§ 1. Privacy Policy and Data Controller
1.1. In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation; “GDPR”), this personal data processing policy (“Privacy Policy”) sets out the principles and contains information on the processing of personal data by the data controller, which is: KOZIKOWSKI & PARTNERS SPÓŁKA KOMANDYTOWA with its registered office in Warsaw, at ul. Grzybowska 5A, 00-132 Warsaw, entered into the Register of Entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, XII Commercial Division of the National Court Register under the number KRS: 0001079192, holding the NIP number: 5252986983 and REGON number: 527403394, e-mail: biuro@kozikowski.com.pl (“Law Firm” or “Controller”).
1.2. Contact with the Controller is possible by post or e-mail to the addresses provided in point 1.1 of the Privacy Policy.
§ 2. Categories of Individuals Whose Personal Data is Processed by the Law Firm
2.1. The Privacy Policy relates to the processing of personal data by the Law Firm of the following categories of individuals:
a) natural persons, including those conducting business activities, for whom the Law Firm provides legal services (“Individual Clients“);
b) representatives of the Law Firm’s clients or business partners, such as representatives, employees, collaborators, or other persons acting on behalf of the client or business partner of the Law Firm (“Representatives“);
c) persons contacting the Law Firm via the Law Firm’s communication channels such as e-mail, messengers, phone, post (“Third Parties“);
d) persons visiting the Law Firm’s profile on LinkedIn available at https://www.linkedin.com/company/kozikowski-partners/ (“LinkedIn Profile“), including those contacting the Law Firm via the LinkedIn Profile;
e) persons visiting the Law Firm’s website available at https://kozikowski.com.pl (“Website“).
§ 3. Individual Clients
3.1. The personal data of Individual Clients is processed for the purpose of:
(a) providing legal services based on contracts concluded by the Law Firm
- when services are provided to Individual Clients – based on Art. 6(1)(b) GDPR, i.e., processing is necessary for the performance of a contract or to take steps at the request of the data subject prior to entering into a contract,
- when services are provided to persons who are not clients – for the purpose of fulfilling a contract concluded by the Law Firm, which constitutes the legitimate interest of the Law Firm according to Art. 6(1)(f) GDPR;
- regarding special categories of personal data (e.g., health-related data) – based on Art. 9(2)(f) GDPR, i.e., processing is necessary for the establishment, exercise, or defense of legal claims or whenever courts are acting in their judicial capacity;
(b) fulfilling obligations imposed on the Law Firm by regulations governing proceedings before courts and administrative authorities, particularly civil, criminal, administrative proceedings, and obligations resulting from regulations governing the practice of an advocate, legal advisor, tax advisor, or patent attorney; (c) fulfilling obligations imposed on the Law Firm by law, including tax settlements and bookkeeping – based on Art. 6(1)
(c) GDPR, i.e., processing is necessary for compliance with a legal obligation to which the Law Firm is subject, including tax law and accounting regulations;
(d) establishing, exercising, or defending against potential claims related to the provision of legal services or legal assistance:
- concerning special categories of personal data – based on Art. 9(2)(f) GDPR, i.e., processing is necessary for the establishment, exercise, or defense of legal claims or whenever courts are acting in their judicial capacity;
(e) concerning other personal data – based on Art. 6(1)(f) GDPR, i.e., based on the legitimate interest pursued by the Law Firm, which is the ability to establish, exercise, or defend against claims.
3.2. Providing personal data to the extent expected by the Law Firm and justified by the scope of the engagement is necessary for establishing cooperation with the Law Firm.
§ 4. Representatives
4.1. The personal data of Representatives originates from the following sources:
(a) the personal data of Representatives is provided to the Law Firm by the client or business partner of the Law Firm whom the Representative represents, or
(b) it is provided directly by the individual to the Law Firm; The Law Firm receives this personal data in connection with the conclusion or performance of a contract between the client or contractor and the Law Firm, particularly for its implementation and ensuring ongoing contact.
4.2. The Law Firm processes the following categories of personal data of Representatives:
(a) identification data (i.e., first names, surnames, position/function);
(b) contact data (i.e., business phone number, email).
