Privacy Policy

This Privacy Policy explains how the Firm processes data relating to users of adwokatchudzinski.pl, its contact form and correspondence. Version dated 15 September 2026.

1. Privacy Policy: controller and contact details

The controller is Tomasz Piotr Chudzinski, conducting business under the registered Polish name Kancelaria Adwokacka Adw. Tomasz Piotr Chudzinski i Wspólnicy, Tax Identification Number (NIP) 9532553483. The correspondence address is Aleje Jerozolimskie 100, 10th floor, 00-807 Warsaw, Poland. The English marketing name is Tomasz Piotr Chudzinski & Partners Law Firm.

For data protection matters, use the contact form and select a data protection enquiry, or write to the address above. The Firm has not appointed a data protection officer. Its owner is responsible for fulfilling the controller’s obligations.

2. What data we receive

The form asks for your name, email address, type of matter and a short description. You may also provide a company or medical entity name, telephone number, preferred office and documents. Required fields are marked. Other information is voluntary.

During a visit, the server may record the IP address, request date and time, visited address, browser and operating system information. Logs may also contain errors and security events. We do not use this information to assess a legal matter or its prospects automatically.

3. Sending an enquiry safely

In your first message, provide only information needed for a preliminary assessment. Do not send passwords, access credentials, complete case files or excessive information about other people. Documents containing health data, criminal proceedings data or other specially protected information require particular care. Send them only after agreeing the necessary scope and suitable channel with the Firm.

Submitting the form does not conclude an engagement, confirm acceptance of a matter or constitute legal advice. It does not suspend procedural or other legal time limits. Until a conflict check and engagement arrangements are complete, do not assume that the Firm acts for you.

We use organisational and technical safeguards appropriate to the information and risks, including access controls, software maintenance, monitoring, backups and incident procedures. However, no online transmission method is entirely risk free. Sensitive information should therefore be sent through a method agreed with the Firm.

4. Purposes and legal bases

  • Responding and arranging cooperation. If you request a service for yourself, we take pre-contractual steps at your request under Article 6(1)(b) GDPR. For correspondence on behalf of an organisation or about other matters, the basis is our legitimate interest in handling contact under Article 6(1)(f) GDPR.
  • Assessing whether we can accept a matter and checking conflicts. We process necessary information to fulfil professional duties and protect clients’ and the Firm’s rights. Article 6(1)(c) or (f) GDPR applies according to the purpose.
  • Providing legal assistance and handling accounts. Processing is based on performance of the contract and legal or professional obligations, under Article 6(1)(b) and (c) GDPR. When accepting an engagement, we may provide additional information specific to that matter.
  • Establishing, pursuing or defending claims. The basis is our legitimate interest in protecting rights, under Article 6(1)(f) GDPR.
  • Website and correspondence security. Preventing spam, attacks and unauthorised access is the controller’s legitimate interest under Article 6(1)(f) GDPR.
  • Website analytics. With your consent, we use Google Analytics 4 to measure traffic, sources, devices, approximate location and website behaviour. We also assess content and form performance and steps leading to contact without sending enquiry content. The basis is consent under Article 6(1)(a) GDPR, together with Article 399 of the Polish Electronic Communications Law. You can withdraw consent in the cookie settings.
  • Extended Google features. Separate consent enables Google Signals and aggregated demographic or interest data made available by Google. The Firm does not independently establish those characteristics or create its own browser fingerprints.

Where legal assistance requires special category data, including health data, Article 9(2)(f) GDPR concerning legal claims may apply. Another basis may be appropriate to the particular matter. We process criminal conviction and offence data only within Article 10 GDPR and applicable national law.

5. Who has access to data

The owner and authorised employees and associates handle enquiries. Access depends on their duties and confidentiality obligations. Recipients may also include hosting, email, IT support, security, office-software and document-storage providers. Accountants and legally authorised entities receive data where appropriate.

cyber_Folks provides website and email hosting. The website uses WordPress, Contact Form 7, WP Mail SMTP and Wordfence security supplied by Defiant. Google Ireland Limited and Google group entities provide Google Tag Manager, Google Analytics 4 and, following the appropriate consent, Google Signals. The Firm also uses other Google and Microsoft services.

