. company name (where provided),

5. the content of the message,

6. data provided voluntarily in correspondence,

7. IP address and technical data of the device and browser.

The Controller does not require personal data to be provided to an extent broader than necessary to achieve the purpose of the contact.

§ 5. Recipients of data

Personal data may be disclosed to entities supporting the Controller in the conduct of its activity, in particular:

1. providers of hosting and server infrastructure,

2. providers of e-mail services,

3. providers of IT services,

4. entities providing accounting or advisory services,

5. entities authorised under provisions of law.

Data is disclosed solely to the extent necessary to achieve the specified purposes and on the basis of data processing agreements or other mechanisms provided for by the GDPR.

§ 6. Transfers of data outside the European Economic Area

Where the Controller uses the services of technology providers established outside the European Economic Area, data may be transferred outside the EEA solely on the basis of the mechanisms provided for by the GDPR, in particular a European Commission adequacy decision or standard contractual clauses.

§ 7. Retention periods

Correspondence
Data is retained for the period necessary to conduct the communication and for the limitation period for any claims, and in any event for not less than 3 years from the end of the correspondence.

Data relating to the conclusion or performance of a contract
Data is retained for the term of the contract and for the period required by provisions of law (in particular tax and accounting provisions — as a rule 5 years).

Data processed on the basis of a legitimate interest
Data is retained until an effective objection is raised or until the Controller's legitimate interest ceases to exist.

§ 8. Rights of data subjects

The data subject has the right to:

1. access the data and obtain a copy of it,

2. rectification of the data,

3. erasure of the data (the "right to be forgotten"),

4. restriction of processing,

5. data portability,

6. object to processing based on a legitimate interest,

7. withdraw consent at any time (where processing is based on consent),

8. lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).

To exercise the above rights, please contact the Controller at: biuro@kancelaria-karpiuk.pl.

§ 9. Automated decision-making

The Controller does not apply profiling or automated decision-making producing legal effects or similarly significantly affecting data subjects, as referred to in Article 22 GDPR.

§ 10. Cookies

The Website uses cookies — small text files stored on the user's device while using the Website.

§ 11. Types of cookies used

Necessary cookies
They enable the proper functioning of the Website (for example session handling and technical security measures). These cookies are necessary for the Website to function and do not require the user's consent.

Analytics cookies
In its current version the Website does not use analytics cookies. Should analytics tools be implemented in the future, this Policy will be updated and users will be informed of the change in accordance with the requirements of law.

§ 12. Managing cookies

The user may manage cookies through the settings of their web browser. Most browsers allow the user to:

1. block all or selected cookies,

2. delete cookies stored on the device,

3. be notified of an attempt to store a cookie.

Restricting the use of necessary cookies may affect the functioning of the Website.

§ 13. Amendments to the Policy

The Controller may amend this Policy in the event of changes in the law, technological changes or changes to the functionality of the Website. The current version of the Policy is always available on the Website together with the date of its last update.