Legal

Privacy policy

Version 1.1 · effective 3 August 2026 · change: addition of Google Analytics

This is a courtesy translation. In the event of any discrepancy, the Polish version prevails.

1. Data controller

The controller of personal data is ContaPlug Jacek Augustyn, ul. Estreicherów 19, 30-225 Kraków, Poland, trading as Biuro Kontraktu (the "Controller"). For all matters concerning personal data: biuro@biurokontraktu.pl.

This policy covers the website biurokontraktu.pl, the panel at panel.biurokontraktu.pl (and the earlier addresses of these services in the asystentprojektu.pl domain) as well as correspondence conducted by email and telephone in connection with our services.

2. What we process and why

Contact form. First name, email address, optionally company name and telephone, the content of your enquiry and any files attached. We use them solely to handle the enquiry and prepare the free initial review — the basis being steps taken prior to entering into a contract and our legitimate interest in responding to enquiries (Art. 6(1)(b) and (f) GDPR). Attachments may contain personal data of third parties (for example the authors of contractual correspondence) — we process these solely to review the matter and treat them as confidential.

Marketing consent. If you tick the separate, optional consent, we will use your email address to send practical material on contract documentation (Art. 6(1)(a) GDPR). Consent may be withdrawn at any time — one email to the address above is enough.

Panel. On company registration: tax identification number and company registry details retrieved automatically from public registers, account users' data (name and email address) and the documents and content uploaded to the panel. The basis is performance of the contract for the supply of services by electronic means (Art. 6(1)(b) GDPR) and our legitimate interest in the security of the service (point (f)).

Server logs. IP address, date and content of the request — to ensure security and for technical diagnostics (Art. 6(1)(f) GDPR).

Correspondence. Sender's details and message content — to run the matter the correspondence concerns.

3. Client documents

Documents sent to us for review or uploaded to the panel are treated as confidential information. They are accessible only to the people working on that particular matter. In the panel, each company's data is isolated — only people invited by the account holder can access a project. We do not share documents with other clients or third parties, save as described in point 5.

4. Cookies and website statistics

Our own statistics. We measure visits on our own infrastructure, without cookies and without profiling — recording only aggregate traffic data (page address, referral source, device type), without identifying individuals.
Google Analytics. The website uses Google Analytics 4 (measurement ID G-E8VGQ0HQWT), supplied by Google Ireland Limited. It stores cookies in your browser (including _ga, _ga_*, retained for up to 2 years) and transfers to Google data about your use of the site — including a truncated IP address, the pages visited and device information. The purpose is traffic analysis and improving the site; the basis is your consent (Art. 6(1)(a) GDPR).
How to opt out. You may withdraw consent at any time by deleting cookies and blocking them in your browser settings, or by installing the Google Analytics opt-out add-on. The site then works without any restrictions.
Panel. Uses only the mechanisms strictly necessary to sign in and maintain a session.

5. Who we may disclose data to

Technical service providers acting on our instructions (server infrastructure, email, IT support) — to the extent necessary to keep the services running. Google Ireland Limited — in respect of website traffic data described in point 4. For ongoing contract support — a co-operating law firm, solely at the client's express instruction. Public authorities — only where disclosure is required by law.

6. Transfers outside the EEA

Client documents, account data and correspondence are stored on servers located in the European Economic Area and are not transferred outside the EEA.

The exception is statistical data processed by Google Analytics: Google may transfer it to the United States on the basis of the European Commission's adequacy decision (EU–US Data Privacy Framework) and standard contractual clauses. This transfer does not include documents or content you send us.

7. How long we keep data

form enquiries and correspondence — up to 24 months from the end of correspondence on the matter,
panel account data — for as long as the account exists, and after deletion until the limitation periods for any claims expire,
documents uploaded to the panel — until deleted by the user or until the account is deleted,
an email address covered by marketing consent — until consent is withdrawn,
server logs — up to 90 days,
Google Analytics data — per the account setting, a maximum of 14 months; _ga cookies — up to 2 years or until you delete them.

8. Your rights

You have the right to: access your data and obtain a copy, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interest, and withdrawal of consent at any time (without affecting the lawfulness of processing before withdrawal). A message to biuro@biurokontraktu.pl is enough — we reply by the next working day at the latest and handle requests within the periods laid down by the GDPR.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).

9. Is providing data voluntary?

Providing data is voluntary, but: without the form data we will not be able to answer your enquiry, and without a tax identification number we cannot open a company account in the panel.

10. Automated decision-making

We do not take decisions in relation to you based solely on automated processing that would produce legal effects, and we do not profile users.

11. Security

Data in transit is encrypted (TLS). We apply access control, isolation of data between companies in the panel, backups and the principle of least access — case documents are accessible only to the people working on that case.

12. Changes to this policy

Each version of the policy is dated. We will announce material changes on the website, and notify panel users by email as well.