I. About Privacy Policy

1. In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation; hereinafter "GDPR"), this privacy policy (hereinafter "Privacy Policy") sets out the rules for the processing of personal data by Justyna Matuszak-Leśny, Kancelaria Radcy Prawnego with its registered office in Warsaw (03-317), 12/27 Wrzesińska Street, Tax Identification Number (NIP): 5242555359, Business Identification Number (REGON): 221884976 (hereinafter "esb").

II. General Information - Personal Data Processing by esb

2. This Privacy Policy applies to esb's processing of the personal data of the following categories of persons:

1. clients of esb who are natural persons (including entrepreneurs) to whom esb provides legal services (hereinafter “Clients”);
2. esb contractors who are natural persons (hereinafter “Contractors”);
3. Representatives, employees and associates of Clients (and Clients that are not natural persons) and Contractors (and Contractors that are not natural persons) (hereinafter "Representatives");
4. persons contacting or being contacted by esb by telephone, e-mail or other communication channel.

3. The personal data controller is esb.
4. Contact with esb is possible:

1. by post to the following address esb Justyna Matuszak-Leśny, Kancelaria Radcy Prawnego, ul. Wrzesińska 12 lok 27, 03-317 Warszawa
2. electronically to: biuro@esb-legal.pl
3. by telephone at: +48 22 401 06 13.

5. Persons whose personal data is processed by esb will not be subject to any automated decisions, including as a result of profiling.
6. Personal data processed by esb may be disclosed to the following entities: esb employees and associates, IT service providers, hosting providers and other service providers on the basis of an appropriate entrustment agreement. These parties shall only be given access to personal data which is necessary for the performance of the contract between esb and such party.
7. Personal data processed by esb may be made available to entities and authorities authorised to process such data on the basis of legal provisions.
8. esb does not intend to transfer personal data it processes to countries outside the European Economic Area or to international organisations.

III. Clients' Personal Data

9. Clients' personal data are processed for the following purposes:

1. conclusion of a legal services contract between the Client and esb and the performance thereof:

• with regard to special categories of personal data (e.g. personal data concerning health) - on the basis of Article 9(2)(f) GDPR, i.e. the processing is necessary for the establishment, exercise or defence of claims or in the exercise of justice by the courts
• with regard to other personal data - on the basis of Article 6(1)(b) of the GDPR, i.e. processing is necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract, and on the basis of Article 6(1)(c) of the GDPR, i.e. processing is necessary for the performance of legal obligations incumbent on the esb, and resulting from the provisions governing proceedings before courts and administrative bodies, and in particular the provisions of the code of civil procedure, the code of criminal procedure, the code of administrative procedure;

2. to protect the vital interests of the Clients or any other natural person:

• with regard to special categories of personal data - on the basis of Article 9(2)(c) GDPR, i.e. the processing is necessary to protect the vital interests of the data subject or of another natural person, and the data subject is physically or legally incapable of giving consent;
• with regard to other personal data - on the basis of Article 6(1)(d) GDPR, i.e. the processing is necessary to protect the vital interests of the data subject or of another natural person;

3. perform tax settlements and keep accounting records - on the basis of Article 6(1)(c) of the GDPR, i.e. data processing is necessary for the fulfilment of legal obligations incumbent on esb, resulting from tax law regulations and accounting regulations;
4. establish, exercise or defend against possible claims between you and esb:

• with regard to special categories of personal data - on the basis of Article 9(2)(f) GDPR, i.e. the processing is necessary for the establishment, exercise or defence of claims or in the exercise of judicial administration by the courts;
• with regard to other personal data, on the basis of Article 6(1)(f) GDPR, i.e. on the basis of a legitimate interest pursued by esb, which is the possibility of pursuing claims or defending against claims.

10. Provision of personal data by the Client is voluntary, but necessary to conclude and perform the contract for legal services (failure to provide personal data results in the impossibility of concluding and performing the above contract).
11. Personal data will be processed for the period necessary for the purposes for which the data are processed (see point 9) or until an objection is lodged (if the processing is based on esb's legitimate interest) - whichever occurs first.
12. Thereafter, esb will store the data until the statute of limitations for possible claims, or until the expiration of the data retention obligation under law (e.g. tax law), whichever occurs later.

IV. Contractors' Personal Data

13. Contractors' personal data are processed for the following purposes:

• conclusion and performance of a contract between Contractor and esb - on the basis of Article 6(1)(b) GDPR, i.e. the processing is necessary for the performance of the contract or to take action at the request of the data subject prior to entering into the contract;
• to perform tax settlements and keep accounting records - on the basis of Article 6(1)(c) of the GDPR, i.e. the processing of data is necessary for the fulfilment of legal obligations incumbent on the esb resulting from tax law provisions and accounting regulations;
• establish, exercise  or defend against potential claims between Contractor and esb - on the basis of Article 6(1)(f) GDPR, i.e. on the basis of a legitimate interest pursued by esb, which is the possibility of investigating claims or defending against claims

14. Provision of personal data by the Contractor is voluntary, however it is necessary to conclude and perform the contract (failure to provide personal data results in the impossibility to conclude and perform the above contract).
15. Personal data will be processed for the period necessary for the purposes for which the data are processed (see point 13) or until an objection is lodged (if the processing is based on esb's legitimate interest) - whichever occurs first.
16. Thereafter, esb will store the data until the statute of limitations for possible claims, or until the expiration of the data retention obligation under law (e.g. tax law), whichever occurs later.

