legal document
Privacy Policy - lexandroll.pl
Version 2.0 · effective from 28 October 2026 · changes since version 1.0: forms, guide, newsletter, Cloudflare (spam check, and visit statistics only with consent). The Polish version is authoritative.
1. Data controller
The controller of personal data processed in connection with the use of lexandroll.pl (the "Website") is Lex&Roll Marek Kozica Law Firm (Polish: Lex&Roll Kancelaria Radcy Prawnego Marek Kozica), Warsaw (second location: Wrocław), tax ID (NIP) 899-271-64-95, an attorney-at-law (radca prawny) registered under OIRP WŁ/LG/510 (the "Firm", "we").
Contact for data protection matters: hello@lexandroll.pl or by post to the registered address.
2. General principles
Browsing the Website does not require you to provide any personal data. Your data reaches us when you: write to the e-mail address published on the Website, submit the contact form, request the guide or subscribe to the newsletter. Apart from the server hosting the Website, your browser connects only to the services described in section 7: Cloudflare visit statistics (only with your consent), the Cloudflare Turnstile spam check (only once you start filling in a form) and the Google service that receives a submitted form. We do not sell data, do not build marketing profiles and do not make decisions based solely on automated processing (Article 22 GDPR).
The Website is operated by a law firm. If contact through the Website leads to the provision of legal services, the related data is protected by the attorney-at-law's professional secrecy (Article 3(3)-(6) of the Polish Act on Attorneys-at-Law of 6 July 1982), and under Article 5a of that Act the right of access and to a copy (Article 15(1) and (3) GDPR), the right to restriction (Article 18) and the obligation under Article 19 GDPR apply only insofar as they do not breach professional secrecy, while the right to object under Article 21(1) GDPR does not apply to data obtained in connection with providing legal services - we will inform you about this separately when we start working together.
3. Purposes, legal bases and retention periods
| Purpose | Source / categories of data | Legal basis | Retention |
|---|---|---|---|
| A. Handling inquiries - e-mails and the contact form | name, e-mail address, selected subject, message body (for e-mail also attachments and metadata); for the form, additionally the address of the page it was sent from | Article 6(1)(b) GDPR (steps prior to entering into a contract at your request) - where you ask about a service for yourself; Article 6(1)(f) GDPR (our legitimate interest: handling correspondence) - in other cases, including when you write on behalf of a business | until the correspondence ends, no longer than 12 months after the last message (form records are deleted automatically after 12 months); if we start working together - thereafter under the rules for the Firm's clients |
| B. Providing the guide at your request | e-mail address, first name (optional), date sent, whether you ticked the newsletter consent | Article 6(1)(b) GDPR (performance of a contract for free digital content - Terms, § 2(3)) | 12 months after sending (deleted automatically) |
| C. Newsletter | e-mail address, first name (optional), language, consent history: sign-up date, confirmation date, version of the consent text, sign-up source, unsubscribe date; sending history | Article 6(1)(a) GDPR (consent) - for sending; consent to commercial communications by electronic means - Article 398(1) of the Polish Electronic Communications Law (PKE); keeping the consent history after unsubscribing - Article 6(1)(f) GDPR (legitimate interest: demonstrating compliance, Article 7(1) GDPR) | until consent is withdrawn; unconfirmed sign-ups - deleted after 30 days; consent and unsubscribe history - 3 years after unsubscribing; sending history - 24 months |
| D. Direct marketing and client acquisition - details in section 4 | contact details of persons representing businesses, obtained from public sources (company websites, KRS/CEIDG registers, LinkedIn) | Article 6(1)(f) GDPR (legitimate interest: marketing our own services - Recital 47 GDPR); e-mail channel only within the limits of Article 398 PKE | until you object, no longer than 6 months after the first contact if you do not reply |
| E. Operating and securing the Website - hosting logs and protecting forms against bots (Cloudflare Turnstile) | IP address, date and time of the request, URL, browser headers; for Turnstile - technical browser and device signals assessed by Cloudflare | Article 6(1)(f) GDPR (legitimate interest: security and availability of the Website, protecting forms against abuse) | hosting logs - per the provider's rules: according to Google, Firebase Hosting “retains IP data for a few months” (firebase.google.com/support/privacy, as of 24.09.2026); Turnstile - per Cloudflare's rules (section 5); we receive only the verification result and do not store it |
