Privacy and Cookie Policy

2. Controller

The controller of your personal data is Michał Bugajło, attorney-at-law (radca prawny), conducting business under the name Kanban Lawyers Michał Bugajło Kancelaria Radcy Prawnego, ul. Adama Naruszewicza 30 lok. 74, 02-627 Warsaw, Poland, tax identification number (NIP) 5782652014, statistical number (REGON) 147333526.

For any matter concerning personal data, including requests to exercise your rights, please contact: contact@kanbanlawyers.com

We have not appointed a data protection officer.

3. Contacting the Firm and service enquiries

When you use the contact form on this website, you provide us with the data you enter in it: your name, email address, telephone number and the content of your message. The same applies where you email us directly or contact us by telephone.

We use this data for the following purposes:

We do not ask for your consent to process the data submitted through the form, because the processing is based not on consent but on the grounds described above. Providing the data marked as mandatory is required to submit the form. Without your email address, we are unable to reply.

We do not use data from the form for marketing purposes – we do not send you offers or materials on that basis unless you ask us to.‍

IP Protector sp. z o.o. is a separate company and a separate controller. Data submitted through this website is not shared with it. Should it turn out that your needs concern that company’s services, we will let you know and transfer your data only once you have agreed to it.

4. Booking a consultation – Microsoft Bookings

We use Microsoft Bookings to schedule consultations. Clicking the booking button takes you to a service operated by Microsoft. When booking an appointment, you provide your name and email address and, optionally, your telephone number and a brief description of the subject of the meeting.

This booking data is made available to us: we remain the controller, and Microsoft processes the data on our behalf as a processor. The legal basis is the same as for the contact form (Article 6(1)(b) or (f) GDPR).

Microsoft also processes certain data for its own purposes – as a separate controller, it is responsible for the operation of its service and for the cookies used on its websites. At that stage, Microsoft’s privacy policy applies, over which we have no control.

5. Data relating to your use of the website

This website runs on the Webflow platform. Like any website, it is delivered through servers that process the technical data necessary to display and secure it, including the IP address of your device. These logs are generated automatically by the hosting provider, are used solely for technical and security purposes, and are retained for the period applied by that provider. The legal basis is our legitimate interest in making the website available and protecting it (Article 6(1)(f) GDPR). We do not use this data to identify visitors.

Contact form submissions are delivered to the Firm’s mailbox, and a copy is stored on the Webflow platform. In both places, the retention periods set out in section 9 apply.

We use Google Analytics 4, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). The tool collects data on the pages visited, visit duration, approximate location (derived from the IP address), traffic source, and device and browser type, in aggregated and pseudonymised form. The script runs only after you have given consent in the “Analytics” category (see section 6).

This website contains a link to our LinkedIn profile. We do not use the LinkedIn Insight Tag or any embedded social media plug-ins.

6. Cookies and similar technologies

Cookies are small files stored on your device. The same rules apply to other technologies that store information on, or access information from, your device, such as the browser’s local storage.

Storing or accessing such information requires your consent. The exception is where this is strictly necessary to provide a service you have explicitly requested – in that case, consent is not required (Article 399(1) and (3) of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej)).

You give your consent through the banner displayed on your first visit. You may reject all non-essential cookies with a single click – doing so does not restrict access to any part of the website. You may also choose individual categories. Scripts that require consent are not run until consent has been given.

You may change your choice at any time using the Cookie settings link in the website footer. Withdrawal of consent takes effect for the future and does not affect the lawfulness of processing carried out before the withdrawal. You may also delete cookies and change how they are stored in your browser settings.

Consent covers only the storing of, or gaining access to, information on your device. Where the information obtained in this way constitutes personal data, its further processing has a separate legal basis under the GDPR: for analytics cookies, your consent (Article 6(1)(a) GDPR); for strictly necessary cookies, our legitimate interest in ensuring the proper functioning of the website (Article 6(1)(f) GDPR) and our obligation to demonstrate that consent has been given (Article 6(1)(c) in conjunction with Article 7(1) GDPR).

