Data processing information clause

Under REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), further: “GDPR”, we inform you that:

Personal Data Controller

The Personal Data Controller of your personal data is the tax and law firm Tomczykowski Tomczykowska sp. z o. o., with its registered office in Warsaw, Aleje Jerozolimskie 93, 02-001 Warszawa, entered in the business register kept by the District Court for the city of Warsaw, 12th Commercial Department of the Polish Court Register, under number KRS 0000183769, tax identification number NIP 5262734243 (further: “Tomczykowski Tomczykowska sp. z o.o.” or “Company”).

Source and scope of personal data

Your personal data was provided to Tomczykowski Tomczykowska sp. z o.o. by your employer/customer with whom Tomczykowski Tomczykowska sp. z o.o. co-operates or takes actions in order to enter into co-operation.

Tomczykowski Tomczykowska sp. z o.o. received your personal data in the following scope: first name, last name, job, employing entity, company e-mail address.

Personal data processing purposes and grounds

  • Your personal data will be processed for purposes connected with the co-operation between Tomczykowski Tomczykowska sp. z o.o. and your employer/customer.
  • The legal grounds for processing your personal data for the aforesaid purposes are established by article 6 section 1 letter f) of the GDPR.
  • Tomczykowski Tomczykowska sp. z o.o.’s legitimate interest referred to in article 6 section 1 letter f) of the GDPR is entering into co-operation and performing correctly agreements to which Tomczykowski Tomczykowska sp. z o.o. is a party, including the co-operation with your employer/customer, and protecting tangible and intangible interests of Tomczykowski Tomczykowska sp. z o.o.

Automated decision-making, including profiling

Your personal data will not be subject to automated decision-making, including profiling, referred to in article 22 sections 1 and 4 of the GDPR.

Personal data recipients

  • In accordance with the GDPR, the Company may use processing entities (processors) and entrust them with processing personal data. The Company informs you that it will transfer personal data to other recipients to whom it entrusted the processing of your data. The category of such recipients includes: providers of IT infrastructure solutions; subcontractors or suppliers of and entities cooperating with the Company, which provide administration, accounting and financial, HR or advisory services, or other services contracted by the Company. Those entities may also use further processors.
  • Personal data may be processed outside the European Economic Area (EEA) based on the principles set out in Chapter V of the GDPR, in which case the Company will comply with the GDPR requirements and transfer personal data outside the EEA based on e.g. Standard Contractual Clauses. Additional information about personal data transfers outside the EEA is published by the Company in its communications on personal data processing and is also made available at the Company’s contact address.
  • The Company will not provide your personal data to other recipients, unless the provision thereof is admissible by the law, especially where it arises from the law or from the legal relationship between you and the Company.

Personal data processing period

Your personal data will be processed no longer than it is necessary to achieve the aforesaid purposes, and where the data processing requirement arises from the law – for the period prescribed by the law.

Your personal data will be processed during the period of the co-operation referred to above, and afterwards – for archival purposes, no longer than for six (6) months from the co-operation completion time.

If you object to the processing of your personal data – until the objection takes effect.

The period of processing your personal data may be extended, especially if the facts and/or legal situation change, and also where this is justifiable for the establishment, exercise or defence of claims.

Rights of data subjects

In the situations and subject to the principles set out in articles 15, 16, 17, 18, 20 and 21 of the GDPR, you have a right to: access, rectify or erase your data, to restrict or to object to its processing, and to data portability.

In addition, you have a right to lodge a complaint with the supervisory authority, which in the Republic of Poland is the Personal Data Protection Authority in Warsaw (UODO), address: ul. Stawki 2,  00‑193 Warszawa.



by traditional mail: Tomczykowski Tomczykowska sp. z o.o., ul. Aleje Jerozolimskie 93, 02-001 Warszawa.