Privacy Policy

Privacy Policy

effective from 12 February 2025 (date of last update: 1 December 2025)

Data controller

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”), this personal data processing policy (“Privacy Policy”) sets out the rules and provides information on the processing of personal data by the personal data controller, which is:

JUSTLAW Jastrun Kowalski sp.k., with its registered office in Warsaw (00-667), ul. Koszykowa 61, entered into the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, 12th Commercial Division of the National Court Register under KRS number: 0001066183, NIP: 7011171507, REGON: 526788216, e-mail: odo@justlaw.pl (“Law Firm” or “Controller”).

You may contact the Controller by post or by e-mail at the addresses provided above.

Categories of individuals whose personal data is processed by the Law Firm

The Privacy Policy applies to the processing by the Law Firm of personal data of the following categories of individuals:

  1. natural persons, including sole proprietors, for whom the Law Firm provides legal services (“Individual Clients”);
  2. natural persons, including sole proprietors, who are contractors of the Law Firm (“Contractors”);
  3. representatives of the Law Firm’s clients or business partners, e.g. persons acting on behalf of, employees, associates, or other persons acting on the side of the Law Firm’s client or business partner (“Representatives”);
  4. individuals who contact the Law Firm via communication channels such as e-mail, contact forms, messaging apps, telephone, or post;
  5. individuals who have given their consent to receive the Law Firm’s marketing information;
  6. individuals visiting the Law Firm’s social media profiles, including those who contact the Law Firm through functionalities available within these profiles;
  7. individuals visiting the Law Firm’s website available at: https://justlaw.pl/ (“Website”);
  8. candidates for cooperation with the Law Firm (“Candidates”).

Individual Clients

Personal data of Individual Clients is processed for the purpose of:

  1. providing legal services under agreements concluded by the Law Firm:
    • where services are provided directly to Individual Clients – on the basis of Article 6(1)(b) GDPR, i.e. processing is necessary for the performance of a contract or to take steps at the request of the data subject prior to entering into a contract,
    • where services are provided to persons who are not parties to the agreement with the Law Firm – for the purpose of performing the contract concluded by the Law Firm, which constitutes the Law Firm’s legitimate interest pursuant to Article 6(1)(f) GDPR;
    • with regard to special categories of personal data (e.g. health data) – on the basis of Article 9(2)(f) GDPR, i.e. processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;
  2. fulfilling obligations imposed on the Law Firm under regulations governing proceedings before courts and administrative authorities, in particular regulations concerning civil, criminal and administrative proceedings, as well as obligations arising from regulations governing the professions of advocate, attorney-at-law, tax adviser or patent attorney – on the basis of Article 6(1)(c) GDPR in connection with the above-mentioned provisions of law;
  3. fulfilling legal obligations imposed on the Law Firm, including tax settlements and keeping accounting records – on the basis of Article 6(1)(c) GDPR, i.e. processing is necessary to comply with the Law Firm’s legal obligations, including those arising from tax law and accounting regulations;
  4. establishing, pursuing or defending against potential claims in connection with the provision of legal services or legal assistance:
    • with regard to special categories of personal data – on the basis of Article 9(2)(f) GDPR, i.e. processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;
    • with regard to other personal data – on the basis of Article 6(1)(f) GDPR, i.e. the Law Firm’s legitimate interest, which is the ability to establish, pursue or defend against claims.

Contractors

Personal data of Contractors is processed for the purpose of:

  1. concluding and performing the agreement entered into between the Law Firm and the Contractor – on the basis of Article 6(1)(b) GDPR;
  2. fulfilling legal obligations imposed on the Law Firm, including tax settlements and keeping accounting records – on the basis of Article 6(1)(c) GDPR, i.e. processing is necessary to comply with the Law Firm’s legal obligations, including those arising from tax law and accounting regulations;
  3. establishing, pursuing or defending against potential claims – on the basis of Article 6(1)(f) GDPR, i.e. the legitimate interest pursued by the Law Firm, which is the ability to establish, pursue or defend against claims.

Representatives 

Personal data of Representatives come from the following sources:

  1. the Representative’s personal data is provided to the Law Firm by the client or contractor of the Law Firm whom the Representative represents, or
  2. they are provided directly to the Law Firm by the individual.

