Privacy Policy

1. What does this Privacy Policy describe?

This privacy policy ("Policy") regulates the processing of personal data by Cabaj Kotala Doradztwo Podatkowe sp. z o.o. ("Cabaj Kotala," "we") when we provide services, when you contact us, and when you visit our website https://cabajkotala.com ("Website").

The Policy contains information about the processing of personal data by Cabaj Kotala, and in particular:

• specifies the types of personal data we collect;
• explains how and why we collect and use your personal data;
• explains when and why we will share personal data with other entities; and
• explains the rights and choices you have regarding your personal data.

We want to make it clear to you whether the Policy also applies to the processing of your personal data. The Policy applies if:

• you are a potential Customer, i.e., you contact us because you are interested in our services;
• you are our customer, i.e., we provide legal services to you;
• you are a Customer Representative, i.e., you represent an entity for which we provide legal services;
• you are a Candidate, i.e. you participate in our recruitment process or send us your application documents for future recruitment processes;
• you are a Contractor, i.e. you provide us with any products or services;
• you are a Contractor Representative, i.e. you represent an entity that provides us with any products or services;

We process your personal data in accordance with the European Union's General Data Protection Regulation (2016/679) ("GDPR") and other applicable personal data protection regulations that supplement or implement the GDPR, including in particular the Tax Advisory Act, the Legal Advisors Act, and the Labor Code.

2. Who is the controller of your personal data

The controller of your personal data is Cabaj Kotala Doradztwo Podatkowe sp. z o.o. with its registered office in Warsaw at ul. Karolkowa 30, 01-207 Warsaw, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, 12th Commercial Division of the National Court Register, under KRS number: 0000529878, NIP: 7010451653, REGON: 36010202600000.

In matters related to the processing of personal data, you can contact us by post or by e-mail at info@cabajkotala.com.

3. What information do we collect and from what sources?

If you are a potential customer, we collect information during conversations or email exchanges. This may include, in particular, your first name, last name, mailing address, email address, and phone number.

If you are our customer, we collect information during conversations, correspondence, meetings, and from documents provided by you. This includes, in particular, personal data necessary to conclude and perform a contract for the provision of legal services, such as your first name, last name, mailing address, email address, telephone number, and financial data. In certain cases, this may include special categories of data or data relating to criminal convictions and offenses.

If you are a representative of our client, we collect information during conversations, correspondence, meetings, and from documents provided by you.

If you are a Candidate, we collect information provided to us in your CV or other application document as part of the recruitment process. This may include, in particular, your first and last name, date of birth, contact details, education, professional qualifications, employment history, and other personal data that you provide to us on your own initiative. Please note that providing your personal data to the extent required by law, including Article 221 § 1 and 4 of the Labor Code, is necessary to participate in the recruitment process. Providing other data is voluntary, and failure to provide it will not result in any negative consequences for you, in particular it will not constitute a reason for refusing employment.

If you are a Contractor, we collect information provided to us in the documents you send us, during conversations, email exchanges, and meetings, including, in particular, information necessary to conclude and perform a contract. This may include, in particular, your first name, last name, e mail address, telephone number, company name, business address, PESEL (Personal Identification Number), NIP (Tax Identification Number), REGON (National Business Registry Number), and bank account number.

If you are a Representative of a Contractor, we collect information provided to us in documents sent by you, during conversations, and in email correspondence. This may include, in particular, your first name, last name, contact details, position, and details of the entity you represent.

4. For what purpose and on what basis do we process your data?

If you are a potential customer, we process your data:

• for the purposes of the legitimate interests pursued by Cabaj Kotala, i.e., to contact you in response to your questions, requests, comments, to handle your inquiry, for internal administrative and marketing purposes (Article 6(1)(f) of the GDPR);

If you are our customer, we process your data:

• for the purpose of concluding and performing a contract (Article 6(1)(b) of the GDPR);
• to fulfill legal obligations (Article 6(1)(c) of the GDPR), in particular with regard to tax settlements, storage of financial documentation, and counteracting money laundering and terrorist financing;
• to establish, pursue, or defend legal claims (Article 9(2)(f) of the GDPR)
• for the purposes of the legitimate interests pursued by Cabaj Kotala (Article 6(1)(f) of the GDPR) related to conducting business, maintaining business relationships, ongoing contact, payment processing, verifying conflicts of interest, conducting marketing activities, as well as pursuing our claims and defending ourselves against claims.

If you are a Contractor, we process your data:

• for the purpose of concluding and performing a contract (Article 6(1)(b) of the GDPR);
• to fulfill legal obligations (Article 6(1)(c) of the GDPR), in particular with regard to the settlement of tax liabilities and the storage of financial documentation;
• for the purposes of the legitimate interests pursued by Cabaj Kotala (Article 6(1)(f) of the GDPR) related to conducting business, maintaining business relationships, ongoing contact, conducting marketing activities, as well as pursuing claims and defending against claims.

