Privacy Policy

16. DETAILED GDPR AND PKE PRIVACY SUPPLEMENT

Supplement version: 28 September 2026.

This section supplements the preceding provisions of the Policy and explains in greater detail how ONE PLUS Sp. z o.o. processes the data of website visitors, people who submit forms or book consultations, clients, company representatives, employers, employees and foreign nationals, and users of ONE PLUS electronic systems. It should be read together with the rest of this Policy, the Website Terms of Use and any privacy information provided in connection with a particular service.

Merely visiting the website or sending an enquiry does not amount to consent to every possible form of processing. For each purpose, ONE PLUS relies on the appropriate legal basis: performance of a contract or steps taken before entering into a contract, compliance with a legal obligation, a legitimate interest or consent, depending on the purpose and the type of data. Where an earlier statement in the Policy is more general, the more specific explanation in this section applies.

16.1. Data controller and contact point

The controller of personal data is ONE PLUS Sp. z o.o., ul. Marszałka Józefa Piłsudskiego 43/7, 50-032 Wrocław, Poland, KRS 0000739695, NIP 8971857670, REGON 380898127. Questions concerning personal data, consent, cookies or the exercise of data protection rights may be sent to [email protected]. For other matters, please use [email protected] or the details shown on the contact page.

A privacy-related message sent to another ONE PLUS address may be forwarded to an authorised member of the team. To protect personal data, the controller may ask for information needed to verify the requester’s identity, but will not request more information than is reasonably necessary for that verification.

16.2. Who this Policy covers

The Policy may apply to website visitors, current and prospective clients, people booking consultations, users of forms, messaging services and the client portal, authorised representatives, family members, employees and candidates named in case files, company representatives, contractors, suppliers, partners, people referred to in official correspondence and anyone whose data a client provides in connection with a matter handled by ONE PLUS.

Information relating to a natural person remains personal data when that person acts as a sole trader, management board member, employee, representative or contact person for a legal entity.

16.3. Categories of data processed

The scope of processing depends on the reason for contact and the service requested. ONE PLUS may process, in particular:

• identification data such as name, date and place of birth, citizenship, sex, signature, PESEL number and identity document details;
• contact details, including home and correspondence addresses, email address, telephone number, preferred language and communication channel;
• residence and immigration data, including information from passports, visas, residence cards, permits, decisions, border stamps, residence history and correspondence with public authorities;
• employment, business and employer-service data, including employer details, position, type of contract, remuneration, working time, qualifications and documents legalising work;
• family and personal circumstances where required for a case, such as information about a spouse, children, parents, guardians or inviting persons;
• financial, billing and tax data, such as bank account details, payment history, invoice details, NIP, income information and official fees;
• the content of enquiries, agreements, powers of attorney, forms, meeting notes, correspondence, documents and attachments provided for a case;
• technical and security data, including IP address, timestamps, session identifiers, device and browser information, visited URL, referral source, diagnostic data, system logs and recorded privacy settings;
• website activity data where the user has given the required consent to optional analytics or advertising;
• other information voluntarily supplied by the person or reasonably required to assess and carry out a specific instruction.

ONE PLUS does not require documents or information that are unrelated to the enquiry or service. Before sending a file, users should check whether it contains unnecessary information about other people.

16.4. Sources of personal data

Personal data most commonly comes directly from the person concerned. It may also be supplied by a client, employer, family member, authorised representative, contractor or partner involved in delivering the service. To the extent permitted by law, information may be obtained from public registers and sources such as KRS, CEIDG, the Polish VAT White List, official registers, public authority websites and documents released by a competent institution.

Where data was not obtained directly from the individual, ONE PLUS provides the information required by Article 14 GDPR unless a statutory exception applies. This may be the case, for example, where the person already has the relevant information, providing it is impossible or would involve disproportionate effort, or collection or disclosure is expressly required by law and appropriate safeguards are in place.

16.5. Purposes and legal bases

Personal data may be processed for the following purposes and on the following legal bases:

• responding to an enquiry, preparing a quote, arranging a consultation and taking steps before entering into a contract — Article 6(1)(b) GDPR and, for a person acting on behalf of another entity, also Article 6(1)(f) GDPR;
• entering into and performing a contract, handling a case, communicating, exchanging documents, settling service stages and providing client support — Article 6(1)(b) GDPR;
• corresponding with authorities, courts, banks, notaries, translators and other participants in a case — performance of a contract, compliance with a legal obligation or the legitimate interest in properly organising the service;
• accounting, tax matters, sales documentation, fraud prevention and compliance with other statutory obligations — Article 6(1)(c) GDPR;
• work organisation, client relationship management, deadline control, quality assurance, recording arrangements, establishing, pursuing or defending claims and preventing conflicts of interest — Article 6(1)(f) GDPR;
• protecting the website, forms, CRM and infrastructure against attacks, spam, fraud and unauthorised access, and conducting diagnostics — Article 6(1)(f) GDPR and, where required by law, Article 6(1)(c) GDPR;
• optional analytics, behavioural advertising, remarketing and storing optional identifiers on a user’s device — consent under Article 6(1)(a) GDPR in conjunction with Article 399 of the Polish Electronic Communications Law (PKE);
• direct marketing of ONE PLUS services within legally permitted limits — the legitimate interest under Article 6(1)(f) GDPR; email, telephone or another channel requiring prior consent is used only after that consent has been obtained;
• handling data protection requests and complaints and demonstrating GDPR compliance — Articles 6(1)(c) and 6(1)(f) GDPR.