The Law Firm receives this personal data in connection with the conclusion or performance of an agreement between the client or contractor and the Law Firm, in particular for the purpose of performing the agreement and ensuring ongoing communication.

The Law Firm processes the following categories of personal data of Representatives:

  1. identification data (i.e. first name, last name), position/function performed;
  2. contact details (i.e. business phone number, e-mail).

Personal data of Representatives is processed for the following purposes and on the following legal bases:

  1. concluding and performing the agreement between the Law Firm and its client or contractor, including ongoing communication in connection with the performance of the agreement, which constitutes the Law Firm’s legitimate interest pursuant to Article 6(1)(f) GDPR;
  2. fulfilling legal obligations imposed on the Law Firm, including tax settlements and keeping accounting records – on the basis of Article 6(1)(c) GDPR, i.e. processing is necessary to comply with legal obligations imposed on the Law Firm, including those arising from tax law and accounting regulations;
  3. establishing, pursuing or defending against potential claims – on the basis of Article 6(1)(f) GDPR, i.e. the legitimate interest pursued by the Law Firm, which is the ability to establish, pursue or defend against claims.

Data of individuals contacting the Law Firm

Personal data of individuals who contact the Law Firm, or whom the Law Firm contacts via the Law Firm’s communication channels, is processed for the purpose of:

  1. communication and correspondence, in particular responding to questions addressed to the Law Firm by the person initiating contact or sending a requested offer concerning the Law Firm’s services, which constitutes the Law Firm’s legitimate interest pursuant to Article 6(1)(f) GDPR;
  2. initiating or establishing a business relationship with that individual or with the entity they represent or cooperate with, which constitutes the Law Firm’s legitimate interest pursuant to Article 6(1)(f) GDPR.

Data of individuals who have consented to receive the Law Firm’s marketing information

If an individual has given consent (within the meaning of Article 398 of the Electronic Communications Law of 12 July 2024) to receive marketing information from the Law Firm, their personal data is processed for marketing purposes on the basis of Article 6(1)(a) GDPR (consent).

Social media profiles

The Law Firm operates the following social media profiles:
LinkedIn – https://www.linkedin.com/company/just-law-it/posts/?feedView=all

Facebook – https://www.facebook.com/profile.php?id=61572565347990

YouTube – https://www.youtube.com/@Kancelaria_Just_LAW 

 

In connection with maintaining the above profiles, the Law Firm processes personal data of social media users who are natural persons in relation to their activities performed within the Law Firm’s profiles, such as following, posting comments, reacting to content (e.g. “likes”), or initiating contact through messaging functions. The Law Firm processes personal data of individuals visiting its social media profiles, in particular in the following scope:

  1. user identifier (may include first and last name, job position, and other information);
  2. identification data and other information published by the individual on the given social media platform;
  3. profile photo (image);
  4. content of comments posted on the Law Firm’s profile and the content of conversations conducted with the individual via the given platform;
  5. statistical data regarding visits to the Law Firm’s social media profiles.

Personal data in the above scope is processed for the following purposes and on the following legal bases:

  1. operating the Law Firm’s social media profiles in accordance with the terms and conditions set by their operators, informing via these profiles about activities, services, events, sharing knowledge, as well as building and maintaining a community and communicating through the available functionalities of the service (comments, messages, including event registrations), which constitutes the Law Firm’s legitimate interest pursuant to Article 6(1)(f) GDPR;
  2. conducting analyses of the functioning, popularity, and ways of using social media profiles, which constitutes the Law Firm’s legitimate interest pursuant to Article 6(1)(f) GDPR.

When using the statistics function on Facebook, the Law Firm and Meta Platforms Ireland Limited act as joint controllers of data processed for statistical purposes. The arrangements between the joint controllers defining responsibilities for personal data processing are available here: https://www.facebook.com/legal/terms/page_controller_addendum. According to these terms, Meta Platforms Ireland Limited has assumed primary responsibility under the GDPR for processing data for statistical purposes and for fulfilling all relevant GDPR obligations.

