Version effective from 23 September 2026
1. Controllers and contact details
The controllers of personal data processed in connection with the jointly run practice are Bartosz Opaliński and Grzegorz Pieczonka, partners of Opaliński Pieczonka s.c. Kancelaria Radców Prawnych, 9 Zygmuntowska St., 35-025 Rzeszów, Poland, VAT ID 8133302141, REGON 691741445.
The joint contact point for privacy matters is biuro@bogp.pl, telephone +48 17 852 06 61 and the office postal address. You may also contact either controller directly.
As partners in one practice we jointly determine the purposes and means of processing, so we are joint controllers within the meaning of Article 26 GDPR. The essence of our arrangement is this: we perform the information duty jointly through this policy, we handle data requests through the joint contact point above, and the partner conducting a given matter is primarily responsible for it. Irrespective of that arrangement, you may exercise your rights against each of us separately — Article 26(3) GDPR.
No data protection officer has been appointed. Requests concerning personal data are handled through the contact point above.
2. Categories and sources of data
Depending on the matter, we may process identification and contact details, information about the facts and course of a case, documents and correspondence, financial and billing data, and — where necessary for legal assistance — special categories of data or data concerning criminal convictions and offences.
- You provide data to us by telephone, email, through the form on this website or in person.
- We may receive it from our client if you are another party, a witness, representative or participant in a matter.
- It may come from case files, courts, prosecutors, public authorities, bailiffs, counterparties and their representatives.
- It may come from public registers such as KRS, CEIDG and land and mortgage registers, or other lawfully available sources.
Where data were not obtained from you and Art. 14 GDPR applies, we provide the required information within the statutory period unless an exception applies — in particular where the data must remain confidential under a statutory duty of professional secrecy (Art. 14(5)(d) GDPR).
3. Purposes and legal bases
| Purpose | Legal basis |
|---|
| Responding to an enquiry, checking for conflicts and deciding whether we can accept a matter | Art. 6(1)(b) GDPR and, where applicable, Art. 6(1)(f) GDPR — steps requested before a contract and the legitimate interests of observing professional duties and protecting clients' rights |
| Providing legal assistance, conducting a matter and communicating with participants | Art. 6(1)(b), (c) and (f) GDPR — performance of the engagement, legal and professional duties, and the establishment, exercise or defence of legal claims |
| Processing data of persons who are not our clients, including another party or a witness | Art. 6(1)(c) and (f) GDPR — procedural duties and the legitimate interests of our client and the controllers in protecting rights and pursuing or defending claims |
| Special categories of data where necessary for the matter | Art. 9(2)(f) GDPR — the establishment, exercise or defence of legal claims |
| Data concerning criminal convictions and offences where necessary for the matter | Art. 10 GDPR in conjunction with the Act on Attorneys-at-Law and the relevant provisions governing legal assistance and legal proceedings |
| Invoicing, accounting and tax settlements | Art. 6(1)(c) GDPR — compliance with legal obligations |
| Retention of files and protection against claims | Art. 6(1)(c) and (f) GDPR, including Art. 5c of the Act on Attorneys-at-Law |
| Operation and security of the website | Art. 6(1)(f) GDPR — the legitimate interest in providing, diagnosing and securing the website |
Providing data in an enquiry is voluntary, but without information necessary to identify and assess the matter we may be unable to reply, check for a conflict or provide legal assistance. Where a legal obligation applies, providing particular data may be required by law.
4. Retention periods
- Data processed by attorneys-at-law in the practice of the profession — 10 years from the end of the year in which the proceedings in which the data were collected ended, in accordance with Art. 5c(1)(2)(c) of the Act on Attorneys-at-Law.
- Enquiries that do not become a matter — only for as long as necessary to answer, perform a conflict check and protect against claims; data that are not required are periodically deleted, generally within 12 months of the last contact, unless the statutory professional-retention rule applies.
- Accounting and tax records — for the periods prescribed by tax and accounting law, generally five years calculated in accordance with those provisions.