If you are a Representative of a Contractor or Customer, we process your data:

• in order to pursue our legitimate interests (Article 6(1)(f) of the GDPR) related to the conclusion and performance of a contract with the entity you represent, maintaining business relations and ongoing contact, conducting marketing activities, as well as pursuing claims and defending against them.

If you are a Job Candidate, we process your personal data on the basis of your consent for the purposes of future recruitment processes (Article 6(1)(a) of the GDPR), and special category data if you have provided it to us on your own initiative (Article 9(2)(a) of the GDPR) or in order to fulfill the legal obligations incumbent on Cabaj Kotala as an employer and the corresponding rights of the job applicant, resulting from legal provisions, including labor law provisions (Article 6(1)(c) of the GDPR).

5. Who we share your data with

When necessary to achieve the purposes for which we process your data, we may disclose it to:

• entities authorized to receive it under the law, including courts and public administration bodies;
• entities processing personal data on our behalf, i.e., companies providing specific services to us, the performance of which involves the processing of personal data, e.g., entities operating our IT systems or providing us with ICT tools, entities providing consulting services to us, and others (so-called "processors");

In each case of disclosure of your data, we will ensure that the transfer has a legal basis and covers only the minimum information necessary to achieve the purpose of data processing for which the data is disclosed.

If necessary for the purposes referred to in point 4, the data may be transferred outside the European Economic Area. In each case of transfer of your data outside the EEA, we will ensure the highest level of security.

Under no circumstances will the disclosure of data violate the professional secrecy associated with the services we provide.

6. How long we store your data

If you are a potential customer, we store your personal data for as long as necessary to fulfill the purposes related to contacting you.

If you are our customer or your representative, we store your data for the duration of the contract concluded with you or the entity you represent. After this period, we store your data to the extent necessary for the time resulting from legal requirements (e.g., the obligation to store financial documentation for 5 years), statutes of limitations for claims (3 years for claims arising from business activities), or as necessary to fulfill the other purposes of data processing indicated in this Privacy Policy. In the case of personal data related to the legal assistance we provide, the period of storage of personal data is 10 years from the end of the year in which the proceedings in which the personal data was collected ended. In addition, we may store certain personal data after the expiry of the above-mentioned periods in order to determine the existence of a conflict of interest.

If you are a Contractor or a Contractor's Representative, we store your data for the duration of the contract concluded with you or the entity you represent. After this period, we store your data to the extent necessary for the time resulting from legal requirements (e.g., the obligation to store financial documentation for 5 years), statutes of limitations for claims (3 years for claims arising from business activities), or as necessary to fulfill the other purposes of data processing indicated in this Privacy Policy.

If you are a Candidate, we store your data until the end of the recruitment process, and longer only if you have consented to its processing for future processes.

7. What are your rights

By exercising your rights regarding the processing of personal data, you can make the following requests to us:

1. if we process your personal data on the basis of your consent, you may withdraw that consent at any time; withdrawal of consent does not affect the lawfulness of the processing we have carried out on the basis of your consent until its withdrawal;
2. you may request access to your personal data and obtain a copy of it to the extent that this does not violate the attorney or legal advisor's obligation of professional secrecy;
3. you may request the correction of your personal data if it is incorrect or incomplete;
4. in connection with your particular situation, you may object to the processing of your personal data if we process it on the basis of our legitimate interest;
5. in cases specified by law - e.g. if your data is outdated, unnecessary, processed unlawfully, or if you have withdrawn your consent to its processing (where consent was the basis for such processing) or have effectively objected to the processing of your personal data, you may request the deletion of your personal data;
6. you may also request the restriction of data processing to the extent that it does not violate the attorney or legal advisor's obligation of professional secrecy.

To exercise the above rights, please contact us by mail or email: info@cabajkotala.com

In any case where you believe that our processing of personal data violates the provisions of the GDPR, you also have the right to lodge a complaint with the President of the Personal Data Protection Office.

8. Do you have to provide us with your data and where do we get it from if it does not come from you?

Providing your data is always voluntary, but please note that refusal to provide it will prevent us from achieving the purposes for which the data is collected, in particular it will prevent or significantly impede contact with you, prevent the conclusion of a contract if you are a party to it, or prevent us from providing services, including legal advice or the initiation of court proceedings.

If you are a representative of a contractor or client and do not provide us with your data yourself, it comes from the entity you represent or has been collected by us from publicly available sources (e.g., that entity's website).

If you are our Counterparty, your data may come from publicly available sources (e.g., CEiDG).

If you are our Customer or Customer Representative and you do not provide us with your data yourself, it may come from publicly available sources (e.g., CEiDG) as well as from court records.