Privacy Policy

of the website www.oca.com.pl

Version of 26 August 2026

This Privacy Policy explains how Orzeł Ciszowski Adwokaci Spółka Partnerska processes personal data — both of visitors to the website www.oca.com.pl and of Clients and other individuals whose data relates to the matters we handle.

The Firm is a law firm of Polish advocates (adwokaci). The way in which personal data is processed is therefore governed not only by the GDPR, but also by the Polish Bar Act, which materially modifies the general rules laid down in the GDPR. Section 10 of this Privacy Policy is devoted entirely to that issue; we ask you to read it, as it describes the actual scope of the rights you have vis-à-vis the Firm.

This is a translation prepared for the convenience of English-speaking readers. In the event of any discrepancy, the Polish-language version of this Privacy Policy prevails. References to legal provisions are references to Polish law and to Regulation (EU) 2016/679.

1. Controller of personal data

1.1. The controller of personal data is Orzeł Ciszowski Adwokaci Spółka Partnerska (a professional partnership), with its registered office in Katowice at plac Oddziałów Młodzieży Powstańczej 5/8, 40-061 Katowice, Poland, entered in the register of entrepreneurs of the National Court Register kept by the District Court Katowice-Wschód in Katowice, 8th Commercial Division of the National Court Register, under KRS number: 0000877537, tax identification number (NIP): 9542822128, statistical number (REGON): 387881041 (hereinafter: the „Firm”). The Firm maintains an office at its registered address and a branch office in Zawiercie, at ul. 3 Maja 33, 42-400 Zawiercie.

1.2. The partners of the Firm are adwokat Joanna Orzeł (roll number: KAT/ADW/2054) and adwokat Adrian Ciszowski (roll number: KAT/ADW/1802), both entered on the roll of advocates kept by the District Bar Council in Katowice (Okręgowa Rada Adwokacka w Katowicach). Advocates practising in the Firm are bound by the rules of professional ethics set out in the Code of Ethics of Advocates (Zbiór Zasad Etyki Adwokackiej i Godności Zawodu), adopted by the Polish Bar Council and available at www.adwokatura.pl.

1.3. In all matters concerning the processing of personal data you may contact the Firm:

• a) by e-mail — at: sekretariat@oca.com.pl;
• b) by telephone — at: +48 535 204 359;
• c) in writing — at the registered office address indicated in section 1.1.

2. Data protection officer

2.1. The Firm has not appointed a data protection officer. The obligation to appoint one arises solely in the cases set out in Article 37(1) GDPR, none of which applies to the Firm.

2.2. All requests and enquiries concerning personal data should be directed to the contact details indicated in section 1.3.

3. Definitions

Wherever this Privacy Policy refers to:

• a) the GDPR — this means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);
• b) the Bar Act — this means the Polish Act of 26 May 1982 – Law on the Bar (ustawa z dnia 26 maja 1982 r. – Prawo o adwokaturze);
• c) the Firm — this means the entity identified in section 1.1;
• d) the Website — this means the website available at www.oca.com.pl;
• e) the User — this means a natural person using the Website;
• f) the Client — this means a natural person, legal person or organisational unit for whom the Firm provides legal assistance;
• g) advocate’s professional secrecy — this means the duty to keep secret everything an advocate has learned in connection with the provision of legal assistance (Article 6(1) of the Bar Act).

4. Scope of personal data processed

4.1. The scope of the personal data processed depends on the relationship in which the data subject stands to the Firm.

4.2. In connection with the use of the Website, the Firm processes the IP address, information about the terminal device and browser, the date and time of the visit, the referring page address and information stored in cookies and similar technologies.

4.3. In connection with contact made through the contact form or by e-mail, the Firm processes the data provided by the person making contact, in particular first name and surname, e-mail address, telephone number and the content of the message together with the description of the matter.

4.4. In connection with the provision of legal assistance, the Firm processes the data necessary to conduct the matter, including identification and contact data, data contained in the case documents and — to the extent required by the nature of the matter — special categories of data within the meaning of Article 9(1) GDPR (in particular health data) and data relating to criminal convictions and offences within the meaning of Article 10 GDPR.

