Privacy Policy
Introduction
Below we describe how we process the personal data of people who use the atlanticlawyers.pl website and who contact the firm. This document has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR).
Once you have given consent, a Google Ads tag runs on the website (section 8.3). Information on how Google uses data from sites that use its services is available at business.safety.google/privacy.
Last updated: 1 November 2026.
1. Data controller
The controller of your personal data is Kancelaria Adwokacka ATLANTIC LAWYERS Piotr Śliwiński, with its registered office at ul. Wilcza 29a lok. 7, 00-544 Warsaw, Poland, NIP (Polish tax identification number) 7742958825, REGON (Polish statistical number) 368473928.
Contact for matters concerning personal data:
- email: kancelaria@atlanticlawyers.pl
- phone: +48 518 999 476
- postal address: ul. Wilcza 29a lok. 7, 00-544 Warsaw, Poland
The firm is operated as a sole proprietorship. The entity named above is the controller of your personal data to the extent described in this policy; for Google Ads, Google acts as an independent controller (section 5.2). There is no joint controllership within the meaning of Article 26 GDPR.
The firm has not appointed a data protection officer - the obligation referred to in Article 37 GDPR does not apply to the firm.
2. What data we process
2.1. Data from the contact form
The contact form comprises the following fields:
- full name (required),
- phone number (required),
- email address (required),
- what your matter concerns (optional, free text entered by you),
- description of the matter (required, free text).
In the form, we ask you not to send documents or third-party personal data. A corresponding notice appears directly next to the “Description of your matter” field.
2.2. Special category data (Article 9 GDPR)
Given the nature of the matters the firm handles, the description of your matter may contain special category data within the meaning of Article 9(1) GDPR - in particular data concerning health, sex life or sexual orientation, religious or philosophical beliefs, or trade union membership, as well as data relating to criminal convictions and offenses within the meaning of Article 10 GDPR.
We ask that you provide in the form only the information necessary for an initial assessment of your matter. We discuss the details during the consultation, under the protection of advocate-client privilege (tajemnica adwokacka).
2.3. Technical data
In connection with your use of the website, technical data is processed: your IP address, information about your browser and device, the date and time of the request, and the address of the page you came from. This data is processed by our hosting and content-delivery network provider in order to ensure the availability and security of the service.
Advertising data (Google Ads) is processed only once you have given consent in the consent banner. Details are in section 8.
2.4. Correspondence
We process data contained in electronic correspondence and in telephone calls with the firm, to the extent necessary to respond to you and handle your matter. The firm does not record telephone calls.
3. Purposes and legal bases for processing
| Purpose | Legal basis | Notes |
|---|---|---|
| Responding to an inquiry and taking steps prior to entering into an agreement for legal services | Article 6(1)(b) GDPR | Applies where the contact is intended to lead to an agreement |
| Handling inquiries not intended to lead to an agreement, and ongoing communication | Article 6(1)(f) GDPR - the controller’s legitimate interest in responding to a person who has contacted us | - |
| Processing special category data contained in the description of a matter | Article 9(2)(f) GDPR - necessity for the establishment, exercise or defense of legal claims | This basis is sufficient at the pre-contractual stage as well; the firm does not collect explicit consent for this purpose |
| Processing data relating to criminal convictions and offenses | Article 10 GDPR in conjunction with Article 4(1), read together with Article 1(1) and (3), of the Act of 26 May 1982 - Law on the Bar (Prawo o adwokaturze) | Processing in the course of practicing as an advocate |
| Measurement of advertising performance (Google Ads) | Article 6(1)(a) GDPR - consent | Given in the consent banner, revocable at any time |
| Ensuring the security and availability of the website, and preventing misuse | Article 6(1)(f) GDPR - the controller’s legitimate interest | - |
| Establishment, exercise or defense of legal claims | Article 6(1)(f) GDPR - the controller’s legitimate interest | Includes keeping data after the matter has ended (section 6) |
| Compliance with legal obligations to which the controller is subject | Article 6(1)(c) GDPR | Accounting and tax obligations |
The processing of the data you provide in the contact form is not based on your consent, and the form therefore contains no consent checkbox. The processing is necessary in order to take steps at your request prior to entering into an agreement for legal services (Article 6(1)(b) GDPR) and, beyond that, relies on the controller’s legitimate interest (Article 6(1)(f) GDPR). Consent is collected only in respect of the Google Ads tag and cookies - see section 8.
