Privacy policy

Below we explain who processes the personal data provided to the law office (through this website, by phone, by e-mail and in connection with handling a case), for what purpose and on what legal basis, how long we keep it and what rights you have. We also describe the cookies used by the website.

1. Data controller

The controller of personal data is advocate Konrad Wysocki, running a business under the name:

• Kancelaria Adwokacka Adwokat Konrad Wysocki
• ul. Koperkowa 1 lok. 1
• 81-589 Gdynia
• NIP: 9581617852
• REGON: 381109670

Contact on personal data matters: [email protected], tel. 785 950 983, or in writing to the law office's address.

2. What data we process

• data from the contact form: full name, phone number, e-mail address, type of matter and the content of the message,
• data provided in connection with handling a case, to the extent necessary for it: identification data (e.g. PESEL number, identity card number, address), contact details, information about your family, financial and professional situation, and in some cases also health data and data relating to criminal convictions and offences,
• billing data: invoice details, bank account number,
• technical data: the IP address from which the form was sent (we record it only to limit spam) and data recorded automatically in server logs (IP address, browser type, date and time of the visit),
• data stored in cookies (see section 9).

3. Purposes and legal bases of processing

• replying to a message sent via the form, by e-mail or by phone: Article 6(1)(b) GDPR (steps taken prior to entering into a contract) and Article 6(1)(f) GDPR (our legitimate interest in conducting correspondence),
• providing legal assistance and performing the contract: Article 6(1)(b) GDPR, and for special categories of data (e.g. health data in compensation cases) Article 9(2)(f) GDPR; data relating to criminal convictions and offences in criminal cases are processed under Article 10 GDPR in conjunction with the Law on the Bar (Prawo o adwokaturze) and the rules of criminal procedure,
• compliance with legal obligations, including tax, accounting and anti-money laundering obligations: Article 6(1)(c) GDPR,
• establishing, pursuing or defending claims: Article 6(1)(f) GDPR,
• ensuring the security and proper functioning of the website: Article 6(1)(f) GDPR,
• visitor statistics in Google Analytics: only on the basis of your consent (Article 6(1)(a) GDPR), if the law office enables them; you may withdraw your consent at any time without affecting the lawfulness of processing carried out before its withdrawal.

4. Is providing data mandatory

Providing data is voluntary but necessary for us to reply to your message or to take on your case. Without a phone number or e-mail address we will not be able to reply. Data needed to conclude the contract and for billing are a condition of concluding it.

5. Legal professional privilege

Everything an advocate learns in connection with providing legal assistance is covered by legal professional privilege (tajemnica adwokacka) under the Law on the Bar. Data covered by privilege are not disclosed to anyone except in cases expressly provided for by law.

Data of third parties (e.g. the opposing party or witnesses) obtained in connection with handling a case are processed within the limits of professional secrecy. To that extent the information obligation towards those persons does not apply (Article 14(5)(d) GDPR).

6. Who we share data with

Only to the extent necessary and, where they act on our behalf, under data processing agreements:

• providers of hosting, e-mail and IT services,
• the SMS gateway provider, if we confirm contact by text message,
• Cloudflare: traffic to the website passes through its network, which protects the website against attacks and bots,
• payment operators, if you pay through the website: PayPro S.A. (Przelewy24), mBank S.A. (Paynow), PayU S.A., PayPal (Europe) S.à r.l. et Cie, S.C.A.; they receive the data needed to process the payment (name, e-mail, amount and title), and you give your card or bank login details directly to them,
• Google Ireland Limited as the provider of Google Analytics, only if you consent to statistics,
• the accounting office, postal and courier operators and banks, to the extent needed for billing and correspondence,
• courts, authorities and other bodies, where required by law or necessary for handling the case.

7. Transfers of data outside the EEA

As a rule, we do not transfer data outside the European Economic Area. Google and Cloudflare services may be an exception; in that case data may be transferred to the USA on the basis of the European Commission's adequacy decision (EU-US Data Privacy Framework).

8. How long we keep data

• messages that did not lead to a contract: up to 12 months from the last contact,
• case files: for the period required by the rules governing the practice of advocates, and in any case at least until the limitation periods for claims related to the case have expired (in criminal cases, until the conviction is expunged),
• documentation required by anti-money laundering legislation: 5 years, counted from the first day of the year following the year in which our cooperation ended,
• accounting records: 5 years from the end of the calendar year in which the tax payment deadline fell,
• data in Google Analytics (if you consent): no longer than 14 months,
• server logs: in accordance with the hosting provider's policy, usually up to 12 months.

After that time we delete or anonymise the data.

9. Cookies

Cookies are small text files stored on your device. The website uses:

• necessary cookies, which remember your cookie choice; they cannot be switched off in the website settings,
• Google Analytics analytics cookies (_ga, _ga_*), only if the law office enables Google statistics and you consent to them in the banner; without consent the Google script is not loaded at all.

We keep visit statistics on our own server — without cookies and without external providers. When you visit the site we record the IP address, the country (determined from the IP address), the type of device, the operating system and browser, the page visited, the page you came from the time spent on the site, and clicks on the firm's phone number and e-mail address. We do this on the basis of our legitimate interest (Art. 6(1)(f) GDPR), to understand how the site is used and to protect it against abuse. IP addresses are kept for 30 days, other statistical data for 13 months. We do not share them with anyone or combine them with data from the contact form.

You can change your cookie choice at any time using the privacy settings button in the corner of the screen, and you can block or delete stored cookies in your browser. Restricting cookies may affect how some features of the website work.

10. Your rights

You have the right to access your data and obtain a copy, to rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interest. You may withdraw your consent at any time. Some of these rights may be limited by legal professional privilege and by statutory obligations; for example, we will not delete data needed to perform the contract or data we are required by law to keep before the relevant period ends.

You can submit requests by e-mail to [email protected] or in writing to the law office's address.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO) (ul. Stawki 2, 00-193 Warszawa) if you believe that the processing of your data infringes the GDPR.

11. Profiling

We do not make automated decisions and do not carry out profiling.

12. Changes to this policy

We update this policy when the law or the way the website operates changes. The current version is always available at this address.