Please read this document, which describes the rules for the processing of your personal data in relation to use of the website https://kprw.pl (hereinafter: “Website“) or the provision of services by our law firm. 

The controller of your personal data and the owner of the website is Paweł Ryś, conducting business activity under the name Kancelaria Prawa Ryś i Współpracownicy Paweł Ryś, address: Ariańska 18/3 St., 31-505 Kraków, Poland, NIP (tax ID): 734-287-06-24. You can contact us by post at the above address and by e-mail: kancelaria@kprw.pl.  

Your personal data shall be processed in accordance with the requirements of generally applicable law, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: “GDPR“) and the Act of 18 July 2002 on the provision of electronic services (Polish Journal of Laws of 2024, item 1513, as amended). 

What information do we process? 

1. Depending on the purpose, we may process the following information (including personal data) about you: 

1. Identification data: 

1. for e-mail communication: name and surname, e-mail address, 

1. for telephone communication: name and surname, telephone number, 

1. if you conclude with us a contract for provision of legal services: name and surname, address, tax ID number, e-mail address, telephone number. 

1. Web server logs: we automatically collect web server logs when you visit our Website using the computer on which the Website is installed (referred to as the “web server”). The web server automatically recognises certain information, such as your IP address, the date and place of your visit to the Website, the website from which you visited the Website, the type of web browser you are using, the type of operating system you are using, the domain name and address of your internet service provider. 

1. IP addresses: we may collect information about your IP address. IP addresses are used as part of the information contained in the web server logs described above and for technical purposes. 

2. If we become aware of your use of the Website in breach of law or this Privacy policy, we may process your personal data for the purpose and to the extent necessary to establish your liability and protect your legitimate rights and claims.
3. We will not use or transfer your personal information for purposes unrelated to those described in this Privacy policy without first notifying you and, where appropriate, requesting your consent to use your personal information in such a different way.

Aims and legal basis of the data processing 

Your personal data is processed for the following purposes, based on the following legal bases: 

1. if you communicate with us by telephone or email – in order to respond to your request, on the basis of Article 6(1)(b) GDPR, i.e. the prerequisite of necessity for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; our correspondence may be archived for the purpose of establishing or defending against potential claims, on the basis of Article 6(1)(f) GDPR, i.e. the legitimate interest pursued by the controller, 

1. when concluding a contract for legal services – for the purpose of concluding and performing the contract, on the basis of the premise of necessity to perform the contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract, referred to in Article 6(1)(b) of the GDPR. Accounting and settlements made in connection with the performance of the contract shall take place on the basis of the premise of necessity to comply with the controller’s legal obligation (under tax and accounting law) referred to in Article 6(1)(c) of the GDPR. Your personal data may also possibly be processed for the purpose of asserting or defending against contractual claims, on the basis of the premise of necessity for the purposes of the legitimate interests pursued by the controller, indicated in Article 6(1)(f) of the GDPR, 

1. for technical purposes so that the Website displays correctly, is stable and secure and enables information to be found quickly, and also to send you information relating to the operation of the Website (if necessary), on the basis of Article 6(1)(f) of the GDPR (i.e. the controller’s legitimate interest in ensuring the proper functioning of the Website), 

1. for the purposes of creating an archive, for the possible defence or assertion of claims, on the basis of Article 6(1)(f) of the GDPR (legitimate interest of the controller to protect legitimate rights and claims), 

1. in the event that we become aware of your use of the Website in breach of the law or this Privacy policy, we may also process your personal data for the purpose and to the extent necessary to establish your liability and protect your legitimate rights and claims, on the basis of Article 6(1)(f) of the GDPR (legitimate interest of the controller to protect legitimate rights and claims), 

1. where access to your personal data is requested by an authorised state authority, on the basis of the premise of necessity to comply with a legal obligation to which the controller is subject, as referred to in Article 6(1)(c) of the GDPR. 

Processing time 

In the case of communication by telephone or e-mail, your personal data will be processed until we respond to the request received. Correspondence may be archived for the purpose of pursuing of claims or defending against possible claims, until such claims have expired. You may ask us to obtain a copy of this correspondence or to delete it (unless this is opposed by our overriding legitimate interest, e.g. relating to the pursing of claims or defence of claims). 

Your personal data processed in connection with the conclusion and performance of a contract for legal services will, in principle, be processed for the duration of the contract. However, your data may be processed after the completion of the contract if this is justified by the applicable legal provisions (e.g. for tax or accounting purposes) and, to the extent necessary, your data may be processed until the expiry of any contractual claims. Thereafter, the data will be deleted or anonymised. 

Obligation of data provision 

Provision of your personal data is voluntary, however, failure to provide data may prevent us from providing services to you or responding to an enquiry received. 

Data Subject rights 

Regardless of the legal basis for the processing, you have the right to access your data, the right to obtain a copy of your data, as well as the right to request rectification and, in certain situations, the right to request erasure or the right to request restriction of processing of your personal data.  

