Privacy Policy

Translation for convenience; the Polish version is binding: Polish version

1. Data controller

1. The controller of personal data is Easy Legal sp. z o.o. with its registered office at: ul. Belgradzka 10A, Gdańsk, KRS 0000970955, NIP 5842817438 (the Controller, we).
2. Contact in all matters concerning personal data: e-mail kontakt@pobyto.pl, telephone +48 506 579 045, in writing to the registered office address.
3. We have not appointed a data protection officer (inspektor ochrony danych), as we are not required to do so. In data matters, please contact the Controller directly.

2. What data we process and where we get it from

1. Enquiry form: first name, surname, telephone number, e-mail address, the type of assistance selected, the stage of the case, the deadline (if provided), the preferred contact channel (if selected), the page language, the address of the subpage from which the enquiry was sent, confirmation that you have read this Policy and the version of that information, and the identifier and time of the submission.
2. Contact by telephone, e-mail and instant messaging apps: the data you provide to us yourself, e.g. your telephone number, your username in the messaging app, the content of messages.
3. Performance of the agreement: data necessary to prepare the residence permit application, in particular data from the travel document, PESEL number, address, marital status, data on employment, insurance, accommodation and income, and in family matters — data of family members (e.g. spouse, children) and data from civil status records. We receive family members' data from the Client; we provide information about this in accordance with Article 14 GDPR.
4. Technical data: IP address and browser data processed automatically by the hosting provider in server logs and — in the form of a hash stored in memory for about 1 minute — to protect the form against abuse.
5. Specially protected data: we do not ask for health data or information about criminal records, and we ask you not to enter them in the form or in messages. If, for the case, the Client needs to present a document containing such data (e.g. a medical certificate or decision), we process it only to the extent necessary to prepare the application, on the basis of Article 9(2)(f) GDPR (establishment, exercise or defence of legal claims in administrative proceedings) or the Client's explicit consent (Article 9(2)(a) GDPR), which can be withdrawn at any time. We do not store certificates from the National Criminal Register (Krajowy Rejestr Karny) — the Client submits them directly to the authority.

3. Purposes, legal bases and retention period

1. Replying to an enquiry and presenting an offer — Article 6(1)(b) GDPR (steps taken at your request prior to entering into an agreement). We store the data for up to 12 months from the last contact if no agreement is concluded.
2. Conclusion and performance of the agreement — Article 6(1)(b) GDPR, and with regard to data of the Client's family members — Article 6(1)(f) GDPR (our legitimate interest in performing the agreement concluded with the Client). We store the data for the duration of the agreement and then until the limitation period for claims expires.
3. Establishment, exercise or defence of claims — Article 6(1)(f) GDPR. We store the data until the limitation periods expire — as a rule 6 years, counted from the end of the calendar year in which the cooperation ended (art. 118 of the Civil Code).
4. Accounting and tax obligations — Article 6(1)(c) GDPR in conjunction with the Accounting Act and the Tax Ordinance. We store settlement documents for 5 years, counted from the end of the year in which the tax payment deadline expired, or longer if required by law.
5. Handling complaints, withdrawals and terminations — Article 6(1)(c) GDPR (obligations under the Consumer Rights Act) and Article 6(1)(f) GDPR. We store the data until the limitation period for claims expires.
6. Website security and spam protection — Article 6(1)(f) GDPR. We store technical data for the period resulting from the hosting provider's settings (logs), and the IP address hash for about 1 minute.
7. Ongoing communication via the channel you have chosen (telephone, e-mail, WhatsApp, Telegram) — Article 6(1)(b) GDPR or Article 6(1)(f) GDPR. We store the data for as long as the contact continues, and then in accordance with the periods in points 1–3.
8. We delete copies of documents provided for preparing the application no later than 12 months after the first-instance decision is issued or the agreement ends, unless they are needed to defend against claims.

