Privacy Policy

for the website www.viavox.pl

This Privacy Policy was published on 07 May 2025 and applies to all Users of the Website, including persons browsing the Website or using its functionalities, as well as users of our social media accounts (Facebook, Instagram and LinkedIn). The Policy also applies to persons using our services, including in connection with the Website, in the areas of recruitment and selection, temporary employment, secondment and consulting, as well as persons entering into other relationships with us, including business relationships (also as employees or representatives of third parties). The Policy also applies to persons contacting us by e-mail, telephone or through the forms made available by us.

We reserve the right to make changes to this Policy (more).

Table of contents

1. Who is responsible for your personal data?

2. How do we collect your data?

3. What happens to your data when:

A. you browse the Website www.viavox.pl

B. you apply as a candidate for employment – you register in our candidate database for future recruitment processes

C. you use the Apply form provided alongside published job advertisements

D. you contact us using the contact form or the “Write to us” form, by e-mail, telephone or otherwise

E. you click links to social media displayed on the Website

F. you use our social media accounts

4. How do we process your data when you are a representative, proxy or contact person of an entity with which we cooperate?

5. How do we process your data when it is necessary to establish or pursue potential claims or defend against claims?

6. How can you exercise your rights relating to the processing of personal data?

7. Personal data security

8. Changes to the Privacy Policy

Thank you for your interest in our Website. Protecting your privacy is very important to us. Below you will find detailed information regarding the purposes and scope of the processing of your personal data and the rights available to you.

Depending on how you use our Website or what kind of relationship you enter into with us, we may collect and process your personal data. Further details can be found in the individual sections of this Policy. These sections also explain what rights you have in connection with our processing of your personal data. To understand how you can exercise these rights in practice and what they involve, please refer to the section How can you exercise your rights relating to the processing of personal data?

1. Who is responsible for your personal data?

The data controller is: Via Vox BPO sp. z o.o., with its registered office in Warsaw (02-403), at ul. Pianistów 2, KRS: 0001001364; e-mail: viavox@viavox.pl, entered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, 12th Commercial Division, under KRS number 0001001364, NIP: 5252930913 (hereinafter also referred to as: ViaVox).

Contact with the Controller regarding personal data protection: The Controller has appointed a Data Protection Officer. The Data Protection Officer (DPO) is Marcin Pankau. In all matters relating to the processing of personal data by ViaVox, you may contact our Data Protection Officer by e-mail at: marcin.pankau@viavox.pl or by post to the address of our registered office, marked “Data Protection Officer”.

2. How do we collect your data?

Some data is collected when you provide it to us directly. This may include, for example, information provided in contact forms available on the Website or included in correspondence addressed to us (electronic or traditional mail).

Other data is collected automatically by our IT systems when you visit the Website or use its functionalities. Whenever the Website is accessed, the server automatically records only so-called server logs, such as the User’s IP address, date and time of transmission and browser type, and records access to the Website.

We may also collect your data when you visit our social media accounts – in such cases, we process information from your profile on the relevant platform, posts, comments and chat messages.

Your data is also collected through cookies used on the Website. You can read more about this in a separate document, our Cookie Policy.

3. What happens to your data when:

A. you browse the Website www.viavox.pl

Whenever the Website is accessed, the server automatically records only so-called server logs, such as the User’s IP address, date and time of transmission and browser type, and records access to the Website.

Your data is also collected through cookies used on the Website. You can read more about this in a separate document, our Cookie Policy.

On what legal basis do we process your data and for what purposes?

We process the data of persons using the Website (including IP addresses), to the extent necessary to provide access to the Website and its basic functionalities:

  • for the purpose of providing electronic services consisting in making the Website content and its basic functionalities available to Users – in this case, the legal basis for processing is that processing is necessary for the performance of a contract;
  • for the purpose of ensuring the security and proper functioning of the Website – on the basis of our legitimate interest consisting in ensuring the availability and security of the Website.

User activity on the Website, including personal data, is recorded in system logs (chronological records of events concerning the IT system). We process the information collected there in connection with the provision of the service (necessity for the performance of a contract) and for the purpose of ensuring IT security (the Controller’s legitimate interest). This data is not used to identify Users and is automatically deleted after 14 days.

With whom do we share your data – recipients of the data?

We share your data with:

  • subcontractors, i.e. entities whose services we use in connection with data processing and with whom we have concluded data processing agreements, including our hosting service provider, providers of IT solutions used by us, entities providing IT support services to us and entities supporting us in operating the Website and maintaining its functionality.

