- Privacy policy -

This Policy explains how KKZ processes the personal data of people who use the website, contact the Firm online, subscribe to the newsletter or visit our social media profiles.

Key information

– We use data provided in a message primarily to handle the enquiry and provide a response or proposal.
– We use cookies other than necessary cookies only with the user’s consent.
– Job applicants, KKZ Team Members and individuals involved in a client relationship may receive separate, more detailed privacy notices.

1. Who is responsible for your data?

The controller of personal data is Kancelaria Kopeć Zaborowski Adwokaci i Radcowie Prawni sp. p. (KKZ), with its registered office at ul. Hoża 59a, unit 1b, 00-681 Warsaw, Poland, NIP: 7010522123, KRS: 0000587324.

Contact for personal data protection matters: iod@kkz.com.pl

2. Who does this Policy apply to?

This Policy applies in particular to people who:

visit the website www.kkz.com.pl (Website);
contact KKZ through a form, email, telephone or other online channels;
subscribe to the newsletter or receive information about KKZ events;
visit KKZ social media profiles or interact with them.

Separate privacy notices appropriate to the relevant situation may apply to other processing activities, in particular recruitment, cooperation with KKZ Team Members and client services.

3. What data may we process?

The scope of data depends on how a person uses the Website or contacts KKZ. We may process in particular:

identification and contact data, such as name, email address, telephone number, organisation and position;
the content of messages, enquiries and forms, as well as documents or attachments provided to us;
newsletter-related data, such as an email address and information about consent being given or withdrawn;
technical data and online identifiers, such as an IP address, device and browser information, activity on the Website and cookie preferences;
data shared through social media, such as a profile name, comments, reactions, messages and other information made available through a platform.

We do not require data that is not necessary to handle the relevant matter or provide a Website function.

4. Why and on what legal basis do we process data?

A. Contact with the Firm

We process data to respond to a message, assess whether we can undertake the engagement, arrange a consultation, provide a proposal or take other steps requested by the person contacting KKZ.

Legal basis: Article 6(1)(b) GDPR where the contact is intended to lead to a contract, and Article 6(1)(f) GDPR – KKZ’s legitimate interest in conducting and documenting communications.

B. Newsletter and events

Where a user subscribes to the newsletter or gives consent to receive information, we process data to send legal updates, KKZ news and invitations to events, webinars or training sessions.

Legal basis: Article 6(1)(a) GDPR – consent, which may be withdrawn at any time.

C. Use of the Website and cookies

We process technical data required for the proper and secure operation of the Website. We use analytics, advertising and Personalisation cookies only with the user’s consent.

Legal basis: Article 6(1)(f) GDPR for the security and proper operation of the Website, and Article 6(1)(a) GDPR for cookies that require consent.

Further information is available in the Cookie Policy and in the consent management panel.

D. Social media

We maintain social media profiles, in particular on Facebook, LinkedIn and YouTube. We process data to manage the profiles, respond to messages and comments, provide information about KKZ, promote events and services, and analyse activity on the profiles.

Legal basis: Article 6(1)(f) GDPR – KKZ’s legitimate interest in communicating, promoting its activities and preparing statistics. Social media platforms also process data under their own terms and privacy rules.

E. Legal obligations and claims

We may process data to comply with legal obligations, demonstrate that our actions were performed correctly, and establish, pursue or defend claims.

Legal basis: Article 6(1)(c) GDPR – compliance with a legal obligation, and Article 6(1)(f) GDPR – KKZ’s legitimate interest in protecting its rights and establishing, pursuing or defending claims.

5. Where do we obtain data from?

We usually obtain data directly from the person concerned. We may also obtain it:

from a person or organisation contacting KKZ on the user’s behalf or identifying the user as a contact person;
from a social media platform when the user visits or interacts with a KKZ profile;
from publicly available sources where this is necessary to identify the sender, the organisation represented or assess whether we can undertake the engagement.

6. Who may receive the data?

Data may be accessed by authorised persons at KKZ and disclosed to entities supporting our activities, in particular:

providers of IT, hosting, email, form, newsletter and consent management services;
providers of analytics and advertising tools and social media platforms – in accordance with the user’s cookie choices;
advisers and other entities providing organisational or technical support to KKZ;
public authorities where disclosure is required by law.

Detailed and up-to-date information about cookie providers is available in the consent management panel.

7. May data be transferred outside the European Economic Area?

Some providers of tools used by KKZ may process data outside the European Economic Area. Where such a transfer takes place, it is based on mechanisms provided for under the GDPR, in particular an adequacy decision adopted by the European Commission or standard contractual clauses.

8. How long do we retain data?

We retain data no longer than necessary for the purpose for which it was collected. In particular:

data relating to a contact or enquiry – for the time required to handle the contact and then for the period necessary to establish, pursue or defend claims;
newsletter data – until consent is withdrawn or the subscription is cancelled; we may retain information about the withdrawal of consent for evidentiary purposes;
cookie-related data – for the periods specified in the consent management panel;
social media data – for as long as it remains available on the relevant platform or until it is deleted, subject to data required to protect rights or claims;
data subject to a legal retention requirement – for the period required by the applicable law.

9. Do you have to provide data?

Providing data is voluntary. Without the data required for contact, however, we may be unable to respond to a message, provide a proposal or send the requested information. Cookies other than necessary cookies are optional and disabled by default.

10. What rights do you have?

Depending on the legal basis and circumstances of the processing, you have the right to:

access your data;
rectify your data;
erase your data;
restrict processing;
data portability;
object to processing based on KKZ’s legitimate interests;
withdraw consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn. You may also lodge a complaint with the President of the Polish Personal Data Protection Office.

11. Do we make automated decisions?

KKZ does not make decisions concerning users based solely on automated processing that produce legal or similarly significant effects. External providers may use advertising and Personalisation cookies to create interest profiles and tailor content or advertisements. Further information is available in the Cookie Policy.

12. Current version of the Policy

We update this Policy when the tools we use, the operation of the Website or applicable law changes. The current version is available on the Website.

Last updated: 31 July 2026.