- Hosting and security logs — for the short period necessary for security and diagnostics, according to the current hosting plan and the provider's retention rules.
5. Recipients of data
Only where necessary and to the extent required, data may be received by:
- courts, prosecutors, bailiffs, public authorities and other bodies, where required by the matter or by law;
- attorneys-at-law and advocates working on the matter, sworn translators, experts and appraisers, each subject to an appropriate duty of confidentiality;
- our accounting and email providers, postal operators, couriers and IT service providers;
- Netlify, Inc., the provider of hosting and content-delivery infrastructure for this website.
Where an entity acts as our processor, it processes data under a data processing agreement and documented instructions. Other recipients may act as independent controllers where the law or the nature of their professional role so provides. We do not sell personal data or disclose it for third-party marketing.
6. Your rights
Subject to the conditions and exceptions laid down in the GDPR and the Act on Attorneys-at-Law, you may have the right to access and obtain a copy of your data, rectify it, erase it, restrict processing, portability of data supplied under a contract or consent, and object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing.
Send a request to biuro@bogp.pl. We may need to verify your identity. We respond without undue delay and generally within one month; in the cases permitted by Art. 12(3) GDPR this period may be extended by a further two months, of which we will inform you.
You may lodge a complaint with the President of the Personal Data Protection Office. Current contact details are available at uodo.gov.pl.
7. Professional secrecy and statutory limitations
Attorneys-at-law are bound by professional secrecy, without a time limit. Under Art. 5a of the Act on Attorneys-at-Law, the rights under Art. 15(1) and (3), 18 and 19 GDPR apply only insofar as they do not infringe that secrecy; the right to object under Art. 21(1) GDPR does not apply to data obtained in connection with the provision of legal assistance.
These limitations do not remove all data-protection rights. Each request is assessed individually, with due regard to professional secrecy, the rights of the client and any duties or exceptions arising directly from law.
8. The contact form
The form on this page sends nothing to any server. When you press “Write the message”, your browser assembles the text and hands it to the email programme on your own device. The message leaves your own mailbox only when you send it and arrives at biuro@bogp.pl. We use the details you provide solely to review your enquiry, contact you and decide whether we can assist.
From that point it is ordinary email correspondence, handled by the firm's email provider on exactly the same terms as any other message written to us directly. The website neither stores the contents of the form nor passes them to any intermediary.
Please do not describe the matter in more detail than necessary in the first message and do not attach confidential documents. Details are best discussed by phone or at a meeting.
9. Hosting logs
This website is hosted by Netlify, Inc. Its infrastructure automatically processes technical request data, which may include the IP address, date and time, requested resource, device, browser and operating-system information. These data are used to deliver, diagnose and secure the service. They are not used by the firm to build advertising profiles.
10. Fonts and outbound links
The fonts and page assets are served from the website's own domain. Merely displaying the page does not connect your browser to Google Fonts, maps, social networks or media sites. A connection to an external provider occurs only after you follow the relevant link; that provider's own privacy rules then apply.
11. Transfers outside the EEA
Netlify, Inc. is established in the United States, so technical data may be processed outside the European Economic Area. Netlify states that, for relevant EU–US transfers, it participates in the EU–US Data Privacy Framework and also uses the European Commission's Standard Contractual Clauses where applicable. Information and a copy of the relevant safeguards may be requested from us; Netlify's current privacy information is available at netlify.com/privacy.
12. Automated decisions
The firm does not use website data to profile visitors or make decisions producing legal or similarly significant effects by automated means alone. Legal matters are assessed by a lawyer.
13. Security
We apply technical and organisational safeguards proportionate to the risk, including encrypted transmission, access control, protection of office premises and systems, confidentiality obligations and secure disposal of records. The exact measures are reviewed as technology, risks and the way the practice operates change.
14. Changes
We update this policy when the law, providers or the operation of the website changes. The effective date is shown at the beginning. A new version applies from the date stated in it and is always available here.
