Your data.
Clear rules.

1. Controller and contact

The controller of the personal data described in this notice is UPIK KANCELARIA SP. Z O.O., ul. Elektronowa 2, 03-219 Warsaw, NIP: 5242850294, REGON: 369345724, KRS: 0000715631, referred to as “UPIK” or “we”.

For personal data matters, you can email biuro@upik.com.pl, write to the address above or call +48 22 122 88 82.

UPIK has not appointed a data protection officer. We handle data protection enquiries directly using the contact details above.

2. Who does this notice apply to?

This notice applies to visitors to upik.com.pl and people contacting UPIK by email, phone or post about services, cooperation, ongoing arrangements and other ordinary matters. It also covers representatives and contact persons of clients, contractors and other entities. It includes people within the range of video surveillance inside and outside UPIK's office; section 11 provides details.

It does not replace separate notices relating to recruitment, employment or other processes requiring specific rules. If your matter requires further information, we provide it for the relevant process.

This notice concerns situations in which UPIK acts as controller. When we process data on a client's behalf as part of accounting or HR and payroll services, separate data processing arrangements apply. This page does not replace them.

3. What data do we process and where does it come from?

The scope depends on the matter. It may include your name, email address, phone number, job title or role, the company you represent, address details, correspondence and necessary data in attachments.

We usually receive data directly from you. Representatives' and contact persons' data may come from the entity they represent or the person handling the matter with us. If we use a public register, such as KRS or CEIDG, as a source of data needed for the matter, we explain this as appropriate. For indirectly obtained data, we identify the actual source in the notice addressed to the person.

When you visit the site, the server may record technical data such as IP address, connection date and time, the page visited, browser information and errors. The actual scope depends on the hosting configuration.

Do not send data that is unnecessary for the matter. Use the agreed communication channel for documents relating to accounting and HR services.

4. For what purposes and on what legal bases?

Sending a message or opening the website does not in itself constitute consent to marketing.

5. Who may receive your data?

Where necessary, recipients may include providers of hosting, email, software, IT support, storage and backups. Depending on the matter, recipients may also include postal and courier operators, legal service providers and authorities entitled by law. Providers processing data on our behalf act within their agreements and the controller's instructions, in accordance with applicable law.

6. How long do we retain data?

Retention depends on the purpose of processing and the type of matter. We do not retain all correspondence indefinitely or apply a single period to all data.

• Ordinary enquiries and correspondence unrelated to a contract: for the time needed to respond and close the matter. Further retention requires separate justification, such as a genuine need to document arrangements or defend claims. Data no longer needed for these purposes is deleted.
• Correspondence about preparing and performing a contract: during negotiations and performance. Once the contract ends, we retain records only as necessary to meet legal obligations or establish, exercise or defend claims.
• Records needed for legal claims: until the relevant limitation period expires. We take account of when the claim falls due, the calendar-year-end rule and events affecting limitation periods. If proceedings arise, we also keep necessary data for the time needed to conclude them and implement the outcome.
• Documents subject to mandatory retention: if a message or attachment constitutes a record subject to mandatory retention, we apply the period and calculation rules for that type of record, not automatically to the whole mailbox.
• Technical logs: for the period defined for the system and needed for security and error diagnosis. Entries relating to a specific incident may be kept longer if needed to investigate it or protect legal claims.
• Backups: within a limited recovery and overwrite cycle. Backups are not used to archive all correspondence indefinitely.
• Surveillance recordings: retention and preservation rules for recordings connected with proceedings are described in section 11.

7. What are your rights?

Under the GDPR, you may request access to and a copy of your data, rectification, erasure or restriction of processing. Not every right applies in every situation; for example, a legal obligation may prevent immediate erasure.

Where processing is based on Article 6(1)(f) GDPR, you have the right to object on grounds relating to your particular situation. We will consider the objection under Article 21 GDPR.

Data portability applies to the extent that processing is based on consent or a contract and carried out by automated means. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. Ordinary correspondence described above generally does not require such consent.

To exercise your rights, contact us using the details in section 1. Where there are reasonable doubts, we may request information necessary to verify your identity, respecting data minimisation.

You also have the right to lodge a complaint with the President of Poland's Personal Data Protection Office. Details of how to complain are available on the UODO website (new tab).

8. Do you have to provide data?

Providing data during ordinary contact is voluntary. However, missing information needed to reply, identify the recipient or clarify the matter may prevent us from handling it. If particular data is required to enter into a contract or by law, we explain this in the context of that matter.

Technical data needed to connect to the server is transmitted when you visit the website.

9. Website and cookies

The website may use cookies or similar technologies to store information on your device. Without consent, only solutions necessary to transmit communications or provide a service requested by the user, including its essential security, may be used.

If tools requiring consent are introduced, particularly analytics or advertising tools, they will run only after their purposes have been explained and consent obtained. Refusing consent will not restrict access to the site's core content. Withdrawing consent will be as easy as giving it.

You can manage, delete or block cookies and similar data in your browser settings. Restricting necessary technologies may affect some functions. Using the website does not itself constitute consent to tools that require it.

10. Is data transferred outside the EEA?

Using IT services may involve transfers outside the European Economic Area (EEA), including access by service providers' subcontractors.

Any such transfer may take place only on a basis and under conditions required by Chapter V GDPR. Depending on the transfer, this may be a European Commission adequacy decision or appropriate safeguards, particularly standard contractual clauses, with supplementary measures where necessary.

You can request information about transfers involving your data and how to obtain a copy of applicable safeguards by contacting us as set out in section 1.

11. Video surveillance

Video surveillance is used in UPIK's office at ul. Elektronowa 2 in Warsaw and its immediate surroundings to protect people's safety and property. Data includes images of people within camera range and information about recorded events.

The legal basis is Article 6(1)(f) GDPR — the legitimate interest in protecting people and property and, in the event of an incident, establishing what happened and protecting related legal claims.

Recordings are retained only for the time needed to identify and verify events threatening people's safety or property. This takes into account when an event may be discovered during normal office use, including after periods when the office is closed.

If a recording is evidence in legally conducted proceedings, or UPIK learns that it may be, the relevant part may be retained until the proceedings are finally concluded. Recordings are deleted once the applicable period ends, unless a separate law provides otherwise.

Authorised persons may access recordings; where necessary, so may providers operating the surveillance system for UPIK. Recordings may be disclosed to entitled authorities, particularly the police and courts, where there is a legal basis.

The rights in section 7 apply to surveillance data to the extent provided by law, including access, restriction and objection on grounds relating to your particular situation, and the right to complain to the President of UODO. For surveillance matters, use the contact details in section 1.

12. Automated decisions and profiling

This website's code does not make decisions about users that produce legal or similarly significant effects, and does not carry out advertising profiling.