Privacy policy

1. Data controller

The controller of the personal data covered by this policy (except the data described in the last paragraph of this section) is Dmytro Sarbash, ul. Ostródzka 13A/1, 03-289 Warszawa, NIP 5214079906 (the Provider).

For matters concerning personal data you can contact the Provider at info@legalizehub.pl. The Provider has not appointed a data protection officer.

The controller of the data that firms enter into the system (including their clients’ data, other content and the activity log) is the firm concerned; the Provider processes it on the firm’s behalf as a processor (see section 2). This also applies to a request sent from the rating to a chosen firm: once it has been passed to that firm’s CRM, the controller is that firm, and the Provider processes it on the firm’s behalf as a processor.

2. What data we process

The data depends on the role in which someone uses the Service.

• The request form on the website: name, firm name, city, one contact field (a phone number or a Telegram or WhatsApp handle), the approximate number of clients the firm handles per month, the selected plan, the language of the site and the address of the page the form was sent from. Providing the data is voluntary, but the request cannot be handled without it. To limit abuse, the sender’s IP address is written to a request counter and removed periodically after the counter expires.
• The rating of firms: clicks to the contacts of rated firms and to their pages on other services, views of firm pages, requests sent from the “Is this your firm?” block and requests sent to firms are counted as events that hold no data identifying the visitor. We record only the firm, the kind of event, the language, the address of the page and the time, and an event is not linked to any person. This counting does not record an IP address, uses no cookies and does not store browser data (the browser header is used only to filter out robots and is not recorded). To avoid counting repeats, a short-lived irreversible hash is made from the IP address, the firm and the kind of event (using a secret key); it is pseudonymous data and goes into a counter; the counter stops counting after 10 minutes and is removed periodically.
• A request to a firm from the rating: name, one contact field (a phone number, an e-mail address or a Telegram handle), a question (optional) and the chosen firm. Providing the data is voluntary, but it is needed to pass the request on to the firm. The request goes to the CRM of the chosen firm, and that firm’s administrators receive a notification in the system. To limit abuse, the sender’s IP address is recorded in the request counter and deleted periodically after the counter expires.
• Accounts of the system’s users, that is, the staff of the firms: e-mail address, name, role in the system, sign-in data (the password is stored only as a hash) and data about sign-ins and the security of the account. This data comes from the firm that added the user to the system or from the user (Article 14 GDPR).
• Correspondence and billing: the content of messages sent to the Provider and the data needed to issue an invoice.
• Technical data: hosting providers record basic connection data (IP address, time, browser) for security and diagnostics.
• Data of the firms’ clients and other content entered into the system: firms using the system, including through their users, enter into it the data of their clients (including identification and contact details, information about documents, family, cases and payments) and a log of actions in the system. The controller of that data is the firm concerned, and the Provider processes it as a processor under Article 28 GDPR (RODO) and a data processing agreement, only on the firm’s documented instructions and to the extent needed to provide the service. A person whose data this is should address requests to the firm that handles their case; the Provider will help the firm to carry them out.

3. Purposes and legal bases

Data is processed for the following purposes:

• handling a request from the form and getting in touch about a demonstration of the system: Article 6(1)(f) GDPR (the Provider’s legitimate interest in answering a business enquiry from a firm’s representative) and, where a sole trader contacts the Provider on their own behalf, also Article 6(1)(b) GDPR (steps taken at the request of the person before entering into a contract); ticking in the form that the person has read the privacy policy is an acknowledgement, not consent to the processing;
• passing a request from the rating to the chosen firm and the statistics of the rating: the request is passed on under Article 6(1)(a) GDPR (consent given by ticking the box when the request is sent); the consent can be withdrawn at any time, with the chosen firm or by e-mail to info@legalizehub.pl, which does not affect the lawfulness of processing carried out before the withdrawal; ticking this box is a consent, unlike the confirmation of having read the policy in the request form on the website; counting clicks, views and requests for the statistics of the rating (the events contain no IP address, cookies or browser data and are not linked to a person; the short-lived hash that protects against repeats is pseudonymous data) relies on Article 6(1)(f) GDPR (the Provider’s legitimate interest in reliable statistics for the rated firms and in protecting the counting from repeats and robots);
• concluding and performing the agreement on the use of the system and billing the firm: Article 6(1)(b) GDPR, and for persons acting on behalf of the firm Article 6(1)(f) GDPR;
• creating and maintaining the accounts of users (the staff of firms), technical support, security of the system and preventing abuse, including limits on requests: Article 6(1)(f) GDPR (the Provider’s legitimate interest in performing the agreement concluded with the firm and securing the system); the agreement is concluded with the firm, not with its employee;
• issuing invoices, keeping accounts and other duties under tax and accounting law: Article 6(1)(c) GDPR;
• establishing, pursuing and defending claims and traffic statistics for the Service: Article 6(1)(f) GDPR (the Provider’s legitimate interest);
• processing the data of firms’ clients on behalf of those firms: the data processing agreement concluded under Article 28 GDPR.

