Privacy policy
Information on the processing of personal data
This document explains what personal data the Firm processes, for what purpose, on what legal basis and for how long, to whom it discloses the data, and what rights data subjects have. It covers the website pawlowski-partners.pl, including the contact form and visitor statistics, and the legal services provided by the Firm. This English text is a translation for convenience; in case of doubt the Polish version prevails.
Version of 6 November 2026
01
Definitions
- Controller, Firm
- Jakub Pawłowski, attorney-at-law (radca prawny), carrying on business under the name Kancelaria Radcy Prawnego Jakub Pawłowski and trading as Pawłowski Partners.
- Website
- The website at pawlowski-partners.pl, including its sub-pages and language versions.
- Client
- A natural person, legal person or organisational unit to which the Firm provides legal services.
- GDPR
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
- Professional secrecy
- The duty to keep confidential everything an attorney-at-law has learned in connection with providing legal services, arising from Art. 3 of the Act of 6 July 1982 on Attorneys-at-Law. This duty is unlimited in time and binds the Firm also towards public authorities.
02
Data controller and contact
The controller of personal data is Jakub Pawłowski, attorney-at-law (radca prawny), carrying on business under the name Kancelaria Radcy Prawnego Jakub Pawłowski, ul. Litewska 3/2, 60-605 Poznań, Poland, tax ID (NIP) 5571624541, REGON 365403620, registered in the Central Register and Information on Economic Activity (CEIDG) and entered on the list of attorneys-at-law kept by the Poznań Regional Bar of Attorneys-at-Law under number PZ-3991. The Firm trades as Pawłowski Partners.
The Firm has not appointed a data protection officer. In all matters concerning personal data you can contact the controller directly.
03
Who this information is for
This information is addressed to:
- visitors to the Website;
- people who contact the Firm through the form on the Website, by e-mail, by telephone or by post;
- Clients who are natural persons, and people acting on behalf of Clients: members of governing bodies, shareholders, attorneys and employees;
- the Firm's contractors and suppliers and their representatives;
- people whose data the Firm receives in connection with handling Clients' matters: opposing parties and their attorneys, witnesses, experts, employees and contractors of Clients, and other participants in proceedings.
The Firm cannot always inform people in the last group directly, because the data is covered by the professional secrecy of an attorney-at-law (Art. 14(5)(d) GDPR). In such cases this information is publicly available on the Website.
04
What data we process and where it comes from
Server logs
The Website's server automatically records standard information about every connection: the IP address, date and time, the address of the page visited, the type of browser and operating system, and the address of the referring page. This data is used solely to administer the server, diagnose errors and ensure security; the Firm does not link it to individual people.
Visitor statistics
Visitor statistics for the Website (number of visits, pages viewed, country, browser and device type, referral source) are generated by the hosting provider from the server logs described above. They require no script in the browser and no cookies, and they do not allow visitors to be identified. The Firm does not use Google Analytics or any other external analytics tools.
Contact form
In the form you provide your full name, e-mail address, optionally a telephone number, and your message. The IP address, the language version of the Website and the date of sending are attached to the submission. The form stores no submissions on the server or in any database: the submission is forwarded solely as an e-mail to the Firm's mailbox. To limit abuse, a hash of the sender's IP address (not the address itself) is kept for one hour after sending, and the form contains a hidden anti-spam field that collects no data about the person filling it in.
Correspondence and calls
If you write to or call the Firm, we process your contact details, the content of your message and the information you yourself provide.
Legal services
In connection with concluding and performing a legal services agreement, the Firm processes the data needed to identify the Client and handle the matter: name, business name, address, PESEL, NIP or KRS number, contact details, invoicing details and, where anti-money-laundering rules require it, identity document details and information on the beneficial owner. We also process information about the matter and its documentation. Where the nature of the matter requires it, this may include special categories of data, for example health data, or data relating to criminal convictions and offences (Art. 9 and 10 GDPR), processed to the extent necessary to establish, exercise or defend legal claims and within the limits set by the rules governing the profession of attorney-at-law.
