Privacy Policy

This Privacy Policy and Cookie Policy explains how Personal Data are processed and how cookies and similar technologies are used on the website kancelariachristensen.eu.

As a User, please familiarise yourself with its provisions. The table of contents below will help you do so. It explains how we protect and process Users’ Personal Data, with whom we share them, and other important matters relating to Personal Data.

§1 DEFINITIONS

1. Controller – Alicja Christensen, conducting business under the name Kancelaria Radcy Prawnego Alicja Christensen, NIP: 7822952434, address: 1 Maja 6/6, 69-100 Słubice.
2. User – any entity visiting the Website and using it.
3. Website – the website available at kancelariachristensen.eu.
4. Personal Data – any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
5. Cookies – cookies and other similar technologies enabling information to be stored on the User’s terminal device or access to information already stored on that device.
6. Consent – a freely given, specific, informed and unambiguous indication of the User’s wishes by which the User, by a statement or by a clear affirmative action, signifies agreement to the processing of Personal Data relating to them.
7. Form or Forms – areas on the Website which enable the User to enter Personal Data for the purposes indicated therein, e.g. for the purpose of contacting the User.
8. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
9. Act on the Protection of Personal Data – Act of 10 May 2018 on the Protection of Personal Data (Polish Journal of Laws 2019, item 1781, as amended).
10. Act on the Provision of Electronic Services – Act of 18 July 2002 on the Provision of Electronic Services (Polish Journal of Laws 2024, item 1513, as amended).
11. Electronic Communications Law – Act of 12 July 2024 – Electronic Communications Law (Polish Journal of Laws 2024, item 1221, as amended).

Terms beginning with a capital letter used in this Privacy Policy and Cookie Policy have the meanings assigned to them above.

§2 GENERAL PROVISIONS

This Privacy Policy and Cookie Policy set out the rules for the processing and protection of Personal Data provided by Users and of cookies, as well as other technologies appearing on the Website. The Controller of Personal Data is Alicja Christensen, conducting business under the name Kancelaria Radcy Prawnego Alicja Christensen, NIP: 7822952434, address: ul. 1 Maja 6/6, 69-100 Słubice, e-mail: kontakt@kancelariachristensen.eu, hereinafter referred to as the “Controller”.

The Controller processes Personal Data in accordance with the currently applicable provisions of law, in particular the GDPR and the Act on the Protection of Personal Data.

The Controller exercises particular diligence to ensure respect for the privacy of Users and protection of their interests, in particular by ensuring that Personal Data collected by the Controller through the Website are processed solely for specified purposes and are not subjected to further processing incompatible with those purposes.

Users’ Personal Data are collected and processed solely on the basis of appropriate legal grounds, and the scope of data depends on the type of service provided and is kept as limited as possible.

Should you have any doubts regarding the provisions of this Privacy Policy and Cookie Policy, please contact the Controller at: kontakt@kancelariachristensen.eu.

The Controller may update the Policy if the manner in which the Website operates, the tools used or the provisions of law change. The current version of the Policy is always available on the Website together with the date of its last update.

§3 PERSONAL DATA AND THE RULES FOR THEIR PROCESSING

IS PROVIDING DATA VOLUNTARY? WHAT ARE THE CONSEQUENCES OF NOT PROVIDING IT?

Providing Data is voluntary; however, failure to provide certain information, generally marked as mandatory on the Controller’s pages, will mean that it will not be possible to perform a given service, achieve a specific purpose or take specified actions.

Please do not provide special categories of data, including health data, or information covered by professional secrecy through the contact form unless the Controller has previously indicated a secure communication channel. If a User provides such data on their own initiative, the Controller processes it only to the extent necessary to handle the enquiry and in accordance with the applicable provisions of law.

FOR WHAT PURPOSES AND ON WHAT LEGAL BASES DOES THE CONTROLLER PROCESS THE USER’S PERSONAL DATA PROVIDED IN CONNECTION WITH THE USE OF THE WEBSITE?