Do we transfer your data to a third country and on what basis?

We inform you that we do not transfer your data to a third country.

For how long do we process your personal data?

We process your personal data:

  • always for the period necessary to fulfil the purposes of the processing, provided that:
    • where the legal basis for processing is our legitimate interest – no longer than until an effective objection is raised;
    • in the case of data collected through cookies – depending on the specific cookie; further information can be found in the Cookie Policy.

Does the processing involve automated decision-making, including profiling?

Your personal data will not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

You have the right to access your data, request its rectification, erasure, restriction of processing and data portability.

You have the right to object at any time to the processing of your data where we process it on the basis of our legitimate interest. If you object and your objection is justified, we will cease processing your data for these purposes.

You have the right to lodge a complaint with a supervisory authority. A complaint may be lodged in the Member State of your habitual residence, place of work or place of the alleged infringement. More information on how to exercise your rights can be found here.

Providing data is voluntary. When you load our Website for browsing, we collect only the data necessary to display it (essential cookies) – without collecting such data, displaying the Website (providing the service) will not be possible. More information can be found in the Cookie Policy.

B. you apply as a candidate for employment – you register in our candidate database for future recruitment processes

If you use the “Contact a Recruiter” form available on the Website and give the consent displayed next to this form or elsewhere on the Website for your personal data contained in the form, CV and other submitted documents to be processed for a period of 24 months for the purpose of adding you to the candidate database, conducting recruitment processes, presenting job offers to you and presenting your candidacy to potential employers, user employers and entities commissioning Via Vox BPO sp. z o.o. or affiliated group companies to conduct recruitment processes, we process the data that you provide.

On what legal basis do we process your data and for what purposes?

Your data is processed:

  • for the purpose of adding your candidacy to our candidate database, conducting recruitment processes, presenting job offers to you and presenting your candidacy to potential employers, user employers and entities commissioning us to conduct recruitment processes – on the basis of your consent given by checking the checkbox and submitting the form. You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal;
  • for the purpose of transferring your personal data contained in the form, CV and other submitted documents to separate databases of affiliated group companies (a list of companies can be found here) so that those companies may add you to their candidate databases, conduct independent recruitment processes, present job offers to you and present your candidacy to potential employers, user employers and entities commissioning them to conduct recruitment processes – on the basis of your consent given by checking the checkbox and submitting the form. You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal;
  • for the purpose of responding to an enquiry submitted through the form – on the basis of our legitimate interest consisting in efficiently managing correspondence;
  • for the purpose of verifying your employment status with the entity to which we presented your candidacy and settling our service with that entity – we will obtain feedback from the potential employer regarding the result of the recruitment process, which is necessary for the proper settlement of the employment agency service provided by us to that entity, on the basis of our legitimate interest consisting in the need to verify the performance of the agreement concluded with that entity and determine the remuneration due to us.

More information on how to exercise your rights can be found here.

With whom do we share your data – recipients of the data?

Your data will be shared with subcontractors, i.e. entities whose services we use in connection with data processing and with whom we have concluded data processing agreements, including our hosting service provider, providers of IT solutions used by us, entities providing IT support services to us and the provider of a business application suite, including e-mail services.

In addition, your data may be shared with:

  • potential employers, user employers and entities commissioning Via Vox BPO sp. z o.o. to conduct recruitment processes;
  • affiliated group companies (a list of companies can be found here) – only if you have given the appropriate consent by checking the relevant checkbox. Once the data has been transferred, these companies become controllers of your data independent of us.

Do we transfer your data outside the European Economic Area and on what basis?

We inform you that we do not transfer your data to a third country.

For how long do we process your personal data?

  • always for the period necessary to fulfil the purposes of the processing, but no longer than until consent is withdrawn – for a maximum of 24 months from the date consent was given;
  • data obtained for the purpose of providing a response is processed for the period necessary to provide the response/clarify the matter or until you raise an effective objection to the processing;
  • data processed for the purpose of verifying your employment status with the entity to which we presented your candidacy and settling our service with that entity is processed until the verification is completed – for a maximum period of 3 years from the end of the relevant recruitment process (which results from the limitation periods applicable to financial claims related to conducting business activity).

Does the processing involve automated decision-making, including profiling?

