Privacy policy
1. Personal data controller
The personal data controller is KLBF G.Kycia Sp.k., with its registered office in Warsaw (address: Al. Jana Pawła II 29, 00-867 Warsaw) (KL).
2. Legal basis
KL processes collected personal data in accordance with applicable laws, including Regulation (EU) 2016/679 of the European Parliament, and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (GDPR).
3. Purposes of data processing
Personal data is processed when necessary for the following:
(1) concluding and performing a contract with KL, for the provision of legal services;
(2) compliance of KL with its legal obligations;
(3) for the purposes of legitimate interests pursued by KL or a third party; and
(4) carrying out the recruitment of persons interested in working or cooperating with KL.
4. Categories of data processing
KL processes in particular the following categories of personal data:
(1) personal identification data (name, surname, PESEL number, ID number, date of birth);
(2) contact data (telephone number, e-mail address, residence address, correspondence address);
(3) tax identification data; and
(4) other data, insofar as they are necessary for the purposes of the processing of personal data set out in the Privacy Policy.
5. Transfer of personal data
KL is entitled to provide personal data to:
(1) entities that cooperate with KL in connection with the services provided to KL, in particular KL is entitled to share personal data to:
(a) postal operators and couriers;
(b) entities providing accounting and auditing services to KL;
(c) entities providing hosting and IT services to KL; and
(d) solicitors, legal advisers, notaries, and other legal service providers working with KL; and
(2) entities authorised by law.
6. Data retention period
KL stores personal data:
(1) obtained for the purpose of entering into and performing the contract, until the termination or expiry of the contract, and then for the period of limitation of potential claims under generally applicable legislation;
(2) obtained for the purpose of complying with its legal obligations, for the period resulting from generally applicable law; and
(3) which it has obtained for the purposes of the legitimate interests pursued by KL or a third party – for no longer than is necessary for the purposes for which the data are processed or until an objection is raised to the processing of personal data on grounds relating to the particular situation of the data subject, unless KL demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, including grounds relating to the establishment, pursuit, or defence of claims.
7. Rights of individuals whose persona data are processed
The individual whose personal data are processed by KL has the right:
(1) to access, rectify and supplement their personal data, to restrict their processing and deletion, wherein the right to delete data does not apply to data necessary for KL’s obligation to assess in the future whether there is a conflict of interest;
(2) to transfer personal data, including the right to receive data and send them to another controller or to request that such data be sent directly to another controller – this right being exercisable only where the processing is based on consent and where it is fully automated;
(3) object to the processing of personal data insofar as the processing is carried out for purposes based on legitimate interests pursued by KL or a third party; the grounds for objecting must be based on the particular situation of the data subject, unless KL demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, including grounds relating to the establishment, pursuit, or defence of claims; and
(4) lodge a complaint with the supervisory authority for the protection of personal data, if they consider the processing of data is inconsistent with the law.
8. Requirement to provide personal data and consequences of failure to do so
If the processing of personal data is necessary for KL to fulfil its legal obligations, the provision of personal data is a statutory requirement.
If personal data are processed for other purposes referred to in the Privacy Policy, providing personal data is always voluntary; nonetheless, providing personal data is necessary to conclude and perform a contract with KL.
9. Contact
For matters relating to the processing of personal data, contact KL electronically at: office@kycialegal.com.
10. Final provisions
Any changes made to the Privacy Policy in the future will be published on the website https://kycialegl.com/ at least 5 working days before they take effect.