Privacy policy

Data controller

The data controller is the law office run by advocate Włodzimierz Szabłowski, with its registered office in Warsaw. The controller's contact details are provided on the Contact page.

Purpose and basis of processing

Data provided in the contact form is processed solely in order to respond to the message sent and to carry out an initial assessment of the matter. The basis is Article 6(1)(b) GDPR where the contact is directed towards entering into an agreement for the provision of legal assistance, or Article 6(1)(f) GDPR — the legitimate interest in conducting correspondence and handling enquiries; site security and protection against abuse, and the establishment, pursuit or defence of claims, rest on Article 6(1)(f) GDPR, and legal obligations of the Law Office on Article 6(1)(c) GDPR to the extent such obligations arise. The acknowledgement checkbox next to the form confirms that you have read this Policy; it is not a separate consent to the processing of personal data. Analytics consent is a separate decision and does not affect how an enquiry is handled.

Scope of data

The data processed is that provided voluntarily in the form: name, email address, optionally a phone number, the content of the message and voluntarily attached files (up to 5 PDF, DOC, DOCX, JPG or PNG files, 30 MB in total). Please do not send special categories of data or details covered by professional secrecy in the message until the terms of the engagement have been established.

How enquiries are handled

The content of an enquiry and its attachments are stored in a private, encrypted data store operated on Cloudflare infrastructure with storage restricted to the European Union jurisdiction. Only the advocate, after authentication, has access to enquiry documents, through a protected panel. The e-mail notifying the Law Office of a new enquiry contains only a technical identifier, the time of receipt and the number of documents — it does not contain the content of the matter, contact details or files. A separate confirmation of receipt is sent to the e-mail address provided; it does not contain a copy of the submitted content or documents. The e-mail messages — the notification to the Law Office and the confirmation to the person making the enquiry — are delivered by Resend, an external sending provider, which for that purpose processes the recipient’s e-mail address and the content of the message itself; those messages contain neither the content of the matter nor any attachments. The form is protected by the Cloudflare Turnstile anti-spam mechanism. Submitting the form does not mean that the matter has been accepted for handling and does not establish an advocate–client relationship; the telephone and e-mail address of the Law Office remain the fallback channel.

Retention period

Enquiries that do not turn into a handled matter are automatically deleted from the enquiry store 30 days after receipt; e-mail notifications held in the Law Office's mail system contain technical data only, without the enquiry content. If instructions are accepted, the necessary documentation is transferred to the Law Office's proper records system and kept for the period arising from the rules governing the practice of the advocate profession, and the enquiry copy is deleted.

Site analytics

The site uses Google Analytics 4 to measure website traffic and interactions with the site. The legal basis for processing for analytics purposes is consent under Article 6(1)(a) GDPR. The tool is activated only after you consent to analytics and only on the Law Office's production website; without that consent it is not loaded at all. Once active it stores first-party cookies under the kancelariaszablowski.pl domain, with a configured lifetime of 365 days. You can change or withdraw your decision at any time through Cookie settings; withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Details are set out in the Cookie policy.

The custom events configured by the site are technical — for example, a successful form submission. They do not include the content of an enquiry, nor the name, e-mail address or telephone number of the person making it. Advertising and remarketing storage is disabled at all times, and the site does not use advertising or remarketing tools.

In connection with this tool, data may be processed by Google, including outside the European Economic Area. Where that is the case, the transfer is based, as applicable, on an adequacy decision of the European Commission or on appropriate safeguards, including Standard Contractual Clauses. Information about the applicable transfer mechanism and the related safeguards may be obtained by contacting the Law Office.

Location map

The contact page carries an interactive location map provided by Mapbox. The map loads automatically as the location section approaches the visible area of the screen — no click or other interaction is required. Until a visitor scrolls to that section, the browser does not connect to Mapbox.

Once the map loads, your browser connects directly to Mapbox servers to retrieve the script, stylesheet, style data, map tiles and fonts. The Law Office address is also given as text below the map, independently of whether the map loads.

Through those connections Mapbox may receive your IP address together with technical data about the request, browser, device and operating system, timestamps and technical identifiers needed to provide, secure and bill the service. According to the provider’s documentation, the Mapbox GL JS library additionally sends anonymised usage telemetry to events.mapbox.com. Your browser may use its cache or browser storage to hold map resources.

The map uses fixed office coordinates. The implementation does not call the browser’s Geolocation API and does not obtain the visitor’s device location — neither before nor after the map is activated.

If the map section is never displayed, no data reaches Mapbox. The map also does not run when JavaScript is disabled in the browser — the Law Office address and the “Get directions” link remain available in that case. The map uses the Mapbox service, with the corresponding attribution.

The separate “Get directions” link opens an external navigation service in a new tab; from that point the privacy terms of that service apply.

Rights of the data subject

You have the right to access your data, to rectify, erase or restrict its processing, the right to object, the right to data portability and the right to lodge a complaint with the supervisory authority. The scope of some of these rights may be limited by the specific rules governing the practice of the advocate profession and professional secrecy.