 

Please note that social media platform operators are also separate controllers of personal data. Detailed information on personal data processing by each social media platform operator can be found here:
LinkedIn – https://pl.linkedin.com/legal/privacy-policy

Facebook – https://www.facebook.com/privacy/policy/?locale=pl_PL

YouTube – https://policies.google.com/privacy?hl=pl 

Data of individuals visiting the Website

In connection with the possible use of cookies or other similar technologies on the Website (as described below), the Law Firm may process personal data of individuals visiting the Website in the scope of online identifiers (e.g. cookie ID, IP address) and – provided that the user has given prior consent – information about activity on the Website.

Personal data of individuals visiting the Website is processed for the purpose of:

  1. enabling the use of the Website and its functionalities, which constitutes the Law Firm’s legitimate interest pursuant to Article 6(1)(f) GDPR (in the case of necessary cookies or similar technologies);
  2. analytical, advertising, and other purposes, depending on the types of cookies for which the user has given consent—based on Article 6(1)(a) GDPR, i.e. consent (in the case of cookies or similar technologies other than those necessary).

Candidates

Personal data of Candidates is processed for the purpose of conducting the recruitment process and selecting the appropriate person for employment in a given position, including assessing the Candidate’s qualifications, capabilities, and skills relevant to cooperation.

The Law Firm processes personal data for the above purposes on the following legal bases:

  1. with respect to data necessary to assess the Candidate’s competences and qualifications (first name, last name, date of birth, contact details, education, professional qualifications, employment history) – on the basis of Article 6(1)(b) GDPR, as the processing of such data is necessary to take steps at the request of the data subject prior to entering into a contract;
  2. if the Candidate includes in their application documents any data other than those indicated in point 1 above – on the basis of the Candidate’s consent (the voluntary submission of data beyond what is required constitutes consent to their processing), pursuant to Article 6(1)(a) GDPR;
  3. with respect to personal data collected during the recruitment interview and the results of any qualification tests – processing is necessary for purposes arising from the legitimate interests pursued by the Controller, consisting in verifying the qualifications and skills of Candidates in order to select the appropriate person for the position for which recruitment is conducted, in accordance with Article 6(1)(f) GDPR;
  4. for the purposes of future recruitment processes, with regard to all personal data contained in the Candidate’s application documents, on the basis of the Candidate’s voluntary consent, i.e. pursuant to Article 6(1)(a) GDPR.

Voluntary or mandatory provision of personal data

When data is processed for the purpose of conducting correspondence and responding to inquiries, establishing, pursuing or defending claims, or fulfilling other legitimate interests of the Law Firm – the provision of data is voluntary, but necessary to achieve these purposes.

In the case of processing personal data for the purpose of performing a contract, providing the data is voluntary but necessary for concluding and performing the contract. In the case of personal data processed for the purpose of fulfilling the legal obligations imposed on the Law Firm, providing the personal data is mandatory and results from the applicable legal provisions.

When data is processed for the purpose of sending marketing information – the provision of data is voluntary and is based on consent.

When data of individuals visiting the Website is processed – data is provided automatically while using the Website; however, in the case of cookies or other technologies that are not necessary for using the Website, data is processed only if the individual has given consent.

Providing personal data in application documents with respect to: first name, last name, date of birth, contact details, education, professional qualifications, and employment history is necessary for participation in the recruitment process. Failure to provide these data will result in the inability to consider the candidacy. Providing personal data in any additional scope is voluntary and does not affect participation in the recruitment process.

Failure to provide personal data will make it impossible to achieve the specific purpose of processing.

Retention periods for personal data

Personal data will be stored for the period necessary to achieve the purposes for which the data is processed. In addition, the Law Firm will store them until the expiry of any data retention obligations arising from applicable law (e.g. tax law). If the basis for processing is the Law Firm’s legitimate interest, the data will be processed until that legitimate interest has been fulfilled or until a valid objection is raised – whichever occurs first. If processing is based on consent, the data will be processed until the consent is withdrawn.

The Law Firm may store personal data in particular where processing is necessary for the establishment, exercise or defence of legal claims, and after that period – only if and to the extent required by law.

Information contained in private messages sent to the Law Firm via its social media profiles will be stored for the message retention period determined by the operator of the respective platform.

In the case of information held by the Law Firm in the form of comments posted by an individual, such information will remain visible on the Law Firm’s profile until it is removed by the individual or until the Law Firm removes the relevant content from its profile. Personal data collected by a social media platform operator – such as post history, activity history, and sent messages – are retained under the terms and conditions of that platform.

