Kancelaria Adwokacka dr Pauliny Smulskiej-Gachon
Polski English
Appearance
PL: +48 886 58 03 12 ES: +34 617 486 927
Book Consultation
RODO • GDPR Compliance

Personal Data Protection Notice (GDPR)

Bearing in mind the security of the data of clients of the Law Firm of Advocate Dr. Paulina Smulska (hereinafter: "the Law Firm"), we hereby present this document containing information on the processing of your personal data by the Law Firm within the framework of providing legal services.

In addition, information regarding the processing of personal data in connection with the operation of the website at www.adwokat-smulska.com can be found in our Privacy Policy.

The Law Firm complies with the provisions and principles of personal data protection established in generally applicable laws, including in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: "GDPR"). Personal data is treated as confidential and is processed by the Law Firm in a secure manner, applying appropriate technical and organizational measures.

Pursuant to Article 13(1) and (2) of the GDPR, please be informed that:

Data Controller

The Controller of your personal data is Advocate Dr. Paulina Smulska, conducting business under the registered name "dr Paulina Smulska Kancelaria Adwokacka", with:

  • Registered office: ul. Jana Brożka 18/8, 01-451 Warsaw, Poland
  • Principal place of business (correspondence address): ul. Bracka 20 apt. 7a, 00-028 Warsaw, Poland

(hereinafter referred to as: "the Controller").

Personal Data Collected

If you are an employee of a client of the Law Firm or an individual client of the Law Firm, your data has been collected either directly from you or provided by the Law Firm's client. Such data includes:

  • Full name
  • Position / Job title
  • Contact details

Purposes and Legal Bases for Data Processing

Your personal data will be processed where necessary for:

  • Conclusion and performance of a contract (Article 6(1)(b) GDPR) — in particular, legal services contracts or contracts for the supply of services to the Controller by third-party providers.
  • Fulfillment of legal obligations incumbent on the Controller (Article 6(1)(c) GDPR) — arising under European Union or Polish law.
  • Legitimate interests pursued by the Controller or a third party (Article 6(1)(f) GDPR) — specifically including:
    • Establishing, exercising, or defending legal claims
    • Fraud prevention and countering abuses
    • Ensuring the security of IT systems and networks
    • Operating internal control systems, identifying conflicts of interest, and managing ethical compliance
    • Archival and statistical purposes
    • Providing services to the client where client interests override the rights and freedoms of the data subject

The Law Firm processes personal data for the purposes of providing legal advisory services, organizing and conducting training sessions (including webinars), and sending invitations or updates regarding events organized by the Law Firm.

Personal data is processed strictly to the extent necessary for the above purposes and subject to a valid legal basis. For sending event information and marketing updates, the legal basis is your consent (Article 6(1)(a) GDPR).

Categories of Personal Data Processed

The Controller processes the following categories of personal data:

  • Identity verification data: name and surname, PESEL number, national identity document number, date of birth
  • Contact details: telephone number, email address, postal address
  • Tax identification data (e.g., NIP)
  • Education and professional experience data — where required for the provision of services
  • Financial and property status data — where required for the provision of services
  • Professional or business activity data
  • Marital / civil status data — where required for the provision of services
  • Image / photograph — where required for the provision of services

The Controller may also process other categories of personal data if they cannot be classified into the groups above, provided the processing aligns with the purposes outlined in this notice.

Categories of Data Recipients

We do not share your data without prior consent, except where permitted or required by law. Recipients of your data may include:

  • Cooperating advocates, legal advisors, notaries, and other legal service providers who independently determine the purposes and means of processing.
  • Authorized public authorities and bodies (in particular courts and state enforcement agencies).
  • Economic and credit information bureaus.
  • Service providers supporting the Law Firm's operations:
    • Information technology and hosting providers (including email and cloud services)
    • Payment, accounting, financial, and auditing services
    • Debt recovery agencies
    • Printing, scanning, and document shredding services
    • Postal and courier operators

All third-party service providers are vetted to verify that they maintain adequate security standards and guarantee proper data protection.

As a general rule, the Controller does not transfer personal data outside the European Economic Area (EEA). If a transfer outside the EEA is necessary, data will only be transferred to trusted entities ensuring an adequate level of protection confirmed by an adequacy decision of the European Commission or safeguarded via Standard Contractual Clauses (SCCs). You may request further details and copies of these safeguards at any time.

Data Retention Period

  • Legal advisory services: Personal data is retained for a period of 10 years, counted from the end of the calendar year in which the relevant proceedings concluded or the legal service was completed.
  • Event and marketing communications: Where data is processed on the basis of consent, it is retained for 3 years following the last interaction or correspondence, unless consent is withdrawn earlier.

Your Rights

Under the GDPR, you have the following rights:

  • Right of access: To obtain confirmation as to whether your personal data is being processed, and access to that data.
  • Right to rectification and completion: To request correction of inaccurate data or completion of incomplete data.
  • Right to erasure: To request deletion of your personal data ("right to be forgotten").
  • Right to restriction of processing: To request that processing activities be restricted in certain circumstances.
  • Right to data portability: To receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller (applicable when processing is automated and based on consent or contract).
  • Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out prior to withdrawal.
  • Right to lodge a complaint: You have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych — www.uodo.gov.pl).

To exercise any of these rights, please contact the Controller directly:

Requirement to Provide Data

  • Providing data to comply with legal obligations is a statutory requirement.
  • Providing data for concluding and performing a contract or for legitimate interest purposes is a contractual requirement.

Providing personal data is voluntary; however, failure to provide the necessary data will prevent the conclusion and execution of an agreement for legal services with the Controller.

Cookies

This website uses only strictly necessary technical cookies required for its proper and secure operation. The legal basis for their processing is the Controller’s legitimate interest (Article 6(1)(f) GDPR) in conjunction with Article 5(3) of the EU ePrivacy Directive (exempting strictly necessary cookies from prior consent). We do not use any tracking, analytics, or marketing cookies. You can manage or disable cookies at any time through your browser settings.