We manage consent using the Consent Pro tool. Each choice made in the banner is recorded as a separate entry containing: an identifier, the date and time, the page URL, the detected region, the text of the banner at the time of the choice, browser information and the choices made in each category. Your IP address is not recorded. These records are stored on our behalf by the infrastructure provider Cloudflare for 5 years and are then deleted. They serve solely to demonstrate that consent was given or refused (Article 7(1) GDPR).

7. Recipients of data

Your data is accessible only to entities whose involvement is necessary for running the Firm and operating this website:

• the website platform and hosting provider (Webflow),
• Cloudflare – spam protection for the contact form (Turnstile),
• jsDelivr – content delivery network for website scripts (CDN),
• the consent management tool provider (Consent Pro),
• Microsoft, as the provider of email, calendar and booking services,
• the analytics tool provider (Google Analytics) – Google Ireland Limited / Google LLC,
• IT service providers supporting the Firm, where they gain access to data in the course of those services.

Where these entities process data solely on our instructions, they do so under a data processing agreement. Providers of third-party tools may also process certain data for their own purposes as separate controllers – this applies in particular to services you reach when leaving our website.

Data may also be disclosed to public authorities where required by law. In that case, those authorities act as separate controllers, and any disclosure takes into account the limits imposed by the professional secrecy of attorneys-at-law (radcowie prawni).

We do not sell data or share it for marketing purposes.

8. Transfers outside the EEA

We use Microsoft services for email, calendar and consultation bookings. Microsoft has committed to storing and processing the data of its EU customers within the EU and EFTA. There are exceptions to this commitment, set out in Microsoft’s documentation – relating mainly to technical support and threat protection – in which data may be accessed from outside the EEA.

The Webflow platform and the Consent Pro tool are provided by entities established outside the EEA. Consent records are stored on Cloudflare infrastructure.

Information on the transfer mechanism relied upon, and a copy of the relevant safeguards, is available on request – please write to contact@kanbanlawyers.com.

9. Retention periods

We review these periods regularly and delete data earlier once it is no longer needed – in particular where you have successfully objected to processing based on legitimate interest.

10. Your rights

You have the right to access your data, to have it rectified or erased, to restrict its processing, and to data portability in respect of data you provide to us on the basis of a contract or consent.

You may object at any time to processing based on our legitimate interest (Article 21 GDPR) – this applies, among other things, to the retention of correspondence and of technical data relating to your use of the website.

You may withdraw your consent to analytics cookies at any time, without affecting the lawfulness of processing carried out before the withdrawal.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

We do not make decisions about you based solely on automated processing, including profiling.

Two limitations arise from the legislation governing the profession of attorney-at-law (radca prawny). They apply only to data obtained in connection with the provision of legal services and do not extend to data collected through the website itself. In respect of such data, the right to object does not apply (Article 5a(2) of the Act on Attorneys-at-Law), and the right of access, the right to restriction of processing and the notification obligation under Article 19 GDPR apply only to the extent that they do not infringe professional secrecy (Article 5a(1) of that Act). These limitations exist to protect the Firm’s clients.

11. Confidentiality and security

The contact form and email are not intended for sending documents or details of your matter. A brief description of the subject is sufficient in your first message – we will agree on a secure method of sharing materials with you individually.

We treat information you provide in connection with a prospective engagement as confidential. Information disclosed before a matter is accepted is protected by the professional secrecy of attorneys-at-law where the circumstances indicate that it was provided for the purpose of obtaining legal services and in the reasonable expectation that such services would be provided (Article 15(3) of the Code of Ethics for Attorneys-at-Law).

Submitting the form or exchanging initial messages does not in itself constitute acceptance of the matter or the conclusion of a contract with the Firm.

We apply technical and organisational measures appropriate to the risk (Article 32 GDPR) and review them whenever there is a significant change in how the website operates or how the Firm organises its work.

12. Changes to this Policy

We update this Policy whenever there are changes to how the website operates or to the applicable law. The date of the current version is shown at the top of this document. Changes take effect on the date of publication.