PL  |   EN  |   DE
Search results
PL EN DE

Privacy policy / Information clause

PRIVACY POLICY

JDP DRAPAŁA & PARTNERS Sp. j. (hereinafter: “JDP”) with its registered office in Warsaw, ul. Bonifraterska 17 (00-203), is the data controller. Personal data collected by JDP are processed in accordance with the principles set out in the provisions on the protection of personal data, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”), and in the Polish provisions issued in connection with the GDPR, including the Personal Data Protection Act of 10 May 2018 (Journal of Laws of 2018, item 1000, as amended). JDP keeps personal data confidential and protects them against unauthorised access by third parties in accordance with the rules set out in the above-mentioned legal instruments.

JDP processes personal data of counterparties (including clients) and business contacts to the extent and for the purpose of establishing and maintaining business relationships (including by sending own marketing materials), performing contracts between the parties, in particular with regard to the provision of legal assistance, as well as complying with the controller’s statutory obligations.

Grounds for data processing

JDP processes personal data:

  1. on the basis of the data subject’s consent,
  2. where processing is necessary for the performance of a contract entered into by JDP and the data subject or in order to take steps at the request of the data subject prior to entering into a contract,
  3. where processing is necessary for compliance with a legal obligation to which JDP, as the controller, is subject,
  4. where processing is necessary in order to protect the vital interests of the data subject or of another natural person,
  5. where processing is necessary for the purposes of the legitimate interests pursued by JDP or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

As a rule, the processing of personal data of the Firm’s counterparties is based on the performance of binding contracts between the parties or on the need for JDP to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) of the GDPR). The processing of personal data of attorneys-in-fact and employees of JDP’s counterparties is based on the legitimate interest of JDP or that counterparty (Article 6(1)(f) of the GDPR), which consists in enabling the contracting process and subsequent performance of a contract.

Categories of processed personal data

JDP specifically processes the following categories of personal data:

  1. forename(s) and surname,
  2. address,
  3. phone number,
  4. email address,
  5. PESEL (Personal Identification Number),
  6. business name,
  7. NIP (Taxpayer’s Identification Number),
  8. REGON (Statistical Identification Number),
  9. bank account number.

JDP may also process other categories of personal data where this is necessary for the fulfilment of a specific purpose of the processing of personal data and in accordance with the applicable data protection legislation.

For the purpose of personal data processing JDP does not collect copies of ID cards or other ID documents (e.g. driving licence) containing personal data in any form, unless this is adequate for the purposes for which the data are processed or permitted under applicable law.

Processing of special personal data

JDP may process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, as well as genetic, biometric data to identify a natural person and data concerning health, sex life or sexual orientation of that person, as well as data concerning criminal convictions and offences or related security measures, only in the cases expressly provided for in Articles 9 and 10 of the GDPR or other specific provisions of law.

Data subjects’ rights

Any person whose personal data are processed by JDP has the right to control the processing of his/her personal data, and in particular the right:

  1. to obtain comprehensive information on whether his/her personal data are being processed and to be informed about the full name and registered office address of the firm,
  2. to be informed about the purpose, scope, method and categories of personal data processed,
  3. to be informed since when his/her personal data have been processed and to be provided with the content of such data in a generally intelligible form,
  4. to be informed about the source of personal data concerning him/her,
  5. to be informed about the manner in which personal data are disclosed, and in particular about recipients or categories of recipients to whom the personal data are disclosed,
  6. to request that personal data be supplemented, updated, rectified, that their processing be temporarily or permanently suspended or that they be erased if they are incomplete, outdated, inaccurate or have been collected in breach of the personal data protection legislation or are no longer necessary for the purpose for which they were collected.

Persons whose data JDP processes on the basis of the controller’s legitimate interest have the right to object to the processing of their personal data.

At the data subject’s request, JDP is required, within a maximum of 30 days after receipt of the request, to provide the information referred to above in a generally intelligible form.

In addition, the data subject has the right to lodge a complaint regarding the processing of personal data by JDP with the President of the Office for the Protection of Personal Data.

Data transfers to third parties

JDP may share personal data with other entities where it has the data subject’s consent. In addition, JDP may share personal data on any other ground provided for in the GDPR provisions which renders such disclosure admissible and lawful, in particular where the disclosure of personal data to another entity is necessary for the purpose of performing a contract to which the data subject is a party.

Contact

If you have any questions regarding data processing, please do not hesitate to contact JDP at: office@jdp-law.pl.

Download PDF