Privacy Policy

 §1. General Information

1. This Privacy Policy and the Terms and Conditions define the rules of operation of the website www.gabiec-kancelaria.pl, belonging to the Law Firm of Legal Counsel Żaneta Gabiec, with its registered office in Wrocław, ul. Kościańska 32/2, 54-027 Wrocław, NIP: 8943244725, : +48 531 257 746, e-mail: kontakt@gabiec-kancelaria.pl (hereinafter: “Administrator” or “Law Firm“).
2. The Administrator undertakes to protect the privacy of users and ensure the security of personal data processing in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter: “GDPR“), as well as other applicable laws.
3. This Policy aims to inform users about how their personal data is collected, processed, and protected when using the Law Firm’s website.
4. The website www.gabiec-kancelaria.pl is for informational purposes and does not constitute an offer within the meaning of Article 66 §1 of the Civil Code.
5. All materials posted on the website, including content, graphics, photos, and documents, are protected by law under the Act of February 4, 1994, on Copyright and Related Rights, and the Act of April 16, 1993, on Combating Unfair Competition.

 

§2. Obligations of the Administrator

The Administrator undertakes to:

1. Ensure compliance with the law – Users’ personal data is processed in accordance with the GDPR and other applicable laws regarding personal data protection.
2. Ensure an adequate level of data protection – The Administrator has implemented the necessary technical and organizational measures to prevent unauthorized access to personal data, its loss, unauthorized disclosure, or breach.
3. Ensure users’ rights are exercised – Every person whose data is processed has the right to exercise their rights under the GDPR, such as access to data, its correction, deletion, or restriction of processing.
4. Maintain documentation on data processing – The Administrator keeps a record of processing activities, containing information about the categories of processed data, their purposes, and legal bases.
5. Take action in case of a data breach – If a personal data breach occurs, the Administrator will take appropriate actions and, if necessary, report the breach to the President of the Personal Data Protection Office.
6. Minimize processed data – The Administrator collects only personal data necessary for the purposes specified.

 

§3. Obligations of Website Users

1. The user is obliged to use the website www.gabiec-kancelaria.pl in accordance with applicable laws, the provisions of these Terms and Conditions, and good practices.
2. The user may not take actions that could disrupt the functioning of the website, including:

1. • Attempting unauthorized access to the Administrator’s IT systems,
   • Interfering with the content of the website,
   • Introducing content that is contrary to applicable law or violates the rights of third parties.

3. The content posted on the website may only be used for personal purposes. Any commercial use requires the prior consent of the Administrator.

 

§4. Purposes and Legal Basis for Personal Data Processing

1. The Administrator processes users’ personal data for the following purposes:

1. • Provision of legal services – based on Article 6(1)(b) of the GDPR,
   • Compliance with legal obligations – based on Article 6(1)(c) of the GDPR,
   • Establishment, exercise, or defense of claims – based on Article 6(1)(f) of the GDPR,
   • Contacting users and potential clients – based on Article 6(1)(f) of the GDPR,
   • Marketing of the Law Firm’s services – based on Article 6(1)(a) of the GDPR.

2. Providing personal data is voluntary but necessary to use the Administrator’s services.

 

§5. Personal Data Retention Period

1. Personal Data Retention Period

The Administrator stores users’ personal data for the period necessary to achieve the purposes for which it was collected, including:

1. • For the duration of the contract and service provision – data is stored for the duration of the contract and the provision of legal services to the user, in accordance with Article 6(1)(b) of the GDPR (necessity to perform the contract).
   • To fulfill obligations under the law – in particular regarding the storage of accounting, tax, and accounting documentation, data is stored for the period required by law in accordance with Article 6(1)(c) of the GDPR (legal obligation).
   • Until the statute of limitations for potential claims – data may be stored for the period resulting from the statute of limitations for civil and tax claims in accordance with Article 6(1)(f) of the GDPR (legitimate interest of the Administrator).
   • In case of user consent – data processed on the basis of consent is stored until its withdrawal, unless there are other legal bases for further processing in accordance with Article 6(1)(a) of the GDPR.

2. Archival data and its storage:

1. • After the service is completed or the contract expires, data may be archived for the purpose of pursuing claims, protection against claims, or for evidentiary purposes.
   • Documents containing personal data that are no longer required for further processing are stored in archiving systems until their deletion.

