Privacy and cookie policy
How the Firm processes the data of clients and website visitors.
In the event of any discrepancy, the Polish version prevails.
§1. Data controller
The controller of your personal data is Maciej Puchała, attorney-at-law (radca prawny), doing business as Maciej Puchała & Partnerzy Kancelaria Radcy Prawnego, Aleja Wojska Polskiego 31/7, 70-473 Szczecin, Poland, NIP (tax ID) 8522198502, REGON 320538996 (the “Firm”).
For any matters relating to personal data, you can contact us by e-mail at mp@puchala-partnerzy.pl, by phone at +48 91 434 53 52 or by post at the Firm’s address. The Firm has not appointed a data protection officer.
§2. Purposes and legal bases of processing
We process data only for the purposes listed in the table, on the basis of Regulation (EU) 2016/679 (GDPR).
| Purpose | Legal basis | Data |
|---|---|---|
| Replying to an enquiry sent via the form, e-mail, phone or WhatsApp | Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) or, where no contract is planned, Art. 6(1)(f) GDPR (handling correspondence) | name or company, e-mail address or phone number, content of the message |
| Providing legal services and performing the contract with the client | Art. 6(1)(b) GDPR | identification and contact details, data relating to the case |
| Legal obligations (tax, accounting) | Art. 6(1)(c) GDPR | data from invoices, accounting records and client identification |
| Establishing, pursuing and defending claims | Art. 6(1)(f) GDPR | data from case files and correspondence |
| Website security and protecting the form against spam | Art. 6(1)(f) GDPR | IP address, technical browser data |
| Visitor statistics (Google Analytics) | Art. 6(1)(a) GDPR – your consent given in the cookie banner | cookie identifiers, data on use of the website |
| Measuring the effectiveness of advertising (Google Ads) | Art. 6(1)(a) GDPR – your consent given in the cookie banner | cookie identifiers, data on use of the website |
If, in connection with a case, you provide us with health data (e.g. in medical negligence cases), we process it on the basis of Art. 9(2)(f) GDPR to the extent necessary to establish, pursue or defend claims.
Providing data is voluntary, but without contact details we cannot reply to your enquiry, and without data required by law we cannot enter into a contract. We do not make automated decisions or profile you within the meaning of Art. 22 GDPR.
§3. Data of persons who are not our clients
When providing legal services, we also process data of third parties, such as opposing parties, witnesses, attorneys and representatives of business partners. We obtain this data from clients, from case files and from public registers (e.g. KRS, CEIDG, land and mortgage registers).
The legal basis is the legitimate interest of our clients and the Firm (Art. 6(1)(f) GDPR) in protecting the client’s rights. Under Art. 14(5)(d) GDPR, we do not provide these persons with information about the processing, because the data is subject to the professional secrecy of an attorney-at-law (Art. 3 of the Polish Act of 6 July 1982 on Attorneys-at-Law).
§4. Recipients of data
We share data only to the extent necessary for a given purpose. Service providers process it on our behalf under data processing agreements.
| Recipient | Purpose | Country and transfer basis |
|---|---|---|
| cyber_Folks S.A., ul. Wierzbięcice 1B, 61-569 Poznań, Poland | hosting the website and its backups | Poland / EEA |
| Microsoft Ireland Operations Ltd. | the Firm’s e-mail (Microsoft 365), including messages sent via the form | data stored in the Frankfurt data centre (Germany, EEA); access from outside the EEA, e.g. for technical support, on the basis of the EU-US Data Privacy Framework or standard contractual clauses |
| Google Ireland Ltd. | Google Analytics (analytics consent), Google Tag Manager and Google Ads (marketing consent) | Ireland; possible transfer to the USA on the basis of the EU-US Data Privacy Framework |
| WhatsApp Ireland Ltd. (Meta) | when you contact us via WhatsApp | Ireland; possible transfer to the USA on the basis of the EU-US Data Privacy Framework |
| accounting firm, IT service providers | the Firm’s accounting and technical support | Poland |
In connection with a case, data may also be received by courts, public authorities, bailiffs, notaries and other parties’ attorneys, to the extent required by the case and the law.
§5. How long we keep data
| Data | Retention period |
|---|---|
| An enquiry that did not lead to a contract | 180 days from the last contact |
| Client data and case files | for the duration of the contract and, after it ends, 10 years from the end of the year in which the proceedings ended (Art. 5c(1)(2)(c) of the Polish Act on Attorneys-at-Law) |
| Accounting and tax records | 5 years from the end of the year in which the tax payment deadline expired |
| Third-party data (§3) | as long as the case files in which it appears |
| Analytics and marketing data | until consent is withdrawn or the cookies expire (§7); in Google Analytics no longer than 14 months |
Data processed on the basis of legitimate interest is deleted earlier if you successfully object.
§6. Your rights
You have the right of access to your data and to receive a copy (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability for data processed on the basis of a contract or consent (Art. 20) and to object to processing based on legitimate interest (Art. 21). You may withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal.
To exercise these rights, write to mp@puchala-partnerzy.pl. We will reply within one month. These rights may be limited where exercising them would breach the professional secrecy of an attorney-at-law. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, or with the supervisory authority in your country of residence.
§7. Cookies
Necessary cookies are always stored; analytics and marketing cookies only with your consent given in the banner (Art. 399 of the Polish Electronic Communications Law). Until you make a choice in the banner, the website does not load any analytics or advertising scripts.
| Name | Provider | Purpose | Category | Duration |
|---|---|---|---|---|
| pp_consent (browser storage, localStorage) | the Firm | remembering your choice in the cookie banner | necessary | 12 months, after which the banner is shown again |
| pp_lang | the Firm | remembering the language version you selected | necessary | 12 months |
| _ga | distinguishing users in Google Analytics | analytics | 2 years | |
| _ga_F8P0X54905, _ga_BFL1D5DVBD | storing the session state in Google Analytics | analytics | 2 years | |
| _gcl_au | measuring Google Ads conversions | marketing | 90 days | |
| IDE and other cookies in the doubleclick.net domain | measuring Google Ads conversions | marketing | up to 13 months |
You can change or withdraw your consent at any time using the “Cookie settings” button in the footer. You can also delete cookies or block them in your browser settings; blocking necessary cookies may make the website harder to use.
§8. Final provisions
This policy applies from 14 October 2026. We will announce any material changes on this page, stating the date of the update. The website contains links to services run by others (e.g. our clients’ websites, Facebook, WhatsApp); their administrators are responsible for privacy in those services.