| F. Visit and event statistics (Cloudflare Web Analytics and our own measurement stored in Google Workspace) - only with your consent | Cloudflare: address of the visited and referring page, browser and device type, country, load times; the IP address is processed by Cloudflare for transmission. Our own measurement: the page visited, the type and domain of the traffic source (e.g. search engine, AI assistant, LinkedIn), campaign parameters (utm), device class, language, scroll depth, active time, clicks on buttons and outbound links, starting a form and the result of submitting it (not its content), quiz result and calculator use, and a random session identifier for the browser tab. We store no IP address and no identifier linking visits, and we do not combine the measurement with form data. | Article 6(1)(a) GDPR (consent) and consent to access information on your device - Article 399(1) PKE. The statistics script loads only after you click “I agree” in the statistics notice; without consent it is not downloaded. You can withdraw consent at any time via the “Statistics settings” link in the page footer. | Cloudflare - aggregated reports per the provider's rules; our own measurement - events for 14 months (deleted automatically), daily numeric summaries without identifiers - indefinitely; we do not combine them with data from rows A-D |
| G. Establishing, exercising or defending legal claims | data from rows A-F, to the extent necessary | Article 6(1)(f) GDPR | until the limitation periods expire (as a rule 3 years for business-related claims, Article 118 of the Polish Civil Code) |
Interactive tools ("AI Act Check", "Legal Stack Configurator", "Exposure Calculator", "Regulatory Radar") run entirely in your browser - your answers and inputs are not sent or stored anywhere, so we do not process personal data in connection with them.
Providing data is voluntary, but without an e-mail address we cannot reply, send the guide or send the newsletter. Consent to the newsletter is separate from the guide request, unticked by default and not a condition for receiving the guide. Please do not send documents, case details or special categories of data (Article 9 GDPR) in your first message - including through the form; we agree a secure channel individually once we are in touch.
4. Direct marketing and client acquisition
The Firm addresses its offer to businesses. We may contact you - as a person representing a business (board member, person responsible for compliance, data protection, IT or legal) - with a proposal to work together, even if you have not used the Website before.
- Source of data: your business details (name, position, business e-mail or phone, company name) are obtained from publicly available sources: company websites, the KRS/CEIDG registers, professional networks (e.g. LinkedIn) and industry events. This section constitutes the information referred to in Article 14 GDPR.
- Legal basis: Article 6(1)(f) GDPR - our legitimate interest in marketing our own services (Recital 47 GDPR). E-mails containing commercial information are sent only within the limits of Article 398(1) PKE. Our first message contains no commercial information - it only asks for consent to send it; we send an offer only once consent is given.
- The newsletter is a separate purpose (section 3, row C): you are added to the list only after signing up yourself and confirming via the e-mail link, or after consent documented in another way - never on the basis of public-source data alone.
- Recipients and transfer: correspondence is handled in Google Workspace (sections 5-6).
- Period: until you object, no longer than 6 months after the first contact if you do not reply.
- You may object at any time to the processing of your data for direct marketing (Article 21(2) GDPR). A "no" in reply to our message or an e-mail to hello@lexandroll.pl is enough. After an objection we will no longer process your data for this purpose.
5. Recipients (processors)
Data is processed on our behalf, under data processing agreements (Article 28 GDPR), only by the following providers:
| Provider | Role | Data | Location / transfer |
|---|---|---|---|
| Google LLC (USA) - Firebase Hosting | hosting the Website and content delivery network (CDN) | IP address and technical request data (section 3, row E) | Google servers, including outside the EEA - see section 6 |
| Google Ireland Ltd. / Google LLC - Google Workspace | the Firm's e-mail (Gmail); receiving forms, keeping the subscriber list and consent register, sending the guide and the newsletter (Google Apps Script, Google Sheets, Gmail) | data from section 3, rows A-C and our own event measurement from row F | EU / USA - see section 6; Apps Script is a Google Workspace Core Service covered by the data processing terms (Google Workspace Services Summary, as of 16.07.2026) |
| Cloudflare, Inc. (USA) | spam check for forms (Turnstile) and visit statistics (Web Analytics) | technical data from section 3, rows E and F, including IP address | Cloudflare's global network, including outside the EEA - see section 6 |
Otherwise we may disclose data only to entities authorised by law (e.g. a court or supervisory authority), subject to the attorney-at-law's professional secrecy.