4. Recipients of data

The Provider uses services of entities that process data on its behalf (Supabase, Vercel, Resend) under data processing agreements that comply with the GDPR. The payment operator Tpay processes data as a separate controller, in line with the rules on payment services; each firm uses its own account with that operator.

Telegram: for every new request from the form, the Provider receives a notification through the Telegram messenger containing the name, firm name, city and contact details given in the form. The operator of Telegram is Telegram FZ-LLC, based in Dubai (United Arab Emirates). There is no data processing agreement between the Provider and Telegram. If a firm configures messages to its clients through Telegram, the messages are passed through that messenger on the firm’s instructions.

• Supabase: database and authentication; data is stored on servers in the European Union (Paris region, France);
• Vercel: hosting of the application (Paris region) and traffic analytics for the Service;
• Resend: sending e-mails from the system, for example notifications and invitations;
• Tpay: online payment operator, if a firm accepts online payments from its clients;
• the rated firm to which a person sent a request: receives it (name, contact details, question) as a separate controller and is responsible for further processing; the Provider keeps the request in that firm’s system as a processor and does not send requests from the rating to Telegram;
• providers of accounting and legal services, to the extent needed for those services, and public authorities where the law requires it.

5. Transfers outside the European Economic Area

Data in the system is stored on servers in the European Union. Some providers (for example Vercel, Resend) are based, or have affiliated entities, outside the European Economic Area, in particular in the United States. Where data is transferred there, it is done under the mechanisms of Chapter V GDPR, in particular standard contractual clauses or a European Commission decision confirming an adequate level of protection.

The notification about a request from the form, passed through Telegram, reaches an operator based in the United Arab Emirates, for which there is no adequacy decision, and the Provider has not concluded standard contractual clauses with Telegram. The transfer takes place because it is necessary to respond to the request (Article 49(1)(b) GDPR). A person who does not want their data to be passed through Telegram can contact the Provider by e-mail instead of using the form.

Information about the safeguards used can be obtained from the Provider.

6. How long we keep data

Retention periods depend on the purpose of processing:

• requests from the form: 12 months from receipt, unless an agreement is concluded earlier (then the data becomes part of the contract documentation) or the person objects;
• requests from the rating: in the system of the chosen firm for as long as the firm, as the controller of that data, decides; the statistical events of the rating contain no IP address, cookies or browser data and are not linked to a person, and the hash in the counter expires after 10 minutes and is removed periodically;
• user accounts and firms’ data: for the duration of the agreement and, after it is terminated, until the data is deleted, which happens no later than 30 days after the agreement ends or within 30 days of the firm’s earlier request, whichever comes first, as set out in the Terms of service (Regulamin);
• accounting and billing documents: for the period required by law, as a rule 5 years from the end of the tax year;
• data needed to pursue or defend claims: until the claims become time-barred;
• data of firms’ clients: as long as the firm, as the controller of that data, specifies, but no longer than the service is provided and the deletion period set out in the Terms of service runs.

7. Rights of data subjects

Every person whose data is processed has the right to:

• access their data and obtain a copy of it (Article 15 GDPR);
• rectify the data (Article 16 GDPR);
• erase the data (Article 17 GDPR);
• restrict processing (Article 18 GDPR);
• data portability (Article 20 GDPR);
• object, on grounds relating to their particular situation, to processing based on a legitimate interest (Article 21 GDPR);
• withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (Article 7(3) GDPR), where the processing is based on consent;
• lodge a complaint with the President of the Personal Data Protection Office (PUODO) if the processing infringes the GDPR.

8. How to exercise these rights

Requests concerning data for which the Provider is responsible should be sent to info@legalizehub.pl. A reply will be given without undue delay and at the latest within one month of receiving the request.

Requests concerning the data of a client of a firm that uses the system, or a request sent from the rating that has already reached the chosen firm, should be addressed to that firm. If someone turns to the Provider about such a matter, the Provider will pass the request on to the firm and help it to carry the request out.

9. Profiling and automated decisions

The Provider does not take decisions about anyone based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect the person.

Deadline reminders created in the system follow rules set by the firm and are not an assessment of the person they concern.

10. Cookies and analytics

The Service uses only necessary cookies and browser storage, for example to remember the chosen language and to keep the session after sign-in. We do not use advertising or marketing cookies.

The Service (the website and the application) may use Vercel analytics (Web Analytics and Speed Insights), which measures traffic and speed. According to the provider, it works without cookies and without building profiles of visitors. Data from the request form does not reach analytics.

11. Changes to this policy

The policy may be updated, in particular when the services or providers change. The current version is available on this page, and the date of the last change is shown at its top. The Polish version is binding; versions in other languages are translations provided for convenience.