Your personal data (including qualifications, professional experience and salary expectations) will be analysed by our recruiter in order to match your candidacy with the recruitment requirements of our Clients and select persons whose profiles best match the relevant job position. This process is carried out in a traditional (manual) manner, without the use of automatic matching algorithms.

At the same time, we inform you that no automated decision-making, including profiling, as referred to in Article 22(1) and (4)(4) of the GDPR, will be applied in your case. Every decision regarding qualifying you for the next stage of recruitment, presenting your candidacy to an employer or refusing your participation in the process is made individually by a human being.

Is providing data mandatory or voluntary?

Providing data is voluntary. Failure to provide the data will result in us being unable to contact you/respond to you or add you to the candidate database.

C. you use the Apply form provided alongside published job advertisements

If you use the “Apply Now” form available on the Website and apply for a specific job offer published on the Website, we process the data that you provide.

On what legal basis do we process your data and for what purposes?

Your data is processed:

  • for the purpose of conducting the current recruitment process – assessing your qualifications, skills and experience against the requirements specified in the job advertisement and presenting your candidacy to a potential employer/user employer – on the basis of your consent given by checking the checkbox and submitting the form. You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal;
  • for the purpose of verifying your employment status with the entity to which we presented your candidacy and settling our service with that entity – we will obtain feedback from the potential employer regarding the result of the recruitment process, which is necessary for the proper settlement of the employment agency service provided by us to that entity, on the basis of our legitimate interest consisting in the need to verify the performance of the agreement concluded with that entity and determine the remuneration due to us.

More information on how to exercise your rights can be found here.

With whom do we share your data – recipients of the data?

Your data will be shared with subcontractors, i.e. entities whose services we use in connection with data processing and with whom we have concluded data processing agreements, including our hosting service provider, providers of IT solutions used by us, entities providing IT support services to us and the provider of a business application suite, including e-mail services.

In addition, your data may be shared with:

  • the potential employer for whom the recruitment process is being conducted – the data will be disclosed each time only after prior contact with you and disclosure to you of the identity of that employer.

Do we transfer your data outside the European Economic Area and on what basis?

We inform you that we do not transfer your data to a third country.

For how long does the Controller process your personal data?

  • your data will be processed until the recruitment process is completed (the position is filled) – thereafter for no longer than 3 months or until you withdraw your consent;
  • data processed for the purpose of verifying your employment status with the entity to which we presented your candidacy and settling our service with that entity is processed until the verification is completed – for a maximum period of 3 years from the end of the relevant recruitment process (which results from the limitation periods applicable to financial claims related to conducting business activity).

Does the processing involve automated decision-making, including profiling?

Your personal data (including qualifications, professional experience and salary expectations) will be analysed by our recruiter in order to match your candidacy with the recruitment requirements of our Clients and select persons whose profiles best match the relevant job position. This process is carried out in a traditional (manual) manner, without the use of automatic matching algorithms.

At the same time, we inform you that no automated decision-making, including profiling, as referred to in Article 22(1) and (4)(4) of the GDPR, will be applied in your case. Every decision regarding qualifying you for the next stage of recruitment, presenting your candidacy to an employer or refusing your participation in the process is made individually by a human being.

Is providing data mandatory or voluntary?

Providing data is voluntary. Failure to provide the data will result in you being unable to participate in the recruitment process.

D. you contact us using the contact form or the “Write to us” form, by e-mail, telephone or otherwise

We process the data that you provide to us – usually your contact details such as your e-mail address and telephone number, as well as the content of your enquiry. We may also process your IP address.

On what legal basis do we process your data and for what purposes?

Your data is processed:

  • for the purpose of responding to an enquiry addressed to us. We process the data on the basis of our legitimate interest consisting in handling correspondence addressed to us in connection with our business activity.

With whom do we share your data – recipients of the data?

We share your data with:

  • subcontractors, i.e. entities whose services we use in connection with data processing and with whom we have concluded data processing agreements, including our hosting service provider, providers of IT solutions used by us, entities providing IT support services to us and the provider of a business application suite, including e-mail services.

Do we transfer your data outside the European Economic Area and on what basis?

We inform you that we do not transfer your data to a third country.

For how long do we process your personal data?

  • always for the period necessary to fulfil the purposes of the processing, but no longer than until an effective objection is raised.

You have the right to access your data, request its rectification, erasure and restriction of processing.

You have the right to object at any time to the processing of your data where we process it on the basis of our legitimate interest. If you object and your objection is justified, we will cease processing your data for these purposes.

