1. Data controller and contact
The controller of personal data is Zbigniew Minda, a Polish attorney-at-law (radca prawny) conducting business under the business name Zbigniew Minda, ul. Elektronowa 2, 03-219 Warszawa, NIP 7991872057, REGON 140133008, referred to below as the “Firm” or the “Controller”.
For personal data matters, contact the Controller by email at sekretariat@kancelaria-minda.com.pl, by phone on +48 22 100 43 33 or by post at the address above.
The Controller has not appointed a data protection officer. Please contact the Controller directly about personal data protection using the details above.
2. Who this notice covers
This notice covers data processed in connection with contacting and corresponding with the Firm, providing legal assistance, dealing with suppliers and using the website. It concerns, in particular:
- clients and people seeking legal assistance, including sole traders;
- representatives, members of governing bodies, employees and associates of clients and business partners;
- people whose data appears in cases we handle: parties and participants in proceedings, persons against whom claims are pursued, guarantors, witnesses and representatives;
- suppliers and their contact persons, other people corresponding with the Firm, website users and persons authorised to use the client portal.
The GDPR protects the data of natural persons. When we act for a company, this notice concerns, among other things, the data of its representatives, not the company itself as a legal person.
Not every purpose or category of data described applies to every person. Case-specific information supplements this notice.
3. Purposes, legal bases and legitimate interests
Contact and enquiries
We reply to messages, arrange meetings and clarify the matters about which we are contacted. The basis is Article 6(1)(f) GDPR — the legitimate interest in correspondence and efficient communication. Where an individual requests steps towards entering into a contract with them, the basis for the necessary processing is Article 6(1)(b) GDPR.
Contracts and legal assistance
We process the data of an individual who is a party to a contract to the extent necessary to enter into and perform that contract under Article 6(1)(b) GDPR. This also applies to contracts with suppliers who are natural persons. We process the data of a client’s or supplier’s representatives and contact persons under Article 6(1)(f) GDPR — in the interest of proper contract performance, communication, verifying authority and protecting the interests of the represented entity. A contract with a company does not by itself make Article 6(1)(b) GDPR applicable to every employee’s data.
Case handling, representation and debt recovery
We process the data of persons involved in cases to analyse the facts and law, advise, negotiate, establish, exercise or defend legal claims and represent clients in proceedings. For people who are not parties to a contract with the Firm, the basis is generally Article 6(1)(f) GDPR — the Firm’s or client’s legitimate interest in obtaining legal assistance and protecting rights. A statutory obligation provides a separate basis under Article 6(1)(c) GDPR only to the extent that a specific provision requires the processing concerned.
Legal obligations and accounting
We fulfil obligations arising, among other things, from the Polish Act on Attorneys-at-Law, the Law on the Bar (where applicable), tax legislation, accounting documentation rules and the relevant procedural provisions — under Article 6(1)(c) GDPR. If the Firm is an obliged entity for a particular activity under the Polish Act on Counteracting Money Laundering and Terrorist Financing, it also processes data to fulfil those obligations. This does not mean that every consultation or every case is subject to them.
Conflicts of interest, security and our own claims
We check whether we can accept a matter without a conflict of interest, protect the confidentiality of documents and systems, prevent misuse and establish, exercise and defend our own claims. The basis is Article 6(1)(f) GDPR — the interest in proper and secure professional practice and protecting the Firm’s rights; where processing follows directly from a statutory obligation, we apply Article 6(1)(c) GDPR.
Client portal and website
Providing authorised persons with case information through the portal serves to perform a contract with a client who is a natural person (Article 6(1)(b) GDPR), or the interest in efficiently serving an institutional client and communicating with its representatives (Article 6(1)(f) GDPR). Technical support, security logs and prevention of unauthorised access are based on Article 6(1)(f) GDPR — the interest in ensuring service availability and security.
Consent is not the general basis for all legal services. Where specific, separate processing genuinely requires consent, we state its purpose and scope before obtaining consent.
4. Data categories and data requiring special protection
Depending on the case, we process identification and contact details; information about representation and authority; business, employment, payment, contractual and financial information; data about claims, payments and proceedings; correspondence and documents; and technical data associated with using our services. We process PESEL numbers, identity document details or other identifiers where needed for a particular case or required by law, not automatically on every contact.
Case documents may contain special categories of data, such as health information. In addition to a basis under Article 6 GDPR, an appropriate condition under Article 9(2) GDPR is required. In particular, we apply Article 9(2)(f) GDPR where the data is necessary for the establishment, exercise or defence of legal claims.
