Privacy & Cookie Policy
Last updated: [date]
01Data controller
The controller of personal data is [full legal name, e.g. CCM Legal sp. k.], with its registered office at ul. Hoża 42, 00-521 Warsaw, Poland, entered in the Register of Entrepreneurs (KRS) under number [KRS], tax ID (NIP) [NIP], statistical no. (REGON) [REGON] (the "Controller" or the "Firm").
Contact for data protection matters: e-mail office@ccmlegal.eu, phone +48 502 290 815, postal address as above.
02Data Protection Officer
The Controller [has / has not] appointed a Data Protection Officer (DPO). Where a DPO is appointed, contact: [DPO e-mail]. If no DPO is appointed, all data protection matters should be directed to the Controller using the details in section 01.
03Purposes, legal bases and scope of processing
We process personal data only for specific, lawful purposes:
| Purpose | Legal basis (GDPR) | Scope of data |
|---|---|---|
| Responding to an enquiry sent by e-mail or phone | Art. 6(1)(f) — legitimate interest (communication with interested parties) | name, e-mail, phone, message content |
| Conclusion and performance of a legal services agreement | Art. 6(1)(b) — necessary for performance of a contract | identification and contact data, data needed to perform the engagement |
| Compliance with legal obligations (tax, accounting, and obligations under the acts governing the profession of attorney / legal adviser) | Art. 6(1)(c) — legal obligation | data required by law |
| Establishing, pursuing or defending claims | Art. 6(1)(f) — legitimate interest | data necessary to pursue claims |
| Operation and security of the website (necessary cookies) | Art. 6(1)(f) — legitimate interest | technical data, settings (see section 12) |
[If the Firm adds a contact form, newsletter or analytics/marketing tools, add the relevant purposes, legal bases (including consent, Art. 6(1)(a)) and update section 12.]
04Recipients of data
Data may be disclosed only to authorised bodies and trusted processors acting under data processing agreements, in particular:
- IT, hosting and e-mail service providers: [hosting / e-mail provider];
- providers of tools used on the website (see sections 05 and 12);
- accounting office / tax adviser: [if applicable];
- entities and authorities empowered under applicable law.
05Transfers outside the EEA
As a rule, we do not transfer personal data outside the European Economic Area. The fonts used on the website are self-hosted — using the website does not involve any transfer of data to third-party providers (e.g. Google).
[If tools transferring data outside the EEA are added in the future (e.g. analytics), update this section and indicate the transfer basis.]
06Retention period
- correspondence / enquiries: for the time needed to handle the matter and then [e.g. 12 months];
- contract-related data: for the term of the contract and the limitation period for claims;
- billing data: for the period required by tax and accounting law (generally 5 years);
- cookies: as set out in section 12.
07Your rights
You have the right to: access your data, rectification, erasure, restriction of processing, data portability, and to object to processing (where based on legitimate interest). Where processing is based on consent, you have the right to withdraw it at any time (without affecting the lawfulness of processing before withdrawal).
To exercise your rights, please contact us using the details in section 01.
08Complaint to the supervisory authority
You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warsaw, Poland) if you consider that the processing infringes the GDPR.
09Is providing data voluntary?
Providing data is voluntary but, to the extent necessary to respond to an enquiry or to conclude and perform a contract, it is required to achieve those purposes.
10Automated decision-making and profiling
Data is not used for automated decision-making, including profiling, producing legal effects concerning you.
11Security
The Controller applies appropriate technical and organisational measures ensuring a level of data security appropriate to the risk, including encryption of transmission (HTTPS) and access restrictions.
12Cookie policy
Cookies are small text files stored on the user's device. We also use similar technologies (e.g. localStorage) to remember preferences. Below is what we currently use:
| Name | Type | Purpose | Duration |
|---|---|---|---|
| ccm-lang | Necessary (localStorage) | remembers the selected language (PL/EN) | until cleared by the user |
| ccm-cookie-consent | Necessary (localStorage) | remembers the cookie decision | until cleared by the user |
The website currently does not use analytics or marketing files (e.g. Google Analytics, Meta Pixel). Necessary files do not require consent. [If analytics/marketing tools are added in the future, they will only run after consent is given in the cookie banner, and the table above will be updated.]
Managing cookies
You can change your cookie decision at any time by clearing site data in your browser or using its privacy settings. Restricting necessary files may affect the website's operation (e.g. remembering the language).
The website does not load resources from external servers — fonts are self-hosted.
13Changes to this policy
This policy may be updated. The current version is published on this page together with the date of the update.
14Contact
[full legal name] · ul. Hoża 42, 00-521 Warsaw, Poland · office@ccmlegal.eu · phone +48 502 290 815