Privacy Policy

This is a translation provided for convenience. In case of any discrepancy, the Polish version of this document prevails.

§ 1. Who controls your data

The controller of personal data processed in connection with your use of prawoue.pl is KANCELARIA INSTYTUTU PRAKTYKI PRAWNICZEJ spółka z ograniczoną odpowiedzialnością (a Polish limited liability company), the publisher of this title. Its registered office is at ul. Izabelińska 26C, 05-082 Stare Babice, Poland. It is entered in the register of entrepreneurs of the Polish National Court Register under number KRS 0000678146, with tax identification number NIP 1182145577 and statistical number REGON 367293940.

For any matter concerning personal data write to kontakt@prawoue.pl or to the registered office address. We have not appointed a data protection officer, as none of the conditions in Article 37(1) GDPR applies; such correspondence is handled by the controller directly.

§ 2. Where your data comes from

From you and no one else. We receive it when you complete one of the forms on the site, write to us by e-mail, or subscribe to the newsletter. We do not buy databases, do not harvest data from social platforms, and do not enrich your data with information from other sources.

Separately, serving every connection to the site requires the infrastructure operator to process technical connection data — see § 3(d).

§ 3. What we collect, why, and on what basis

(a) Correspondence through the contact form and by e-mail. We collect your name or company name, e-mail address, and the content of your message, in order to answer you and to continue the correspondence on the matter you raise. The basis is our legitimate interest in handling correspondence — Article 6(1)(f) GDPR; where the matter concerns concluding or performing a contract, the basis is Article 6(1)(b) GDPR.

(b) Submissions through the News Tip form. We collect the content of the submission and — only if you supply one — a channel for us to reply. The form accepts no attachments and does not require you to identify yourself — you may complete it anonymously. We process submissions in order to verify the tip and potentially use it in editorial work. The basis is our legitimate interest in carrying out journalistic activity — Article 6(1)(f) GDPR. It is read together with Article 2 of the Polish Personal Data Protection Act, which limits the application of parts of the GDPR to press activity.

(c) Newsletter. We collect your e-mail address and the date and time of subscription, in order to send the digest you asked for. Immediately after you subscribe we send a welcome message containing a link that ends the subscription with one click — the same link appears in the footer of every issue, so an address entered by someone else has an immediate way out. You may withdraw consent at any time by following that link and confirming on the page that opens — the extra confirmation protects against unsubscription by automated mail scanners. If you no longer have any of our messages, write to kontakt@prawoue.pl and we will remove the address from the list. The basis is your consent — Article 6(1)(a) GDPR. That consent also covers commercial information within the meaning of Article 10 of the Polish Act on Providing Services by Electronic Means. It covers the use of electronic communication under Article 398 of the Polish Electronic Communications Law as well.

(d) Technical connection data. The site runs on the infrastructure of Cloudflare, Inc. (§ 6), which — like any network operator — processes the data needed to serve a connection: the IP address, the date and time of the request and the resource requested. This serves delivering the page, keeping the site secure and repelling attacks. We keep no connection logs of our own, have no routine access to them, do not combine technical data with form submissions and do not build user profiles from it. The only trace connected with sending a form is an irreversible digest of the IP address, kept for one hour solely to limit the number of submissions; the digest cannot be turned back into an address. The basis is our legitimate interest in keeping the site running and secure — Article 6(1)(f) GDPR.

§ 4. Whether providing data is mandatory

It is not. Providing data is always voluntary, but some things cannot be done without it. Without an e-mail address we cannot reply to you or send the newsletter. Without the content of a submission we cannot verify a tip. The News Tip form may be submitted with no contact details at all — in which case we simply have no way to ask follow-up questions.

