Privacy and data protection policy
1. Scope and version
This policy explains personal data use on cip.legal, when contacting Centrum Informacji Prawnej and when preparing or delivering services. It covers visitors, enquirers, clients, representatives and people mentioned in case documents. Service-specific information supplements it where additional explanations are needed. Version: 19 October 2026.
2. Controller and contact details
The controller is Centrum Informacji Prawnej spółka z ograniczoną odpowiedzialnością, ul. Zygmunta Słomińskiego 7/203, 00-195 Warsaw, Poland; KRS 0000667596; NIP 5252702537. UK office: 3 Craigmuir Court, Glasgow, G52 4HF, Scotland, United Kingdom. Service enquiries: kancelaria@cip.legal. Centrum Informacji Prawnej is part of Grupa Bodzinski.pl. Group membership does not itself create a shared client database, automatic disclosure to other companies or joint controllership.
3. Appointed Data Protection Officer
Our appointed Data Protection Officer is William Richard Bodziński. Contact: IOD@CIP.LEGAL, or write to the controller’s Polish address marked “Data Protection Officer”. You may contact the DPO about data use, your rights or concerns without becoming a client.
4. Applicable legislation
For processing subject to EU law, we apply Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR), and the Polish Act of 10 May 2018 on the Protection of Personal Data. Where UK law applies, the relevant framework is the UK GDPR and Data Protection Act 2018 as amended, including applicable changes under the Data (Use and Access) Act 2025. Applicability depends on the processing circumstances, not nationality alone.
5. Information and sources
Enquiries contain your email address, message, optional telephone number and information you choose to supply. An engagement may require identification, contact, representation, billing and payment details and relevant correspondence, agreements, decisions and family, financial or employment information. Technical connection data may include IP address, request time, requested resource, response status, browser information and a referring URL if transmitted. We may also receive relevant information from authorised representatives, clients supplying case files, instructed lawyers, courts, authorities and relevant public registers such as KRS or CEIDG. Where information is obtained indirectly, the case-specific notice identifies the actual source and categories, unless a statutory exception applies.
6. Purposes and lawful bases
Your requested pre-contract steps and your contract: Article 6(1)(b) GDPR or UK GDPR, only as necessary.
General enquiries, communication with client representatives and organisational correspondence: Article 6(1)(f), our legitimate interest in effective communication and managing professional relationships. Necessary third-party case information, conflict checks and establishing, exercising or defending specific legal claims may also rely on legitimate interests after assessing the individuals’ rights.
Tax, accounting and data protection duties: Article 6(1)(c) with the applicable law, including the Polish Accounting Act of 29 September 1994 and Tax Ordinance Act of 29 August 1997 where relevant.
Website delivery and security: Article 6(1)(f), maintaining availability, identifying faults, preventing misuse and investigating incidents.
Consent: Article 6(1)(a) only for a separately explained, genuinely optional purpose where requested. We select the relevant basis for each purpose; these are not interchangeable blanket permissions.
7. Sensitive information, criminal data and children
Family and benefit documents may contain health or other special-category information. In addition to Article 6, an applicable Article 9(2) condition is required, such as necessity for legal claims under paragraph (f) or, where appropriate, explicit consent under paragraph (a). Administrative help with a form does not automatically satisfy the legal claims condition. We assess additional Data Protection Act 2018 requirements where relevant. Criminal convictions and offence information is subject to Article 10 restrictions: a contract or ordinary consent is not universal permission. Before receiving such records we establish the permitted scope and whether an appropriately authorised lawyer must handle them. Children’s information is limited to the case’s needs and the representative’s authority is checked. Do not send identity scans, identity numbers, criminal records or medical files in an initial enquiry.
8. Contact form and required information
The form requires an email address and message; telephone is optional. It prepares a message in your email app. Centrum Informacji Prawnej receives it only when you send it from that app. The form does not transmit its contents to a separate ticket system or store them on the website server. Your email provider’s terms apply when using its service. Copying a message places it on your device clipboard at your request. The required checkbox acknowledges reading the notice; it is neither marketing consent nor the legal basis for handling the enquiry. You can also write directly by email or post. Information is generally voluntary, but without contact details we cannot reply and without essential case information we may be unable to provide a service. Contractual or statutory requirements and the consequences of not supplying information are explained when it is collected.
9. Recipients and cooperating law firms
Necessary access may be given to authorised case handlers; hosting, email and IT support providers; accounting, payment, delivery and translation providers; instructed advisers; courts, authorities and other participants where the case and law require disclosure. Suppliers processing on our instructions operate under processing arrangements; recipients determining their own purposes act as separate controllers. For reserved UK legal work we arrange referral to an appropriately authorised cooperating firm in agreement with the client. Before disclosure we explain its identity, role and the documents involved. Agreeing to a referral does not automatically make GDPR consent the basis for every disclosure. Data is limited to each recipient’s needs. Group companies do not receive files merely because they belong to Grupa Bodzinski.pl.
