KPP LEX
Privacy policy
Version dated 25 October 2026. This policy covers kpplex.pl, its language versions and contact with Kancelaria Prawno-Podatkowa Sp. z o.o.
1. Controller and contact
The data controller is Kancelaria Prawno-Podatkowa Sp. z o.o., Aleja Stanów Zjednoczonych 72/12, 04-036 Warsaw, Poland, KRS 0000802761, NIP 1133003156. For personal data matters, email bok@kpplex.pl or write to the registered office.
2. Data and purposes
The form requires your full name, email address, enquiry topic and message. Company name and phone number are optional. We use this information to respond, assess possible cooperation and discuss its terms. Once an instruction is accepted, we use the necessary information to handle it.
- Steps taken at your request before entering into a contract and performing a contract to which you are a party: GDPR Article 6(1)(b).
- Correspondence with company representatives, handling enquiries, protecting the form and establishing, exercising or defending claims: GDPR Article 6(1)(f). Our legitimate interests are effective communication, website security and protection of the company's rights.
- Legal obligations, particularly accounting and financial obligations, where applicable: GDPR Article 6(1)(c).
Providing data is voluntary, but required fields are necessary to submit an enquiry and receive a response. Acknowledging these documents is not marketing consent. We do not subscribe you to a newsletter. Initially, provide only a general description; do not send sensitive data, Polish PESEL numbers, document scans or detailed personal data of others.
3. How the form works
When you press “Send enquiry”, your data is transmitted over encrypted HTTPS to the kpplex.pl server and then by email to bok@kpplex.pl. The message also includes its language and reference number. A confirmation is shown only after the server's mail transport accepts the message. This does not mean that your matter has been accepted or that a professional services contract has been concluded.
If an error occurs, your text remains in the open page so that you can retry. It is not stored in localStorage or cookies. We do not automatically send a copy to the address entered by a visitor. You can also contact us directly by email or phone.
4. Recipients
Data may be received by authorised correspondence handlers and providers of hosting, email, IT and company support services, to the extent necessary for the relevant purpose and on an appropriate basis. Access to case documents is determined by the agreed instruction. Data may also be disclosed to competent authorities where legally required. External maps and other websites are also subject to their providers' policies.
5. Retention
We retain correspondence for the time needed to respond and handle the matter, and afterwards to the extent and for the period required by law or necessary to establish, exercise or defend claims. Accounting documents are retained for the periods required by applicable law. Unnecessary data is deleted.
Supporting anti-spam counters and enquiry fingerprints are stored in hourly buckets. Files older than 24 hours are removed when the form receives a subsequent valid request. They contain no message text or plain-text email addresses. The form session holds a security token, creation time and the fingerprint and reference of the last enquiry. The token is valid for one hour; the session cookie has no persistent expiry set. The server may maintain technical logs including IP addresses, times and connection details. Form logging records only the enquiry reference and mail transport result, without message content.
6. Your rights
Subject to the GDPR, you may request access, rectification, erasure, restriction of processing and data portability where applicable. You may object to processing based on legitimate interests. You may lodge a complaint with Poland's President of the Personal Data Protection Office: uodo.gov.pl.
7. Cookies and security
We do not use advertising tools, profiling or external analytics. Fonts and graphics are served from this website. The form uses an essential kpp_contact session cookie marked Secure, HttpOnly and SameSite=Lax, and a token protecting against submissions from another website. We use server-side validation, a honeypot field, submission rate limits and protection against email header injection. The hosting provider may use its own essential security measures. We do not make decisions with legal effects on visitors solely by automated means.
8. Processing outside the EEA
Using infrastructure provided by international suppliers may involve processing outside the European Economic Area. Any such transfer requires a basis and safeguards provided for by the GDPR, including relevant adequacy decisions or standard contractual clauses. You can ask the controller for information about a specific contact.