4. Advocate-client privilege
Data provided to the firm in connection with the provision of legal assistance is covered by advocate-client privilege (tajemnica adwokacka) under Article 6 of the Act of 26 May 1982 - Law on the Bar (Prawo o adwokaturze). The duty of confidentiality is absolute in character and limits the exercise of certain rights under the GDPR to the extent provided by law.
Limitation of the data subject’s rights
To the extent that the personal data processed by the Controller is covered by advocate-client privilege (tajemnica adwokacka), the exercise of the data subject’s rights is subject to the limitations arising from the special provisions governing the practice of the profession of advocate.
Under Article 6 of the Act of 26 May 1982 - Law on the Bar (Prawo o adwokaturze), an advocate is obliged to keep secret everything he or she has learned in connection with the provision of legal assistance, and the duty of professional secrecy is not limited in time.
At the same time, under Article 16a(1) of the Law on the Bar, Articles 15(1) and (3), 18 and 19 GDPR apply to the processing of data by an advocate only to the extent that they do not infringe the duty to maintain advocate-client privilege. Article 21(1) GDPR likewise does not apply to personal data obtained by an advocate in connection with the provision of legal assistance (Article 16a(2) of the Law on the Bar).
Consequently, where compliance with a data subject’s request would lead to the disclosure of information covered by advocate-client privilege, the Controller may refuse to comply with that request or restrict compliance to the extent necessary to preserve that privilege. Any such limitation should not go beyond what is necessary to protect advocate-client privilege.
Where a right is refused or its exercise restricted, the Controller will inform the data subject of the reasons for doing so, having regard to the limitations arising from the duty to maintain advocate-client privilege.
The legal basis for limiting rights in this respect is, in particular, Article 16a of the Law on the Bar (Prawo o adwokaturze) in conjunction with Article 6 of that Act, together with the relevant provisions of the GDPR. Article 5 of the Act of 10 May 2018 on the Protection of Personal Data (ustawa o ochronie danych osobowych) does not constitute a basis for that limitation where the processing takes place in the course of practicing as an advocate and is covered by the special regime of the Law on the Bar.
5. Recipients of data and processors
Your data may be entrusted to the following processors, solely to the extent necessary for the provision of services to the firm and on the basis of data processing agreements concluded in accordance with Article 28 GDPR, subject to Google’s separate status for Google Ads described in section 5.2:
5.1. Cloudflare - hosting and content delivery network
The website is hosted on Cloudflare’s infrastructure. The provider processes the technical data described in section 2.3 and acts as an intermediary in transmitting the contents of the contact form.
- Entity: Cloudflare, Inc., established in the United States.
- Transfers of data outside the European Economic Area take place on the basis of the EU-U.S. Data Privacy Framework and standard contractual clauses.
5.2. Google Ireland Limited - email and advertising
The firm uses Google Workspace services (email, calendar, online meetings) and Google Ads. The Google Ads tag runs on the website only once you have given consent.
- Entity: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
- Messages sent through the contact form are delivered to the firm’s mailbox, hosted on Google Workspace.
- For Google Ads, Google acts as an independent controller, not as a processor. Google describes how it processes data at business.safety.google/privacy and policies.google.com/privacy.
- Transfer of data outside the European Economic Area: data may be transferred to Google LLC in the United States on the basis of the EU-U.S. Data Privacy Framework and standard contractual clauses.
5.3. Other recipients
Data may be disclosed to entities authorized under law, including courts, law enforcement bodies and administrative authorities - to the extent and on the terms resulting from applicable law, with due regard to advocate-client privilege. Recipients also include the categories of providers the firm engages: an external accounting office and an external IT service provider.
The firm does not sell personal data. Nor does it disclose personal data to third parties for marketing purposes, except for the measurement of advertising performance in Google Ads described in section 8.3, which takes place only once you have given consent.
6. Data retention periods
| Category of data | Retention period |
|---|---|
| Inquiries that did not result in an engagement | 12 months from the last contact |
| Data relating to the provision of legal assistance | For the duration of the matter, and thereafter for a period set by the firm in line with the purposes of processing, as a rule 10 years from the end of the year in which the matter was concluded. The firm reviews this data every 5 years to determine whether further retention is necessary |
| Accounting and tax records | 5 years from the end of the tax year to which the records relate, under the Tax Ordinance (Ordynacja podatkowa) and the Accounting Act (ustawa o rachunkowości) |
| Data processed on the basis of consent (advertising) | Consent applies until it is withdrawn. Google Ads cookies expire after 90 days. Data already sent to Google is retained by Google as an independent controller, in accordance with its policies |
| Information stored in your browser without consent (section 8.2) | The record of your decision in the consent banner ceases to apply after 12 months. The record that you closed the language suggestion remains until your browser data is deleted |
| Technical data and security logs | For the period applied by the infrastructure provider |
7. Your rights
You have the following rights:
- the right of access to your data and to obtain a copy of it (Article 15 GDPR),
- the right to rectification (Article 16 GDPR),
- the right to erasure (Article 17 GDPR),
- the right to restriction of processing (Article 18 GDPR),
- the right to data portability (Article 20 GDPR),
- the right to object to processing based on the controller’s legitimate interest (Article 21 GDPR),
- the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Article 7(3) GDPR).