V. Representatives' Personal Data

17. Representatives' personal data are processed for the following purposes:

1. personal data of persons representing clients or contractors of esb shall be made available to esb by esb's client or contractor respectively, or shall be provided directly to esb by the Representative concerned;
2. personal data of employees and cooperators of esb clients and esb contractors shall be provided to esb by the client or contractor employing such person or shall be provided directly to esb by the employee or cooperator of the client or contractor in question;

• esb receives this personal information in connection with the conclusion and performance of a contract between the customer or contractor and esb, respectively, in particular for the purpose of designating the persons entering into the contract in the name of and on behalf of the customer or contractor, or for the purpose of designating the persons authorised to communicate with them in relation to the performance of the contract.

18. esb shall process the following categories of personal data:

1. persons representing clients and contractors - identification data (i.e. names, surnames, name of the entity which a given person represents, name of the position/function held), data concerning the powers granted (i.e. date of powers granted, type and scope of powers granted);
2. Employees and cooperators of clients and contractors - identification data (i.e. names, surnames, name of the entity employing the person, job title/function, scope of matters handled by the person), contact data (i.e. business phone number, email).

19. Personal data of Representatives shall be processed in order to:

1. conclude and perform the contract between the client or contractor and esb, respectively, and in particular verify the authority of the person contracting with esb on behalf of the client or contractor, and contact the persons indicated in the contract as contact persons in connection with performance of the contract - on the basis of Article 6(1)(f) of the GDPR, i.e. on the basis of the legitimate interest pursued by esb and the client or contractor, respectively, which is to enable esb and the client or contractor, respectively, to perform the contract efficiently on an ongoing basis and to enable esb to verify the authority of the person contracting with esb on behalf of the client or contractor;
2. establish, exercise or defend against possible claims between the customer or contractor, respectively, and esb - on the basis of Article 6(1)(f) of the GDPR, i.e. on the basis of a legitimate interest pursued by esb, which is the possibility of pursuing claims or defending against claims.

20. Personal data will be processed for the period necessary for the performance of the contract between esb and the customer or contractor, respectively.
21. Thereafter, esb will store them until the statute of limitations for any claims related to this contract.

VI. Personal data of persons contacting or being contacted by esb

22. Personal data of persons who contact or are contacted by esb through any communication channel (e.g. telephone or e-mail) are processed for the following purposes:

1. communication with that person in connection with a contact with esb initiated by that person, and in particular replying to the question asked – on the basis of Article 6(1)(f) of the GDPR, i.e. a legitimate interest pursued by esb which is to communicate with the person who has initiated contact with esb, and in particular to answer a question submitted to esb;
2. establishing cooperation with the entity which the person represents or with which she/he cooperates - on the basis of Article 6(1)(f) GDPR, i.e. on the basis of a legitimate interest pursued by esb, which is the establishment and maintenance of relations within the framework of its business activity;
3. to establish, exercise or defend against possible claims between the data subject (or the data subject's representative) and esb - on the basis of Article 6(1)(f) of the GDPR, i.e. on the basis of the legitimate interest pursued by esb to assert or defend claims.

23. Personal data provided by the person who contacts esb is voluntary, but it is necessary to provide a phone number or e-mail address in order for esb to contact the person, including answering the question (failure to provide this personal data will make it impossible for esb to contact the person, including answering the question).
24. Personal data will be processed for the period necessary for the purposes for which the data are processed (see point 22) or until an objection is lodged - whichever occurs first.
25. The esb will then store the data until the statute of limitations for any claims.

VII. Common Provisions - Rights of persons whose data are processed by esb

26. The data subject whose personal data are processed by esb shall have the right to:

1. the right to access his/her personal data;
2. the right to request its rectification;
3. the right to have them erased;
4. the right to request restriction of processing;
5. the right to data portability, i.e. to receive personal data from esb in a structured, commonly used and machine-readable format. The data subject may require esb to forward his or her personal data which he or she has provided to esb to another data controller;
6. to the extent that processing of personal data is based on a legitimate interest of esb, the data subject shall have the right to object to processing of his/her personal data

27. In order to exercise the above rights, you must contact esb using the contact information indicated above (see Section II(4)).
28. Furthermore, the data subject has the right to lodge a complaint with the supervisory authority in charge of personal data protection (the President of the Office for Personal Data Protection) if he/she believes that the processing of data violates the GDPR.

VII. Amendment to the Privacy Policy

29. esb is entitled to change its Privacy Policy if at least one of the following important reasons occurs:

1. change in applicable law that governs the conduct of esb's business;
2. the need to adapt the content of the Privacy Policy to applicable law or the need to make editorial changes to the Privacy Policy;
3. a change in the manner in which the www.esb-legal.pl website is maintained or operates, which is due to objective and independent reasons of a technological or technical nature;
4. a change in the conditions of use of the www.esb-legal.pl website, which will not impair the situation of persons using the www.esb-legal.pl website in relation to the previous one;
5. the need to update the information indicated in the Privacy Policy