10. Poland, UK and international transfers
Cross-border matters may involve processing in Poland and the UK and disclosure to separate recipients there. EEA-to-UK transfers within the applicable adequacy decision rely on Article 45 GDPR and Commission Implementing Decision (EU) 2021/1772 as amended, including Decision (EU) 2025/2574. UK-to-EEA transfers may rely on applicable UK adequacy regulations. This does not authorise unrestricted onward transfers elsewhere. Other transfers require identification of the actual recipient, country and mechanism, such as applicable standard contractual clauses, a UK IDTA or Addendum, together with required assessments and supplementary measures. Ask the DPO for the mechanism applicable to a particular transfer and how to obtain a copy of safeguards; relevant details are provided before the transfer where required. We do not claim that all systems or backups are located exclusively in the EEA.
11. Retention criteria
Different information has different retention needs.
Unconverted enquiries: until the response and necessary follow-up are complete; further retention needs a separate justified reason, such as a documented dispute.
Case files: during the engagement and afterwards only to the extent needed for settlement, compulsory retention or legal claims, considering document type, applicable law, due dates, limitation periods and events affecting them.
Tax records: for statutory periods; Polish tax limitation is generally linked to five years from the end of the year in which payment was due, subject to interruption or suspension. Accounting records follow the period applicable to their category.
Rights requests and complaints: until resolved, then only as needed to demonstrate compliance or address a dispute.
Technical logs: as necessary for security and fault investigation, with relevant incident records preserved separately.
Consent-based data: until the purpose is met or consent withdrawn, unless another basis justifies retaining a limited record. Ask the DPO for the period or criteria applicable to your records. Unnecessary data is deleted or effectively anonymised; backups follow the relevant system’s overwrite cycle.
12. Cookies and website technology
The website code does not use advertising or analytics cookies, marketing pixels, advertising profiles, localStorage or sessionStorage. Language follows the page URL. Images, scripts and styles are served as website files; no embedded maps, videos or social widgets retrieve data from external platforms. Ordinary external links lead to other sites when opened. Hosting infrastructure may process connection logs and operate security mechanisms independently of the website code; these are not form contents. A private publishing-platform preview may additionally require platform-operated sign-in. New tools require prior assessment, updated information and any legally required device-storage or access consent before activation. Merely browsing is not such consent.
13. Your rights
Subject to statutory conditions, you can obtain confirmation, access and a copy of personal data (Article 15), correction or completion (Article 16), erasure (Article 17) and restriction (Article 18). Portability (Article 20) concerns information you supplied, processed automatically on consent or contract; it does not automatically cover every case document or our analysis. Consent may be withdrawn at any time as easily as it was given without affecting previous lawful processing. Rights may be limited by legal duties, others’ rights and properly applicable professional confidentiality, but are not excluded generally. If a request cannot be fully met, we explain the extent, grounds and remedies. Corresponding UK GDPR rights apply subject to applicable UK provisions.
14. Your right to object
You may object at any time, for reasons relating to your particular situation, to processing based on Article 6(1)(f) GDPR or UK GDPR. We will stop unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or grounds for establishing, exercising or defending legal claims. An objection to use for direct marketing, if applicable, is unconditional. Contact IOD@CIP.LEGAL or write by post. No special form is required.
15. Requests and response times
Describe your request to the DPO or at the company address and provide enough information to identify your matter. Identity documents are not required automatically; additional proportionate information may be requested where identity is reasonably in doubt. An authorised representative may act for you. We generally respond without undue delay and within one month. Complexity or the number of requests may justify an extension of up to two further months, notified with reasons within the initial period. UK calculations take account of applicable identity and clarification provisions. Requests are normally free; any charge or refusal requires an applicable legal ground and explanation. Legal wording or article numbers are not needed.
16. Concerns and complaints
Raise concerns at IOD@CIP.LEGAL or by post, explaining what happened and the response you seek. Supply only necessary evidence. For complaints within the UK statutory process, we acknowledge receipt within 30 days, investigate appropriately and communicate the outcome without undue delay. A complaint about the DPO may be addressed to the company’s management at its registered office; the person concerned should not decide it alone. You may complain to the President of Poland’s Personal Data Protection Office, ul. Stanisława Moniuszki 1A, 00-014 Warsaw, uodo.gov.pl, or another competent EEA supervisory authority, particularly where you usually live, work or the alleged infringement occurred. For UK matters, see the ICO complaints process. Contacting Centrum Informacji Prawnej does not remove access to courts or the competent regulator. The ICO website explains its current escalation procedure. Download the complaint form (.txt).
17. Security and automated decisions
Access is limited to work-related need. We agree document-transfer arrangements appropriate to sensitivity; the initial contact form is not intended for complete case files. Report suspected misdelivery or unauthorised access to the DPO without circulating the documents further. Safeguards cannot guarantee absolute security. The website does not make solely automated decisions producing legal or similarly significant effects on visitors and does not profile them. Website illustrations do not imply that client information is sent to image-generation tools. New tools used on case data require assessment and relevant information where purposes, recipients or processing arrangements change.
18. Updates and legislation
We update this policy and its version date when processing changes. Material changes affecting existing data are communicated as appropriate; changing a notice does not itself create a lawful basis. Sources: EU GDPR; Polish Act of 10 May 2018 on the Protection of Personal Data; UK GDPR; Data Protection Act 2018; Data (Use and Access) Act 2025. Ask the DPO how these arrangements apply to your case.