Privacy Policy – zalewski.legal

GENERAL INFORMATION

The Privacy Policy describes how Zalewski Legal processes personal data and uses cookies.
The controller of personal data is Kancelaria Radcy Prawnego Tomasz Zalewski with its registered office at 00-843 Warsaw, Rondo Ignacego Daszyńskiego 1, operating under the brand name Zalewski Legal.
The Privacy Policy applies to all services and websites of Zalewski Legal that refer to it.
Zalewski Legal processes personal data in accordance with the provisions of Regulation 2016/679 of 27 April 2016 (GDPR) and other applicable data protection regulations.
Zalewski Legal uses appropriate technical and organisational measures to protect data against loss, alteration, disclosure or unauthorised access, in particular:
a. technical measures: data encryption, IT system security, regular software updates, backups,
b. organisational measures: data access procedures, employee training, access control to premises, security incident response procedures.
If a data breach occurs that may pose a risk to the rights and freedoms of individuals, Zalewski Legal shall report it to the President of the Personal Data Protection Office immediately, no later than within 72 hours of discovering the breach.
If the breach is likely to result in a high risk, Zalewski Legal shall immediately inform the data subject.
Contact: tomasz.zalewski@zalewski.legal; correspondence address: Rondo Ignacego Daszyńskiego 1, 00-843 Warsaw.
Zalewski Legal has not appointed a data protection officer due to the limited scale of processing of special categories of personal data and the lack of systematic large-scale monitoring.
The Privacy Policy may be updated in connection with changes in the law, the nature of the business or the technologies used.
Zalewski Legal will notify you of any significant changes by publishing an updated version on its website and, where appropriate, by directly notifying the data subjects.
Date of last update of the Privacy Policy: 8 October 2025.

PERSONS WHOSE PERSONAL DATA IS PROCESSED, SCOPE OF DATA, PURPOSES AND GROUNDS FOR PROCESSING

Personal data is processed by Zalewski Legal in relation to the categories of persons and purposes indicated below.
Representatives of clients and contractors:
a. Processed data: first name, surname, position, business contact details (e.g. e-mail address, telephone number) and other data relevant to the provision of legal assistance,
b. Purpose of processing: conclusion and performance of a contract and fulfilment of obligations related to business activities, including AML/CFT (anti-money laundering and counter-terrorist financing) obligations,
c. Legal basis: Article 6(1)(f) of the GDPR (legitimate interest of Zalewski Legal consisting in business contacts and the preparation and implementation of cooperation), in the case of clients who are natural persons, Article 6(1)(b) of the GDPR (necessity for the conclusion and performance of a contract),
d. The legitimate interest has been identified as the need to maintain business contacts with representatives of clients and contractors in order to perform contracts and conduct business activities. The balancing of interests test showed that this interest prevails over the rights of individuals due to the limited scope of the data processed, its necessity for the performance of contractual obligations and the security measures applied.
Persons contacting Zalewski Legal:
a. Data processed: first name, surname, contact details and other data provided in the content of the message or during the conversation,
b. Purpose of processing: communication with potential clients,
c. Legal basis: Article 6(1)(f) of the GDPR (Zalewski Legal’s legitimate interest in communicating with potential clients),
d. The legitimate interest has been identified as the need to respond to enquiries and provide information about the services offered. The balancing of interests test has shown that this interest is proportionate to the rights of individuals due to the voluntary nature of the contact, the possibility of easy objection and the limited scope of the contact data processed.
Special categories of data or data on infringements of the law:
a. Data processed: special categories of data (in particular data concerning health, racial or ethnic origin, political opinions, religious beliefs) and data on convictions and offences – only to the extent necessary to provide a specific legal service,
b. Purpose of processing: provision of specialist legal assistance in cases requiring the processing of such data, fulfilment of legal obligations under AML/CFT regulations, or establishment, investigation or defence of claims,
c. Legal basis: with regard to special categories of data – Article 9(2)(f) of the GDPR (processing is necessary for the establishment, exercise or defence of legal claims, and appropriate safeguards for the rights and freedoms of the data subject are in place); with regard to AML obligations – Article 6(1)(c) and Article 9(2)(g) of the GDPR (processing is necessary for reasons of substantial public interest); in the scope of judgments and infringements of the law – Article 10 of the GDPR (processing is carried out under the control of public authority or on the basis of Union or Member State law),
d. Security measures: special categories of data are processed using special security measures, including encryption, restricted access and additional access control procedures.
Job applicants:
a. Processed data: first name, surname, employment history, education information and other data provided by the candidate that is relevant to the recruitment process,
b. Purpose of processing: conducting the recruitment process,
c. Legal basis: Article 6(1)(b) of the GDPR (pre-contractual measures), Article 6(1)(c) of the GDPR (compliance with legal obligations incumbent on Zalewski Legal) and Article 6(1)(a) of the GDPR (consent – to the extent exceeding the above-mentioned bases).
Marketing contacts on the part of clients:
a. Data processed: first name, surname, position, company, e-mail address and other contact details,
b. Purpose of processing: direct marketing of Zalewski Legal’s services,
c. Legal basis: Article 6(1)(f) of the GDPR (legitimate interest of Zalewski Legal in the form of direct marketing),
d. The legitimate interest has been identified as the need to promote Zalewski Legal’s services to existing customers and to maintain business relationships. The balancing test has shown that this interest is proportionate to the rights of individuals due to the existing legal relationship with the customer, the possibility of easily opting out of receiving marketing information and the limited scope of contact details used.
Newsletter subscribers and persons who have given their marketing consent:
a. Data processed: first name, surname, company name, email address and other contact details,
b. Purpose of processing: direct marketing (including sending newsletters or other marketing information),
c. Legal basis: Article 6(1)(a) of the GDPR (consent).
Pursuing claims or defending against claims:
a. Data processed: scope depending on the circumstances of the case,
b. Purpose of processing: pursuing claims and defending against claims,
c. Legal basis: Article 6(1)(f) of the GDPR (legitimate interest of Zalewski Legal in pursuing claims and defending against them),
d. The legitimate interest has been identified as the need to protect the rights and legal interests of Zalewski Legal, including the pursuit of claims and defence against claims. The balancing test has shown that this interest prevails due to the right to protect one’s rights and the proportionality of the scope of data processing to the purpose pursued.
Obligation to provide personal data:
a. to conclude or perform a contract and fulfil legal obligations (e.g. AML/CFT) – providing data is necessary to achieve these purposes,
b. for communication – providing data is necessary to respond,
c. for marketing – providing data is voluntary.
Marketing information will be sent on an appropriate legal basis or after consent has been given.
You can opt out of receiving marketing information at any time via a link in the message or by contacting us by email.
To manage the list of subscribers to marketing information and to send messages to the persons on that list, we use MailerLite – an external provider that may process data using standard industry technologies in order to help us monitor and improve the information we send.
MailerLite’s privacy policy is available here: https://www.mailerlite.com/pl/legal/privacy-policy.
Personal data will not be used for profiling or automated decision-making in relation to data subjects.
If Zalewski Legal receives third-party data from a client, the client:
a. ensures that the transfer of third-party data is lawful and that they have an appropriate legal basis for disclosing such data to Zalewski Legal;
b. fulfils their information obligation towards these persons, including providing them with this Privacy Policy;
c. transfers the data in a secure manner;
d. ensures that the consent of these persons is obtained prior to the disclosure of the data, if the basis for processing is consent.
The Zalewski Legal website is not directed at children, and Zalewski Legal does not knowingly collect data from persons under the age of 16.