You have the right to lodge a complaint with a supervisory authority. A complaint may be lodged in the Member State of your habitual residence, place of work or place of the alleged infringement. More information on how to exercise your rights can be found here.

Does the processing involve automated decision-making, including profiling?

The processing does not involve automated decision-making, including profiling.

Is providing data mandatory or voluntary?

To the extent that data is processed for the purpose of establishing contact or answering questions, providing the data is voluntary. Failure to provide the data will result in us being unable to establish contact/respond to your enquiry.

E. you click links to social media displayed on the Website

The Website contains icons linking to our official social media profiles. These are standard links (hyperlinks). Merely entering the Website and displaying these icons does not result in the automatic transmission of any personal data to the providers of those platforms. Only when you actively click a selected icon will you be redirected to our profile on the relevant social media platform. From the moment you access the external platform, you become its user, and the rules governing the processing and protection of your personal data are determined exclusively by the privacy policies of the respective providers.

We have included links on the Website to the following social media platforms:

These providers process your data for their own purposes (e.g. marketing, analytics, advertising profiling) as data controllers independent of us. Such processing may involve the transfer of your personal data to third countries (including the United States), under the rules and on the basis of the legal mechanisms specified in the privacy policies of those providers. We encourage you to read them before using the respective platforms:

F. you use our social media accounts

  1. We maintain accounts on Facebook, Instagram and LinkedIn and act as the administrator of these accounts.
  2. Your data as a person using our social media accounts is processed when:
  3. you subscribe to this content using a mechanism provided by the social media platform provider – for example by clicking “Like”, “Follow”, “Share” or “Subscribe”;
  4. you react in some way on the social media platform – for example by clicking “Like”, “Comment”, “Share”, “Save post”, “Repost”, etc.;
  5. you send us a private message using the “Send message” function or another function enabling such communication.
  6. Depending on the interaction you undertake on social media, we may process your first and last name, nickname, image, information available on your public profile and other information provided in messages or comments.
  7. At the same time, your data is administered by the providers of these platforms. These providers process your data for their own purposes, which are unknown to us, as data controllers independent of us. Such processing may result in your personal data being transferred to a third country under the rules specified in the privacy policies of those providers.
  8. For more information regarding the purpose and scope of data collection and processing by the platform providers, please refer to their data protection statements indicated below. These providers will provide further information regarding your rights in this respect and available settings for protecting your privacy.
  9. Facebook and Instagram – the provider is Meta Platforms Ireland Limited., Merrion Road, Dublin 4, DO4 X2K5 Ireland. Information on data processing can be found at: https://www.facebook.com/privacy/policy/?locale=pl_PL or https://help.instagram.com/196883487377501/?helpref=hc_fnav&locale=pl_PL;
  10. LinkedIn – the provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. Information on data processing can be found at: https://pl.linkedin.com/legal/privacy-policy
  11. As the operators of Facebook and Instagram accounts, we jointly control personal data with Meta Platforms Ireland Limited., Merrion Road, Dublin 4, DO4 X2K5 Ireland, the provider of these platforms.

As administrators of our Facebook and Instagram social media accounts, we have access to aggregated statistics (number of fanpage/profile followers, age and gender of users with percentage breakdown among followers, cities and countries from which users follow us with percentage breakdown, reach of the fanpage/profile and individual posts, number of likes and reactions, number of comments and shares, number of link clicks and aggregated and anonymised reports regarding campaigns conducted using the self-service advertising system). We process this data jointly with Meta Platforms Ireland Limited. Details regarding the principles of joint processing of statistics with Meta Platforms Ireland Limited are available at: https://pl-pl.facebook.com/legal/terms/page_controller_addendum (where this document refers to the User, it means us, i.e. Via Vox BPO sp. z o.o.). In connection with joint controllership, you are entitled to exercise your rights against each of the Joint Controllers, by writing to Via Vox BPO sp. z o.o., ul. Pianistów 2, 02-403 Warsaw, e-mail: viavox@viavox.pl, or Meta Platforms Ireland Limited., Merrion Road, Dublin 4, DO4 X2K5 Ireland, contact form:

  • Facebook can be found in your account – go to “Help and Support” in your account settings and then select “Report a Problem” or “Contact”;
  • Instagram can be found in the application under Settings -> Help -> Report a Problem or Help Centre.