If the processing of your personal data is carried out on the basis of the premise of necessity for purposes arising from the legitimate interest of the data controller (Article 6(1)(f) of the GDPR), you have the right to object to the processing of your personal data. 

Where the legal basis for the processing of your personal data is previously granted consent (Article 6(1)(a) of the GDPR), you have the right to withdraw your consent at any time, without affecting the lawfulness of the processing carried out prior to the withdrawal of consent.  

If the processing is based on your consent (Article 6(1)(a) of the GDPR) or on the premise of necessity for the performance of the contract concluded (Article 6(1)(b) of the GDPR), or if the processing is carried out by automated means, you also have the right to data portability. 

You can address the above requests to: kancelaria@kprw.pl 

Regardless of the legal basis for the processing, if you suspect that your personal data is being processed in violation of the GDPR, you have the right to lodge a complaint to a supervisory authority (in Poland this is the President of the Office for Personal Data Protection) about the unlawful processing of your personal data. 

Sharing data with third parties 

The transfer of personal data to third parties is always carried out in accordance with the law, on the basis of the contract concluded, which indicates the purposes of the processing specified by us. 

Recipients of your personal data may be entities that support our day-to-day operations. These may include providers of external systems that support our operations, including web hosts, IT service providers, and other subcontractors if the scope of our collaboration requires access to your data.  

Personal data may also be disclosed to state authorities legally entitled to access the data. 

Automated decision-making, profiling 

Your personal data is not used for automated decision-making, including profiling. We do not use IT systems to automatically make decisions about your personal data. Decisions and actions are taken solely by members of our team. 

Data Protection 

We use appropriate technical, physical and organisational measures to protect your personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure and access. Please be aware, however, that no information security system ensures it in 100%. Nonetheless, we endeavour to take all necessary steps to exclude (if possible) or limit possible risks. 

The storage of your personal data is protected by appropriate physical, IT and organisational measures designed to adequately protect your data. However, we have no control over the security of your e-mails from the time they are sent by you until they reach us. 

Access to your personal data is restricted. Only members of our team who need access to your personal data in order to carry out their work can gain this access. 

In addition, the Website is equipped with the SSL protocol, which allows secure and effective encryption of the data transmitted between the user and the server. Sub-pages containing personal data forms are automatically switched to the https protocol. 

Updating or correcting data 

We take reasonable measures to ensure that the personal data we collect is appropriate for the purposes for which it is to be used, reliable and usable for its intended purpose, correct, complete and up to date. However, in some cases we must rely on individual users to provide correct personal data. This means that you are responsible for ensuring that the data you provide to us is up-to-date and correct at the time of submission. 

If you wish to update or correct your personal data, please send the information to our e-mail address. You will receive notification that your data has been updated. Please update your personal data whenever it changes. The provision of false personal data or personal data relating to another person is prohibited. 

Cookies 

1. Definition: cookies are information that websites send to your browser, which your browser sends back to the website when you access the website again. Through the use of cookies, you do not have to re-enter the data previously entered into the website and your device is recognised by the website, so that its display is automatically adapted to your individual needs and pre-selected settings. Cookies can be read by the administrator’s IT system (own cookies) or by third-party IT systems (third-party cookies). The Website uses both session cookies, i.e. temporary files that are stored on the user’s terminal equipment until the user logs out, leaves the Website or switches off the browser, and permanent cookies, which are stored on the user’s terminal equipment for the time specified in the parameters of the cookies or until they are deleted by the user. 

1. Are cookies personal data: generally, cookies are not personal data; however, certain information stored in cookies, in combination with other information about you, may constitute personal data. However, such data is not disclosed by us to unauthorised persons and is only processed for the purpose of providing the specified services. 

1. Types of cookies: The following types of cookies are used on the Website: 

• essential cookies: necessary for the proper functioning of the Website; they are usually used in response to your actions, such as setting privacy options; if you change your browser settings to block essential cookies, the Website will not function properly, 

• functional cookies: they allow us to remember the choices you have made on the Website and thus make it possible to adapt it to your preferences. 

1. Legal basis for the use of cookies: generally, the basis for the use of cookies is your consent. On your first visit to the Website, you will be presented with a box to consent to all or some cookies (or reject them). Until you have given your consent, cookies remain blocked. However, this does not apply to essential cookies.  

1. Own cookies: We use our own cookies to store information about the user’s session (i.e. the IP address from which the user connects to the Website, the connection time and other technical parameters of the connection). They allow the proper operation of certain functions of the Website. 

1. Third-party cookies: currently we do not use any third-party cookies.  

1. Disabling cookies: at any time, using your browser settings, you can block all or some cookies (including those to which you have previously gave your consent). Please note, however, that this may make it difficult or impossible to use the Website or some of its functions. 

Final provisions 

1. We make every effort to ensure a high level of security for your personal data. Please report any incidents of concern affecting the security of your personal data to the following email address: kancelaria@kprw.pl 

1. For further information regarding the processing of your personal data, please contact us by e-mail: kancelaria@kprw.pl 

1. We reserve the right to make changes to this Privacy policy.