4. Recipients of data

The data may be received only by entities that help us run the Website and handle enquiries, acting on our instructions, and by entities authorised under the law:

1. Cloudflare, Inc. (USA) — website hosting, receiving the form (Cloudflare Workers), e-mail routing for the pobyto.pl domain, protection against attacks.
2. Google LLC / Google Ireland Ltd — e-mail (Gmail), to which copies of enquiries and correspondence are delivered.
3. Telegram Messenger Inc. — the messaging app through which the full form data (section 2.1) is forwarded to a closed working group of our team so that we can reply to the enquiry quickly; and also — if the Client chooses this channel — ongoing correspondence.
4. WhatsApp Ireland Ltd (Meta group) — only when the Client chooses WhatsApp as the contact channel.
5. Accounting office, bank and payment operator — for settlements.
6. A natural person acting as a representative in the proceedings — only when the Agreement provides for this.
7. Public administration authorities (in particular the voivode (wojewoda) handling the case) — only when the Client submits an application or instructs us to forward documents, and other authorities authorised by law.

We do not sell data and do not share it for marketing purposes.

5. Transfer of data outside the European Economic Area

1. Cloudflare, Inc. and Google LLC are certified under the EU–US Data Privacy Framework. The transfer takes place on the basis of a European Commission decision finding an adequate level of protection (Implementing Decision (EU) 2023/1795, Article 45 GDPR), and additionally standard contractual clauses used by these providers.
2. Telegram Messenger Inc. is based outside the EEA (United Arab Emirates / British Virgin Islands), in a country for which the European Commission has not issued an adequacy decision. Telegram does not conclude a data processing agreement or standard contractual clauses with us. This means there is a risk that the level of data protection will be lower than in the EU and that the authorities of that country may gain access to the data. We transfer form data there solely to handle your enquiry quickly, to a closed group accessible only to our team, using an encrypted connection. If you do not want your data to go to Telegram, please call or write to kontakt@pobyto.pl instead of sending the form.
3. A copy of the information on safeguards can be obtained by writing to kontakt@pobyto.pl.

6. Your rights

You have the right to:

1. access your data and obtain a copy of it (Article 15 GDPR);
2. rectification of your data (Article 16 GDPR);
3. erasure of your data (Article 17 GDPR);
4. restriction of processing (Article 18 GDPR);
5. portability of data processed on the basis of an agreement or consent (Article 20 GDPR);
6. object to processing based on our legitimate interest (Article 21 GDPR);
7. withdraw consent at any time, if processing is based on consent — without affecting the lawfulness of processing before its withdrawal;
8. lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warszawa (uodo.gov.pl).

To exercise your rights, please write to kontakt@pobyto.pl. We reply without undue delay, no later than within one month. We may ask for information confirming your identity.

7. Voluntary provision of data

Providing data is voluntary. However, without your first name, surname, telephone number and e-mail address we cannot reply to the enquiry, and without the data needed for the application we cannot perform the agreement. Some data is required by the regulations on residence permits; failure to provide it may make it impossible to submit a complete application.

8. Automated decisions and profiling

We do not make decisions based solely on automated processing, including profiling, which would produce legal effects concerning you or similarly significantly affect you.

9. Cookies and similar technologies

1. The Website does not use analytics or marketing cookies and does not use tracking tools (e.g. Google Analytics, Meta Pixel).
2. The hosting provider (Cloudflare) may store technical cookies in the browser that are necessary to ensure security and protection against bots. They are necessary to provide the service you request and therefore do not require consent (art. 399(2) of the Electronic Communications Law (Prawo komunikacji elektronicznej)).
3. You can block or delete cookies in your browser settings; however, this may make it more difficult to use the Website.
4. If in the future we introduce cookies that require consent, we will ask for consent before storing them and update this Policy.

10. Security

We use an encrypted connection (HTTPS), restrict access to data to the people who need it to handle the case, and do not store the content of the form on the website server — the form only forwards the submission to the channels described in section 4. We never ask for passwords, SMS codes or login details for the Trusted Profile (Profil Zaufany) or MOS.

11. Changes to the Policy

We update the Policy when the law, our services or our providers change. The current version is always available on this page, and the version date is given at the beginning of the document. The rules for concluding and performing agreements are set out in the Terms of Service.