Privacy Policy.

This Privacy Policy sets out the rules for processing personal data of users of the website operated at zwyrtek.pl (the “Website”), as well as of persons using services provided by entities forming Zwyrtek Group, their contractors, representatives and contact persons.

The controller of your personal data is jointly the entities forming Zwyrtek Group and Michał Zwyrtek (jointly referred to as: the “Joint Controllers”, the “Controller” or “We”):

• Zwyrtek Tax & Legal sp.k., ul. Porcelanowa 23, 40-246 Katowice, Poland, KRS: 0001000856, NIP: 9542847217, REGON: 523608917.
• Zwyrtek Business Services sp. z o.o., ul. Porcelanowa 23, 40-246 Katowice, Poland, KRS: 0001137836, NIP: 9542879186, REGON: 540242848.
• Zwyrtek Advisory sp. z o.o., ul. Porcelanowa 23, 40-246 Katowice, Poland, KRS: 0001172799, NIP: 9542887978, REGON: 541718508.
• Zwyrtek Digital sp. z o.o., ul. Porcelanowa 23, 40-246 Katowice, Poland, KRS: 0001172412, NIP: 9542888239, REGON: 541766996.
• Michał Zwyrtek, conducting business activity at ul. Porcelanowa 23, 40-246 Katowice, Poland.

We process your data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR”) and other applicable data protection laws.

A joint-controllership agreement has been concluded within Zwyrtek Group. The Joint Controllers jointly determine the purposes and means of data processing, in particular regarding shared use of IT infrastructure, a shared client database, and the provision of integrated advisory, legal and digital services.

The contact point for all matters relating to personal data protection is the email address: kontakt@zwyrtek.pl.

Your data may be processed for the following purposes:

• Provision of services by electronic means (making the Website content available): legal basis — necessity for the performance of a contract (Article 6(1)(b) GDPR).
• Handling enquiries and correspondence: legal basis — legitimate interest of the Controller (Article 6(1)(f) GDPR) consisting in building relationships with users, or taking steps prior to entering into a contract (Article 6(1)(c) GDPR).
• Conclusion and performance of a service agreement (legal, tax, business, advisory or digital services): legal basis — performance of a contract (Article 6(1)(b) GDPR) or legitimate interest in the case of persons representing the client (Article 6(1)(f) GDPR).
• Analytical and statistical purposes: legal basis — legitimate interest (Article 6(1)(f) GDPR) consisting in optimising the operation of the Website.
• Direct marketing: legal basis — legitimate interest (Article 6(1)(f) GDPR) or consent (Article 6(1)(a) GDPR) where specific communication channels are used.
• Defence against and pursuit of claims: legal basis — legitimate interest (Article 6(1)(f) GDPR).
• Compliance with legal obligations (e.g. tax, accounting, AML): legal basis — legal obligation (Article 6(1)(c) GDPR).

We receive data directly from you or from third parties (e.g. from your employer / principal that is our Client).

We process, among others: first name, surname, company name, tax identification number, contact details (email, phone), data on activity on the Website (IP address, cookies), and, in connection with the performance of contracts — also identification data necessary for identification (e.g. national ID number, ID document number) and financial data (bank account number).

Data may be disclosed to:

• Processors acting on our behalf (IT, accounting, hosting, marketing).
• Entities authorised under applicable law.
• Postal operators and couriers.

In the event of a transfer of data outside the EEA (e.g. when using global IT service providers), we ensure appropriate safeguards, including Standard Contractual Clauses approved by the European Commission.

We retain data for the following period:

• For the duration of the contract and the limitation period for claims (usually from 3 to 6 years).
• As required by law (e.g. 5 years for tax documentation).
• Until consent is withdrawn or an effective objection is raised (for marketing purposes).

You have the right to:

• Access your data and obtain a copy of it.
• Rectify (correct) your data.
• Erasure of data (the right to be forgotten).
• Restriction of processing.
• Data portability.
• Object to processing (in particular for marketing purposes).
• Lodge a complaint with the President of the Personal Data Protection Office (UODO – the Polish Personal Data Protection Office) (ul. Stawki 2, 00-193 Warszawa).

The Website uses cookies for functional, analytical and marketing purposes.

• Session cookies — deleted once the browser is closed.
• Persistent cookies — stored on the device for a set period of time.

You may manage cookie settings in your browser. Disabling cookies may affect the correct operation of certain functions of the Website.

We apply modern technical and organisational measures to protect data, including:

• Encryption of connections via an SSL certificate.
• Regular backups and software updates.
• Internal data protection and access control procedures.

To protect contact and newsletter forms against automated spam, we use the Google reCAPTCHA v3 service (Google Ireland Limited). This service loads a Google script, collects limited technical information about the interaction with the form (including IP address, cursor movements, timestamps) and uses it solely to assess whether the submission comes from a human. The rules governing Google's data processing are described in the Google Privacy Policy and the Google Terms of Service.

For any matters relating to privacy, please contact us:

• Emailkontakt@zwyrtek.pl
• Addressul. Porcelanowa 23, 40-246 Katowice, Poland

This document is regularly reviewed and updated to ensure compliance with dynamically changing legislation and with the business profile of Zwyrtek Group.