Personal data processed in connection with the use of necessary cookies or similar technologies will be stored for the duration of their validity. Personal data processed in connection with the use of cookies or similar technologies other than those strictly necessary will be stored for the duration of their validity, but no longer than until consent is withdrawn.

Personal data processed by attorneys-at-law or advocates in the exercise of their profession are kept for 10 years from the end of the year in which the proceedings during which the personal data were collected were concluded.

Candidates’ personal data will be stored until the recruitment process is completed, unless the candidate has given consent for their personal data to be processed for the purposes of future recruitment processes – in such cases, the personal data will be stored until the consent is withdrawn.

Data recipients and transfer of data outside the EEA

Personal data processed by the Law Firm may be disclosed to the following entities: employees and associates of the Law Firm, IT service providers, hosting providers, entities providing accounting, advisory, and recruitment services, as well as other service providers involved in the processing of personal data, on the basis of an appropriate agreement. Only those personal data that is necessary for the performance of the contract between the Law Firm and such an entity will be disclosed.

Personal data processed by the Law Firm may also be made available to entities and authorities authorised to process such data under applicable law.

In connection with the Law Firm’s operation of social media profiles and the use of cookies other than those strictly necessary on the Website (provided that the user has given prior consent), the user’s personal data is transferred to the operator of the respective social media platform or to providers of cookies or similar technologies. These entities may, in turn, transfer personal data to companies in the USA or other countries outside the European Economic Area, which requires them to ensure appropriate safeguards for data transfers in accordance with Chapter V of the GDPR. Detailed information on the privacy principles applied by these entities is available in their respective privacy policies.

The Law Firm does not intend to transfer the personal data it processes to countries outside the European Economic Area or to international organisations. Any potential transfer of data outside the EEA may occur only if it is necessary for the purposes of processing, and such transfer will take place in compliance with the provisions of Chapter V of the GDPR.

Rights of individuals in relation to the processing of personal data

An individual whose personal data is processed by the Law Firm has the following rights:

  1. the right of access to their personal data;
  2. the right to request rectification of their data;
  3. the right to request erasure of their data;
  4. the right to request restriction of processing;
  5. the right to data portability, i.e. the right to receive from the Law Firm the personal data concerning them, which they have provided to the Law Firm, in a structured, commonly used, machine-readable format, where the processing is based on consent or a contract and carried out by automated means; the data subject may request that the Law Firm transmit the personal data they have provided to another controller;
  6. the right to object to the processing of personal data, insofar as the processing is based on the Law Firm’s legitimate interest;
  7. the right to withdraw consent to the processing of personal data, where the data are processed on the basis of consent; consent may be withdrawn at any time, without affecting the lawfulness of processing carried out prior to its withdrawal.

To exercise the above rights, you should contact the Law Firm by post at the Law Firm’s address or by e-mail at: odo@justlaw.pl

In addition, an individual whose personal data is processed has the right to lodge a complaint with the supervisory authority responsible for data protection (the President of the Personal Data Protection Office) if they believe that the processing of their data violates the GDPR. 

Cookies or similar technologies

Depending on the settings selected by the individual visiting the Website (the user) through the banner displayed during the first visit to the Website, in addition to technically necessary cookies or similar technologies (hereinafter collectively referred to as “cookies”), the Law Firm may use cookies for statistical, analytical, or advertising purposes.

Cookies are small data packets that are stored locally in the cache or on the hard drive of the device used to access the Website. In addition to cookies, other technologies that collect information about user behaviour on the Website may also be used.

Under applicable law, the Law Firm may store cookies on the user’s device if they are necessary for the functioning of the Website (these cookies are described below as necessary). The use of any other types of cookies (in particular analytical or advertising cookies) requires the user’s prior consent.

Necessary cookies are automatically installed on the user’s device when they access the Website or perform certain actions on the Website.

If the user gives consent during their first visit to the Website or later through the cookie settings panel, the Law Firm may also use statistical, analytical, or advertising cookies.

The user of the Website may change their cookie settings at any time using the settings panel available on the Website (if implemented by the Law Firm in connection with the use of non-essential cookies) or through the settings of their web browser.