3. Right to be forgotten:

1. • Under Article 17 of the GDPR, every person whose data is processed by the Administrator has the right to request its deletion if:
     • The personal data is no longer necessary for the purposes for which it was collected,
     • The user has withdrawn consent to processing, and there is no other legal basis for further processing,
     • The data subject objects effectively to the processing, and there are no overriding legitimate grounds for further processing,
     • The personal data has been processed unlawfully,
     • The data must be deleted to comply with a legal obligation under EU or national law.
   • The right to delete data does not apply if processing is necessary to:
     • Comply with a legal obligation requiring processing under EU or national law,
     • Establish, exercise, or defend claims.

4. Procedure for exercising the right to be forgotten:

1. • To exercise the right to delete data, the user can submit a request as follows:
     • By phone at: 531 257 746,
     • By e-mail to: kontakt@gabiec-kancelaria.pl,
     • In person at the Law Firm’s office.

5. Method of data deletion:

1. • After the retention period, personal data will be permanently deleted.
   • Data deletion is carried out in accordance with security principles that ensure it will not be accessible to unauthorized persons or subject to further processing.
   • In case of data deletion, the Administrator will not be able to process it further or restore its content, which means losing access to all information associated with the user.

6. Data processed on the basis of the Administrator’s legitimate interest:

• • In the case of data processed under Article 6(1)(f) of the GDPR, i.e., within the legitimate interest of the Administrator (e.g., conducting analyses, statistics, pursuing claims), data will be stored until the purpose of its processing ceases or the user objects effectively.
  • The user has the right to object to the processing of their data, and the Administrator is obliged to cease processing unless there are overriding legitimate grounds for further processing or the need to pursue claims.

 

§6. Protection of Personal Data of Minor Users

1. Principles of processing minors’ data:

1. • The website www.gabiec-kancelaria.pl and services provided by the Administrator are intended for adults. The Administrator does not knowingly collect personal data of persons under 18 years of age without the prior consent of their parents or legal guardians.
   • If the Administrator finds that it is processing the data of a minor without the required consent, it will take immediate action to delete this data.

2. Consent of a parent or legal guardian:

1. • If a user of the website or the Administrator’s services is under 18 years of age, it is required to obtain the consent of a parent or legal guardian for the processing of personal data.
   • This consent should be given in an explicit and verifiable manner, e.g., by providing a statement by e-mail or in writing.

3. Rights of parents and legal guardians:

1. • Parents or legal guardians have the right to:
     • Request access to their child’s data and its correction or deletion,
     • Withdraw consent to data processing at any time,
     • Object to the processing of their child’s data if they believe it is not in accordance with the GDPR.

4. Procedure for reporting breaches concerning minors’ data:

• • If a parent or legal guardian suspects that their child’s data has been processed without consent or unlawfully, they can report this fact to the Administrator:
    • By phone at: 531 257 746,
    • By e-mail to: kontakt@gabiec-kancelaria.pl,
    • In person at the Law Firm’s office.
  • The Administrator undertakes to take immediate action to protect the rights of the child and, if necessary, delete the data.

 

§7. Deadlines for Fulfillment of Information Obligations by the Administrator

1. Data collected directly from the data subject:

1. • When obtaining personal data directly from the user, the Administrator provides them with all required information at the time of collection.

2. Data collected indirectly:

1. • If personal data is obtained from other sources (e.g., public registers, databases), the Administrator fulfills the information obligation within the following deadlines:
     • No later than one month from the moment of obtaining the data – taking into account the specifics of processing and the potential impact on the data subject.
     • At the latest upon the first contact with the data subject if the data is used for communication.
     • At the latest upon the first disclosure of data to another recipient if the data is to be transferred to third parties.

3. Scope of information provided:

1. • When fulfilling the information obligation, the Administrator provides the data subject with at least the following information:
     • The purpose and legal basis for data processing,
     • The Administrator’s contact details,
     • Information about recipients of personal data (if applicable),
     • The data retention period or criteria for determining it,

• The rights of the data subject, including the right to lodge a complaint with the President of the Personal Data Protection Office 1 (PDPO).

4. Exemption from the information obligation:

• • The Administrator may be exempt from the information obligation if:
    • The data subject already has the required information,
    • Obtaining data and providing information would be impossible or would require disproportionate effort,
    • Personal data must remain confidential under the law, e.g., due to professional or defense secrecy.

