What data we collect

We collect only the data you give us yourself when you contact the firm:

• through the form on this website: your name, your company name (if you provide it), your e-mail address or phone number, and the content of your message;
• by e-mail or phone: the data you include in your message or share during the call.

Please do not send especially sensitive data through the form, such as health information, or any documents. If they are needed, we will discuss them at a meeting.

Providing your data is voluntary, but without contact details we will not be able to reply to your enquiry.

Purpose and legal basis

We process your data in order to:

• reply to your enquiry and, at your request, take steps before entering into an agreement for legal services, such as arranging a meeting or preparing a quote (Article 6(1)(b) GDPR);
• correspond with you and, if necessary, establish, pursue or defend legal claims, which is our legitimate interest (Article 6(1)(f) GDPR).

We do not use your data for marketing, and we do not make automated decisions about you, including profiling.

If we start working together, we will describe how we process data in connection with your matter in the agreement or in a separate notice.

Professional secrecy

We treat the information in your enquiry in accordance with the rules of professional secrecy that bind Polish attorneys-at-law (radcowie prawni). Only the firm’s lawyers and staff who handle the reply have access to it.

How long we keep your data

We keep the data from your enquiry for as long as our correspondence continues. If we do not start working together, we delete it no later than 12 months after our last contact, unless a longer period is needed to establish, pursue or defend legal claims. In that case, we keep it until those claims become time-barred.

Who has access to your data

We do not sell your data or share it with other companies for their own purposes. Your data may be accessed only by providers of technical services who process it on our instructions under a data processing agreement:

• OVHcloud: provider of website hosting and e-mail, with servers in the European Union.

We do not transfer your data outside the European Economic Area. Your data may also be disclosed to public authorities, but only where the law requires it.

Your rights

In connection with the processing of your data, you have the right to:

• access your data and receive a copy of it;
• request its rectification if it is inaccurate or incomplete;
• request its erasure or the restriction of its processing;
• receive it and transfer it to another controller, for data processed in connection with steps taken before entering into an agreement;
• object to processing based on our legitimate interest.

To exercise these rights, write to office@nsw.legal. We will reply without undue delay and within one month at the latest.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Moniuszki 1A, Warsaw, Poland) if you believe that we process your data unlawfully.

Server technical data

Like any web server, our hosting provider’s server automatically records basic technical connection data: IP address, date and time, the address of the page visited and information about the browser. This data is used only to keep the website secure and working properly (Article 6(1)(f) GDPR). We do not combine it with other data, we do not analyse it to study visitor behaviour and we do not use it to identify you. It is kept for as long as necessary to keep the website secure.

To protect the form against automated spam, we keep an encrypted hash of the sender’s IP address for one hour after a message is sent. The IP address cannot be read from it, and it is deleted automatically after an hour. We do not store the content of form messages on the server; it goes only to the firm’s e-mail inbox.

We do not use cookies

This website does not store cookies or any other information on visitors’ devices, and does not read them. We do not use analytics tools, advertising pixels, social media plug-ins or third-party maps. Fonts and all other elements of the website are loaded from our own server. That is why we do not show a cookie consent banner.

Links to our partners’ LinkedIn profiles are ordinary links. LinkedIn receives information about you only when you click such a link and go to its website. From that moment, LinkedIn’s privacy rules apply.

Administration panel

The part of the website intended only for the firm’s staff, the content editing panel, uses a single technical cookie that keeps the session open after logging in. It is strictly necessary for that service and therefore does not require consent (Article 399(3) of the Polish Electronic Communications Law of 12 July 2024). Visitors to the website do not receive this cookie.

Changes to this policy

If we start using new tools or the law changes, we will update this policy and its effective date. If a change meant using cookies that require consent, we would ask for your consent before storing anything on your device.