privacy policy
§ 1. About the Privacy Policy and the Personal Data Controller
1.1. In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation; “GDPR”), this personal data processing policy (“Privacy Policy”) sets out the rules and provides information on the processing of personal data by the personal data controller, who is: Paulina Dziadulewicz, President of the Management Board of IP-TAX sp. z o.o. with its registered office at: Wileńska 14A lok. 87 03-414 Warsaw, NIP: 1133149368 · REGON: 529974741 · KRS: 0001134060, e-mail: ip-tax@ip-tax.pl (“Law Firm” or “Controller”).
1.2. The Administrator can be contacted by post, e-mail or telephone at the addresses and telephone number provided in section 1.1. of the Privacy Policy.
§ 2. Processing of personal data by the Law Firm
2.1. The Privacy Policy applies to the processing by the Law Firm of personal data of the following categories of persons:
(a) clients of the Law Firm who are natural persons (including entrepreneurs) to whom the Law Firm provides legal services (“Clients”);
(b) the Law Firm's contractors who are natural persons (including entrepreneurs) (“Contractors”);
(c) representatives, employees, and associates, authorized contacts, or other persons performing contracts with the Law Firm on behalf of the Law Firm's clients or contractors (“Representatives”);
(d) persons contacting the Law Firm or with whom the Law Firm contacts by telephone or e-mail for purposes not related to the performance of a contract (for the provision of legal services or other contract) concluded between them and the Law Firm;
(e) persons contacting the Law Firm via the contact form available on the Law Firm's website (“Contact Form”) for purposes not related to the performance of a contract (for the provision of legal services or other contract) concluded between them and the Law Firm.
2.2. No automated decisions, including those based on profiling, will be made with regard to persons whose personal data is processed by the Law Firm.
§ 3. Clients' personal data
3.1. Clients' personal data is processed for the purpose of:
(a) concluding and performing a contract for the provision of legal services between the Client and the Law Firm – pursuant to Article 6(1)(b) of the GDPR, i.e. processing is necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract;
(b) provision of legal services
– with regard to special categories of personal data (e.g., personal data concerning health) – pursuant to Article 9(2)(f) of the GDPR, i.e., processing is necessary for the establishment, exercise, or defense of legal claims or in the course of judicial proceedings;
– with regard to other personal data – pursuant to Article 6(1)(c) of the GDPR, i.e. processing is necessary for compliance with a legal obligation to which the Law Firm is subject, and resulting from the provisions regulating proceedings before courts and administrative authorities, in particular the provisions of the Code of Civil Procedure, the Code of Criminal Procedure, and the Code of Administrative Procedure;
(c) protection of the vital interests of Clients or another natural person:
– with regard to special categories of personal data – pursuant to Article 9(2)(c) of the GDPR, i.e. processing is necessary to protect the vital interests of the data subject or another natural person, and the data subject is physically or legally incapable of giving consent;
– with regard to other personal data – pursuant to Article 6(1)(d) of the GDPR, i.e. processing is necessary to protect the vital interests of the data subject or another natural person;
(d) fulfillment of the Law Firm's obligations under the law, including tax settlements and accounting documentation − pursuant to Article 6(1)(c) of the GDPR, i.e., data processing is necessary for compliance with legal obligations incumbent on the Law Firm, including those arising from tax law and accounting regulations;
(e) establishing, pursuing, or defending against possible claims between the Client and the Law Firm:
– with regard to special categories of personal data – pursuant to Article 9(2)(f) of the GDPR, i.e., processing is necessary for the establishment, exercise, or defense of legal claims or in the course of judicial proceedings;
– with regard to other personal data – pursuant to Article 6(1)(f) of the GDPR, i.e. on the basis of a legitimate interest pursued by the Law Firm, which is the ability to establish, pursue or defend against claims.
3.2. The provision of personal data by the Client is voluntary, but necessary for the conclusion and performance of a contract for the provision of legal services (failure to provide personal data will result in the inability to conclude and perform the above-mentioned contract).