PERSONAL DATA RETENTION PERIOD

The period of storage of personal data depends on the purpose of its processing:
a. Processing in connection with the performance of a contract and related claims – for the duration of the contract and until the expiry of the limitation periods for claims;
b. Processing in connection with communication with potential customers – 1 year from the last message or 1 year from the date specified in the offer as its expiry date, whichever occurs later, unless the law provides for a longer period;
c. Processing in connection with direct marketing based on legitimate interest – until an effective objection is raised;
d. Processing in connection with marketing based on consent – until consent is withdrawn;
e. Processing in connection with the fulfilment of legal obligations – for the period required by law, in particular tax and accounting regulations;
f. Processing in connection with the use of social media platforms – for the duration of the website, profile or account on a given platform or until the content or profile is deleted.

TRANSFER OF PERSONAL DATA

Data may be transferred to entities cooperating with Zalewski Legal, including entities processing data on our behalf (subcontractors, lawyers, service providers) and separate controllers (e.g. courts, tax authorities, notaries, couriers) to the extent necessary to achieve the purposes set out in the Privacy Policy.
As a rule, data will not be transferred outside the European Economic Area (EEA), unless this is necessary for the proper provision of legal services or related to the use of technology providers’ tools.
If it is necessary to transfer data outside the EEA, the transfer will only take place to countries covered by the European Commission’s decision on an adequate level of protection or on the basis of appropriate safeguards in accordance with Article 46 of the GDPR.
Current transfers outside the EEA include:
a. The United States – under the EU-US Data Privacy Framework for Google Analytics and other Google tools (Commission Implementing Decision (EU) 2023/1795),
b. Other countries – only on the basis of standard data protection clauses approved by the European Commission.
Detailed information on international transfers, including the safeguards applied, is available upon request from the data subject.