The User’s Personal Data on the Controller’s Website may be processed for the following purposes and on the following legal bases:

Purposes of Personal Data Processing

Purpose of Processing	Legal Basis	Retention Period
Provision of legal assistance, including the conclusion and performance of an agreement with a client, handling a matter, communicating with a client, preparing pleadings, legal opinions and other documents, and representing the client – according to the scope of the engagement.	Article 6(1)(b) GDPR – necessity for the performance of an agreement to which the client is a party or in order to take steps at the client’s request prior to entering into an agreement.	For the duration of the agreement and the handling of the matter, and thereafter for the period necessary to establish, pursue or defend claims and to fulfil legal obligations.
Handling an enquiry sent via the contact form or by e-mail, including providing a response and taking steps prior to entering into an agreement.	Article 6(1)(b) GDPR – where the enquiry concerns the conclusion or performance of an agreement; otherwise, Article 6(1)(f) GDPR – the Controller’s legitimate interest in communicating and handling enquiries.	For the time necessary to handle the enquiry and thereafter – where necessary – for the limitation period for claims.
Keeping accounts and fulfilling tax obligations after the conclusion of an agreement.	Article 6(1)(c) GDPR in conjunction with the applicable tax and accounting provisions.	For the period required by law.
Establishing, pursuing or defending claims.	Article 6(1)(f) GDPR – the Controller’s legitimate interest in protecting its rights.	Until the expiry of the limitation period for claims or until the proceedings have been finally concluded.
Ensuring the security and proper functioning of the Website, including handling server logs.	Article 6(1)(f) GDPR – the Controller’s legitimate interest in ensuring the security of the Website and preventing abuse.	For the period necessary to ensure the security of the Website and analyse incidents.
Use of optional analytical or marketing cookies – only if they are actually used.	Article 6(1)(a) GDPR, in conjunction with Article 399(1)(2) and Article 399(2) of the Act of 12 July 2024 – Electronic Communications Law.	Until Consent is withdrawn or the relevant cookie expires.
Collecting opinions about the Controller’s services and publishing opinions on the Website, solely to the extent covered by the client’s separate Consent. The scope of the data may include the content of the opinion, the first and last name or an agreed designation of the author, the company name – where applicable – and the date on which the opinion was given.	Article 6(1)(a) GDPR – freely given, specific and separate Consent. The Consent covers both the use of the data for the purpose of collecting the opinion and its publication on the Website.	Until Consent is withdrawn or the opinion is removed due to loss of its currency or usefulness.

HOW IS DATA COLLECTED?

Only the Data provided by the User themselves are collected and processed (except – in certain situations – Data collected automatically by means of cookies and server log data, as discussed below).

During a visit to the Website, Data relating to the visit itself are collected automatically, e.g. the User’s IP address, domain name, browser type, operating system type, etc. (server log data). Data collected automatically may be used to analyse Users’ behaviour on the Website, collect demographic data about Users or personalise the content of the Website in order to improve it. However, this data is processed solely for the purposes of administering the Website, ensuring efficient hosting services or directing marketing content, and is not associated with the Personal Data of individual Users. More information about cookies can be found in the further part of this Policy.

Data may also be collected for the purpose of completing Forms available on the Website, as discussed further in this Privacy Policy.

Information Society Services

The Controller does not collect children’s Data. A User should be at least 16 years old to independently give Consent to the processing of Personal Data for the purpose of providing information society services, including for marketing purposes, or should obtain the Consent of a legal guardian for this purpose (e.g. a parent).

If a User is under 16 years of age, they should not use the Website or the kancelariachristensen.eu service.

The Controller is entitled to take reasonable steps to verify whether the User meets the age requirement referred to above or whether the person exercising parental responsibility or custody over a User under 16 years of age has given or approved the Consent.

WHAT ARE THE USER’S RIGHTS?

The User has, at any time, the rights set out in Articles 15–21 GDPR, i.e.:

• the right to access the content of their Personal Data;
• the right to data portability;
• the right to correct their Personal Data;
• the right to rectification of their Personal Data;
• the right to erasure of their Personal Data where there are no grounds for processing it;
• the right to restriction of processing where it has been carried out improperly or without a legal basis;
• the right to object to processing based on the Controller’s legitimate interest;
• the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) (on the principles set out in the Act on the Protection of Personal Data), if they consider that the processing of their data is inconsistent with the currently applicable provisions of law on the protection of Personal Data;
• the right to be forgotten if further processing is not provided for by the currently applicable provisions of law.

