GDPR
notice

1. Controller of personal data

The controller of your personal data is Joanna Szymańska-Skrobak, Attorney, running a law office under the name "Kancelaria Adwokacka Adwokat Joanna Szymańska-Skrobak", with its registered office at Plac Wolności 18, 61-739 Poznań, Poland.

• VAT ID (NIP): 7812044942
• Poznań Bar (ORA) registration no.: POZ/Adw/4370
• E-mail: kancelaria@adwokatszymanska.pl
• Phone: +48 509 104 520

2. Purposes and legal bases for processing

Your personal data are processed for the following purposes:

• Conclusion and performance of an agreement for the provision of legal assistance — legal basis: Art. 6(1)(b) GDPR (processing necessary to perform a contract or take steps at the data subject's request).
• Handling correspondence and contact with the office — legal basis: Art. 6(1)(f) GDPR (the controller's legitimate interest in answering enquiries).
• Fulfilment of legal obligations — legal basis: Art. 6(1)(c) GDPR (obligations under the Polish Bar Act and tax and accounting regulations).
• Pursuing and defending against claims — legal basis: Art. 6(1)(f) GDPR (the controller's legitimate interest).
• Processing of special categories of data (health data, sensitive data) to the extent necessary to provide legal assistance — legal basis: Art. 9(2)(f) GDPR (necessity for the establishment, exercise or defence of legal claims).

3. Attorney's professional secrecy

An attorney is bound by the professional secrecy referred to in Art. 6 of the Act of 26 May 1982 — the Bar Act (consolidated text: Journal of Laws of 2022, item 1184, as amended). The obligation of attorney's secrecy is unlimited in time and covers all information obtained by the attorney in connection with the provision of legal assistance. Attorney's secrecy is, at the same time, a guarantee of protection of the personal data provided to the office.

4. Recipients of the data

Your personal data may be disclosed to:

• entities providing technical and IT services (hosting, software) — on the basis of data processing entrustment agreements,
• accounting offices and tax advisers servicing the law office,
• courts, state authorities and other entities — solely to the extent resulting from the law or necessary to represent the client.

The controller does not transfer data to third countries (outside the EEA) or to international organisations.

5. Data retention period

Personal data are stored for the period of:

• the duration of the legal-assistance agreement and for 10 years after its end — due to possible claims related to the legal assistance provided,
• resulting from the law (e.g. 5 years for accounting documents),
• correspondence — for 3 years from the last contact,
• until consent is withdrawn — where the basis of processing is the person's consent,
• until an effective objection is raised — where the basis is the controller's legitimate interest.

6. Rights of the data subject

In connection with the processing of personal data, you have the following rights:

• Right of access to your personal data (Art. 15 GDPR).
• Right to rectification of data (Art. 16 GDPR).
• Right to erasure of data, unless there is a legal basis or another legitimate purpose for further processing (Art. 17 GDPR).
• Right to restriction of processing (Art. 18 GDPR).
• Right to data portability to the extent that processing is based on a contract or consent and is automated (Art. 20 GDPR).
• Right to object to processing based on the controller's legitimate interest (Art. 21 GDPR).
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Art. 7(3) GDPR).

These rights are exercised upon a written or e-mail request to the controller. A response will be provided within 30 days of receipt of the request.

Indicating these rights does not derogate from the principles of attorney's secrecy applicable to the cases conducted. Where the exercise of the right to erasure or access is excluded due to professional secrecy or the law, the controller will inform you without delay.

7. Right to lodge a complaint

If you consider that the processing of personal data by the controller infringes the GDPR, you have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (UODO) (ul. Stawki 2, 00-193 Warsaw, e-mail: kancelaria@uodo.gov.pl, tel. 606-950-000, uodo.gov.pl).

8. Obligation and voluntariness of providing data

Providing personal data to the extent necessary to conclude and perform the legal-assistance agreement is a condition of concluding it — without providing these data it is not possible for the office to provide services. Otherwise, providing data is voluntary.

9. Automated decision-making and profiling

The controller does not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.