5. Purposes of processing and legal bases

5.1. Provision of legal assistance. The Firm processes personal data in order to perform the agreement on the provision of legal assistance, comprising in particular the giving of legal advice, the drafting of legal opinions, the preparation of draft legal instruments and appearing before courts and public authorities (Article 4(1) of the Bar Act). The legal bases are:

• a) Article 6(1)(b) GDPR — where the Client is a natural person and processing is necessary for the performance of the agreement or in order to take steps prior to entering into it;
• b) Article 6(1)(c) GDPR — to the extent that processing is necessary for compliance with legal obligations to which the Firm is subject, in particular obligations arising under the Bar Act;
• c) Article 6(1)(f) GDPR — where the Client is a legal person or an organisational unit and the processing of the data of individuals acting on its behalf is necessary for the purposes of the legitimate interests pursued by the Firm, consisting in the performance of the agreement concluded with the Client;
• d) Article 9(2)(f) GDPR — as regards special categories of data, where processing is necessary for the establishment, exercise or defence of legal claims;

Data relating to criminal convictions and offences (Article 10 GDPR) is processed on the basis of Article 6(1)(b) or Article 6(1)(c) GDPR, the national law authorising such processing and providing appropriate safeguards being the provisions of the Bar Act which define the scope of legal assistance and establish the advocate’s professional secrecy.

5.2. Contact through the contact form and by e-mail. The Firm processes data in order to respond to the message received and to conduct further correspondence. The legal bases are:

• a) Article 6(1)(b) GDPR — where the message is aimed at entering into an agreement on the provision of legal assistance;
• b) Article 6(1)(f) GDPR — in all other cases, the legitimate interest of the Firm being to respond to the message received and to conduct ongoing correspondence.

Providing data in the contact form is voluntary but necessary in order to receive a reply. The legal basis for processing the data provided in the form is not consent, but the provisions indicated above; accordingly, the Firm does not make the receipt or handling of a message conditional on the granting of any consent.

5.3. Data of persons not obtained directly from them. In connection with the provision of legal assistance the Firm also processes the personal data of persons other than the Client — in particular opposing parties, witnesses, debtors and creditors of the Client, and other persons named in the case documents. The legal bases are Article 6(1)(c) and Article 6(1)(f) GDPR, the legitimate interest of the Firm being the provision of legal assistance to the Client and, to the relevant extent, the establishment, exercise or defence of legal claims.

In relation to the persons referred to in the preceding sentence, the Firm does not comply with the information obligation under Article 14(1)–(4) GDPR. The basis for this is Article 14(5)(d) GDPR, under which those provisions do not apply where “the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy”. The advocate’s professional secrecy (Article 6 of the Bar Act) is such a statutory obligation.

5.4. Use of the Website, its security and traffic analysis. The legal bases are:

• a) Article 6(1)(f) GDPR — as regards ensuring the proper operation, security and availability of the Website, which constitutes a legitimate interest of the Firm;
• b) Article 6(1)(a) GDPR — as regards cookies other than strictly necessary ones, on the basis of consent given through the consent management mechanism. The storing of information on, and access to information already stored in, the User’s terminal equipment is additionally governed by Article 399 of the Polish Act of 12 July 2024 – Electronic Communications Law (Prawo komunikacji elektronicznej).

5.5. Settlements, accounting records and tax obligations. The legal basis is Article 6(1)(c) GDPR in conjunction with the Polish Accounting Act of 29 September 1994 and the Tax Ordinance Act of 29 August 1997.

5.6. Anti-money laundering and counter-terrorist financing. The legal basis is Article 6(1)(c) GDPR in conjunction with the Polish Act of 1 March 2018 on Counteracting Money Laundering and Terrorist Financing — to the extent that the Firm provides legal assistance concerning the activities listed in Article 2(1)(14) of that Act and is, on that account, an obliged institution.

5.7. Establishment, exercise and defence of legal claims. The legal basis is Article 6(1)(f) GDPR, the legitimate interest of the Firm being the protection of its rights.

5.8. The Firm’s social media profiles. The Firm maintains profiles on Facebook and LinkedIn. The data of persons visiting those profiles is processed for the purpose of communication and of providing information about the Firm’s activity, on the basis of Article 6(1)(f) GDPR. As regards aggregate statistics concerning visits to a profile, the Firm and the operator of the given social media service are joint controllers within the meaning of Article 26 GDPR, as follows from the judgment of the Court of Justice of the European Union of 5 June 2018 in Case C-210/16. Independently of the above, the operator of the social media service processes data as a separate controller, on the terms set out in its own privacy policy, over the content of which the Firm has no influence.