§ 4. Personal data of Contractors
4.1. The personal data of Contractors is processed for the purpose of:
(a) conclusion and performance of a contract between the Counterparty and the Law Firm – pursuant to Article 6(1)(b) of the GDPR, i.e. processing is necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract;
(b) fulfilling the Law Firm's obligations under the law, including tax settlements and keeping accounting records – pursuant to Article 6(1)(c) of the GDPR, i.e. processing is necessary for compliance with a legal obligation to which the Law Firm is subject, including obligations under tax law and accounting regulations;
(c) establishing, pursuing, or defending against possible claims between the Contractor and the Law Firm – pursuant to Article 6(1)(f) of the GDPR, i.e. on the basis of a legitimate interest pursued by the Law Firm, which is the ability to establish, pursue, or defend against claims.
4.2. The provision of personal data by the Contractor is voluntary, but necessary for the conclusion and performance of the contract (failure to provide personal data will result in the inability to conclude and perform the contract).
§ 5. Personal data of Representatives
5.1. The personal data of Representatives comes from the following sources:
(a) the personal data of Representatives is made available to the Law Firm by the client or contractor of the Law Firm whom the Representative represents, or
(b) are provided to the Law Firm directly by the person concerned;
– The Law Firm receives this personal data in connection with the conclusion or performance of a contract between the client or contractor and the Law Firm, in particular for the purpose of its implementation and ensuring ongoing contact.
5.2. The Law Firm processes the following categories of personal data of Representatives:
(a) identification data (i.e., first names, last names), position/function performed);
(b) contact details (i.e., business phone number, email).
5.3. The personal data of Representatives is processed for the purpose of:
(a) concluding and performing a contract between the client or contractor and the Law Firm, including ongoing contact in connection with the performance of that contract – pursuant to Article 6(1)(f) of the GDPR, i.e. on the basis of a legitimate interest, which is to enable the Law Firm and, respectively, the client or contractor to conclude and perform the contract and to ensure ongoing contact;
(b) establishing, pursuing or defending against possible claims between Representatives and the Law Firm or, respectively, the client or contractor and the Law Firm – pursuant to Article 6(1)(f) of the GDPR, i.e. on the basis of a legitimate interest pursued by the Law Firm, which is the ability to establish, pursue or defend against claims.
5.4. Providing personal data is voluntary, but necessary for the conclusion and performance of the contract, including ensuring ongoing contact (failure to provide personal data will result in the inability to conclude or perform the above contract).
§ 6. Personal data of persons contacting the Law Firm or with whom the Law Firm contacts
6.1. Personal data of persons who contact the Law Firm or with whom the Law Firm contacts by letter, telephone, or email are processed for the purpose of:
(a) Communication and correspondence, in particular responding to questions asked to the Law Firm by the person initiating contact or other resolution of the matter – pursuant to Article 6(1)(f) of the GDPR, i.e. on the basis of the legitimate interest pursued by the Law Firm, which is to communicate in connection with its business activities, in particular to respond to questions asked or otherwise resolve matters;
(b) establishing a relationship with that person or the entity they represent or with which they cooperate – pursuant to Article 6(1)(f) of the GDPR, i.e. on the basis of a legitimate interest pursued by the Law Firm, which is establishing and maintaining relationships in the course of its business activities;
(c) establishing, pursuing, or defending against possible claims between the data subject or the entity represented by the data subject and the Law Firm – pursuant to Article 6(1)(f) of the GDPR, i.e. on the basis of the legitimate interest pursued by the Law Firm, which is the ability to establish, pursue, or defend against claims.
6.2. Providing personal data when contacting us is voluntary, but it is necessary in order to maintain contact, for the Law Firm to respond to a question or other matter (failure to provide personal data will result in the Law Firm being unable to contact the person concerned or may result in the inability to answer the question asked or otherwise resolve the matter).