4.3. The personal data of Representatives is processed for the purpose of concluding and performing the contract between the Law Firm and its client or business partner, including ongoing contact related to the performance of the contract, which constitutes the legitimate interest of the Law Firm according to Art. 6(1)(f) GDPR.
4.4. Providing personal data to the extent expected by the Law Firm and justified by the scope of cooperation is necessary for establishing cooperation with the Law Firm.
§ 5. Third Parties
5.1. The personal data of Third Parties who contact the Law Firm or whom the Law Firm contacts via the Law Firm’s communication channels:
(a) for communication and correspondence, particularly in response to questions posed to the Law Firm by the person initiating contact or to resolve another issue for which the person contacts the Law Firm, which constitutes the legitimate interest of the Law Firm according to Art. 6(1)(f) GDPR;
(b) for establishing relationships within the scope of the business activities with the person or the entity they represent or cooperate with, which constitutes the legitimate interest of the Law Firm according to Art. 6(1)(f) GDPR.
5.2. Providing personal data to the extent expected by the Law Firm and justified by the type of selected communication channel is necessary to establish contact with the Law Firm.
§ 6. LinkedIn Profile
6.1. In connection with managing the LinkedIn Profile, the Law Firm processes the personal data of LinkedIn users who are natural persons in connection with their activities related to the LinkedIn Profile, such as following, posting comments, reacting to content with “likes,” or contacting via the messaging function. The Law Firm processes the personal data of LinkedIn users particularly in the following scope:
a) user identifier (may contain name and surname, job position, and other information);
b) identification data and other information published by the individual on the LinkedIn platform;
c) profile picture (image);
d) content of comments posted on the LinkedIn Profile and the content of the conversation conducted with the person via LinkedIn;
e) statistical data concerning visits to the LinkedIn Profile.
6.2. The personal data on the LinkedIn Profile is processed to manage the LinkedIn Profile under the conditions and principles set out by the LinkedIn platform operator and to inform via the LinkedIn Profile about activities, services, events, sharing knowledge, as well as to build and maintain the community and communicate through available LinkedIn functionalities (comments, messages, including event registrations), which constitutes the legitimate interest of the Law Firm according to Art. 6(1)(f) GDPR.
6.3. The data controller of LinkedIn users’ personal data is the LinkedIn platform operator, through which the user visits the LinkedIn Profile. Information regarding the processing of personal data by the LinkedIn platform operator is available here: LinkedIn Privacy Policy.
§ 7. Personal Data of Website Visitors
7.1. In connection with the use of cookies on the Website (as described below), the Law Firm may process personal data of Website visitors to the extent of internet identifiers (e.g., cookie ID, IP address) and (if the user consents) information about activity on the Website.
7.2. Data of Website visitors is processed for the purpose of:
a) enabling the use of the Website and its functionalities, which constitutes the legitimate interest of the Law Firm according to Art. 6(1)(f) GDPR (in the case of necessary cookies);
b) for analytical, advertising, and other purposes, depending on the consent given by the user for the respective cookies – based on Art. 6(1)(a) GDPR, i.e., based on consent (in the case of non-essential cookies).
7.3. Providing data is necessary to use the Website, while the user can influence the scope of processed data by managing their cookie preferences.
§ 8. Cookies
8.1. Depending on the settings of the Website visitor (user) through the banner displayed during the first visit to the Website, in addition to technically necessary cookies, the Law Firm may use cookies for statistical, analytical, or advertising purposes.
8.2. Cookies are small text files containing information about the user’s activity on the Website and storing it on the device from which the user accesses the Website.
8.3. In accordance with applicable law, the Law Firm may store cookies on the user’s device if they are necessary for the functioning of the Website (these cookies are described below as necessary). For the use of any other types of cookies (especially analytical or advertising cookies), the Law Firm requires the user’s prior consent.
8.4. Necessary cookies are automatically installed on the user’s device when they enter the Website or make specific choices/activities on the Website.
8.5. If the user consents during the first visit to the Website or later through the cookie settings panel, the Law Firm may also use statistical, analytical, or advertising cookies.
8.6. The Website user can change the cookie settings at any time using the settings panel available on the Website by clicking the “Cookie Settings” button.
8.7. Detailed information about the cookies used by the Law Firm on the Website and their functions can be found in the Cookie Policy available on the Law Firm’s website.