 

§8. Reporting Personal Data Breaches

1. Obligation to report a personal data breach:

1. • The Administrator, in accordance with Article 33 of the GDPR, is obliged to report a personal data breach to the PDPO no later than 72 hours after its detection, unless it is unlikely that the breach will result in a risk to the rights and freedoms of natural persons.
   • If the notification to the supervisory authority occurs after 72 hours, the Administrator is obliged to provide justification for this delay.
   • In the event that the breach concerns personal data processed under a contract with a third party (e.g., client, contractor), the Administrator takes immediate action to secure the data and notify the parties that may be affected by the breach.

2. Content of the breach notification to PDPO:

1. • The personal data breach notification should include:
     • A description of the nature of the breach – indicating whether there has been a leak, loss, unauthorized access, or breach of personal data integrity,
     • Identification of the categories and approximate number of data subjects, as well as the categories of data that have been breached,
     • A description of the possible consequences of the breach – e.g., the risk of identity theft, unauthorized use of data, loss of control over personal data,
     • Information on the measures taken or proposed – actions aimed at minimizing the effects of the breach and preventing similar incidents in the future.

3. Obligation to notify data subjects of a breach:

1. • If a data breach may lead to a high risk to the rights and freedoms of natural persons, the Administrator is obliged to inform the data subjects without undue delay.
   • The notification should be clear and include:
     • A description of the breach,
     • The potential consequences of the breach,
     • Actions that the data subjects can take to protect their data,
     • Contact details of the person responsible for providing information about the breach.
   • The Administrator may waive the obligation to notify natural persons if:
     • Appropriate technical measures (e.g., encryption) have been implemented that effectively prevent unauthorized access to the breached data,
     • Actions have been taken to eliminate the high risk to the rights and freedoms of natural persons,
     • Notification would require disproportionate effort – in this case, a public announcement informing about the breach should be issued.

4. Registration of data breaches:

1. • The Administrator keeps a record of personal data breaches, even if the breach does not require notification to PDPO.
   • The register should include:
     • The date and time of breach detection,
     • The circumstances of the incident,
     • The type of breach,
     • The measures taken,
     • An assessment of the risk and consequences of the breach.
   • The register should be available at the request of the PDPO for compliance control with the GDPR.

5. Preventive measures to prevent breaches:

1. • The Administrator implements adequate technical and organizational measures that ensure the maximum level of protection of processed personal data, in accordance with the principles set out above.

6. Procedure for reporting a breach by the user:

1. • If a user of the website www.gabiec-kancelaria.pl suspects that their personal data has been breached, they can report this fact to the Administrator:
     • By phone at: 531 257 746,
     • By e-mail to: kontakt@gabiec-kancelaria.pl,
     • In person at the Law Firm’s office.
   • The Administrator undertakes to promptly consider the report and take appropriate action to secure the data and minimize the risk of a breach.

7. Cooperation with supervisory authorities:

1. • In the event of a personal data breach notification, the Administrator cooperates with the PDPO, providing the required information and implementing the recommended corrective measures.
   • The Administrator undertakes to implement all guidelines and recommendations of PDPO to improve personal data security and prevent further breaches.

8. Deadline for taking action – 72 hours:

• • The Administrator undertakes to take all actions to assess and report a breach within 72 hours of its detection, in accordance with the GDPR.
  • In the event of a data breach, the Administrator immediately analyzes the situation, assesses the risk, and decides on further steps, including the need to report the incident to PDPO and/or notify the data subjects.

 

§9. Rights of Website Users

1. Every user has the right to:

1. • Access their data,
   • Rectify their data,
   • Request data deletion,
   • Restrict data processing,
   • Transfer their data,
   • Object to data processing.

2. To exercise these rights, please contact the Administrator in person, by phone, or by e-mail at kontakt@gabiec-kancelaria.pl.

 

§10. Cookie Policy

1. The website uses cookies to:

1. • Ensure proper website operation,
   • Analyze user traffic,
   • Adapt content to users.

2. Types of cookies used on the website:

1. • Necessary – ensuring proper website functioning,
   • Analytical – allowing analysis of user traffic,
   • Marketing – used to personalize advertising content.

3. The user can manage cookies independently through their web browser settings.

 

§11. Right to Lodge a Complaint

1. If the user believes that their personal data is processed unlawfully, they have the right to lodge a complaint with the PDPO.

 

§12. Final Provisions

1. The Administrator reserves the right to make changes to the Privacy Policy and Terms and Conditions in the event of updates to legal regulations or other circumstances requiring their adjustment.
2. The new version of the document will be published on www.gabiec-kancelaria.pl and will take effect on the date of its publication.