The exercise of some of these rights may be limited on account of advocate-client privilege and obligations arising from law - see section 4.
For matters concerning personal data, please contact us at kancelaria@atlanticlawyers.pl.
You also have the right to lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.
8. Cookies and similar technologies
8.1. General principle
The website does not use cookies for advertising purposes without your consent. On your first visit, a consent banner is displayed, where you may give or refuse consent. Refusal does not limit your ability to use the website.
8.2. Necessary information
Without your consent, we store only two pieces of information in your browser’s storage, both necessary for the website to work:
- the decision you make in the consent banner, so that the banner does not appear on every visit; after 12 months we will ask for your decision again,
- the fact that you closed the suggestion to switch to another language version of the website, if it was shown.
Both remain on your device and are not passed to anyone. The basis is Article 6(1)(f) GDPR and the provisions of the Electronic Communications Law (Prawo komunikacji elektronicznej) on the storage of information necessary to provide a service you have requested.
8.3. Advertising cookies - only with consent
Once you have given consent, a Google Ads tag runs on the website. The firm uses it only to measure the performance of its advertising. The tag tells Google that the contact form was sent or that the firm’s phone number was clicked.
Once you have given consent, the tag is downloaded from Google’s servers on every page view. On every page view Google receives your IP address, information about your browser and device, the address and title of the page being viewed, the address of the page you visited before it if your browser provides it, and the identifier from the _gcl_au cookie, and, if you reached the website from an ad, also the ad click identifier. This happens even if you do not send the form or click the phone number. The address and title of a page may indicate the area of law you are interested in.
When the form is sent or the phone number is clicked, Google also receives information about that event, together with the data listed above, including the address and title of the page where it happened. The content of the form, including your name, phone number, email address and description of the matter, is not sent to Google as part of this measurement. Messages sent through the form reach the firm’s mailbox, as described in section 5.2.
The tag stores the cookie _gcl_au and, if you reached the website from an ad, a cookie with the click identifier, for example _gcl_aw. These cookies expire after 90 days. The tag also creates a matching entry in your browser’s storage. Google may also use its own cookies on Google domains.
The firm does not carry out remarketing or personalize ads based on visits to the website, and it signals to Google that ads personalization is off. As an independent controller, Google may also process the data it receives for its own purposes, as described in its policies. Information on how Google uses data from sites that use its services is available at business.safety.google/privacy.
Consents are managed using Consent Mode version 2. Until consent is given, the tag is not loaded and sends no data to Google.
8.4. Withdrawing consent
The “Cookie settings” link in the footer reopens the consent banner, where you can change your decision or withdraw consent at any time. Once consent is withdrawn, the tag stops working and the data it stored on this website is removed from your device. We cannot remove cookies stored on Google domains ourselves; you can do so in your browser settings. Withdrawing consent does not cover data already sent to Google. For that data, you may also address your requests directly to Google.
8.5. Embedded content
The firm’s location on the contact page is indicated solely by a link to an external map. Apart from the Google Ads tag described in section 8.3, which is loaded only once you have given consent, the website does not embed a map or any other third-party content, so until the link is clicked, no data is transmitted to their providers.
9. Profiling and automated decision-making
We do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you.
The only processing resembling profiling takes place within Google Ads - only once you have given consent. The firm uses it only to measure the performance of advertising activity. We do not use it to assess a matter or for any decisions relating to the provision of legal assistance.
10. Voluntary provision of data
Providing your data is voluntary, but necessary to respond to your inquiry and to arrange a consultation. If you do not provide your data, we will not be able to contact you.
11. Data security
We apply technical and organizational measures appropriate to the risk, including encrypted data transmission, access controls for the firm’s mailbox, and document-handling practices arising from the duty of advocate-client confidentiality. The firm’s email is hosted on Google Workspace with two-factor authentication enabled.
12. Changes to this privacy policy
We may update this policy in connection with changes to how the website operates or to the law. The current version is always available at atlanticlawyers.pl/en/privacy-policy. The date of the last update is shown at the beginning of this document.