Privacy policy

K&P Kancelaria Prawna Kania Pavlenko sp.k.

I. Controller and principles of data processing

1. Controller. The controller of personal data is K&P Kancelaria Prawna Kania Pavlenko sp.k. with its registered office in Kraków, ul. Lwowska 2/8, 30-548 Kraków, Poland, KRS: 0000740805, NIP: 6772436309, REGON: 380802185 (the “Controller”, the “Law Firm”). Contact in data protection matters: by post to the above address or by e-mail: biuro@kplaw.pl.
2. Scope. This policy covers data provided to the Law Firm in person, by phone, by post or by e-mail, and data collected when using www.kplaw.pl (Part II).
3. Purposes and legal bases:
   1. taking steps prior to entering into a legal services agreement (including preparing an offer and quote) and performing that agreement – Art. 6(1)(b) GDPR;
   2. compliance with the Law Firm’s legal obligations, in particular tax, accounting and anti-money laundering and counter-terrorist financing obligations – Art. 6(1)(c) GDPR;
   3. the Law Firm’s legitimate interests: establishing, pursuing or defending claims, handling correspondence, contacting representatives of clients and business partners – Art. 6(1)(f) GDPR;
   4. processing special categories of data or data relating to criminal convictions where necessary to establish, pursue or defend legal claims – Art. 9(2)(f) and Art. 10 GDPR in conjunction with the Polish Act on Legal Counsels.
4. Data obtained from third parties. When providing legal services, the Law Firm may process data of persons who did not provide it themselves (e.g. opposing parties, witnesses). The information obligation towards those persons does not apply where the data must remain confidential due to the professional secrecy of a legal counsel – Art. 14(5)(d) GDPR.
5. Voluntary provision. Providing data is voluntary, but without it we may be unable to prepare an offer or provide legal services.
6. Retention. Client data is kept for the term of the agreement and then for 10 years from the end of the year in which the matter was closed, or longer where required by law or in the event of a dispute. Data from correspondence that did not lead to an agreement is kept until any potential claims become time-barred.
7. Recipients. Data may be disclosed to:
   1. courts, public authorities and other entities authorised by law;
   2. legal counsels, advocates and notaries cooperating with the Law Firm – to the extent necessary to perform the agreement (e.g. substitution);
   3. processors acting on behalf of the Law Firm: providers of accounting, IT, hosting and e-mail, postal and courier services;
   4. providers of the tools described in Part II (Google, Meta, LinkedIn, TikTok).
8. Automated decisions. The Law Firm does not make decisions based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR.

II. Website www.kplaw.pl

1. Cookies. Cookies are small text files stored on the user’s device by the website or by external services. We use cookies necessary for the website to function without consent. We use analytics cookies only after consent is given in the cookie banner (Art. 399 of the Polish Electronic Communications Law, Art. 6(1)(a) GDPR).
2. Cookies used on the website:

   Cookie	Provider	Purpose	Consent required	Duration
   cookieconsent_status	Law Firm (consent plugin)	stores your cookie choice	no	12 months
   pll_language	Law Firm (Polylang)	stores the language version	no	12 months
   PHPSESSID	Law Firm	session handling	no	until the browser is closed
   tpg_post_views	Law Firm (The Post Grid)	technical counter of blog post views (prevents double counting)	no	24 hours
   _ga, _ga_D6PFDD30YH	Google Ireland Ltd. (Google Analytics 4)	visit statistics	yes	up to 2 years
   Google cookies (e.g. NID)	Google Ireland Ltd. (Google Maps)	displaying the map	yes – the map loads only after clicking “Show map”	per Google’s policy

3. Google Analytics 4. With your consent, the website uses Google Analytics 4 provided by Google Ireland Ltd. GA4 collects information on how the website is used (pages visited, visit duration, approximate location, device and browser type). Data may be transferred to Google LLC in the USA (Part III item 3). You can withdraw consent at any time using the “Cookie settings” button in the corner of the page. Withdrawal does not affect the lawfulness of processing before withdrawal.
4. Google Maps. The map does not load automatically. After clicking “Show map”, your browser connects to Google’s servers, which may receive your IP address and store their own cookies. Google’s policy: policies.google.com/privacy.
5. Server logs. The server automatically records, among other things, the IP address, date and time of the request, the page requested, the referring page and browser information. This data is used to ensure the security and proper operation of the website (Art. 6(1)(f) GDPR) and is not combined with other data. It is kept for the period agreed with the hosting provider.
6. Social media. The website contains links to the Law Firm’s profiles on Facebook, Instagram, TikTok and LinkedIn. Clicking a link takes you to that service, which processes data under its own rules. With regard to data of visitors to the Law Firm’s profiles (e.g. page statistics), the Law Firm may be a joint controller with the service operator, e.g. Meta Platforms Ireland Ltd. (Art. 26 GDPR).
7. Managing cookies in your browser. Regardless of the banner, you can delete cookies or block them in your browser settings. Blocking necessary cookies may affect some website functions.

III. Your rights, transfers outside the EEA, changes to this policy

1. Rights. Every person whose data we process has the right to:
   1. access their data and obtain a copy (Art. 15 GDPR);
   2. rectification (Art. 16 GDPR);
   3. erasure (Art. 17 GDPR);
   4. restriction of processing (Art. 18 GDPR);
   5. data portability for data processed on the basis of consent or a contract (Art. 20 GDPR);
   6. object to processing based on legitimate interests (Art. 21 GDPR);
   7. withdraw consent at any time, without affecting the lawfulness of prior processing (Art. 7(3) GDPR).
   These rights may be limited by the rules on the professional secrecy of legal counsels. Please send requests to biuro@kplaw.pl or by post to the Law Firm’s address.
2. Complaint. You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl).
3. Transfers outside the EEA. Using Google services and social media may involve transferring data to the USA. The transfer is based on the European Commission’s adequacy decision (EU–U.S. Data Privacy Framework) for certified entities or on standard contractual clauses (Art. 46(2)(c) GDPR).
4. Changes. This policy may be updated if the law or the tools used on the website change. The current version is always available at kplaw.pl/en/privacy-policy.

Version of 8 October 2026. In case of discrepancies, the Polish version prevails.