The following Information Clause provides mandatory information regarding the transparency of personal data processing as required under Articles 13 and 14 of the European General Data Protection Regulation (GDPR), ie. Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of Personal Data and on the free movement of such data and repealing Regulation (EC) 95/46.
Who is the Data Controller of your personal data?
The Data Controller of your personal data is Piotr Kamler Kancelaria Radcy Prawnego SKA, registered in the National Court Register under number KRS: 0000961480, NIP: 8992920876, REGON: 521532239 (further referred to as “Data Controller” or “ADO”).
What is the legal basis of data processing?
Your personal data will be processed on the following legal basis:
1. consent granted by you in one or more specific purposes (e.g. by consent given in a contact form);
2. if it is necessary for the performance of a contract to which you are a party or to take action at your request prior to the conclusion of a contract;
3. when it is necessary to fulfill the legal obligation imposed on us (in particular: tax and accounting obligations, obligations related to counteracting money laundering and terrorism financing, obligations related to avoiding the conflict of interests between clients of attorneys-at-law);
4. when it is necessary for purposes arising from legitimate interests pursued by us, unless your interests or fundamental rights and freedoms prevail over these interests; such interests are direct marketing, ensuring the security and integrity of data in our IT systems, as well as seeking possible claims or defending against such claims.
For what purpose are personal data processed?
Your personal data will be processed in order to:
1. take action on your request;
2. conclude a contract and fulfill its terms, in particular to provide legal assistance;
3. perform financial settlements;
4. fulfill legal obligations imposed on us, in particular tax and accounting obligations, obligations related to counteracting money laundering and terrorism financing, obligations related to avoiding conflicts of interest between clients of attorneys-at-law;
5. carry out our legitimate interests, in particular conducting marketing activities, pursuing claims and defending against them, preventing fraud, ensuring the authenticity, integrity and confidentiality of personal data being processed.
If you place an order, it is necessary to provide personal data, such as your name, billing address and e-mail address. If you are making an order as part of your business, you must provide your company name, registered address and tax identification number (NIP). Providing data is voluntary, but necessary to place an order.
Data provided in relation to the order are processed for the purpose of the contract (Article 6 (1) (b) of the GDPR), invoice (Article 6 (1) (c) of the GDPR), invoice included in the accounting documentation (Article 6 paragraph 1 point c of the GDPR) and for archival and statistical purposes (Article 6 (1) (f) of the RODO).
Data on orders will be processed for the time necessary to execute the order, and then until the expiry of the limitation period for claims under the concluded contract. In addition, after this date, the data can still be processed for statistical purposes. We are obligated to store invoices from your personal data for a period of 5 years from the end of the tax year in which the tax obligation arose.
When contacting us via e-mail, you naturally inform us of your e-mail address and any personal data you include in the message. If you use the contact form or calendar to arrange an on-line appointment, you must provide us with your email address, telephone number, name and surname. Providing us with these data is voluntary, but necessary to establish contact.
In such case, your data are processed based on your consent (Article 6 (1) (a) and the GDPR). The legal basis for processing after the end of contact is a justified purpose in the form of archiving correspondence for the purpose of showing its course in the future (Article 6 (1) letter f of the GDPR).
Who can be the recipient of the data?
The recipients of your personal data are all of the entities whom we can disclose (provide with) your personal data, such as public administration bodies and entities performing public tasks or acting on behalf of public administration bodies and judicial authorities, entities that process personal data in our name and other trusted entities cooperating with us, if necessary, for the purposes in which we process personal data, i.e. in particular accounting firms, other law firms, IT service providers, Poczta Polska, or courier companies.
We do not pass your personal data to third countries or international organizations.
How long is my personal data stored?
Your personal data will be kept for the period necessary to achieve the purpose of processing, i.e. for the duration of the contract concluded by you with the Administrator of Personal Data and the limitation of claims – but no longer than for 6 years; if the processing is based on consent – until the consent is withdrawn; and for the period resulting from the legal obligations imposed on us, which oblige us to store your personal data – for example, obligations under the Ordynacja Podatkowa , tax bills, the ustawa o przeciwdziałaniu praniu brudnych pieniędzy i finansowaniu terroryzmu, ustawa o radcach prawnych – but no longer than 20 years.
What are my rights as the data subject?
You have the right to request access to your personal data and the right to demand rectification, deletion, processing restrictions, as well as the right to transfer data and the right to raise objections.
You have the right to lodge a complaint with the competent supervisory body regarding the protection of personal data: the Prezes Urzędu Ochrony Danych Osobowych.
If the data is processed on the basis of your consent, you have the right to withdraw your consent at any time. This will not affect legality of the processing, which was made on the basis of your consent before its withdrawal.
Providing personal data by you is voluntary, but necessary to conclude and perform the contract, establish contact, provide services or fulfill other purposes for which we collect your personal data.
As part of the processing of your personal data, no type of automated decision-making is used.