1. The controller of personal data is Advocate Katarzyna Gorgol Pryczynicz, trading as Kancelaria Adwokacka Adwokat Katarzyna Gorgol Pryczynicz, ul. Chłodna 22A, suite 9/10, 00-891 Warsaw, Poland, NIP 5272788476, REGON 365983965 (the “Controller”).
2. For matters concerning personal data, contact kancelaria@adwokatgorgol.pl, call +48 509 393 095 or write to the address given in point 1. The Controller has not appointed a data protection officer.
3. Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”), and the Polish Act of 26 May 1982 — Law on the Bar.
4. Purposes and legal bases of processing:
a) entering into and performing a legal services agreement, including communicating with the client — Article 6(1)(b) GDPR;
b) compliance with legal obligations applicable to the Controller, particularly tax and accounting obligations and those arising under the Law on the Bar — Article 6(1)(c) GDPR;
c) establishing, exercising or defending legal claims, corresponding with people who contact the practice and ensuring information security — Article 6(1)(f) GDPR (the Controller’s legitimate interests);
d) direct marketing of the Controller’s own services and providing information about events organised by the practice — Article 6(1)(a) GDPR (consent), and, for electronic communications, also in accordance with the provisions governing electronic communications.
5. In connection with providing legal assistance, the Controller may process special categories of data (such as health data) and data relating to criminal convictions and offences under Article 9(2)(f) and Article 10 GDPR, in conjunction with Article 6 of the Law on the Bar, to the extent necessary to handle a case and to establish, exercise or defend legal claims.
6. The Controller obtains personal data concerning persons other than clients (such as opposing parties, witnesses and legal representatives) from clients, case files, courts and authorities, and publicly available sources. Such data is processed to the extent necessary to provide legal assistance (Article 6(1)(f) GDPR).
7. Consent to the processing of data for marketing purposes is voluntary and is not a condition for entering into or performing an agreement. In particular, consent allows the Controller to:
a) send seasonal greetings and greetings for special occasions;
b) provide information about meetings and events organised by the practice;
c) provide information about changes in legislation and case law, publications, and initiatives aimed at raising legal awareness;
d) provide information about training and professional, community or social events;
e) invite participation in groups and clubs.
The Controller’s marketing communications are occasional and focus on customary celebrations and special occasions. Consent may be withdrawn at any time (point 13).
8. Data retention periods:
a) data processed in connection with providing legal assistance — 10 years from the end of the year in which the proceedings during which the data was collected ended (Article 16c(1)(2)(c) of the Law on the Bar); the data is deleted after that period;
b) data processed to comply with tax and accounting obligations — for the period required by law (generally five years from the end of the year in which the tax payment deadline expired);
c) data processed on the basis of legitimate interests — until those interests have been fulfilled, the limitation period for claims has expired, or an objection has been successfully raised;
d) data processed on the basis of consent — until consent is withdrawn.
9. Recipients of data may include entities providing the Controller with services necessary to operate the practice and perform the agreement, particularly accounting, IT (including email and hosting providers), postal and courier services, as well as advocates, attorneys-at-law and trainee lawyers working on a case, and entities providing specialist services commissioned by the practice. Data may also be disclosed to courts, law enforcement agencies, administrative authorities and other participants in proceedings to the extent required by law and the needs of the case. Entities processing data on the Controller’s behalf act under data processing agreements (Article 28 GDPR) and are bound by confidentiality obligations.
10. Communication with the Controller may take place through electronic tools (email, messaging services, and voice and video calling applications) whose providers may store data on servers outside the European Economic Area. In such cases, data is transferred to a third country only on the basis of a European Commission adequacy decision (Article 45 GDPR), standard contractual clauses adopted by the European Commission (Article 46 GDPR) or, where necessary for the performance of a contract with the data subject, Article 49(1)(b) GDPR. Information on the safeguards applied can be obtained by contacting the Controller.
11. Data subjects have the right to:
a) access their data (Article 15 GDPR);
b) have their data rectified (Article 16 GDPR);
c) have their data erased (Article 17 GDPR) and restrict processing (Article 18 GDPR);
d) data portability (Article 20 GDPR) and object to processing based on Article 6(1)(f) GDPR (Article 21 GDPR).
Requests may be sent to kancelaria@adwokatgorgol.pl or by post to the practice’s address.
12. The scope of these rights is limited by the rules on advocates’ professional secrecy. Under Article 16a of the Law on the Bar, the right of access (Article 15(1) and (3) GDPR), the right to restriction of processing (Article 18 GDPR) and the obligation to notify recipients of rectification or erasure (Article 19 GDPR) apply to the extent that they do not infringe the duty of professional secrecy. The right to object under Article 21(1) GDPR does not apply to data obtained in connection with providing legal assistance. Data necessary to perform an agreement, comply with legal obligations or establish, exercise or defend legal claims is not subject to erasure before the periods specified in point 8 expire (Article 17(3) GDPR).
13. Consent to data processing may be withdrawn at any time by writing to kancelaria@adwokatgorgol.pl. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
14. Providing data is voluntary. However, providing the data necessary to enter into and perform a legal services agreement and comply with tax obligations is a condition for entering into the agreement. Failure to provide it prevents the provision of legal assistance. The Controller does not make automated decisions, including profiling.
15. Data subjects have the right to lodge a complaint with the supervisory authority, the President of the Personal Data Protection Office (ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland), if they consider that the processing of their data infringes the GDPR.