§ 7. Contact form
7.1. Contact with the Law Firm is possible via the Contact Form available on the Law Firm's website.
7.2. The personal data of persons who contact the Law Firm via the Contact Form are processed for the following purposes:
(a) data marked as required – for the purpose of providing the contact form service – pursuant to Article 6(1)(b) of the GDPR, i.e. due to the necessity of data processing for the performance of the contract for the provision of the Contact Form service;
(b) data other than required – for the purpose of facilitating contact with the sender or responding to a question or other resolution of the matter – pursuant to Article 6(1)(a) of the GDPR, i.e. on the basis of consent;
(c) establishing, pursuing, or defending against possible claims between the data subject or the entity represented by the data subject and the Law Firm – pursuant to Article 6(1)(f) of the GDPR, i.e. on the basis of the legitimate interest pursued by the Law Firm, which is the ability to establish, pursue, or defend against claims.
7.3. Providing data in the Contact Form is not mandatory, but providing the data marked as required is necessary for the Contact Form service to be performed.
§ 8. Periods of personal data processing
8.1. Personal data will be processed for the period necessary to achieve the purposes for which the data is processed. In addition, the Law Firm will store it until the expiry of the data storage obligation resulting from legal provisions (e.g., tax law). If the basis for processing is the Law Firm's legitimate interest, in the event of an objection, personal data will be processed until an effective objection is lodged. If processing is based on consent, the data will be processed until consent is withdrawn.
8.2. The Law Firm may store personal data when processing is necessary to establish or pursue claims or defend against claims, and after that period – only if and to the extent required by law.
8.3. Personal data processed by legal advisors and attorneys in the course of their professional activities shall be stored for 10 years from the end of the year in which the proceedings in which the personal data was collected ended.
§ 9. Data recipients and data transfer outside the EEA
9.1. Personal data processed by the Law Firm may be disclosed to the following entities: employees and associates of the Law Firm, IT service providers, hosting providers, entities providing legal and accounting services, and other providers of services related to the processing of personal data, on the basis of an appropriate agreement. Only personal data necessary for the performance of the agreement between the Law Firm and such entity will be disclosed to these entities.
9.2. Personal data processed by the Law Firm may be made available to entities and authorities authorized to process such data on the basis of legal provisions.
9.3. The Law Firm does not intend to transfer the personal data it processes to countries outside the European Economic Area or to international organizations. Any transfer of data outside the EEA may only take place with the consent of the data subject or if necessary, and the transfer will be carried out in accordance with the provisions of Chapter V of the GDPR.
§ 10. Rights of individuals in relation to the processing of personal data
10.1. A person whose personal data is processed by the Law Firm has the following rights:
(a) the right to access their personal data;
(b) the right to request its rectification;
(c) the right to request their deletion;
(d) the right to request restriction of their processing;
(e) the right to transfer personal data, i.e. to receive personal data from the Law Firm in a structured, commonly used, machine-readable format. The data subject may request the Law Firm to send their personal data, which they have provided to the Law Firm, to another controller;
(f) the right to object to the processing of personal data - to the extent that the basis for the processing of personal data is the legitimate interest of the Law Firm;
(g) the right to withdraw consent to the processing of personal data – if the data is processed on the basis of consent. Consent may be withdrawn at any time, but this does not affect the lawfulness of the processing carried out before its withdrawal.
10.2. In order to exercise the above rights, please contact the Law Firm using the contact details provided above (see § 1 of the Privacy Policy).
10.3. In addition, a person whose personal data is being processed has the right to lodge a complaint with the supervisory authority responsible for personal data protection (the President of the Personal Data Protection Office) if they believe that the processing of data violates the GDPR.
§ 11. Final provisions
11.1. In matters not covered by the Privacy Policy, the GDPR and the provisions of Polish law shall apply.
11.2. The Privacy Policy shall enter into force and remain in force from October 26, 2025.