The Controller points out that these rights are not absolute and do not apply to all processing activities involving the User’s Personal Data. This applies, for example, to the right to obtain a copy of the data. This right may not adversely affect the rights and freedoms of other persons, such as copyright or professional secrecy. To learn about the limitations applicable to the User’s rights, please refer to the GDPR.

The User always has the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, tel. 22 531-03-00, e-mail: kancelaria@uodo.gov.pl, if they consider that the processing of Personal Data violates the GDPR or other applicable provisions concerning the processing of Personal Data.

To exercise their rights, the User may contact the Controller by e-mail at kontakt@kancelariachristensen.eu or by post at the address where the Controller conducts business, if it has been provided in this Privacy Policy, specifying the scope of their requests. The Controller will respond without undue delay, generally within one month of receiving the request. Where necessary, this period may be extended in accordance with the GDPR; in that case, the Controller will inform the User of the extension and the reasons for it.

CAN THE USER WITHDRAW CONSENT GIVEN?

If the User has given Consent for a specific action, that Consent may be withdrawn at any time, which will result in the removal of the e-mail address from the Controller’s mailing list and the cessation of the specified activities (in the case of a subscription based on Consent). The User may withdraw Consent at any time, in particular by changing the cookie settings or contacting the Controller at the e-mail address indicated in the Policy. Withdrawal of Consent does not affect the lawfulness of processing based on Consent before its withdrawal.

In some cases, Data may not be completely erased and will be retained for the purpose of defending against potential claims for the period prescribed by the provisions of the Civil Code or, for example, for the purpose of fulfilling legal obligations imposed on the Controller.

In each case, the Controller will address the User’s request, providing appropriate reasons for any further actions resulting from legal obligations.

HOW LONG DOES THE CONTROLLER RETAIN THE USER’S DATA?

The Controller will retain the User’s Data for the duration of the performance of the individual services / achievement of the purposes indicated in the table above, and:

1. for the duration of the service and cooperation, and also for the limitation period for claims in accordance with the provisions of law – with regard to Data provided by contractors, clients or Users;
2. for the duration of discussions and negotiations preceding the conclusion of an agreement or performance of a service – with regard to Data provided in a request for quotation;
3. for the period required by law, including tax law – with regard to Personal Data connected with the fulfilment of obligations arising from applicable provisions;
4. until an effective objection is lodged under Article 21 GDPR – with regard to Personal Data processed on the basis of the Controller’s legitimate interest, including for direct marketing purposes;
5. until Consent is withdrawn or the purpose of processing or the business purpose is achieved – with regard to Personal Data processed on the basis of Consent. After Consent is withdrawn, the Data may still be processed for the purpose of defending against potential claims in accordance with the limitation period for those claims or for a shorter period indicated to the User;
6. until the Data becomes outdated or loses its usefulness – with regard to Personal Data processed mainly for analytical or statistical purposes, for the use of cookies and for administering the Controller’s Websites.

Retention periods for Data stated in years are calculated at the end of each year in which the processing of the Data commenced. This is intended to streamline the process of processing and managing Data.

Detailed periods for processing Personal Data relating to individual processing activities are set out in the Controller’s records of processing activities.

LINKS TO OTHER WEBSITES

The Website may contain links to other websites. They will open in a new browser window or in the same window. The Controller is not responsible for the content provided by those websites. The User is obliged to familiarise themselves with the privacy policy or terms and conditions of those websites.

DATA SECURITY

The User’s Personal Data are stored and protected with due diligence, in accordance with the Controller’s implemented internal procedures. The Controller processes information about the User using appropriate technical and organisational measures meeting the requirements of universally applicable provisions of law, in particular the provisions of the Act on the Protection of Personal Data and the GDPR. These measures are primarily intended to protect Users’ Personal Data against access by unauthorised persons.

In particular, access to Users’ Personal Data is granted only to authorised persons who are obliged to keep such Data confidential, or to entities entrusted with the processing of Personal Data under a separate data processing agreement.

The User should likewise exercise due diligence in securing their Personal Data transmitted over the Internet, in particular by not disclosing their login details to third parties, using antivirus protection and keeping software up to date.

WHO MAY BE THE RECIPIENTS OF PERSONAL DATA?