§ 9. Periods of Personal Data Processing
9.1. Personal data will be stored for the period necessary to achieve the purposes for which the data is processed. In addition, the Law Firm will store them until the expiry of the obligation to retain data resulting from legal regulations (e.g., tax law). If the processing is based on the legitimate interest of the Law Firm, the data will be processed until this legitimate interest is fulfilled or until a valid objection is raised – whichever occurs first. If the processing is based on consent, the data will be processed until it is withdrawn.
9.2. The Law Firm may retain personal data if the processing is necessary to establish, exercise, or defend claims, and after this period – only if and to the extent required by law.
9.3. Information contained in private messages sent to the Law Firm via LinkedIn will be stored for the message retention period specified by the LinkedIn operator.
9.4. In the case of information held by the Law Firm in the form of comments provided by an individual, they will be available on the LinkedIn Profile until they are deleted by the individual or the material is removed from the LinkedIn Profile by the Law Firm. Personal data collected by the LinkedIn platform operator, such as post history, activity history, and sent messages, are stored under the rules specified in the LinkedIn platform’s regulations.
9.5. Personal data processed in connection with the use of necessary cookies will be stored for the validity period of individual cookies. Personal data processed in connection with the use of cookies other than necessary will be stored for the validity period of individual cookies, but no longer than until the consent is withdrawn.
9.6. Personal data processed by legal advisors, advocates within the practice of their profession are stored for 10 years from the end of the year in which the proceedings, in which personal data was collected, concluded.
§ 10. Data Recipients and Data Transfers Outside the EEA
10.1. Personal data processed by the Law Firm may be disclosed to the following entities: employees and collaborators of the Law Firm, IT service providers, hosting providers, legal service providers, accounting service providers, and other service providers related to the processing of personal data, based on an appropriate agreement. Only the personal data necessary to perform the contract between the Law Firm and such an entity will be disclosed to these entities.
10.2. Personal data processed by the Law Firm may be disclosed to entities and authorities authorized to process such data based on legal regulations.
10.3. In connection with managing the LinkedIn Profile and using non-essential cookies on the Website (if the user consents), the user’s personal data is transferred to the operator of the LinkedIn platform – LinkedIn Ireland Unlimited Company or to the providers of cookies, i.e., Google Ireland Limited based in Ireland. These entities may, in turn, transfer personal data to companies in the USA (LinkedIn Corporation, Google LLC based in the USA) or other countries outside the European Economic Area, which requires them to provide appropriate safeguards for data transfers in accordance with Chapter V of the GDPR. Detailed information about the privacy policies of these entities is available at the following links:
LinkedIn – LinkedIn Privacy Policy, Google – Google Privacy Policy.
10.4. The Law Firm does not intend to transfer personal data processed outside the European Economic Area or to international organizations. Any transfer of data outside the EEA may only occur after obtaining the data subject’s consent or if it is necessary to achieve the purposes of processing, and the transfer will be in accordance with Chapter V of the GDPR.
§ 11. Rights of Individuals Related to the Processing of Personal Data
11.1. Individuals whose personal data is processed by the Law Firm have the right to:
a) access their personal data;
b) request its rectification;
c) request its deletion;
d) request the restriction of its processing;
e) data portability, i.e., to receive from the Law Firm the personal data concerning them, which they have provided to the Law Firm, in a structured, commonly used, and machine-readable format, in the case of processing based on consent or a contract and carried out by automated means. The data subject may request the Law Firm to transmit their personal data, which they have provided to the Law Firm, to another controller;
f) object to the processing of personal data – to the extent that the basis for the processing is the legitimate interest of the Law Firm;
g) withdraw consent for the processing of personal data – if the data is processed based on consent. Consent may be withdrawn at any time, which does not affect the lawfulness of processing based on consent before its withdrawal.
11.2. To exercise the above rights, please contact the Law Firm using the contact details provided above (see § 1 of the Privacy Policy).
11.3. Furthermore, individuals whose personal data is processed have the right to lodge a complaint with the supervisory authority responsible for data protection (President of the Office for Personal Data Protection) if they believe that the processing of their data violates the GDPR. Contact with the Office for Personal Data Protection is possible by post to the address ul. Stawki 2, 00-193 Warsaw, and by email to kancelaria@uodo.gov.pl.