GDPR
We explain what data we process, why we need it, to whom it may be disclosed and what rights are available to data subjects.
The data controller is Kancelaria Adwokacka Tomasz Wiliński, ul. Krucza 16/22, 00-526 Warsaw, NIP 5992888071, attorney registration WAW/Adw/6392. Privacy matters may be addressed to adwokat@tomaszwilinski.eu.
Depending on the relationship, this may include identification and contact data, information concerning a legal matter or mediation, billing data, correspondence, documents, data relating to persons connected with the matter, technical data relating to use of the website and other information provided to the Firm. Legal matters may also involve special categories of personal data within the meaning of Article 9 GDPR and personal data relating to criminal convictions and offences within the meaning of Article 10 GDPR, where their processing is necessary and permitted by applicable law.
We process data in particular to: respond to an enquiry and take steps before entering into a contract; conclude and perform a legal-services, mediation or consultation agreement; check conflicts of interest; comply with legal, tax and accounting obligations; establish, exercise or defend legal claims; ensure website security and organise our work; and, where consent has been obtained, for separate clearly identified purposes. Depending on the purpose, the legal basis may be Article 6(1)(a), (b), (c) or (f) GDPR. Special-category data is processed only where an appropriate basis under Article 9 GDPR exists, and data relating to criminal convictions and offences is processed with due regard to Article 10 GDPR and Polish law governing the legal profession and provision of legal assistance.
In legal matters and mediations, we may receive data concerning the other party, witnesses, family members, employees, counterparties or other persons from a client, court, authority, participant in proceedings or a lawfully available source. The scope of information provided to such a person under Article 14 GDPR may be restricted by law, professional secrecy or the protection of the rights and freedoms of others.
Data may be entrusted or disclosed to IT and hosting providers, e-mail operators, form, payment, scheduling and videoconferencing systems, accountants, technical-support providers and — where the matter requires it — courts, public authorities, experts, interpreters, legal representatives, mediators or other authorised persons. We limit disclosure to what is necessary.
Some technology providers may process data outside the European Economic Area. In such cases, mechanisms provided for by GDPR are used, in particular adequacy decisions or appropriate safeguards such as Standard Contractual Clauses, where required.
The retention period depends on the legal basis and purpose of the processing. For personal data processed by an attorney in the course of professional practice, Article 16c of the Polish Law on the Bar applies: data is retained for 10 years from the end of the year in which the proceedings in which the data was collected ended, and is deleted after the statutory period expires. For data not covered by that special rule — for example certain website technical data, enquiries that do not lead to acceptance of a matter, or billing data — retention follows from the purpose of processing, tax and accounting duties, specific legislation and the period needed to establish, exercise or defend legal claims.
The scope of a data subject's rights depends on the legal basis and context of processing. As a rule, GDPR provides, among other things, rights of access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent. However, data obtained by an attorney in connection with the provision of legal assistance is subject to special limitations under Article 16a of the Polish Law on the Bar: the rights under Article 15(1) and (3), Article 18 and Article 19 GDPR apply only insofar as they do not breach professional secrecy, and Article 21(1) GDPR does not apply to data obtained by an attorney in connection with legal assistance. Other restrictions may follow from a legal obligation, protection of the rights of other persons or the need to establish, exercise or defend legal claims.
A person who considers that their personal data is being processed unlawfully may lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).
The Firm does not make decisions concerning clients that produce legal effects solely by automated means. Technology may assist organisation or analysis, but final decisions on accepting a matter, advice and strategy are made by a human professional.
We process children's data with particular care and only to the extent necessary to conduct a matter, mediation or protect the child's interests. Information addressed directly to a child should be presented in a way that is understandable in light of the child's age and situation.
We apply organisational and technical measures appropriate to the nature of the data and the risk, including access restrictions, confidentiality rules and measures designed to protect communications and documentation.
How we work with data
Personal-data processing at the Firm takes account of GDPR, the Polish Law on the Bar, professional secrecy and the nature of the particular matter. The scope of data and the way it is used depends on whether it concerns an enquiry, qualification of a matter, legal assistance, representation, mediation, an online consultation, billing or use of the website.
Data may be provided directly by a client or another person contacting the Firm during a conversation, meeting, e-mail correspondence, through an online form, during a consultation, mediation or in the course of a matter. It may also come from documents supplied by the client, another party, legal representative, court, prosecutor, administrative authority, enforcement officer, expert, interpreter or another participant in the matter, as well as from publicly available registers and sources where their use is legally justified.
Data may be processed in paper and electronic form, in particular in case files, correspondence, procedural and contractual documents, working notes, mediation documentation, billing documents and systems used for communication and work organisation. Processing may include, among other things, collection, recording, organisation, storage, consultation, use, transmission to authorised recipients, restriction, archiving and deletion.
Before accepting a mandate, the Firm may process basic data concerning the client, the other party and other participants solely to the extent needed to verify whether the Firm may act, check conflicts of interest, determine the scope of the service and organise it. At this stage, please do not provide more data or documentation than is necessary for preliminary qualification.
Once a matter has been accepted, the scope of data processed may be broader and include information required for legal analysis, drafting documents, representation, communication with courts and authorities, negotiations, protecting the client's interests and establishing, exercising or defending legal claims. This may also include special categories of data and data concerning criminal convictions and offences, where legally permitted and necessary to provide legal assistance.
In connection with mediation, we process data needed to register and organise the submission, communicate with the parties, assess whether mediation can be conducted, conduct sessions, prepare the mediation record, document any settlement and settle the mediation fees. Data provided during mediation is additionally protected by the confidentiality rules applicable to mediation.
For consultations and remote communication, data is processed to the extent necessary to qualify the matter, schedule the appointment, communicate, conduct the consultation and settle the service. Where we use an external provider of e-mail, hosting, videoconferencing, calendars, forms or payments, we limit the data transferred to what is necessary for that function, with due regard to data-processing and protection requirements.
Persons acting within the Firm and cooperating professionals may access data only to the extent justified by a specific task and subject to confidentiality obligations. Data may also be processed by providers of technical, accounting, hosting, payment or communication services under an appropriate legal arrangement and disclosed to courts, authorities and other entities where required by law or by the nature of the matter.
Technology may support work organisation and analysis, but its use must not breach professional secrecy, confidentiality or data-protection principles. If a technology provider is to process personal data on behalf of the Firm, before the tool is used we consider in particular the provider's role, scope of data, legal basis, processing arrangement, processing location, potential transfers outside the EEA and adequacy of safeguards. Final responsibility for legal advice and professional decisions remains with a human professional.
Protective measures are selected according to the type of data, risk and manner of processing. They include organisational and technical measures designed in particular to reduce unauthorised access, loss, accidental destruction, disclosure or alteration. Detailed documentation concerning security measures, permissions and security procedures is internal and is not published on the website.
When first contacting us, provide only the information necessary to identify the matter and the parties. Full case files, sensitive data and documents containing information protected by professional secrecy should be transmitted only after the Firm has agreed the appropriate method of communication.