This Privacy Policy sets out the rules for the processing of personal data and the use of cookies.
The controller of the personal data of website users and clients of the law firm is Anna Grzywińska-Okoń, conducting business under the name Kancelaria Radcy Prawnego Anna Grzywińska-Okoń, Tax Identification Number (NIP): 6671663251, place of business: ul. Ptasi Raj 15A, 01-976 Warsaw, Poland.
For matters relating to the processing of personal data and the exercise of rights under data protection law, you may contact the Controller by email at anna.grzywinska@okonlegal.com or at the address indicated above./
In connection with the use of the website, the Controller may process personal data voluntarily provided by the user, in particular through the contact form, by email, or during a telephone conversation.
Depending on the method of contact, the following may be processed in particular:
In connection with entering into and performing an agreement for the provision of legal assistance, the Controller also processes data necessary to identify the client and carry out the engagement, in particular: residential or registered office address, Tax Identification Number (NIP), data concerning business activity, bank account number, PESEL number (where necessary to take action in the matter), and data contained in documents and information provided in connection with the matter. Personal data is obtained directly from the individuals to whom it relates.
In connection with the use of the website, technical data may also be processed, such as the IP address, information about the device, operating system, web browser, and the user's activity on the website, to the extent arising from the operation of the website, server, and the cookies and similar technologies used.
Personal data may be processed for the following purposes:
a) Handling enquiries and communicating with users
Data provided through the contact form, by email, telephone, or other available communication channels may be processed in order to respond to an enquiry and conduct further correspondence.
Depending on the nature of the contact, the legal basis for processing is:
b) Entering into and performing an agreement
If the contact results in cooperation, the data may be processed in order to enter into and perform an agreement for the provision of legal assistance, on the basis of Article 6(1)(b) GDPR.
c) Compliance with legal obligations
Data may be processed to comply with obligations arising from law, in particular tax and accounting obligations (including issuing and storing invoices), obligations arising from the Act of 1 March 2018 on Counteracting Money Laundering and the Financing of Terrorism (to the extent that the Controller is an obliged entity, including identifying and verifying the client's identity and retaining documents), and obligations arising from laws governing the profession of an attorney-at-law (radca prawny), on the basis of Article 6(1)(c) GDPR.
d) Establishing, pursuing, or defending against claims
Data may be processed to establish, pursue, or defend against potential claims, on the basis of Article 6(1)(f) GDPR, i.e. the Controller's legitimate interest in establishing and pursuing receivables (including fees), defending against claims made by clients or third parties, and demonstrating that the engagement was properly performed.
e) Website administration and security
Technical data (in particular the IP address and information about the device, operating system, and web browser) may be processed to ensure the proper functioning and security of the website, including the detection of abuse and attacks, on the basis of Article 6(1)(f) GDPR, i.e. the Controller's legitimate interest in ensuring the security and proper operation of the website.
f) Use of cookies and similar technologies
Cookies and similar technologies necessary for the proper operation of the website are used on the basis of Article 6(1)(f) GDPR, i.e. the Controller's legitimate interest in ensuring the operation and security of the website. For technologies whose use requires the user's consent (e.g. analytics or marketing technologies), the legal basis for processing is consent — Article 6(1)(a) GDPR and Article 399 of the Act of 12 July 2024 — Electronic Communications Law. Consent may be withdrawn at any time.
For clients of the law firm, providing data is voluntary but necessary to enter into and perform an agreement for the provision of legal assistance. Without such data, it may not be possible to enter into or perform the agreement. Where data is processed to comply with legal obligations (in particular tax obligations and obligations arising from anti-money laundering legislation), providing the data is a statutory requirement. Failure to provide the data may result in a refusal to commence or continue cooperation.
Personal data is stored for the period necessary to fulfil the purpose for which it was collected. Data relating to enquiries and correspondence may be stored for the duration of the communication and thereafter for a period justified by the need to retain a correspondence history or safeguard against potential claims.
Where data is processed in connection with an agreement, it may be stored for the duration of the agreement and thereafter for the period required by applicable law or the limitation period for potential claims.
Data processed on the basis of consent is processed until consent is withdrawn, unless another legal basis exists for further processing.
Personal data may be disclosed to entities whose services the Controller uses to conduct business and maintain the website, solely to the extent necessary to fulfil specific purposes.
These may include, in particular:
Subject to the information in Section 9 of this Privacy Policy, the Controller does not transfer personal data to countries outside the European Economic Area or to international organisations.
In the cases provided for by the GDPR, the data subject has the right to:
withdraw consent at any time, where consent is the legal basis for processing.
Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
To exercise their rights, users may contact the Controller at the email address indicated in Section 1 of this Privacy Policy.
The data subject also has the right to lodge a complaint with the President of the Personal Data Protection Office (UODO).
Like many other websites, this website uses cookies and may use similar technologies.
Cookies may be used in particular to:
Technologies whose use requires the user's consent are activated in accordance with the user's choice made through the consent management mechanism available on the website. Users may change their cookie settings through their web browser or delete cookies. Information about the use of cookies is displayed during the first visit to the website.
List of cookies and tools used
The website uses cookies and tools related to cookie consent management (Complianz), website creation (Elementor), the operation of WordPress, and the display of Google Fonts. Complianz cookies are used to store cookie preferences and remain valid for 365 days. The Elementor cookie stores actions performed on the website and is persistent. WordPress cookies are used, among other things, to remember user preferences, maintain logged-in status, and check cookie support; their validity varies by cookie, from the duration of a session to one year or a persistent period. The Google Fonts API is used to display fonts and may involve the transfer of the user's IP address; according to the list, it does not store a cookie.
Detailed information about cookie names, purposes, and retention periods is available in the Cookie Policy (EU)..
The website uses Google Fonts, a service provided by Google. When fonts are downloaded directly from Google's servers, the user's browser connects to Google servers, which may involve the transfer of technical data, including the user's IP address.
This data is transferred to Google LLC (USA) on the basis of Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection under the EU–US Data Privacy Framework or, in its absence, on the basis of Standard Contractual Clauses.
The Controller applies appropriate technical and organisational measures to protect personal data, taking into account the nature of the data processed and the risks involved.
Clients' personal data, as information obtained in connection with the provision of legal assistance, is covered by the professional secrecy of an attorney-at-law (radca prawny) and protected in accordance with applicable laws.
Personal data is not used for automated decision-making, including profiling, that would produce legal effects concerning the data subject or similarly significantly affect them.
This Privacy Policy may be updated, in particular, if the operation of the website, the technologies used, the manner of data processing, or applicable laws change.
The current version of the Privacy Policy is available on the OKON Legal website.
Last updated: 10.10.2026