Information on the processing of personal data

I. Administrator of personal data

The administrator of personal data is Alicja Jagielska-Burduk BACHlaw Law Office NIP 5542624969 REGON 384825817

Administrator’s contact details:

(a) telephone: +48 604092919

(b) e-mail:

c) address of registered office: Al. Jana Pawła II 61/57 01-031 Warsaw

II. Objectives of data processing, legal basis and legitimate interests

Your personal data will be processed for the purpose(s) of:

1) concluding and performing an agreement, including in particular a legal service agreement or an agreement on rendering services for the Law Firm by a co-worker of the Law Firm;

2) fulfilling legal obligations resulting from EU or Polish law, imposed on the personal data controller referred to in art. 6 section 1 letter c of the GDPR;

3) realization of goals resulting from legally justified interests of the administrator or third parties, which include in particular: ensuring IT security of the Personal Data Administrator; implementation and application of internal control systems; visual monitoring of the Law Firm; investigation, determination and defence against claims, prevention of frauds, determination of conflicts of interest and ethical violations as well as providing services for the client in a situation when his or her interest is superior to the interests, rights and freedoms of the data subject.

III. Categories of personal data processed

The Law Office processes the following categories of personal data:

1) name and surname, PESEL number, ID card number, date of birth;

2) contact details, including: telephone number, e-mail address, address of residence;

3) tax identification number;

4) data concerning education and professional experience;

5) data concerning property and financial situation;

6) images.

The Law Firm may also process other categories of personal data if there is a justified need to process such personal data in order to provide legal services to the Client.

IV. Categories of data recipients

The recipients of personal data may be:

• attorneys, legal advisers, notaries and other entities providing legal services and independently deciding on the purposes and methods of data processing cooperating with the Law Office;

• purchasers of the Law Firm’s receivables;

• entities authorized under applicable law, including courts and state bodies;

• business information offices;

• entities rendering services to the Law Firm, in particular IT, debt collection, printing, and courier services.

V. Transfer of data outside the European Economic Area

The Law Firm may outsource the performance of specific services or IT tasks to service providers established outside the European Economic Area. In such a case, the data shall be transferred to a third country with respect to which an appropriate level of data protection has been established on the basis of a European Commission decision.

Data retention period:

The Law Firm processes personal data until the termination or expiration of contracts concluded with it, the statute of limitations for claims or the expiration of obligations arising from legal regulations.

VI.     Rights of the personal data subject

The person to whom the personal data relates is entitled to:

1) the right to access, rectify and complete their personal data, restrict their processing, and delete them;

2) the right to transfer personal data which has been transferred to the Law Firm, i.e. the right to receive them in a structured common format and send them to another administrator. This right may be exercised only in cases when the processing is carried out on the basis of consent or agreement and if it is fully automated;

3) the right to lodge a complaint with the President of the Office for the Protection of Personal Data, if it is found that the Law Firm is processing its personal data in violation of the provisions on personal data protection;

4) the right to object to the processing of personal data, provided that the processing of personal data is carried out for the purposes resulting from legitimate interests pursued by the administrator or a third party, i.e. on the basis of Article 6 paragraph 1 letter f of the GDPR;

5) the right to withdraw consent at any time without affecting the lawfulness of the processing of personal data carried out on the basis of consent prior to its withdrawal.