The remaining rules for processing personal data established by the Facebook and Instagram provider can be found in their Privacy Policies: https://www.facebook.com/privacy/policy/?locale=pl_PL or https://help.instagram.com/196883487377501/?helpref=hc_fnav&locale=pl_PL.

For what purposes do we process your personal data?

We process your data as a user of our social media accounts for the purpose of:

  • operating and managing these accounts under the terms and conditions established by the providers of the respective social media platforms, informing users about our activities, promoting events organised by us, our brand and services, building and maintaining a community associated with us, communicating using the functionalities available on the platforms (comments, chat, messages), and ensuring order and security of discussions on these profiles, including removing comments that violate the law, accepted standards of conduct or the rules of a given social media platform;
  • marketing and promoting our services;
  • ongoing profile management and optimisation of published content (by monitoring the overall number of interactions such as likes, comments or shares) – on the basis of our legitimate interest consisting in building our brand image, promoting our business and interacting with platform users.

What is the legal basis for the processing?

We process your personal data on our profiles on the basis of our legitimate interest (Article 6(1)(f) GDPR), consisting, among other things, in:

  • ensuring order and security on our profiles by moderating posts and comments made by users of our profiles;
  • building positive relationships with users of our profiles, in particular by corresponding with them and organising competitions;
  • marketing our products and services;
  • analysing the activity of users of our profiles in order to adapt the content published there to their needs as effectively as possible.

In the case of competitions, if you are the winner of a particular competition, we will also process your personal data for the purpose of fulfilling our tax obligations related to the settlement of the prize (Article 6(1)(c) GDPR).

With whom do we share your data – recipients of the data?

We share your data with:

Do we transfer your data to a third country and on what basis?

As ViaVox, we do not directly transfer your data outside the European Economic Area (EEA). However, the providers of Facebook, Instagram and LinkedIn may make such transfers. More information:

For how long do we process your personal data?

Personal data will be processed for the period related to the fulfilment of the processing purposes indicated above, i.e.:

  • information contained in posted comments will remain available on the platform until deleted by the author;
  • statistical data concerning persons visiting social media accounts will be processed for as long as such data is available on the platforms;
  • in the case of marketing our products and services – until you object to the use of your data for this purpose, but no longer than for the period during which you follow us;
  • in the case of activity analysis – until you object to the use of your data for this purpose and we determine that your objection is justified, but no longer than for the period during which you follow us;
  • where it is necessary to maintain order on our profiles – until you object to the use of your data for this purpose and we determine that your objection is justified, but no longer than for the period during which you follow us;
  • in the case of competitions – for the duration of the competition and subsequently in accordance with the rules of the relevant competition.

Personal data collected by social media platform providers is subject to retention in accordance with their respective terms and conditions:

Does the processing involve automated decision-making, including profiling?

We currently do not use automated decision-making, including profiling, in relation to your data where such decision-making produces legal effects concerning you or similarly significantly affects you. However, the providers of Facebook, Instagram and LinkedIn may carry out such processing. More information:

What rights do you have?

You have the right to access your data, request its rectification, erasure and restriction of processing.

You have the right to object to the processing of data:

a) for direct marketing purposes – you may object at any time to the processing of your personal data for such marketing, including profiling to the extent that the processing is related to such direct marketing, without having to provide any justification for your objection;

b) for other processing purposes – you may object at any time, on grounds relating to your particular situation, to the processing of personal data carried out on the basis of our legitimate interest, including profiling. An objection in this respect should include justification.

You have the right to lodge a complaint with a supervisory authority. A complaint may be lodged in the Member State of your habitual residence, place of work or place of the alleged infringement. More information on how to exercise your rights can be found here.

The rights available to you in relation to the use of social media platforms against their providers are described in their respective privacy policies:

Is providing data mandatory or voluntary?

Providing data is entirely voluntary, and failure to provide it will result in you being unable to use these accounts and the content published on them.

Due to the specific nature of the above-mentioned social media platforms, information concerning actions taken by users on those platforms is public.

We obtain personal data from the administrators of social media platforms, from your public profile and from posts on those social media platforms.

4. How do we process your data when you are a representative, proxy or contact person of an entity with which we cooperate?

In this case, we process the following categories of your personal data: first name, last name, business contact details, position/function and other business personal data provided at the stage of concluding and performing the Agreement.

We obtain your data from you or from the entity of which you are a representative, proxy or contact person.