Where processing relies on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawal does not automatically erase information that must continue to be retained on another legal basis, for example to meet tax obligations or defend legal claims.

16.6. ONE PLUS CRM and electronic case management

To organise client service and casework, ONE PLUS may use its own or externally provided CRM systems, including the solution available at crm.one-plus.pl, together with integrations for forms, email, telephony and task management. The CRM may record contact details, the source of an enquiry, the service of interest, the team member responsible, communication history, agreed actions, deadlines, case status, billing information and documents needed to perform the service.

Access to the CRM and working panels is limited to authorised people according to their responsibilities. Connections to crm.one-plus.pl use encrypted HTTPS. Safeguards may include role-based permissions, user authentication, logging of relevant events, backups, network protection, security updates, session restrictions and incident-response procedures. The measures used are selected according to the risk and current state of the art.

No information system can guarantee absolute protection against every threat. Security controls are therefore reviewed and updated periodically and, depending on risk, may be subject to testing, vulnerability assessment or audit. An audit or certification is presented as a fact only where a current document confirms its scope and outcome.

The CRM supports the work of the ONE PLUS team. It does not independently make official decisions or decisions producing legal effects for a client. Decisions in residence, employment, registration and administrative matters are made by the competent public authorities.

16.7. Special categories of data and criminal conviction data

Some matters may require information about health, disability, origin, religious beliefs, family life or other special-category data. ONE PLUS processes such information only where it is genuinely necessary and a condition under Article 9(2) GDPR applies, in particular explicit consent, the establishment, exercise or defence of legal claims, or another basis provided by law.

Data concerning criminal convictions and offences is processed only under the conditions set out in Article 10 GDPR and applicable specific legislation, for example where it is relevant to particular proceedings, an authority’s requirement or cooperation with an authorised professional representative. Please do not send this information unless it is required for the matter.

16.8. Recipients of personal data

Personal data is not sold. To the extent necessary for a particular purpose, it may be received by:

• authorised ONE PLUS employees and contractors who are bound by confidentiality;
• providers of hosting, servers, backups, network protection, website maintenance, CRM, email, telephony, videoconferencing and IT support;
• analytics and advertising providers, solely to the extent permitted by the user’s consent settings;
• payment operators, banks, accounting providers, invoicing systems and other parties involved in settlements;
• advocates, attorneys-at-law, notaries, tax advisers, sworn and ordinary translators, couriers, insurers and other specialists where their involvement is necessary and agreed;
• employers, contractors, representatives and family members only where this follows from the nature of the case, an authorisation or another legal basis;
• voivodeship offices, labour offices, the Border Guard, ZUS, tax authorities, courts, police, prosecutors and other public bodies where disclosure is required by law, a lawful request or the handling of the case.

A processor acts on documented instructions from ONE PLUS and under an agreement meeting Article 28 GDPR requirements. Where a recipient independently determines the purposes and means of processing, it may act as a separate controller and must provide its own privacy information.

16.9. Transfers outside the EEA

Some technology providers may process data in a country outside the European Economic Area or permit remote access from such a country. A transfer takes place only in accordance with Chapter V GDPR, in particular on the basis of a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules or a specific derogation provided by law.

Where Standard Contractual Clauses are used, ONE PLUS or the relevant provider assesses the circumstances of the transfer and implements supplementary measures where needed, such as encryption, data minimisation, access controls or pseudonymisation. Information about the applicable transfer mechanism may be requested at [email protected], subject to the protection of trade secrets and system security.