6. Source of the personal data

The Firm obtains personal data:

• a) directly from the data subject — in particular through the contact form, correspondence, telephone contact and in the course of providing legal assistance;
• b) from the Client — as regards the data of the persons referred to in section 5.3;
• c) from the case files and from courts, public prosecutors, public administration authorities, court enforcement officers, and from other parties and participants in proceedings;
• d) from publicly available sources, in particular the National Court Register, the Central Register and Information on Economic Activity, land and mortgage registers, the Court and Commercial Gazette and the National Register of Debtors;
• e) automatically — in connection with the User’s use of the Website, to the extent indicated in section 4.2.

7. Recipients of personal data

7.1. Personal data may be transferred to entities processing it on the Firm’s behalf, under data processing agreements concluded in accordance with Article 28 GDPR. These are in particular: providers of IT, hosting and cloud services, e-mail service providers, providers of software supporting the Firm’s work, the provider of accounting services, providers of document archiving and destruction services, and the entity operating the Website.

7.2. Personal data may further be disclosed — solely to the extent necessary to conduct the Client’s matter or in the performance of a legal obligation — to courts, public prosecutors, public administration authorities, court enforcement officers, parties and participants in proceedings and their attorneys, as well as to postal and courier operators, advocates and legal counsels co-operating with the Firm on a matter, translators, court experts and appraisers, and the Firm’s insurer.

7.3. A reservation of fundamental importance. Data covered by the advocate’s professional secrecy is not disclosed to any entity save in cases expressly provided for by law and save to the extent necessary to conduct the Client’s matter. Persons to whom the Firm entrusts the performance of activities connected with the provision of legal assistance are bound to maintain confidentiality; that requirement follows from § 5 of the Regulations on the Practice of the Profession of Advocate, being the annex to Resolution No. 140/2023 of the Polish Bar Council of 1 December 2023.

7.4. The Firm does not sell personal data and does not disclose it to third parties for marketing purposes.

8. Transfers of personal data outside the European Economic Area

8.1. As a rule, the Firm does not transfer personal data outside the European Economic Area.

8.2. Such a transfer may nevertheless occur in connection with the Firm’s use of the services of providers established outside the European Economic Area or using infrastructure located outside that area. In such a case, the transfer takes place solely on the basis of a mechanism provided for in Chapter V GDPR, in particular:

• a) on the basis of standard data protection clauses adopted by the European Commission (Article 46(2)(c) GDPR), that is Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (OJ L 199, 7.6.2021, p. 31); or
• b) on the basis of a European Commission decision finding an adequate level of protection of personal data (Article 45 GDPR), including Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the EU–US Data Privacy Framework.

8.3. The Firm monitors the status of the decisions referred to in section 8.2. Should any of them be annulled, suspended or repealed, the Firm will promptly apply another mechanism provided for in Chapter V GDPR or cease the transfer of data.

8.4. At the data subject’s request, the Firm provides information about the safeguards applied and — to the extent permissible — makes a copy of them available.

9. Retention periods

9.1. Data processed by an advocate in the practice of the profession is retained for a period of 10 years from the end of the year in which the proceedings in which the data was collected were concluded (Article 16c(1), point 2(c) of the Bar Act). Upon expiry of that period the personal data is erased (Article 16c(2) of the Bar Act). The obligation to keep and retain the case file for that period additionally follows — in relation to an advocate conducting court proceedings or proceedings before a public authority — from § 8(3) of the Regulations on the Practice of the Profession of Advocate.

9.2. Documentation collected in the performance of anti-money laundering and counter-terrorist financing obligations is retained for a period of 5 years from the date of termination of the business relationship with the Client or from the date on which an occasional transaction was carried out (Article 49(1) of the Act of 1 March 2018 on Counteracting Money Laundering and Terrorist Financing).

9.3. Accounting documentation is retained for the periods laid down in Article 74 of the Accounting Act of 29 September 1994, as a rule 5 years counted from the beginning of the year following the financial year to which the documentation relates. Tax books and the documents relating to them are retained until the limitation period for the tax liability expires (Article 86 § 1 of the Tax Ordinance Act of 29 August 1997).

9.4. Data originating from the contact form and from correspondence which has not led to the conclusion of an agreement on the provision of legal assistance is retained for a period of 1 year from the end of the correspondence — unless a longer period is necessary for the establishment, exercise or defence of legal claims.

9.5. Data processed for the establishment, exercise or defence of legal claims is retained until the limitation period expires. Claims for remuneration for services rendered, vested in persons who permanently or within the scope of their business undertake activities of a given kind, become time-barred after two years (Article 751, point 1 of the Polish Civil Code); other claims become time-barred within the periods laid down in Article 118 of the Polish Civil Code.