Third-party data in the matters we handle
The Firm receives the data of opposing parties, witnesses, experts and other participants in proceedings from Clients, from courts and authorities, from case files and from public registers such as the National Court Register (KRS), CEIDG, the land and mortgage registers, the register of family foundations and the Central Register of Beneficial Owners. The scope of this data is determined by the subject of the matter.
05
Purposes, legal bases and retention periods
For each purpose we state what data is processed, on which basis under Art. 6(1) GDPR, for how long, and whether providing the data is voluntary.
Answering an enquiry sent by form, e-mail or telephone
- Data
- full name, contact details, the content of the enquiry; for the form, also the IP address and the language of the Website
- Legal basis
- Art. 6(1)(b) GDPR (steps taken at the request of the data subject prior to entering into a contract), and where the enquiry is made on behalf of a company or other entity, Art. 6(1)(f) GDPR (the legitimate interest of the Firm and that entity in answering the enquiry)
- Retention
- until the correspondence ends, and no longer than 12 months from the last contact; if an agreement is concluded, the data is kept as Client data
- Voluntary?
- providing the data is voluntary, but without a name and e-mail address the Firm will not be able to reply
Concluding and performing a legal services agreement
- Data
- identification, address and contact details, PESEL, NIP or KRS number, invoicing details, information about the matter and its documentation
- Legal basis
- Art. 6(1)(b) GDPR for a Client who is a natural person; Art. 6(1)(f) GDPR for people acting on behalf of a Client (legitimate interest: performing the agreement with the Client); Art. 6(1)(c) GDPR as regards obligations under the Act on Attorneys-at-Law; Art. 9(2)(f) GDPR for special categories of data
- Retention
- for the term of the agreement and then for 10 years from the end of the year in which the proceedings in which the data was collected ended (Art. 5c of the Act on Attorneys-at-Law), and no shorter than until claims connected with the agreement become time-barred
- Voluntary?
- providing the data is voluntary but is a condition of concluding the agreement and handling the matter
Handling Clients' matters: third-party data
- Data
- identification and contact details and the information contained in the case documents
- Legal basis
- Art. 6(1)(f) GDPR (the legitimate interest of the Firm and the Client: practising as an attorney-at-law, representing the Client, establishing, exercising or defending legal claims); Art. 9(2)(f) GDPR for special categories of data
- Retention
- as for Client data
- Voluntary?
- not applicable; the data comes from Clients, courts, authorities and public registers
Fulfilling the Firm's legal obligations
- Data
- invoicing and accounting data; identity document details, beneficial owner information and transaction data where the Firm acts as an obliged institution within the meaning of the Act on Counteracting Money Laundering and Terrorist Financing
- Legal basis
- Art. 6(1)(c) GDPR in conjunction with tax, accounting and anti-money-laundering legislation
- Retention
- accounting and tax records: 5 years from the end of the calendar year in which the tax payment deadline fell; records required by anti-money-laundering legislation: 5 years from the end of the business relationship or the transaction
- Voluntary?
- providing the data is a statutory requirement; without it the Firm cannot issue an invoice or carry out the regulated transaction
Establishing, exercising and defending the Firm's own claims
- Data
- data from the agreement, correspondence and settlements
- Legal basis
- Art. 6(1)(f) GDPR (legitimate interest: protecting the Firm's rights)
- Retention
- until the claims become time-barred
- Voluntary?
- not applicable
Administering the Website and keeping it secure
- Data
- server logs, including the IP address
- Legal basis
- Art. 6(1)(f) GDPR (legitimate interest: maintaining and protecting the Website)
- Retention
- up to 12 months
- Voluntary?
- the data is recorded automatically on every visit to the Website; the server cannot operate without it
Website visitor statistics
- Data
- aggregated statistics from the server logs, described in section 04
- Legal basis
- Art. 6(1)(f) GDPR (legitimate interest: knowing how the Website is used)
- Retention
- server logs: up to 12 months, in line with the hosting provider's rules; the aggregated statistics contain no personal data
- Voluntary?
