1. Personal Data Controller
Nowosielski i Partnerzy – Adwokaci i Radcy Prawni, entered into the Registry of Entrepreneurs of the District Court for Gdańsk–Północ in Gdańsk, VII Commercial Division of the National Court Register under KRS No. 0000214138, REGON No. 190396453, NIP taxpayer identification No. 5880021591.
2. Personal Data Controller contact details
ul. Targ Drzewny 3/7, 80-886 Gdańsk, Poland
3. Purpose of personal data processing
(1) concluding a legal services contract
(2) vindication of claims
4. Legal basis for personal data processing
(1) Should a legal services contract be concluded and performed, personal data shall be processed under:
—Article 6 (1) (b) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (Official Journal of the European Union L 119, p. 1, hereafter referred to as GDPR), i.e. personal data controller’s action in a situation where processing of personal data is necessary for the performance of a contract to which the data subject is party, or
—Article 6 (1) (f) of GDPR, i.e. personal data controller’s action in a situation where processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party—as regards data of contact points and third parties whose data is processed due to the performance of a contract, or
—Article 9(2) (a) of GDPR, i.e. explicit consent to processing of special categories of personal data (data revealing trade union membership, genetic data, biometric data, data concerning health, sex life or sexual orientation, data on criminal record, if processing of such data is necessary to provide legal services).
(2) Where claims are vindicated, the data is processed under Article 6 (1) (f) of GDPR, i.e. personal data controller’ s action in a situation where processing of personal data is necessary for the purposes of the legitimate interests pursued by the controller.
5. Information on categories of personal data recipients
Personal data may be transferred to entities processing personal data on the personal data controller’s request, such as the IT service providers, accounting service providers, financial service providers, legal service providers. Personal data may be transferred to courts, authorities exercising proceedings other than court proceedings, parties to court proceedings and proceedings other than court proceedings.
6. Criteria for determining personal data storage period
Personal data shall be stored until the possible claims related to the provision of legal services are barred by the statute of limitations or until the legally defined personal data storage deadline—the later of the two. Processing of personal data shall stop in every case where the legal basis for its processing is no longer valid.
7. Information on the rights of a person whose data is processed
The person whose personal data is processed by the personal data controller has the right to demand access to his or her personal data, its rectification, erasure, or restriction of processing where personal data is processed under Article 6 (1) (f) of GDPR. The person being a subject of personal data may at any time object to the processing of personal data concerning him or her under Article 21 of the GDPR.
8. Information on the right to withdraw consent
The person whose personal data is processed may withdraw his or her consent to the processing of personal data at any time, which shall not affect the lawfulness of processing based on consent before its withdrawal; this right pertains to the processing of personal data on the basis of consent to personal data processing.
9. Information on the right to lodge a complaint with the supervisory authority
The person whose data is processed has the right to lodge a complaint with the supervisory authority, namely the President of the Personal Data Protection Office.
10. Information on whether provision on personal data is a statutory or contractual requirement or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data
Provision of personal data is not a statutory or a contractual requirement, but is a prerequisite for concluding a legal services contract, which cannot be performed where personal data is not provided.
11. Information on automated decision-making, including profiling
The personal data controller does not envisage automated decision-making or profiling.