Privacy Policy

PRIVACY POLICY OF THE LAW FIRM

JACEK KOSIŃSKI – ATTORNEYS AND LEGAL ADVISORS
Last updated: 8 September 2025

Confidentiality of data and protection of personal privacy are of the utmost importance to us. To ensure the security of your data and in compliance with applicable laws, JACEK KOSIŃSKI – ATTORNEYS AND LEGAL ADVISORS (hereinafter: the “Law Firm”) has established this policy, which sets out the rules governing the collection, processing and use of personal data. This document also applies to users of the website https://kosinskiadvisors.com. We want every visitor to our website or person who contacts us to understand their rights and how they can protect their privacy.

This Privacy Policy explains how we handle the data of our clients and contractors (“your data”), such as your name and contact details. It also sets out the procedures we follow to ensure the security and confidentiality of personal data.

Pursuant to the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: “GDPR”); the Polish Act of 10 May 2018 on the Protection of Personal Data (Journal of Laws 2019, item 1781 as amended); the Act of 18 July 2002 on the Provision of Electronic Services (Journal of Laws 2020, item 344 as amended); and the Act of 16 July 2004 – the Electronic Communications Law (Journal of Laws 2024, item 34), we inform you that we process your personal data as described below.

I. Data Controller

The controller of your personal data is JACEK KOSIŃSKI – ATTORNEYS AND LEGAL ADVISORS, a limited joint-stock partnership (Spółka Komandytowo–Akcyjna) with its registered office in Warsaw, address: Plac Stanisława Małachowskiego 2, 00-066 Warsaw, Poland.
For data protection matters, please contact: aziera@kosinskiadvisors.com.

The Controller ensures that the data collected:
(1) are processed lawfully;
(2) are collected for specified purposes and not further processed in a manner incompatible with those purposes;
(3) are accurate and adequate to the purposes for which they are processed;
(4) are stored in a form permitting identification of the data subjects for no longer than is necessary to achieve the purpose of processing; and
(5) are processed in a manner ensuring appropriate security, including protection against unauthorised or unlawful processing and accidental loss, destruction or damage.

II. Data Protection Representative

We have not appointed a Data Protection Officer, as we are not legally required to do so.
For any questions regarding the scope and purpose of data processing or your rights related to it, please contact our Data Protection Representative at aziera@kosinskiadvisors.com, or in writing to the Law Firm’s address indicated in Section I.

III. Personal Data We Process

“Personal data” means any information relating directly or indirectly to an identified or identifiable natural person. Examples include name, image, identification number, contact details, preferences, behaviour or IP address.

For newsletter subscriptions, we process your email address, date and time of subscription, IP address, and information regarding subscriber activity, such as email opens and link clicks. These data are used solely for statistical purposes and to optimise newsletter content.

We process personal data voluntarily provided by you in correspondence (including email), telephone calls, or direct contact, as well as data obtained in the course of our professional activities. We only process data necessary for specific purposes, in particular: name, surname, employer, job title, email address, postal address, telephone/fax number, residential address, tax ID (NIP), company ID (REGON), and national ID number (PESEL).

Providing data is voluntary but necessary for concluding a contract, providing legal services, sending a commercial offer, or receiving the newsletter.
If you have given your consent, it may be withdrawn at any time, but withdrawal does not affect the lawfulness of processing prior to withdrawal.
The Law Firm does not engage in automated decision-making or profiling based on your personal data.

IV. Purposes and Legal Bases of Processing

We process personal data for the following purposes:
a) to conclude a legal services agreement based on your interest in our offer (Article 6(1)(b) GDPR);
b) to perform a contract once concluded (Article 6(1)(b) GDPR);
c) to provide legal assistance based on your consent (Article 6(1)(a) GDPR);
d) for marketing and follow-up activities (newsletter) based on your consent (Article 6(1)(a) GDPR);
e) to promote and develop our services based on your consent (Article 6(1)(a) GDPR);
f) to directly offer services of our business partners based on your consent (Article 6(1)(a) GDPR, Article 10 of the Act on Electronic Services, and Article 172 of the Electronic Communications Law);
g) to establish, pursue or defend legal claims, which constitutes our legitimate interest (Article 6(1)(f) GDPR);
h) to recruit for positions at the Law Firm based on your consent (Article 6(1)(a) GDPR).

Additionally, data may be processed:

1. for analytical purposes (optimisation and service improvement – Article 6(1)(f) GDPR),
2. for archiving (evidence) purposes (Article 6(1)(f) GDPR),
3. to determine, pursue or defend claims (Article 6(1)(f) GDPR),
4. to survey client satisfaction (Article 6(1)(f) GDPR),
5. for website traffic statistics (processed in aggregate or anonymised form),
6. for the development and administration of IT systems.