§ 5. How long we keep data

• Correspondence — for as long as needed to deal with the matter, then for the limitation period for any related claims, and no longer than 3 years from the last message in the thread.
• Newsletter e-mail address — until you withdraw consent. Withdrawal takes effect for the future and does not affect the lawfulness of earlier sending. Unsubscribing deletes the address itself; only an irreversible digest remains, so that for one month the same address is recognised if someone tries to add it again. After that we delete the digest as well. The digest cannot be mailed or read back as an address.
• News Tip submissions — for the period of verification and, where a piece was published, for as long as needed to defend against claims arising from it.
• Technical connection data — up to 12 months from being recorded.

§ 6. Who we share data with

Access is limited to persons authorised by the controller and to the providers who support us technically. These are: Cloudflare, Inc. (San Francisco, USA) — the site’s infrastructure and the database that stores form submissions and newsletter addresses; Resend (Plus Five Five, Inc., Delaware, USA) — delivery of newsletter issues and subscription confirmation messages; and the newsroom’s e-mail provider. Newsletter addresses stay in our database — a single address reaches Resend at the moment a message is sent and is not stored there as a list. Each of these providers operates under a data processing agreement meeting the requirements of Article 28 GDPR and only to the extent needed to deliver the service.

We do not sell data, do not share it for marketing purposes and do not pass it to data brokers. Data may be disclosed to public authorities where required by law, subject to § 10.

§ 7. Transfers outside the EEA

The site’s infrastructure belongs to Cloudflare, Inc., established in the United States, which means the data described in § 3 may be processed outside the European Economic Area. The same applies to Resend, also a US company. The basis for these transfers is the European Commission’s adequacy decision covering entities certified under the EU-US Data Privacy Framework, supplemented by standard contractual clauses. Beyond this, data goes to no third country.

Independently of the above, the site loads no resources from third-party servers — fonts, stylesheets, scripts and images are all served from the prawoue.pl domain. Simply opening a page therefore sends your IP address to no one except the infrastructure operator that serves the page.

§ 8. Your rights

You have the right to request access to your data, its rectification, erasure or restriction of processing, the right to data portability, and the right to object to processing based on legitimate interest. Where processing rests on consent, you may withdraw it at any time — for the newsletter, the unsubscribe link in every message is enough.

Exercising these rights is free of charge. We respond without undue delay and no later than one month from receiving the request.

You also have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.

Some of these rights may be limited to the extent that data is processed for journalistic purposes. That follows from Article 85 GDPR and Article 2 of the Polish Personal Data Protection Act, which balance data protection against freedom of the press.

§ 9. Cookies and similar technologies

This site sets no cookies on your device. We run no traffic analytics, embed no tracking scripts, serve no advertising and include no social media plugins.

The only thing that may be stored in your browser is your colour theme choice — light or dark — and only if you select it yourself using the switch in the page header. It is written to browser local storage (localStorage), contains nothing but the word “light” or “dark”, carries no identifier and is never sent to a server. Its only purpose is to make the site look the way you left it on your next visit. The “match system” setting stores nothing and clears any earlier choice. You can remove it at any time by clearing site data in your browser.

That is why we ask for no consent and show no consent banner. The consent requirement in Article 398 of the Polish Electronic Communications Law does not extend to information stored to deliver a service the user has expressly requested. Remembering the theme you picked is precisely that. Apart from that one setting, the site stores nothing on your device.

Should that change — if we were to introduce an analytics tool, for instance — we will update this policy before switching it on. We will also implement a consent mechanism that makes refusing as easy as accepting.

§ 10. Protection of sources

Submissions made through the News Tip form, and the identity of anyone who approaches the newsroom with information, are covered by journalistic privilege. Under Article 15(2) of the Polish Press Law we must keep confidential any data enabling identification of the author of press material, of a letter to the editor or of other material of that character. The same duty covers other persons providing information, unless that person expressly releases us from it.

Only authorised members of the newsroom have access to submissions.

§ 11. Profiling and automated decisions

We do not take decisions about you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you.

§ 12. Changes to this policy

We update this policy when the way the site works changes, or when the law does. The date of the last update appears below the text. Changes do not curtail rights already acquired by data subjects.

Current as at 30 August 2026.