We process your data for the following purposes and on the following legal bases:

  • for the purpose of cooperating with the entity you represent, including concluding and performing an Agreement with that entity – on the basis of our legitimate interest consisting in ensuring the legal security of our business activity, including ensuring the possibility of concluding and performing the provisions of the Agreement, settling the Agreement, maintaining contact in connection with the performance and implementation of the Agreement, and correctly identifying persons authorised to represent and incur obligations on behalf of the entity you represent;
  • for the purpose of fulfilling legal obligations imposed on us in connection with our business activity and performance of the aforementioned Agreement – on the basis of applicable law, e.g. for the purpose of demonstrating the legal effectiveness of the concluded Agreement or recording revenue (tax law).

Your data is shared with the following categories of entities:

  1. entities and persons to whom data must be disclosed under the aforementioned Agreement, i.e. where the purpose of the cooperation or Agreement cannot be achieved without disclosing data to those recipients;
  2. subcontractors – entities whose assistance we use in processing your data and with whom we have concluded data processing agreements, e.g. our hosting service provider, entities providing IT support services to us and other subcontractors involved in the performance of the aforementioned Agreement;
  3. other entities that support our business activity with their services and which, due to the services provided to us, remain data controllers independent of us, e.g. advocates, legal advisers and auditors.

Do we transfer your data outside the European Economic Area and on what basis?

We inform you that we do not transfer your data to a third country.

For how long do we process your personal data?

  1. data obtained in connection with concluding and performing the aforementioned Agreement is processed until performance of the Agreement and its settlement are completed, and thereafter for the period required by law;
  2. data processed for the purpose of fulfilling legal obligations imposed on us in connection with our business activity and performance of the aforementioned Agreement is processed until those obligations have been fulfilled and thereafter for the period during which applicable regulations require us to retain your data or during which we may face legal consequences for failure to fulfil our obligations;
  3. data processed on the basis of our legitimate interest ceases to be processed when you object to such processing, unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of claims (this does not apply to objections to processing for direct marketing purposes).

You have the right to access the content of the data being processed and obtain a copy thereof, the right to rectify (correct) data, the right to erase data and the right to restrict data processing.

You have the right to object at any time to the processing of your data, including profiling, where we process your data on the basis of our legitimate interest. If you object and your objection is justified, we will cease processing your data for these purposes.

You have the right to lodge a complaint with a supervisory authority. A complaint may be lodged in the Member State of your habitual residence, place of work or place of the alleged infringement.

Does the processing involve automated decision-making, including profiling?

The processing does not involve automated decision-making, including profiling.

More information on how to exercise your rights can be found here.

Is providing data mandatory or voluntary?

To the extent that data is processed for the purpose of concluding and performing the aforementioned Agreement, providing the data is a condition for concluding and performing the Agreement. Providing the data is voluntary; however, failure to provide it will make it impossible to conclude or perform the Agreement.

5. How do we process your data when it is necessary to establish or pursue potential claims or defend against claims?

In some cases, we may change the original purpose for which your data is processed, and we will inform you about this. The purpose of processing your data may change where it becomes necessary to establish or pursue potential claims or defend against claims. This applies to court proceedings, enforcement proceedings and out-of-court proceedings.

On what legal basis do we process your data and for what purposes?

We process your data for the purpose of establishing, pursuing or defending against claims on the basis of our legitimate interest consisting in the legal and financial protection of our business activity.

With whom do we share your data – recipients of the data?

We share your data with subcontractors – entities whose services we use in processing data and with whom we have concluded data processing agreements, e.g. our hosting service provider, office software provider, including e-mail services, entities providing IT support services and administrative services to us.

We may share personal data with data controllers independent of us, such as advocates, legal advisers, auditors or others who support us in conducting our business activity.

Do we transfer your data outside the European Economic Area and on what basis?

We inform you that we do not transfer your data to a third country.

For how long do we process your personal data?

  • always for the period necessary to fulfil the purposes of the processing – data processed for the purpose of establishing, pursuing or defending against claims will be processed for the limitation period applicable to such claims under generally applicable law (as a rule, for a maximum period of 3 years from the occurrence of the event), and where court or enforcement proceedings are initiated – until their final and binding completion and final settlement.

You have the right to access your data, request its rectification, erasure and restriction of processing.

You have the right to object at any time to the processing of your data, including profiling, where we process your data on the basis of our legitimate interest. If you object and your objection is justified, we will cease processing your data for these purposes.

