PRIVACY POLICY

Privacy policy of Żuraw i Wspólnicy sp. k.

This Privacy Policy governs the rules of personal data processing by Żuraw i Wspólnicy sp. k. address: Sobieszyńska 35, 00-764 Warsaw, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0000780847, NIP 5833349752 („Administrator„) in connection with its business activities.

1. Administrator of personal data

The Administrator collects and processes personal data in accordance with the requirements of generally applicable laws, including in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter: „GDPR„).

The Administrator shall inform about the processing of the data at the time of their collection, make every effort to ensure that the data are collected only to the extent necessary for the indicated purpose and are processed for the time necessary, as well as to ensure their security and confidentiality.

2. Contact with the Administrator

In all matters concerning the processing of personal data, please contact the Administrator at the following address:

1. correspondence: ul. Sobieszyńska 35, 00-764 Warszawa or;
2. e-mail: info@zglegal.pl.

The Data Protection Inspector is Marzena Pasek. In any matter concerning the processing of personal data, the Inspector can be contacted at the following e-mail address: m.pasek@zglegal.pl.

3. Purpose and legal basis of personal data processing

Personal data provided to the Administrator is processed for the following purposes:

1. in order to enable the proper performance of a contract in the event that the Administrator acquires – in connection with the conclusion of contracts in the course of its business – the data of persons involved in the performance of such contracts (legitimate interest of the Administrator and its client within the meaning of Article 6(1)(f) of the GDPR),
2. for the purpose of communication and clarification of the matter in the case of directing to the Administrator traditional correspondence, electronic correspondence by e-mail or telephone contact, in matters not related to the concluded agreement or the provided services (legitimate interest of the Administrator within the meaning of Article 6(1)(f) of the GDPR),
3. for the purposes of identifying the sender and processing his/her inquiry if the inquiry is sent to the Administrator by means of a form made available on the Administrator’s website. Using a form requires providing personal data that are necessary for the Administrator to establish contact and answer the inquiry asked in the form (necessity of processing data to perform a service agreement within the meaning of Article 6(1)(b) of the GDPR). In the form, on a voluntary basis, you can also provide other data that may facilitate contact or handling of the inquiry (consent within the meaning of Article 6(1)(a) of the GDPR),
4. for the purpose of contacting persons participating in online events organised by the Administrator in the event that the Administrator obtains personal data of persons who sign up for and participate in the events (the Administrator’s legitimate interest within the meaning of Article 6(1)(f) of the GDPR in organising the event),
5. to enable Internet users to be active on the Administrator’s profiles on the social networks: LinkedIn, Facebook and Instagram, in the event that users leave such data, e.g. comments or likes (the Administrator’s legitimate interest in promoting its activities (Article 6(1)(f) GDPR),
6. in order to manage and maintain the Administrator’s profiles on LinkedIn, Facebook and Instagram by presenting users of the portals with information about the Administrator’s activities, including events organised by the Administrator (the Administrator’s legitimate interest in promoting its activities (Article 6(1)(f) of the GDPR),
7. for business networking purposes in case personal data is collected during business meetings (legitimate interest of the Administrator within the meaning of Article 6(1)(f) of the GDPR)

4. Rights of data subjects

The person whose personal data is processed has the right to:

1. information on the processing of personal data;
2. receive a copy of your data;
3. rectify your personal data;
4. erasure of data (data which processing is no longer necessary for any of the purposes for which it was collected);
5. the restriction of processing;
6. data portability, insofar as the data are processed by automated means in connection with the concluded contract or consent; the Administrator undertakes to supply the data in a computer-readable format. The Administrator may also order that the data be transferred directly to another entity, provided that both the entity and the Administrator are technically capable of performing such transfer;
7. withdraw consent to the processing of personal data by sending such a request to the Administrator. Withdrawal of consent does not affect the lawfulness of data processing prior to the withdrawal of consent;
8. lodge a complaint with a supervisory authority (if your personal data is processed unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office).

The rights can be exercised by contacting the Data Protection Officer:

• in writing to the address Żuraw i Wspólnicy sp. k., Sobieszyńska 35, 00-764 Warsaw or;
• via a dedicated e-mail: m.pasek@zglegal.pl

The complaint referred to in point h) above may be submitted by contacting the supervisory authority directly.

5. Providing personal data to third parties

The administrator is entitled to share personal data with the following recipients or categories of data recipients:

1. service providers providing services on behalf of or for the Administrator, in particular entities operating the Administrator’s IT systems and equipment, providing accounting, postal, courier and marketing services. In contracts with such service providers, we require compliance with the applicable data protection regulations,
2. to the extent necessary, also other third parties, in particular authorized state authorities, if such an obligation results from mandatory provisions of law.

6. Transfer of personal data to third countries

The administrator does not transfer your personal data to recipients located in third countries.

7. Period of personal data storage

The period of data processing by the Administrator depends on the type of service provided and the purpose of processing. In the case of data processing on the basis of the Administrator’s legitimate interest, the data is processed for a period enabling the implementation of this interest or until an effective objection to data processing is raised.

In the case of data processing on the basis of consent, the data is processed until it is withdrawn.

In the case of data processing due to the necessity of data processing to conclude and perform the contract for the provision of the service, the data is processed until its termination. The data processing period may be extended when the processing is necessary to establish or pursue claims or defend against claims. After the expiry of the processing period, the data is deleted or anonymized.

Personal data processed in the exercise of the profession by legal advisers and advocates are stored for 10 years from the end of the year in which the procedure in which the personal data was collected ended.

8. Security of personal data

The administrator has implemented procedures to ensure data integrity and confidentiality. These procedures allow access to personal data only to authorized persons and to the extent necessary due to the tasks performed by these persons.

The Administrator takes all necessary steps to ensure that subcontractors and other entities processing personal data on behalf of the Administrator guarantee the application of appropriate measures to ensure the security and confidentiality of data.