This does not mean that every enquiry is shared with every provider. The scope depends on the action and service involved. Depending on the matter, recipients may include courts, authorities, experts, translators, substitute counsel and other professional advisers. Disclosure requires an appropriate basis and confidentiality safeguards. Where the GDPR requires a processing agreement, the processor must act on documented instructions.

6. How long data is retained

Enquiries and case records

Enquiries and attachments that do not lead to an engagement are normally kept for three months after we finish handling the enquiry. Some information may need to remain longer because of a legal duty, legal assistance already provided or a necessary conflict check. A specific need to establish, pursue or defend claims may also justify an exception.

Case data is kept while the matter is handled and then for the period required by law. Where Article 16c(1)(2)(c) of the Polish Law on the Bar applies, this is ten years from the end of the year in which the proceedings in which the data was collected ended. Accounting records follow the relevant tax and accounting rules. We do not apply a single shorter period to every type of record.

Logs, backups and attachments

Logs and incident data remain as long as needed for security, investigation and protection against claims. Backups support system recovery and follow the provider’s retention cycles or a documented need to retain a recovery point. They are not a separate archive for routine enquiry handling. Previously completed deletions must be reapplied after a backup is restored.

The form sends attachments by email. Contact Form 7 uses a temporary directory and removes files from it after processing the submission. Deleting a temporary file does not delete the attachment from the Firm’s mailbox.

Analytics data and cookie preferences

Google Analytics 4 event and user data retention is set to 14 months. This affects explorations and funnel reports, not standard aggregated reports. The user-identifier period resets on new activity. Cookie preferences are remembered for 180 days unless you clear browser data or change your choice sooner.

7. Providers outside the European Economic Area

Some Google, Microsoft and Defiant services may involve processing outside the European Economic Area, including the United States. The transfer basis depends on the service and recipient. It may be an applicable European Commission adequacy decision, or standard contractual clauses with the required safeguards. Google describes relevant mechanisms in its advertising data processing terms and privacy documentation.

Contact the controller for information about safeguards for a particular transfer and how to obtain a copy. Provider information is available from Google, Microsoft and Defiant / Wordfence.

8. Your rights and professional secrecy

Within the limits of the law, you may request access, rectification, erasure, restriction and portability of your data. You may object to legitimate-interest processing unless specific legislation excludes that right. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing.

Exercising these rights must not breach an advocate’s professional secrecy or other people’s rights. Article 16a of the Polish Law on the Bar limits the application of Articles 15(1), 15(3), 18 and 19 GDPR. It also excludes Article 21(1) GDPR for data obtained by an advocate when providing legal assistance.

Professional secrecy under Polish law and Bar rules protects information obtained in connection with legal assistance independently of data protection obligations. Please submit requests through the form or by post. We may request information needed to verify your identity safely.

You can also complain to the President of the Polish Personal Data Protection Office. Current contact details are available on the UODO website.

9. Voluntary data and automated decisions

Without contact details and a short description, we may be unable to respond or assess whether we can accept the matter. We do not make decisions based solely on automated processing that have legal or similarly significant effects on users. A person decides whether to accept a matter.

Aggregated traffic analytics, interest reports and GA4 audiences help assess content and traffic sources. They are not used to make such decisions about a particular person.

10. Privacy Policy and website technologies

Consent and Google measurement

The website uses security tools, language preferences and external content described in the Cookie Policy. Google Tag Manager centrally activates Google Analytics 4. We use Advanced Consent Mode v2. Before you make a choice, all optional consent categories are set to denied.

In this mode, the Google tag may send limited signals without cookies, including consent status and technical data used for modelling. Full analytics cookies and measurement operate after analytics consent. Google Signals and aggregated demographic or interest data require consent to personalisation and extended Google features. Their availability remains subject to what Google actually provides.

Measured events and excluded information

Measurement includes page views, traffic sources, approximate location, devices, browsers, scrolling and active time. It also covers navigation, calls to action, form stages and successful submissions. We do not send field contents, email addresses, telephone numbers, names, matter descriptions, attachments or raw search queries to Google Analytics.

Native redaction of email addresses and URL parameters that may contain personal data is enabled. Google Search Console measures visibility in search results without an additional visitor-browser tracker. BigQuery export is not currently active.

We update this Privacy Policy when the law, website functions or processing arrangements change. The version date appears at the beginning.