V. Data Recipients

Personal data may be shared with third parties cooperating with the Law Firm for the purposes stated above, including:
a) payment service providers,
b) accounting service providers,
c) IT and infrastructure maintenance providers,
d) marketing service providers,
e) public authorities when required by law,
f) persons authorised by you,
g) email and newsletter system providers under data processing agreements.

VI. Data Transfers Outside the EEA

We currently do not transfer your data outside Poland / the EU / the EEA.
If this changes, you will be duly notified.
When using mailing or IT tools provided by entities based outside the EEA (e.g., in the United States), data are transferred in compliance with applicable laws, in particular under the European Commission’s adequacy decision or Standard Contractual Clauses (SCCs).
This applies in particular to Mailchimp, provided by The Rocket Science Group LLC (Atlanta, USA), which participates in the EU–US Data Privacy Framework, ensuring an adequate level of data protection under the European Commission’s decision of 10 July 2023. SCCs are also applied for any processing not covered by the adequacy decision.

VII. Data Retention Periods

Your data are stored only as long as necessary for the purposes for which they were collected, including the performance of agreements and resolution of claims.
Specifically:

1. Data collected to conclude an agreement are retained during negotiations and until the end of the calendar year following the last contact.
2. Data processed under a concluded contract are stored until the limitation period for potential claims expires.
3. Basic contact data for direct marketing are retained until consent is withdrawn.
4. Accounting data are retained for 5 years after the end of the financial year in which the transaction was completed or settled.
5. Newsletter and marketing data are retained until consent is withdrawn or an objection is raised.

Where legal proceedings are conducted, data are processed according to the time limits provided in:

1. the Law on the Bar of 26 May 1982, and
2. the Act on Legal Advisers of 6 July 1982.

VIII. Data Subject Rights

You have the following rights:

1. access to your data and obtain a copy (unless restricted by professional secrecy),
2. rectification of inaccurate data,
3. erasure of data (“right to be forgotten”), unless prohibited by professional secrecy,
4. restriction of processing,
5. objection to processing for direct marketing purposes at any time,
6. objection to processing based on legitimate interest (unless overriding grounds apply),
7. data portability (in a structured, commonly used machine-readable format, e.g., CSV),
8. lodging a complaint with the President of the Personal Data Protection Office (UODO):
   ul. Stawki 2, 00-193 Warsaw, Poland, tel. +48 22 531 03 00.

To exercise your rights, please contact us at aziera@kosinskiadvisors.com or by mail to the address indicated in Section I.

IX. Data Security

We process personal data securely, applying physical, technical and organisational safeguards. Only authorised personnel and partners have access to data necessary for the purposes specified in this Policy.
Personal data processed in connection with legal services are further protected by statutory professional secrecy. In certain cases, this may limit the scope of rights under the GDPR.

X. Cookies

Our website uses cookies and similar technologies. We use essential cookies (based on legitimate interest) and analytical and marketing cookies (based on user consent).
Analytical and marketing cookies may be provided by third parties such as Google Analytics, Facebook Pixel, or Mailchimp, used for analysing campaign effectiveness and improving site functionality.
Consent is obtained via a cookies banner displayed during the first visit and may be withdrawn at any time.
Detailed information on cookie use is available in the Cookies Policy published at:
https://kosinskiadvisors.com/polityka-plikow-cookies/

XI. Newsletter

The Law Firm sends newsletters only to individuals who have subscribed and given the required consents. Subscription follows a double opt-in model, meaning that after providing an email address, the user receives an activation email to confirm the subscription.
We use Mailchimp for newsletter management, which allows monitoring of open and click statistics. Such data are used solely to improve content quality and do not involve automated decision-making or profiling.

The legal basis for processing newsletter data is consent under Article 6(1)(a) GDPR. Additionally, the newsletter constitutes:
a) electronic commercial communication under Article 10 of the Act on Electronic Services, and
b) use of telecommunications end devices for direct marketing under Article 172 of the Electronic Communications Law.

Lack of consent prevents newsletter delivery. Consent may be withdrawn at any time using the “unsubscribe” link included in every message.

XII. Amendments to the Privacy Policy

We reserve the right to modify and update this Privacy Policy as necessary. The latest version will always be available at:
https://kosinskiadvisors.com

XIII. Contact

For more information about the processing of your personal data, please contact us at the email address provided in Section II.