1. Data Controller
The Data Controller within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "GDPR") is:
Zofia Urzędowska, Attorney-at-Law, operating a law office
ul. Syta 94h/134, 02-993 Warsaw, Poland
Email: kancelaria@urzedowska.com
2. Purposes and Legal Bases of Processing
We process your personal data only to the extent necessary to fulfil a specific purpose, on the basis of the GDPR provisions indicated below.
a) Contact via the website form
Data (name, email, optionally phone, message content) is processed in order to respond to your enquiry and potentially establish cooperation. Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract) and Art. 6(1)(f) GDPR (legitimate interest of the Controller — handling enquiries).
b) Provision of legal services
Data of clients and other persons related to a matter is processed for the performance of a legal services contract. Legal basis: Art. 6(1)(b) GDPR and, to the extent obligations arise from Polish bar regulations, Art. 6(1)(c) GDPR.
c) Tax and accounting obligations
Legal basis: Art. 6(1)(c) GDPR in conjunction with the Polish Accounting Act and tax law.
d) Establishment, exercise or defence of legal claims
Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
3. Attorney-Client Privilege
Personal data processed in the course of providing legal services is covered by attorney-client privilege under Art. 6 of the Polish Bar Act of 26 May 1982. This privilege is unlimited in time and cannot be waived, save for the exceptions provided by law.
4. Recipients of Data
Your data may be transferred to the following categories of recipients:
- IT service providers, including website hosting and contact form processing (Cloudflare, Inc. — transfers outside the EEA based on Standard Contractual Clauses);
- the accounting office serving the law firm;
- public authorities — to the extent and in cases required by law.
5. Transfers Outside the EEA
We use service providers based outside the European Economic Area (e.g. Cloudflare). Transfers are made on the basis of Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR).
6. Retention Period
- contact form data — for the time necessary to respond and arrange follow-up, no longer than 12 months from the last contact;
- client data — for the duration of the engagement and for the period required by law (in particular, until the expiry of limitation periods for claims and accounting record retention periods, generally 5–10 years);
- data processed on the basis of consent — until consent is withdrawn.
7. Your Rights
You have the right to:
- access your data (Art. 15 GDPR);
- rectification (Art. 16 GDPR);
- erasure (Art. 17 GDPR) — subject to limitations arising from attorney-client privilege and statutory retention obligations;
- restriction of processing (Art. 18 GDPR);
- data portability (Art. 20 GDPR);
- object to processing (Art. 21 GDPR);
- withdraw consent at any time (where processing is based on consent);
- lodge a complaint with a supervisory authority — in Poland: the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warsaw).
To exercise your rights, please contact: kancelaria@urzedowska.com.
8. Voluntary Provision of Data
Providing your data is voluntary, but necessary to establish contact, conclude a contract, or perform legal services. Without such data, contact or contract conclusion is not possible.
9. Profiling and Automated Decision-Making
Your data is not subject to profiling or automated decision-making within the meaning of Art. 22 GDPR.
10. Cookies
The website uses only strictly necessary (functional) cookies. We do not use analytics or marketing cookies. The website loads fonts from Google Fonts (Google LLC, USA) — in this process, the visitor's IP address may be transmitted to Google. You may manage cookies in your browser settings.
Cookie Categories
- Session and technical cookies — required for website operation; deleted when the browser is closed or after a short validity period.
11. Security
We apply appropriate technical and organisational measures to protect personal data from unauthorised disclosure, loss, or destruction (Art. 32 GDPR), including encrypted connections (HTTPS) and access limited to authorised persons.
12. Changes to the Privacy Policy
This policy may be updated. The current version is always available on the website under "Privacy Policy". The date of last update is shown at the beginning of this document.