JDP DRAPAŁA & PARTNERS Sp. j. (hereinafter: “JDP”) with its registered office in Warsaw, ul. Bonifraterska 17 (00-203), is the data controller. Personal data collected by JDP are processed in accordance with the principles set out in the provisions on the protection of personal data, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”), and in the Polish provisions issued in connection with the GDPR, including the Personal Data Protection Act of 10 May 2018 (Journal of Laws of 2018, item 1000, as amended). JDP keeps personal data confidential and protects them against unauthorised access by third parties in accordance with the rules set out in the above-mentioned legal instruments.
JDP processes personal data of counterparties (including clients) and business contacts to the extent and for the purpose of establishing and maintaining business relationships (including by sending own marketing materials), performing contracts between the parties, in particular with regard to the provision of legal assistance, as well as complying with the controller’s statutory obligations.
Grounds for data processing
JDP processes personal data:
As a rule, the processing of personal data of the Firm’s counterparties is based on the performance of binding contracts between the parties or on the need for JDP to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) of the GDPR). The processing of personal data of attorneys-in-fact and employees of JDP’s counterparties is based on the legitimate interest of JDP or that counterparty (Article 6(1)(f) of the GDPR), which consists in enabling the contracting process and subsequent performance of a contract.
Categories of processed personal data
JDP specifically processes the following categories of personal data:
JDP may also process other categories of personal data where this is necessary for the fulfilment of a specific purpose of the processing of personal data and in accordance with the applicable data protection legislation.
For the purpose of personal data processing JDP does not collect copies of ID cards or other ID documents (e.g. driving licence) containing personal data in any form, unless this is adequate for the purposes for which the data are processed or permitted under applicable law.
Processing of special personal data
JDP may process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, as well as genetic, biometric data to identify a natural person and data concerning health, sex life or sexual orientation of that person, as well as data concerning criminal convictions and offences or related security measures, only in the cases expressly provided for in Articles 9 and 10 of the GDPR or other specific provisions of law.
Data subjects’ rights
Any person whose personal data are processed by JDP has the right to control the processing of his/her personal data, and in particular the right:
Persons whose data JDP processes on the basis of the controller’s legitimate interest have the right to object to the processing of their personal data.
At the data subject’s request, JDP is required, within a maximum of 30 days after receipt of the request, to provide the information referred to above in a generally intelligible form.
In addition, the data subject has the right to lodge a complaint regarding the processing of personal data by JDP with the President of the Office for the Protection of Personal Data.
Data transfers to third parties
JDP may share personal data with other entities where it has the data subject’s consent. In addition, JDP may share personal data on any other ground provided for in the GDPR provisions which renders such disclosure admissible and lawful, in particular where the disclosure of personal data to another entity is necessary for the purpose of performing a contract to which the data subject is a party.
If you have any questions regarding data processing, please do not hesitate to contact JDP at: firstname.lastname@example.org.