Privacy Policy

1. Data Controller and contact details

The Data Controller is Cieślak & Associates Radcowie Prawni Sp.p., Gagarina 26 Street, Unit U6, 00-754 Warsaw; District Court for the Capital City of Warsaw, 13th Commercial Division, KRS: 0001241896, TIN: 5214165876.

Contact details for the Data Controller: kontakt@cieslaw.pl.

2. Who this policy applies to

This policy applies to all persons with whom we come into contact, in particular employees and associates, our clients and their business partners, participants in events organised by us, and candidates for employment or collaboration.

3. What data do we collect

We collect only the minimum data necessary for our operations. For example, from contact persons at clients and business partners, we collect their full name, work telephone number, work email address, job title and place of work. From event participants, we collect the data provided during event registration. From job applicants, we collect the data contained in their CVs and cover letters: full name, date of birth, contact details, education, professional qualifications and employment history; and, with separate consent, any other data provided voluntarily. We also process personal data received via post and email.

4. For what purpose and on what basis do we process data

We process the data of individuals contacting us on behalf of current or potential clients for the purpose of ongoing communication regarding the preparation of quotations, the fulfilment of orders, the handling of legal disputes and the organisation of events. Legal basis: Article 6(1)(f) of the GDPR – the controller’s legitimate interest, consisting of maintaining ongoing communication relating to the controller’s professional activities and maintaining business relationships.

We process job applicants’ data for the purpose of assessing their qualifications and selecting the right person for the post. Legal bases: Article 6(1)(c) of the GDPR in conjunction with Article 22 (1) §1 of the Labour Code – for data required by law; Article 6(1)(b) of the GDPR – necessity for the conclusion of an employment contract; Article 6(1)(a) of the GDPR – consent, in respect of data going beyond that required by law and in respect of future recruitment; Article 6(1)(f) of the GDPR – the controller’s legitimate interest, in respect of data collected during the interview, consisting of assessing the candidate’s suitability for employment with the Controller on the basis of data obtained during the interview.

5. Source of data

In most cases, we receive personal data directly from you – through correspondence, conversations or when you register for an event.

In the case of contact persons at our clients and business partners, data may be provided to us by your employer or the organisation you represent, rather than directly by you. In such cases, that entity is the source of the data. Most commonly, we receive your first name and surname, work email address, telephone number, job title and postal address in this way. The legal basis for processing is Article 6(1)(f) of the GDPR – the Controller’s legitimate interest in being able to maintain ongoing contact regarding the assignment.

6. How long we retain data

We retain the contact details of clients’ and business partners’ contact persons for the duration of our relationship with your employer or the organisation you represent, and for the period during which any mutual claims remain valid.

We retain the details of individuals who contact us regarding other matters for the duration of the contact and for one year after it ceases.

We retain the data of event participants for one year following the end of the event.

We retain the data of job applicants until the recruitment process is completed, and, where consent has been given for future recruitment, for two years from the date of collection.

7. To whom we disclose data

We disclose data exclusively to our service providers to whom we outsource activities related to the processing of personal data, in particular IT service providers, accounting service providers and other service providers supporting the Controller’s operations. These entities act solely on the basis of a data processing agreement concluded with us and in accordance with our instructions.

We do not transfer data to countries outside the European Economic Area or to international organisations. Should such a transfer become necessary in the future (e.g. in connection with the use of technology providers’ services), we will utilise the solutions provided for in the GDPR to ensure legality and an adequate level of protection, e.g. through the use of standard contractual clauses adopted by the European Commission or other solutions permitting data transfers.

8. Automated decision-making and profiling

We do not use automated decision-making or profiling within the meaning of Article 22 of the GDPR.

9. Is the provision of data mandatory?

The provision of data by job applicants to the extent required by the Labour Code is essential for participation in the recruitment process – without this data, we cannot carry out the recruitment process. The provision of any other data by applicants is voluntary.

In all other cases, the provision of data is voluntary but necessary to establish or maintain contact with the Law Firm.

10. Your rights

Regardless of the purpose of our mutual contact, you are entitled to the following rights: the right of access to your data (Article 15 of the GDPR), the right to request rectification of data (Article 16 of the GDPR), the right to request erasure of data (Article 17 of the GDPR), the right to request restriction of processing (Article 18 of the GDPR) and the right to object to processing (Article 21 of the GDPR) – to the extent that data is processed on the basis of the controller’s legitimate interests, you may object on grounds relating to your particular situation.

If your data is processed on the basis of consent – regardless of whether you are a job applicant or another individual – you have the right to withdraw your consent at any time, without this affecting the lawfulness of the processing carried out prior to its withdrawal. Job applicants also have the right to data portability (Article 20 of the GDPR) in respect of data processed on the basis of consent or a contract.

Everyone has the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office.

To exercise the above rights, please contact us by sending an email to the address specified in point 1 above.