9.6. Data collected through cookies is retained for the periods indicated in section 15.

9.7. Data processed on the basis of consent is retained until that consent is withdrawn.

9.8. Data processed on the basis of the Firm’s legitimate interest is retained until an effective objection is raised — subject to section 10.5.

10. Advocate’s professional secrecy and the rights of data subjects

10.1. An advocate is bound to keep secret everything he or she has learned in connection with the provision of legal assistance (Article 6(1) of the Bar Act). The duty of professional secrecy may not be limited in time (Article 6(2) of the Bar Act), and an advocate may not be released from the duty of professional secrecy as regards facts learned while providing legal assistance or conducting a matter (Article 6(3) of the Bar Act). Convergent rules follow from § 19 of the Code of Ethics of Advocates, which covers by professional secrecy everything an advocate has learned in connection with the performance of professional duties and describes the duty to observe that secrecy as unlimited in time.

10.2. The duty of professional secrecy does not extend to information disclosed under the anti-money laundering and counter-terrorist financing legislation, nor to information provided under Chapter 11a of Title III of the Tax Ordinance — to the extent set out in those provisions (Article 6(4) of the Bar Act). These are the only statutory exceptions to the advocate’s professional secrecy.

10.3. The duty of professional secrecy does not cease even where the request for disclosure of information obtained by an advocate in connection with the provision of legal assistance is made by the President of the Personal Data Protection Office (Article 16b of the Bar Act).

10.4. Under Article 16a(1) of the Bar Act, Articles 15(1) and (3), 18 and 19 GDPR apply only to the extent that they do not infringe the duty of the advocate’s professional secrecy. In practice this means that, as regards data covered by that secrecy:

• a) the right of access to data and the right to obtain a copy of it (Articles 15(1) and (3) GDPR) is not given effect to the extent that doing so would result in the disclosure of information covered by the advocate’s professional secrecy;
• b) the right to request restriction of processing (Article 18 GDPR) is subject to the same limitation;
• c) the obligation to notify recipients regarding rectification or erasure of personal data or restriction of processing (Article 19 GDPR) is subject to the same limitation.

10.5. Under Article 16a(2) of the Bar Act, Article 21(1) GDPR does not apply to personal data obtained by an advocate in connection with the provision of legal assistance. This means that in respect of such data there is no right to object.

10.6. In relation to persons whose data the Firm has not obtained from them directly, the Firm does not comply with the information obligation under Article 14(1)–(4) GDPR, on the basis of Article 14(5)(d) GDPR — in accordance with section 5.3 above.

10.7. The limitations described in this section are not general in nature. In particular, they do not cover:

• a) the right to rectification of personal data (Article 16 GDPR) or the right to erasure of personal data (Article 17 GDPR) — the Bar Act does not restrict the application of those provisions. The right to erasure is nevertheless subject to the exceptions set out in Article 17(3) GDPR itself, in particular where processing is necessary for compliance with a legal obligation — such an obligation being the retention of data for the period laid down in Article 16c of the Bar Act;
• b) data not covered by the advocate’s professional secrecy — including the data of Users of the Website, data originating from correspondence unconnected with the provision of legal assistance, and the data of the Firm’s counterparties. In respect of such data, all the rights described in section 11 apply in full.

10.8. These limitations do not serve the interest of the Firm; they protect the person who has entrusted his or her matter to an advocate, and the relationship of trust between advocate and Client. Article 23 GDPR permits the introduction of such limitations in the law of a Member State.

11. Rights of data subjects

11.1. Subject to the limitations described in section 10, you have the following rights:

• a) the right of access to personal data and to obtain a copy of it (Article 15 GDPR);
• b) the right to rectification of personal data which is inaccurate and to have incomplete data completed (Article 16 GDPR);
• c) the right to erasure of personal data — in the cases set out in Article 17 GDPR, save that this right does not apply to the extent that processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims;
• d) the right to request restriction of processing of personal data (Article 18 GDPR);
• e) the right to data portability (Article 20 GDPR) — to the extent that processing is based on consent or on a contract and is carried out by automated means;
• f) the right to object to processing based on the Firm’s legitimate interest, on grounds relating to the data subject’s particular situation (Article 21(1) GDPR) — subject to section 10.5;
• g) the right to withdraw consent at any time where processing is based on consent (Article 7(3) GDPR); withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal;
• h) the right not to be subject to a decision based solely on automated processing, including profiling (Article 22 GDPR) — subject to section 14.