You have the right to lodge a complaint with a supervisory authority. A complaint may be lodged in the Member State of your habitual residence, place of work or place of the alleged infringement. More information on how to exercise your rights can be found here.

The processing does not involve automated decision-making, including profiling.

Is providing data mandatory or voluntary?

To the extent that data is processed for the purpose of establishing or pursuing claims or defending against them, providing the data is voluntary. Failure to provide it will mean that we will not receive such data from you, including that we may be unable to take your arguments or requests into account in the course of an amicable resolution of the dispute.

6. How can you exercise your rights relating to the processing of personal data? Every data subject has the right to submit a request to us in order to exercise their rights, which may include:

A. the right of access to data;

B. the right to rectification of data;

C. the right to erasure of data (“right to be forgotten”);

D. the right to restriction of processing;

E. the right to data portability – this right applies only where the processing is based on your consent or a contract and the data itself is processed by automated means;

F. the right to object to the processing of personal data:

a) objection to processing for direct marketing purposes – you may object at any time to the processing of your personal data for such marketing, including profiling to the extent that the processing is related to such direct marketing, without having to justify your objection;

b) the right to object to other purposes of processing – you may object at any time, on grounds relating to your particular situation, to the processing of personal data based on our legitimate interest, including profiling. An objection in this respect should include justification;

G. the right not to be subject to a decision (including profiling) based solely on automated processing which produces legal effects concerning you or similarly significantly affects you – you may object to such processing at any time;

H. the right to withdraw consent (where processing is based on consent) – this right may be exercised at any time. Withdrawal of consent will not affect the lawfulness of processing carried out on the basis of consent before its withdrawal;

I. the right to lodge a complaint with a supervisory authority responsible for personal data protection – a complaint may be lodged in the Member State of your habitual residence, place of work or place of the alleged infringement.

  • We exercise due care when considering requests from data subjects, taking into account applicable law as well as the rights and freedoms of other data subjects.
  • When submitting your request, you should provide data that will allow us to identify you unequivocally.
  • We will not refuse to act on a request from a data subject wishing to exercise their rights unless we are unable to identify the data subject unequivocally.
  • We will provide information on actions taken in response to a request without undue delay and, in any event, within one month of receiving the request. Where necessary, we may extend this period by a further two months, taking into account the complexity and number of requests. Within one month of receiving the request, we will inform you of such an extension and the reasons for the delay.
  • If we receive a request electronically, we will also respond electronically where possible, unless your request indicates otherwise.
  • If we do not take action on your request, we will promptly, and no later than within one month of receiving the request, inform you of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
  • Communication and actions taken in connection with the exercise of your rights are generally free of charge. However, where requests are manifestly unfounded or excessive, in particular because of their repetitive nature, we may:
  • charge a reasonable fee, taking into account the administrative costs of providing information, conducting communication or taking the requested action; or
  • refuse to act on the request.
  • If we are unable to identify you unequivocally or have reasonable doubts concerning your identity, we may request additional information necessary to confirm your identity. If you fail to provide the additional information within 30 days from the date of receiving the request and it remains impossible to identify you unequivocally, the request will be rejected. You will be informed of the deadline for providing the additional data and the consequences of failing to do so.
  • We inform every recipient to whom we have disclosed your personal data of any rectification, completion, erasure or restriction of processing of such data, unless this proves impossible or involves disproportionate effort.

7. Personal data security

We continuously conduct risk analyses to ensure that personal data is processed by us securely – in particular, to ensure that access to the data is granted only to authorised persons and only to the extent necessary for the performance of their duties. We ensure that all operations involving personal data are recorded and carried out only by authorised employees and associates.

We take all necessary measures to ensure that our subcontractors and other entities cooperating with us also guarantee the application of appropriate security measures whenever they process personal data on our behalf.

8. Changes to the Privacy Policy

We reserve the right to make changes to this Policy. Such changes may result from the need to adapt the document to changes in applicable law or privacy standards or from an expansion of our range of services. We will inform you of any material changes by means of a clearly visible notice on the Website. The notice will clearly explain the content of the changes and their consequences for your data. The effective date of each change will be determined so that the notice is displayed sufficiently in advance. This will give you time to familiarise yourself with the new content and assess the impact of the changes on the processing of your data. The timeframe will take into account your ability to freely exercise the rights available to you under the GDPR (e.g. withdrawing consent or objecting to processing). At the end of the document, you will always find information on the date of its most recent update.