16.10. Retention periods

Personal data is kept no longer than necessary for the purpose for which it was collected and then for the period required by law or reasonably needed to protect legal claims. In practice, the following criteria apply:

• an enquiry that does not lead to a contract is kept until the contact ends and then for the time needed to document the response, assess risk and defend against claims; inactive enquiries are periodically reviewed and erased or restricted;
• client data and case files are kept throughout the service and afterwards for the limitation period applicable to potential claims and any mandatory accounting, tax or other statutory retention period;
• accounting and tax records are generally kept for five years, calculated under the relevant rules from the end of the applicable tax or financial year, unless a longer period is required;
• data processed on the basis of consent is kept until consent is withdrawn or the purpose ends; limited evidence of giving or withdrawing consent may be retained to demonstrate compliance;
• data used for direct marketing on the basis of legitimate interest is kept until a valid objection is made or the purpose ends earlier;
• cookie settings and optional identifiers are kept until the specific cookie expires, settings are changed, consent is withdrawn or browser data is manually deleted;
• technical and security logs are retained for diagnostics, business continuity, abuse detection and incident investigation; retention may be extended where a record is evidence of an event or claim;
• backups are retained until the end of the backup cycle and secure overwriting; backup data is not used for routine work and may be restored only following a failure or incident.

At the end of the applicable period, data is erased, anonymised or its further use is restricted. Retention may be extended where required for a claim, audit, proceeding, legal obligation or proper handling of a data subject request.

16.11. Cookies, browser storage and similar technologies

ONE PLUS distinguishes essential from optional technologies. Essential technologies may operate without consent where they are necessary to transmit a communication, ensure security, retain the selected language, operate a form, remember a privacy choice or provide a feature expressly requested by the user. Analytics, advertising, remarketing and other optional technologies are activated only after the required consent has been given.

Consent can be managed through the cookie banner and the privacy centre available on the Website Terms of Use page. A user may enable or disable an entire category and, where the interface permits, an individual tracker or plugin. Refusal must not prevent access to core website content except where a particular function objectively requires that technology.

Withdrawal applies prospectively. Individual files may also be removed in browser settings. Blocking all cookies may affect language preferences, forms, sessions and other technical functions. ONE PLUS may use consent-management mechanisms, including Google Consent Mode, to signal to tools that optional storage or access has not been permitted.

16.12. Commercial communications and marketing

Submitting a form about a particular service permits ONE PLUS to answer that enquiry; it does not automatically constitute consent to a newsletter or unrelated advertising. Where the law requires consent to use email, telephone, messaging services or an automated calling system for direct marketing, such communication starts only after consent has been obtained.

Marketing consent may be withdrawn, and a person may object at any time to marketing based on legitimate interest. Following an objection, ONE PLUS may retain the minimum information on a suppression list so that further communications are not sent to that address or number.

16.13. Profiling, artificial intelligence and automated decisions

Technical data, the source of a visit or contact history may be used to organise enquiries, measure website effectiveness and better match content, where permitted by law and the user’s consent settings. ONE PLUS may use automation or AI-assisted tools to search information, classify correspondence, prepare a working summary or check whether a file is complete. These tools support, rather than replace, human work.

ONE PLUS does not make decisions concerning a user that produce legal or similarly significant effects solely by automated means within the meaning of Article 22 GDPR. If this changes, the processing will be clearly described in advance, an appropriate legal basis will be identified and the required safeguards will be provided, including the possibility of human intervention.

Confidential documents must not be entered into a publicly available AI tool without an approved organisational basis, contract and security assessment. Team members may use only tools authorised for the relevant category of information.

16.14. Security measures

ONE PLUS uses technical and organisational measures appropriate to the risk, scope and purpose of processing. They may include:

• HTTPS/TLS encryption in transit, protective browser headers and safeguards for traffic and forms;
• individual accounts, role management and access limited to what is necessary for a person’s duties;
• authentication, password rules, session restrictions and additional controls where available and appropriate;
• system updates, availability and event monitoring, and protection against spam, bots, malicious traffic and unauthorised access attempts;
• backups, recovery procedures, restricted access to backups and controlled data disposal;
• data processing agreements, confidentiality commitments, authorisations, training and document-handling procedures;
• periodic review of permissions, suppliers, integrations, risks and the effectiveness of safeguards;
• data minimisation, separation of environments and pseudonymisation where appropriate to the process.

For security reasons, configuration details, backup locations, detection mechanisms and information that could facilitate an attack are not published. Users should protect their devices, email accounts and login details and should not send confidential documents through a channel whose authenticity they have not verified.

16.15. Personal data breaches

A suspected loss of data, a document sent to the wrong recipient, account takeover, disclosed password or other incident should be reported immediately to [email protected]. ONE PLUS assesses the scope, potential consequences, number of people affected, categories of data and measures available to reduce the risk.

Where a breach is likely to result in a risk to people’s rights and freedoms, the controller notifies the President of the Polish Personal Data Protection Office (UODO) without undue delay and, where feasible, within 72 hours of becoming aware of it, unless a statutory exception applies. Where the risk is high, affected individuals are informed in accordance with Article 34 GDPR unless safeguards already applied or another legal condition removes that obligation.

