Privacy
policy

1. Data controller

The controller of your personal data is advocate (adwokat) Bartosz Dragon, trading as Kancelaria Adwokacka adw. Bartosz Dragon, ul. Bolesława Prusa 37/4, 30-117 Kraków, Poland, tax identification number (NIP) 6751281296.

For any matter concerning your personal data, you can contact us:

• by email: biuro@kancelariadragon.com,
• by phone: +48 883 406 792,
• by post at the firm's address given above.

The firm has not appointed a data protection officer. All data protection matters are handled directly by the controller.

2. Legal professional privilege

Everything an advocate learns in connection with providing legal assistance is covered by professional secrecy under Article 6 of the Polish Advocates Act (Prawo o adwokaturze). This also applies to information shared before an engagement is agreed, for example in the contact form or during the first conversation.

In the form, it is enough to give the details we need to contact you. The particulars of your case, especially those concerning charges, health or family life, are best discussed during the consultation.

3. Purposes and legal bases

We process only the data needed for a given purpose. Below we explain where it comes from, on what basis we use it and how long we keep it.

Enquiries by form, email or phone

Data: full name, phone number, email address, chosen office, type of matter, preferred contact method, message content and the address of the page from which the form was sent.

Purpose: replying to your enquiry, arranging a consultation and an initial assessment of whether we can help.

Legal basis: your consent given in the form (Article 6(1)(a) GDPR), steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) and, for phone and email contact, also our legitimate interest in replying to correspondence (Article 6(1)(f) GDPR).

Where it goes: an enquiry sent through the form arrives in the firm's e-mail inbox and is also saved in the website's admin panel, which runs on our hosting provider's server. Only people authorised by the firm have access to the panel.

Retention: until the correspondence ends. If no engagement follows, we delete the data no later than 12 months after the last contact. Personal data from an enquiry is deleted from the website's panel automatically 12 months after it was sent.

Running the case

If we enter into an agreement for legal assistance, we process data to perform it (Article 6(1)(b) GDPR) and to meet legal obligations, including tax and accounting obligations (Article 6(1)(c) GDPR). Detailed information on how we process client data is provided when the agreement is made.

Website statistics

Data: information about how the site is used, collected by Google Analytics, such as pages visited, visit duration, device and browser type, approximate location (city), traffic source, and clicks on the phone number and email address and form submissions. Google Analytics does not receive the content of the form.

Purpose: finding out which content is useful and improving the site.

Legal basis: your consent (Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law). Without consent, Google Analytics does not run at all.

Retention: for the period set in Google Analytics, no longer than 14 months.

Cookie-free statistics

Data: the page visited, the domain of the site you came from or a campaign tag in the address, device type (phone, computer, tablet), time of the visit, and clicks on the phone number and e-mail address. We do not store your IP address and we store nothing in your browser. Visits by the same person within one day are recognised by a hash created from the IP address and browser details using a key that changes every day - after a day the hash cannot be linked to a person or to their earlier visits. We produce the same statistics from server logs kept by the hosting provider, without copying IP addresses from them.

Purpose: counting visits and enquiries from the site, including from people who have not agreed to Google Analytics.

Legal basis: our legitimate interest in keeping basic website statistics (Article 6(1)(f) GDPR).

Retention: we keep the statistics for up to 25 months.

Website security

Data: IP address. After a form is sent, the server keeps it for 30 seconds in hashed form to block bulk sending. The hosting provider also keeps standard server logs.

Legal basis: our legitimate interest in protecting the site against abuse (Article 6(1)(f) GDPR).

Retention: the form block expires after 30 seconds; server logs are kept for the period set by the hosting provider.

Establishing and defending legal claims

Where necessary, we may process data to establish, pursue or defend legal claims (Article 6(1)(f) GDPR) until they become time-barred.

Do you have to provide data?

Providing data is voluntary. Without your name and phone number, however, we will not be able to reply to your enquiry. We do not make automated decisions or profile site users.

4. Recipients of data

Data may be shared only with providers who help us run the site and the firm, and with authorities entitled to it by law:

• Zenbox sp. z o.o. - website hosting, sending of form messages and the server for the admin panel in which we keep enquiries and website statistics,
• Google Ireland Limited - the email service that receives enquiries, Google Analytics (only with consent) and the Google maps embedded on the site.

Google may transfer data to the United States. Google LLC participates in the EU-U.S. Data Privacy Framework, and transfers are also based on standard contractual clauses approved by the European Commission.

5. Your rights

In connection with the processing of your data, you have the right to:

• access your data and receive a copy,
• have inaccurate data rectified,
• have your data erased,
• restrict processing,
• data portability,
• object to processing based on legitimate interest,
• withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Some of these rights may be limited where exercising them would breach legal professional privilege or obligations under the law.

You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw.

6. Cookies

Cookies are small text files that a website stores in the browser on your device. The browser's local storage works in a similar way. In this policy, we refer to both simply as cookies.

Which cookies we use

• Necessary - remember your cookie choice and that you have closed the notice shown at the top of the page. They work without consent, because without them the banner and the notice would keep reappearing.
• Analytics - Google Analytics, which shows us how you use the site. We set them only after you click “Accept”.
• Third-party - set by Google when the map embedded on the home page and the Locations page loads.

We do not use advertising or remarketing cookies, and we do not share visit data with advertisers.

Full list

The cookies set by Google are described on the page How Google uses cookies and in Google's privacy policy.

How to change your decision

On your first visit, the site asks for consent to statistics. You can change your decision at any time with the button below. When you withdraw consent, we remove the Google Analytics cookies from your browser.

Change cookie settings

Browser settings

You can also view, delete and block cookies in your browser settings:

• Google Chrome,
• Mozilla Firefox,
• Safari,
• Microsoft Edge.

Blocking cookies does not stop you from using the site or sending the form. If you block local storage, however, the site will not remember your decision and the banner will appear on later visits.

7. Changes to this policy

We update this policy when the way the site works or the law changes. The current version is always available on this page. Last updated: 30 September 2026.