We process data relating to criminal convictions and offences only where the conditions of Article 10 GDPR are met, within the scope permitted by the law governing legal assistance and the relevant proceedings.
Provide only information needed to clarify the matter. Do not send copies of identity documents or sensitive data by ordinary email unless necessary.
5. Where we obtain data
We receive data directly from the person concerned or from other people and entities in connection with a case. Sources may include a client, the creditor we represent, an employer or an entity designating a contact person, another party involved in a case or their representative.
We also use lawfully accessible documents and case files, information supplied by courts, bailiffs and other competent authorities and, where necessary, public registers such as Poland’s Central Register and Information on Economic Activity (CEIDG) and National Court Register (KRS).
In case-specific information, we identify the actual source and scope of the data obtained, as required by Article 14 GDPR. We assess exceptions to the information obligation, particularly those concerning legally protected professional secrecy, in relation to specific data and circumstances, not automatically for everyone.
6. Information for recipients of demands and persons involved in cases
When contacting you about a claim, we represent the client identified in the correspondence, not the recipient of the demand. We receive identification and contact data and information about the liability and its settlement primarily from that client, and subsequently as the matter is clarified and the relevant proceedings progress.
Verifying the claim, correspondence, negotiations and representing the creditor may require processing without the recipient’s consent, on the bases described above.
You may report an error, a payment already made, mistaken identity or objections to the claim. When contacting us, give the case reference from the letter and information enabling us to find it. Data protection rights and statutory limitations are described in section 9.
7. Data recipients and confidentiality
The Controller manages access to the Firm’s systems. Authorised persons may process data only to the extent needed for their assigned tasks. Data is disclosed externally only as necessary and subject to professional secrecy. Depending on the case, recipients may include:
- courts, administrative and tax authorities, law enforcement agencies, bailiffs and other bodies authorised by law;
- clients, parties and participants in proceedings and their representatives — where required by the conduct of the case or the procedure;
- professionals working with us, including other attorneys-at-law, advocates, notaries, tax advisers, experts and translators — where they are involved in the matter;
- providers of hosting and email services, IT support, case management systems and the client portal, archiving, accounting, payments, delivery or secure document destruction — where the service is actually used.
A service provider acting on the Controller’s instructions may act as a processor under Article 28 GDPR. Independent professionals and authorities may be controllers in their own right; their role depends on their actual tasks and the applicable rules. Not every recipient is a processor.
8. How long we retain data
Legal assistance records
For data covered by Article 5c(2) of the Polish Act on Attorneys-at-Law, we retain data for as long as necessary to perform the tasks set out in that Act, but no longer than 10 years from the end of the year in which the data was obtained, unless separate provisions state otherwise. We review the continuing need for retention at least once every 2 years.
Accounting and specific obligations
We retain tax records for the period required by law, generally until the tax liability becomes time-barred. This is normally 5 years from the end of the year in which the tax payment deadline expired; the running of that period may change in cases specified by law. Documents subject to other specific obligations are retained for the period required by those provisions.
Where the Polish Act on Counteracting Money Laundering and Terrorist Financing applies to an activity, we retain documents and information covered by Article 49(1) for 5 years after the business relationship ends or an occasional transaction takes place, and analysis results covered by Article 49(2) for 5 years after the analysis.
Other correspondence, claims and technical data
We retain correspondence unrelated to an accepted matter for as long as needed to reply and conclude the contact. Further retention requires a separate, genuine justification, such as documenting arrangements for a particular claim. In that case, we take account of the relevant claim and limitation periods and the progress of the proceedings.
Disabling client portal access does not automatically delete case records. We retain documents under the rules applicable to their purpose and legal basis, not simply for the lifetime of a technical account. Data no longer needed for processing is deleted or permanently anonymised.
Logs, technical backups and accounts
We apply the following retention periods to technical data:
- logs — up to 90 days from recording;
- rotating technical backups — up to 90 days from creation;
- account data — up to 30 days from account closure.
9. Your rights and statutory limitations
Where the law provides, you may request access to your data, a copy, rectification or completion, erasure or restriction of processing. Erasure is not unconditional: it may not be possible, for example, because of a legal obligation or the need to establish, exercise or defend legal claims.
The right to data portability applies to data you have provided where processing is based on consent or a contract and is carried out by automated means.