- not applicable; the statistics collect no identifying data
Maintaining professional relationships
- Data
- contact details of contractors, cooperating lawyers and their representatives
- Legal basis
- Art. 6(1)(f) GDPR (legitimate interest: running the practice and professional cooperation)
- Retention
- until the relationship ends or a valid objection is raised
- Voluntary?
- providing the data is voluntary
06
Recipients of data
The Firm does not sell personal data and does not make it available to other entities for their own marketing purposes. Data may be disclosed:
- to processors acting on the Firm's behalf under data processing agreements: OVH Sp. z o.o., Wrocław, Poland (hosting of the Website together with the contact form and statistics, the internet domain and e-mail in the MX Plan and Hosted Exchange services), the accounting office, and the companies that service the Firm's hardware and software;
- in connection with handling matters: to courts, administrative and law enforcement authorities, bailiffs, notaries, experts, translators, parties and their attorneys, postal and courier operators, and banks as regards payments;
- to cooperating law firms, including partner firms in the Carpe Jus – European Lawyers Network, where a matter requires a lawyer in another country, in each case with the Client's knowledge;
- to public authorities that request the data on the basis of the law, subject to professional secrecy, which binds the Firm also towards those authorities.
07
Transfers of data outside the European Economic Area
Data is processed within the European Union. The Website, the contact form and e-mail (MX Plan and Hosted Exchange) run on servers of OVH Sp. z o.o. in data centres located in the European Union; all other data the Firm processes in Poland, on its own equipment. The Firm does not transfer data to countries outside the European Economic Area or to international organisations.
The only exception is Clients' matters that require contact with a court, authority or partner firm in a third country. Such a transfer takes place with the Client's knowledge and on a basis provided for in Chapter V GDPR: a European Commission adequacy decision or standard contractual clauses.
08
Rights of data subjects
Everyone whose data the Firm processes has the right to:
- access their data and obtain a copy of it (Art. 15 GDPR);
- have their data rectified (Art. 16 GDPR);
- have their data erased when it is no longer needed for the purposes for which it was collected or when the processing is unlawful (Art. 17 GDPR);
- restriction of processing (Art. 18 GDPR);
- portability of data processed on the basis of a contract or consent (Art. 20 GDPR);
- object to processing based on legitimate interest, on grounds relating to their particular situation (Art. 21 GDPR);
- lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl.
To exercise these rights, write to biuro@pawlowski-partners.pl or by post to the Firm's address. The Firm replies without undue delay and no later than one month after receiving the request.
Limits arising from professional secrecy
The Firm may not disclose information covered by the professional secrecy of an attorney-at-law. For data collected in connection with providing legal services, the right of access under Art. 15(1) and (3) GDPR therefore applies to the extent set out in Art. 5a of the Act on Attorneys-at-Law, and a request for erasure cannot lead to the destruction of case files before the statutory retention period has expired.
09
Cookies and browser storage
The Website stores no cookies or other identifiers in the browser. It does not use Google Analytics, advertising pixels, content embedded from external services (maps, video, social media) or external font services: the font files are kept on the Firm's server, so the visitor's browser does not connect to third-party servers. The language switcher does not store the selection. For this reason the Website shows no cookie consent banner.
Links to external websites, for example to the Carpe Jus network's website, lead to services run by other controllers; data reaches them only after you click, under their own privacy policies.
10
Data security
The connection to the Website is encrypted (HTTPS). Only the controller has access to the hosting account and to the Firm's mailbox; form submissions go straight to that mailbox and are not stored on the server. Case files are protected by professional secrecy and kept in accordance with the rules of the attorney-at-law profession, and only people authorised by the controller and bound by secrecy have access to them.
11
Automated decisions and profiling
The Firm makes no decisions about anyone based solely on automated processing and does not profile the people whose data it processes.
12
Changes to this policy
This policy is updated when the way the Website works or the law changes. The current version, with its date, is always available on the Website. The Firm informs Clients directly of changes that matter to them.