11.2. Requests should be directed to the contact details indicated in section 1.3. The Firm responds without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests, in which case the Firm will inform the data subject within one month of receipt of the request (Article 12(3) GDPR).

11.3. The exercise of these rights is free of charge. Where requests are manifestly unfounded or excessive, the Firm may charge a reasonable fee or refuse to act on the request (Article 12(5) GDPR).

11.4. Where the Firm has reasonable doubts concerning the identity of the person making a request, it may request the provision of additional information necessary to confirm that identity (Article 12(6) GDPR).

12. Right to lodge a complaint with a supervisory authority

12.1. A data subject has the right to lodge a complaint with a supervisory authority if he or she considers that the processing of his or her personal data infringes the GDPR (Article 77 GDPR).

12.2. The competent supervisory authority in the Republic of Poland is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland.

12.3. Independently of the right to lodge a complaint, there is a right to an effective judicial remedy (Article 79 GDPR).

13. Whether the provision of data is voluntary

13.1. Providing personal data through the contact form or by e-mail is voluntary; it is, however, necessary in order to receive a reply.

13.2. Providing personal data in connection with entering into an agreement on the provision of legal assistance is voluntary; it is, however, necessary in order to conclude and perform that agreement.

13.3. To the extent that the obligation to provide personal data arises under the law — in particular under the anti-money laundering and counter-terrorist financing legislation — the provision of data is a statutory requirement, and a failure to comply makes the provision of legal assistance impossible.

14. Profiling and automated decision-making

14.1. The Firm does not take, in relation to data subjects, decisions based solely on automated processing, including profiling, which would produce legal effects concerning them or similarly significantly affect them (Article 22(1) GDPR).

14.2. Data collected through analytical cookies may be used to produce aggregate statistics on the use of the Website. Those statistics are not used to take decisions in relation to individual Users.

15. Cookies and similar technologies

15.1. Cookies are pieces of information stored on the User’s terminal equipment while the Website is being used. The Firm uses cookies and similar technologies, including the browser’s local storage.

15.2. Storing information on, and gaining access to information already stored in, the User’s terminal equipment is permitted after the User has first been informed and has given consent (Article 399(1) of the Act of 12 July 2024 – Electronic Communications Law). The provisions on the protection of personal data apply accordingly to the obtaining of that consent (Article 400 of that Act).

15.3. The Firm uses the following categories of cookies:

• a) strictly necessary cookies — required to ensure the proper functioning of the Website and the delivery of the service requested by the User, including remembering the consent choices made. Their use does not require consent (Article 399(3) of the Electronic Communications Law);
• b) analytical cookies — used to examine how the Website is used and to produce aggregate statistics. Their use requires the User’s consent;
• c) marketing cookies — used to present content matched to the User’s interests, including outside the Website. Their use requires the User’s consent.

15.4. Giving consent to cookies other than strictly necessary ones is voluntary. Refusing consent does not restrict access to the content of the Website or the ability to contact the Firm.

15.5. Consent may be withdrawn at any time — as easily as it was given (Article 7(3) GDPR). To do so, use the “Cookie settings” link permanently available in the footer of the Website. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

15.6. Cookies other than strictly necessary ones, and third-party scripts, are activated only after the User’s consent has been obtained.

15.7. The User may also determine the conditions for the storage of, and access to, cookies through the settings of his or her web browser, including by blocking them entirely. This may, however, affect the proper functioning of the Website.

15.8. A detailed list of the cookies used — including their name, provider, purpose and storage period — is available in the consent management mechanism, under the link indicated in section 15.5.

16. Security of personal data

16.1. The Firm applies technical and organisational measures ensuring a level of security appropriate to the risk to the rights and freedoms of data subjects (Article 32 GDPR).

16.2. Information covered by the advocate’s professional secrecy is protected in a manner preventing unauthorised persons from becoming acquainted with it, and access to it is limited solely to persons performing activities connected with the provision of legal assistance, to the extent necessary for that purpose. These obligations follow from § 5 of the Regulations on the Practice of the Profession of Advocate and apply accordingly to the protection of personal data processed by an advocate in the practice of the profession.

16.3. Persons authorised to process personal data act on the basis of an authorisation and are bound to maintain confidentiality.

17. Changes to the Privacy Policy

17.1. The Firm may amend this Privacy Policy, in particular where the law changes or the operation of the Website changes.

17.2. The version in force is identified by the date indicated at the beginning of this document.

17.3. Previous versions of the Privacy Policy are retained by the Firm and made available on the request of a data subject.