Objection and professional secrecy
For processing under Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation, unless a specific provision excludes that right. We then stop processing for the disputed purpose unless we demonstrate compelling, overriding legitimate grounds or grounds for establishing, exercising or defending legal claims.
Important limitation: under Article 5a(2) of the Polish Act on Attorneys-at-Law, Article 21(1) GDPR does not apply to data obtained by an attorney-at-law in connection with providing legal assistance. An objection alone therefore does not automatically delete data from a case being handled. You may still request correction of an error, challenge the lawfulness of processing or exercise other applicable rights.
Under Article 5a(1) of that Act, we apply Articles 15(1) and 15(3), 18 and 19 GDPR insofar as they do not infringe professional secrecy. We also protect the rights and freedoms of others. Any restriction of a right requires assessment in the particular situation; it does not amount to a complete exclusion of data protection within the Firm.
Consent, requests and complaints
If a particular operation is based on consent, you may withdraw it at any time. This does not affect the lawfulness of earlier processing or remove other independent legal bases.
Send your request to the email or postal address in section 1. We generally respond within one month of receipt. Where the legal conditions for an extension are met, the deadline may be extended by up to two further months; we notify you of the extension and its reasons within the first month. If we have reasonable doubts, we may request the necessary information to confirm identity, without routinely asking for a full copy of an identity document. Requests are generally handled free of charge, subject to the exceptions in Article 12(5) GDPR.
You may lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warszawa. Information on how to complain: uodo.gov.pl. You do not need the Firm’s prior consent or to conclude correspondence with us first.
10. Whether providing data is mandatory
Providing data in an enquiry is voluntary, but we may be unable to respond without contact details or information about the problem. Data needed to enter into and perform a contract is a contractual requirement; without it, we may be unable to accept instructions or perform a particular task. Data required by legislation, for example for accounting or AML identification, is a statutory requirement; its absence may prevent the activity for which it is required.
Receiving data from a client or another lawful source does not mean the person concerned is required to consent or enter into a contract with the Firm.
11. Transfers outside the EEA
The Firm uses IT, communications and cloud services. Depending on the service and its configuration, data may be transferred outside the European Economic Area (EEA), including being made available to providers or their subcontractors for data storage, communications and technical support.
A transfer outside the EEA requires a basis under Chapter V GDPR. Where the recipient and transfer are covered by a European Commission adequacy decision, the basis is Article 45 GDPR. In the absence of such a decision, appropriate safeguards must be provided under Article 46 GDPR, in particular European Commission standard contractual clauses, supplemented by additional protective measures where the transfer assessment requires them.
Details of recipients or their categories, countries of processing and the transfer basis are provided in the service-specific information. To obtain information about the safeguards used or a copy of them, contact the Controller at sekretariat@kancelaria-minda.com.pl.
12. Profiling
The Firm does not profile the people whose data it processes.
13. Website privacy and cookies
This section concerns the public website kancelaria-minda.com.pl, not the separate case management system. The website is informational and provides a route to client portal login. It has no contact form. Clicking a phone number or email address opens the appropriate application on the user’s device.
Technical data
Displaying a page requires the server to handle the connection. The hosting provider may record technical data, such as the IP address, date and time, requested URL, response code, browser details and errors. Processing necessary to deliver the website, diagnose errors and prevent misuse is based on Article 6(1)(f) GDPR. Retention periods are set out in section 8.
Cookies and external services
Logging in to the portal and maintaining a session may require cookies or similar technical mechanisms. These serve authentication, session maintenance and account access protection. Cookie storage settings can be managed in the browser; disabling mechanisms necessary for login may prevent use of the portal.
The directions link opens an external map service only when clicked; no map is embedded on the page. Once you move to an external service, its provider’s data processing rules apply. The Firm’s public website does not itself request access to the device’s location.
14. Client portal
The client portal is intended for individually authorised persons. Logging in provides access to information and documents relating to cases within the permissions granted. The portal preview in the public part of the website contains only fictional data and is separate from the actual login.
Processing in the actual portal may include account data, permissions, case information, documents, activity history and security logs. The general purposes and bases are set out in section 3, and retention rules in section 8.
15. Scope and version of this notice
This notice is available at https://www.kancelaria-minda.com.pl/rodo. We can also provide it in another appropriate form on request. Providing it is not a request for consent to processing.
Before a significant change in the purpose of processing, we provide the required information. Merely changing the website text does not replace individual notification where the law requires it.
Notice version: 25 October 2026.