Recipients of data may include entities supporting the Controller in operating the Website and handling correspondence, in particular a hosting provider, an e-mail provider, an IT services provider and entities providing accounting or legal services – solely to the extent necessary to provide their services. Processors processing data on the Controller’s behalf are obliged to ensure appropriate data protection measures.

The Controller uses the services of LH.PL sp. z o.o. in the field of hosting, domain management and mail server services. The Controller also uses Google services, in particular services provided by Google Ireland Limited with its registered office in Ireland and – depending on the type of service and the manner in which it is provided – Google LLC with its registered office in the United States.

In connection with the use of Google services, Personal Data may be transferred to or may be accessible from the United States. The transfer of data to Google LLC in the United States takes place on the basis of the European Commission’s Implementing Decision (EU) 2023/1795 of 10 July 2023 recognising an adequate level of protection for Personal Data under the EU–US Data Privacy Framework. Google LLC is listed as an active participant in the EU–US Data Privacy Framework programme.

If, in relation to a particular Google service, the transfer is not covered by the aforementioned adequacy decision, the Controller applies other appropriate mechanisms provided for in Chapter V GDPR, in particular standard contractual clauses adopted by the European Commission, together with appropriate supplementary safeguards – where required. Information about the transfer mechanism applied and the possibility of obtaining a copy of the relevant safeguards may be obtained by contacting the Controller.

HAS THE CONTROLLER APPOINTED A DATA PROTECTION OFFICER?

The Controller of Personal Data hereby informs you that it has not appointed a Data Protection Officer (DPO).

The User acknowledges that their Personal Data may be disclosed to authorised state authorities in connection with proceedings conducted by them, at their request and after the conditions confirming the necessity of obtaining such Data from the Controller have been met.

DOES THE CONTROLLER PROFILE THE USER’S DATA?

The Controller does not make decisions concerning Users based solely on automated processing which would produce legal effects concerning the User or similarly significantly affect them.

If the User gives Consent to analytical or marketing cookies, the Controller or the providers of those tools may analyse information about the User’s activity on the Website in order to measure the effectiveness of activities, create statistics or display more suitably targeted advertisements. Such activities may constitute profiling, but do not result in decisions concerning the User of the type referred to in Article 22 GDPR. Consent may be withdrawn in the cookie settings.

The Controller does not use special categories of data to deliver advertisements based on profiling.

§4 FORMS

Using the contact form, the User may send a message to the Controller. The Controller processes the data provided in the form, in particular the first and last name, e-mail address, telephone number – where provided – and the content of the message, for the purpose of providing a response, taking steps prior to entering into an agreement or performing an agreement.

Providing data marked as mandatory is necessary to handle the enquiry. Failure to provide such data may make it impossible to respond.

Data from the form are accessible to the Controller and to entities supporting the Controller in the technical handling of e-mail and hosting, solely to the extent necessary to achieve the purpose of processing.

§5 COOKIE POLICY

The Website uses cookies and similar technologies. These are small files or identifiers stored on the User’s device or used to access information stored on that device.

The Controller uses cookies necessary for the proper functioning of the Website and to ensure its security. Such cookies do not require the User’s Consent.

Analytical and marketing cookies, including tools used to analyse traffic on the Website, measure the effectiveness of advertisements or for remarketing, are used only after obtaining the User’s prior Consent.

On their first visit to the Website, the User may accept all optional cookies, reject them or go to the settings and select their categories. Consent is voluntary and may be withdrawn or changed at any time using the “Cookie Settings” link available on the Website.

The lack of Consent to analytical or marketing cookies does not restrict access to the basic content of the Website.

The current list of cookies used, including their name, provider, purpose and duration of operation, is available in the “Cookie Settings” panel.

§6 SERVER LOGS

Use of the Website involves sending queries to the server on which the Website is stored.

Each query addressed to the server is recorded in server logs. The logs include, among other things, the User’s IP address, the server date and time, information about the browser and the operating system used by the User.

The logs are recorded and stored on the server.

Server logs are used to ensure the security and proper functioning of the Website and to diagnose errors. They may be accessible to the Controller and the hosting provider to the extent necessary to achieve these purposes.

The Controller does not use server logs to deliberately establish the User’s identity unless this is necessary to ensure the security of the Website, detect abuse or defend against claims.