6. Transfers outside the European Economic Area
Outside the European Economic Area, data may be processed by Google LLC (Google Workspace, Firebase Hosting) and Cloudflare, Inc. (Turnstile, Web Analytics). Transfers are based on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection under the EU-US Data Privacy Framework (Article 45 GDPR) - both entities are certified under it (dataprivacyframework.gov register, as of 24.09.2026: status active; next certification due for Google LLC by 13.09.2027 and Cloudflare, Inc. by 15.09.2027). We use no other providers outside the EEA.
You can obtain information about the safeguards by writing to hello@lexandroll.pl.
7. Third-party resources, cookies and browser storage
The Website sets no cookies. Fonts, images and our own script are served from our domain. Your browser connects to external servers in only three cases:
- Visit and event statistics - Cloudflare Web Analytics and our own measurement (only with your consent): on your first visit we ask for consent in a notice at the bottom of the page. Only after you click “I agree” does the browser send, when you leave a page, a batch of the events described in section 3, row F to the Google Apps Script service on our Google Workspace account, and load a script from
static.cloudflareinsights.comand send a page-view measurement tocloudflareinsights.com(page address, referrer, browser type, load times). According to the provider, the tool uses no cookies or local storage and does not track users across sites. We receive aggregated reports only. Without consent the script is not downloaded and the Website works fully. You can change your decision via the “Statistics settings” link in the footer. - Spam check - Cloudflare Turnstile (only pages with a form, and only once you start filling in the form): the browser loads a widget from
challenges.cloudflare.com, which assesses technical browser signals to tell humans from bots. The check is necessary to send the form you are asking to send (Article 399(3)(2) PKE - exemption for information necessary to provide an electronically supplied service requested by the user). - Submitting a form: the form content is sent to the Google Apps Script service (
script.google.com, response fromscript.googleusercontent.com) on our Google Workspace account.
The Website stores only two technical items in your browser (localStorage): the colour theme (light or dark) you choose with the switch in the header, and your decision on visit statistics, so that we do not ask on every visit. They do not identify you, are not sent to any server and serve only to carry out your choice (Article 399(3)(2) PKE - information necessary to provide a service requested by the user; no consent required). Only if you consent to statistics, we additionally store a random session identifier in the tab's memory (sessionStorage); it disappears when you close the tab and lets us count page views within one visit (Article 399(1) PKE - based on your consent). You can remove this data by clearing the site data in your browser.
8. Your rights
You have the right:
- of access to your data and to obtain a copy (Article 15 GDPR),
- to rectification (Article 16),
- to erasure - the "right to be forgotten" (Article 17),
- to restriction of processing (Article 18),
- to data portability for data processed on the basis of consent or contract (Article 20),
- to object to processing based on legitimate interest, including direct marketing (Article 21),
- to withdraw consent at any time - without affecting the lawfulness of processing before withdrawal (Article 7(3)). You can withdraw newsletter consent via the "unsubscribe" link in the footer of every message, your e-mail client's unsubscribe function or by writing to hello@lexandroll.pl; consent to visit statistics - via the “Statistics settings” link in the page footer; consent given in reply to our message (section 4) - by replying to any of our messages.
Send your request to hello@lexandroll.pl. We respond without undue delay and in any event within one month (Article 12(3) GDPR). We may ask you to confirm your identity if we have reasonable doubts about who is making the request.
The limitations arising from professional secrecy (section 2) concern data obtained in connection with providing legal services. They may also cover inquiries (section 3, row A) if they concern a matter in which we provide legal services; they do not apply to data processed solely for the purposes in rows B-F.
9. Right to lodge a complaint
If you believe we process your data unlawfully, you may lodge a complaint with the supervisory authority (Article 77 GDPR):
President of the Personal Data Protection Office (UODO)
ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland
tel. +48 22 531 03 00 · kancelaria@uodo.gov.pl · uodo.gov.pl
10. Security
The Website is served only over HTTPS (TLS), with security headers - including HSTS and a Content-Security-Policy that allows scripts only from our domain and the two Cloudflare services described in section 7, and outgoing connections only to those services and to the Google service receiving forms; the browser blocks any other external source. Forms are protected by a spam check, a honeypot field and submission limits. The subscriber list and form submissions are stored in the Firm's Google Workspace account, accessible only to the Firm. Access to the account is protected by multi-factor authentication.
11. Changes to this policy
We update this policy when the Website or the law changes. The version published at lexandroll.pl/en/privacy-policy applies; the version number and effective date are given at the top of the document. Newsletter subscribers are informed by e-mail of material changes concerning that service.