16.16. Data subject rights

Depending on the legal basis and circumstances, an individual has the right to:

• receive information, obtain access to personal data and receive a copy;
• rectify inaccurate data and complete incomplete data;
• request erasure where a condition in Article 17 GDPR applies and there is no basis for continued retention;
• restrict processing in the situations listed in Article 18 GDPR;
• receive and transmit data processed by automated means on the basis of consent or contract, where technically feasible and without adversely affecting other people’s rights;
• object, on grounds relating to a particular situation, to processing based on legitimate interest, and object to direct marketing at any time;
• withdraw consent at any time;
• receive information about safeguards used for transfers outside the EEA;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, subject to the exceptions provided by law.

A request may be sent to [email protected]. ONE PLUS responds without undue delay and generally within one month. That period may be extended by a further two months due to the complexity or number of requests; the person will be informed of the extension and reasons within the first month.

Exercising rights is generally free of charge. Where a request is manifestly unfounded or excessive, particularly because it is repeatedly made, the controller may charge a reasonable fee reflecting the cost or refuse to act in accordance with Article 12(5) GDPR. Before supplying a copy of case documents, ONE PLUS may redact other people’s data, legally protected confidential information and anything whose disclosure would infringe another person’s rights.

16.17. Complaint to the authority and judicial remedies

An individual may lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, https://uodo.gov.pl/, and may seek judicial remedies under the GDPR and national law. Contacting ONE PLUS first is not required, although a message to [email protected] may allow the issue to be resolved more quickly.

16.18. Whether providing data is voluntary or mandatory

Providing data in a form is voluntary, but fields marked as required are needed to answer the enquiry or deliver the selected function. When entering into and performing a contract, some details are necessary for identification, communication, settlement and provision of the service. Failure to provide required information or documents may make it impossible to enter into a contract, prepare a filing, assess the situation or comply with a legal obligation.

Where the scope of information follows from legislation or a competent authority’s requirements, ONE PLUS explains that requirement in the context of the relevant case. Refusal to provide optional data must not lead to adverse consequences unrelated to the purpose for which the data was requested.

16.19. Information about other people supplied by a client

A client who supplies information about an employee, family member, shareholder, representative or another person should be entitled to disclose it, limit the disclosure to what is necessary and, where required, tell that person that the data has been provided to ONE PLUS. A full identity document, health information or criminal conviction data should not be sent where a less detailed document or redacted extract is sufficient.

ONE PLUS may ask for evidence of authority, a power of attorney, the relationship with the person or another basis for disclosure. If data appears to have been provided without a basis or in excessive scope, the controller may restrict its use, return the document, remove unnecessary elements or decline to carry out the requested action.

16.20. Document confidentiality and work with professionals

Client documents are made available within the organisation on a need-to-know basis. People working on cases are bound by confidentiality. Where a matter requires an advocate, attorney-at-law, notary, tax adviser or sworn translator, that professional may act under applicable legislation and be subject to a separate duty of professional secrecy.

Working with a partner does not give that partner unrestricted access to the client’s entire history. Only the information required for the agreed task is provided, unless the client instructs a broader disclosure or the law requires it.

16.21. Minors

The website is not directed at children as independent recipients of services. A minor’s data may nevertheless be required in a family, residence, citizenship or documentation matter. In that situation, information is provided and processed with the involvement of a parent, guardian or other authorised person and only to the extent necessary for the case and the child’s best interests.

16.22. Social media, messaging services and external platforms

Communication through Facebook, Instagram, LinkedIn, YouTube, TikTok, WhatsApp, Telegram, Viber, map services, meeting platforms or another external service is also subject to that operator’s rules. The operator may act as a separate controller and process data outside ONE PLUS’s control. Documents containing extensive personal data should be sent through a channel identified by a ONE PLUS team member, not in a public comment or open group.

16.23. Data protection by design and by default

When implementing a new feature, form, integration or system, ONE PLUS takes account of data minimisation, purpose limitation, privacy by design and privacy by default. Where planned processing may create a high risk, a risk assessment is carried out before launch and, where required, a data protection impact assessment is performed. Suppliers and access permissions may be reassessed during the relationship.

16.24. Policy changes, versions and interpretation

This Policy may be updated in response to changes in law, case law, regulatory guidance, services, suppliers, the CRM, security controls or cookie technology. Material changes do not operate retrospectively so as to remove rights already acquired. Where a new consent is required, the user will be asked to provide it; continued use of the website does not replace an active choice where the law requires one.

If language versions differ, mandatory law and the language of documents agreed with the client remain decisive for the particular relationship. Translations are intended to provide understandable information and do not restrict rights granted by the GDPR.

16.25. Key legislation

This Policy takes account in particular of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), the Polish Personal Data Protection Act of 10 May 2018, the Polish Electronic Communications Law of 12 July 2024 (Prawo komunikacji elektronicznej), the Polish Act on Providing Services by Electronic Means of 18 July 2002, and applicable civil, tax, accounting and sector-specific rules. Current legal texts are available in the EUR-Lex and ISAP databases.