DATA PROCESSING ON SOCIAL MEDIA

Zalewski Legal has a LinkedIn profile, which is linked to the Zalewski Legal website.
Zalewski Legal processes the data of persons who follow the profile or interact with it (likes, comments, messages) in order to provide information about its activities and respond to questions and comments, pursuant to Article 6(1)(f) of the GDPR (legitimate interest in the form of promotion and communication).
The legitimate interest has been identified as the need to promote the services provided and to communicate with potential clients via the social media platform. The balancing of interests test has shown that this interest is proportionate due to the voluntary nature of interaction on the part of platform users and the possibility of controlling privacy through LinkedIn settings.
The data controller within the platform and its functions remains LinkedIn Ireland Unlimited Company, which applies its own privacy policy and provides mechanisms for the exercise of users’ rights.
In terms of statistics and interactions on the Zalewski Legal profile, Zalewski Legal is a joint controller with LinkedIn; joint control applies only to the processing of data for the purpose of generating profile statistics and managing user interactions.
Division of responsibilities between joint controllers:
a. Zalewski Legal is responsible for: content published on the profile, responses to comments and messages, fulfilling the information obligation regarding its own activities, handling requests from data subjects regarding content published by Zalewski Legal,
b. LinkedIn is responsible for: the functioning of the platform, technical security, data processing within the framework of the platform’s functions, and the exercise of users’ rights with regard to the platform’s functions.
Data subjects may exercise their rights against each of the joint controllers.
Detailed rules for joint administration are set out in the LinkedIn platform terms and conditions available at https://www.linkedin.com/legal/l/page-joint-controller-addendum and are available upon request from the data subject.
The data will be stored for the duration of the profile viewing or interaction, and in the case of messages, until the end of the correspondence and for the period of limitation of claims; the platform may retain copies of the data in accordance with its own rules.
Providing data is voluntary and is related to the use of the platform’s features; you can opt out at any time (e.g. stop following, delete a comment or message, change your privacy settings).

RIGHTS RELATED TO THE PROCESSING OF PERSONAL DATA

Under the terms of the GDPR, persons whose data is processed have the following rights:
a. the right to request access to their data, obtain a copy of that data, rectify it, delete it, restrict its processing and transfer it;
b. the right to object to the processing of data;
c. the right to withdraw consent to data processing at any time – if the data is processed on this basis;
d. the right to lodge a complaint with the President of the Personal Data Protection Office, ul. Stanisława Moniuszki 1A, 00-014 Warsaw.
To exercise the above rights, please contact Zalewski Legal: e-mail: tomasz.zalewski@zalewski.legal; correspondence address: Rondo Ignacego Daszyńskiego 1, 00-843 Warsaw.
If the request concerns processing on a social media platform, please contact LinkedIn directly in accordance with its policy.
The exercise of certain rights may be subject to restrictions arising from professional secrecy and specific regulations.

COOKIES

The Zalewski Legal website uses cookies and similar technologies to ensure proper functioning (necessary), improve functionality, analytics, marketing and social features.
Cookies are small text files stored on the user’s end device (e.g. computer, tablet, smartphone) that help the website to function.
The legal basis for the use of cookies is as follows:
a. necessary cookies – Article 399(1) and (2) of the Electronic Communications Law (cookies necessary to provide an information society service explicitly requested by the user) and Article 6(1)(f) of the GDPR (legitimate interest – ensuring the operation and security of the website);
b. functional, analytical and marketing cookies – Article 399(1) and (2) of the Electronic Communications Law and Article 6(1)(a) of the GDPR on the basis of consent.
Detailed information about the cookies used:
a. Essential cookies: session files ensuring the basic functioning of the website, storage time: until the browser is closed,
b. Analytical cookies: Google Analytics (_ga, _gid, _gat) – website traffic analysis, storage time: up to 24 months,
c. Functional cookies: remembering user preferences, storage time: up to 12 months,
- fp_cookie – a necessary cookie. It stores information about the user’s tracking consents, the list of tracking tools the user has consented to and the date of the last update of the privacy policy page. It does not expire.
- fp_current_session – an optional cookie. It requires consent to statistics tracking. It stores the number and type of pages the visitor viewed during the session, the traffic source domain, the URL parameters of the first landing page in the session and the visitor’s lead score. It expires when the visitor has been inactive for 30 minutes.
- fp_recent_sessions – an optional cookie used to track visitor behaviour across multiple sessions. It requires consent to statistics tracking. It stores the number and type of pages the visitor viewed during recent sessions. It expires 30 days after the last visit.
- cdb_id – a necessary cookie. It is saved after visitors make a choice in the consent banner. It stores the proof-of-consent identifier, which is saved in a remote database. It does not expire.
  A full list of cookies used with a description of their functions is available in the cookie settings on the website.
On your first visit, information about the use of cookies is displayed with the options “Accept”, “Reject” and “Settings”; you can change or withdraw your consent at any time by deleting cookies or changing their settings in your browser.
Not giving your consent or withdrawing it does not affect the use of the basic functions of the website.
The website uses the Google Analytics (GA) analytics service; Google acts as a processor on the basis of the relevant data processing terms and conditions. GA does not store full IP addresses and uses the data for aggregate statistics on visits, devices and behaviour on the website.
If data is transferred outside the EEA (e.g. to the USA) in connection with the operation of analytical services, the data is transferred to entities certified under the EU-US Data Privacy Framework.
When using the website, logs are created (IP address, date, time, browser, operating system), which are processed for security, error diagnosis and website administration purposes on the basis of a legitimate interest for the time necessary for these purposes; the logs are only accessible to authorised administrators.
The legitimate interest lies in the need to ensure the security, stability and proper functioning of the website. The balancing of interests test has shown that this interest prevails due to the need to protect the website from attacks and ensure its availability to all users.