Privacy Policy

1. General provisions

This Privacy Policy sets out the rules for processing and protecting the personal data of people who visit the website available at in-finance.pl (the “Website”), people who contact us, and our Clients and business partners, as well as the rules for using cookies.

We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”), the Polish Personal Data Protection Act of 10 May 2018 and the Polish Electronic Communications Law of 12 July 2024.

2. Data controller

The controller of your personal data is In-Finance Aleksandra Keller, with its registered office in Łomianki, ul. Wiosenna 68a, 05-092, entered in the Central Register and Information on Economic Activity (CEIDG), tax identification number (NIP): 525-121-62-20, statistical number (REGON): 529100203 (the “Controller”, “In-Finance” or “we”).

In matters concerning the protection of personal data you can contact us:

• by e-mail: biuro@in-finance.pl
• by post: at the address of the Controller’s registered office.

3. Where we obtain data from and what data we process

We process data that you provide to us directly, in particular through the contact form, by e-mail, by telephone or in connection with entering into and performing a contract. Depending on the situation, this may include:

• identification and contact data: full name, e-mail address, telephone number, company name, position;
• registration and billing data: address, NIP, REGON, bank account number;
• the content of correspondence and information provided in connection with an enquiry;
• technical data collected automatically when you use the Website: IP address, information about your browser and device, data from cookies (see section 11).

We may receive the data of people who represent Clients, or whom Clients have named as contact persons, from those Clients or from public registers (e.g. the National Court Register (KRS), CEIDG, the “White List” of VAT taxpayers).

4. Purposes, legal bases and retention periods

Purpose of processing	Legal basis	How long we keep the data
Replying to an enquiry sent through the form, by e-mail or by telephone	Article 6(1)(f) GDPR – our legitimate interest in replying to enquiries; Article 6(1)(b) GDPR – where the enquiry concerns entering into a contract	until the reply has been given and the correspondence has ended, and then for no longer than 12 months, unless a contract is concluded
Preparing an offer, and entering into and performing a contract for accounting, advisory, HR and payroll, and tax services	Article 6(1)(b) GDPR – necessity for entering into and performing a contract	for the duration of the contract and, after it ends, for the limitation period for claims
Contact with people who represent a Client or have been named as contact persons	Article 6(1)(f) GDPR – legitimate interest in the efficient performance of the contract	for the duration of our cooperation with the Client
Meeting obligations under the law, in particular tax and accounting obligations (e.g. issuing and storing invoices)	Article 6(1)(c) GDPR in conjunction with the Accounting Act, the Tax Ordinance and the tax acts	for the period required by law, as a rule 5 years from the end of the calendar year in which the tax payment deadline passed
Establishing, pursuing or defending against claims	Article 6(1)(f) GDPR – legitimate interest in protecting our rights	until the limitation period for claims under the Civil Code has passed
Keeping statistics and analysing traffic on the Website (analytics cookies)	Article 6(1)(a) GDPR – your consent	until consent is withdrawn or the cookie expires
Ensuring that the Website works properly and securely (necessary cookies)	Article 6(1)(f) GDPR – legitimate interest in keeping the Website working	for the period stated for the given cookie (see section 11)

5. Processing data on behalf of Clients

When providing accounting and HR and payroll services, we also process personal data for which our Client is responsible, e.g. the data of its employees, associates or business partners. In that case the Client is the controller of those data and In-Finance acts as a processor under a data processing agreement referred to in Article 28 GDPR.

People whose data are concerned in this respect should address their requests first of all to the Client as the controller. If such a request reaches us, we will pass it on to the Client without delay.

6. Recipients of data

We may pass on your data only to the extent necessary for the purposes stated, to the following categories of recipients:

• providers of IT services, including hosting of the Website, e-mail, and accounting and HR software;
• providers of analytics tools – only after you have given your consent;
• entities providing legal, advisory, audit, postal or courier services to us;
• banks – for the purpose of making payments;
• public authorities, including tax offices, the Social Insurance Institution (ZUS) and Statistics Poland (GUS) – where the obligation to pass on data arises from the law or from the scope of the services entrusted to us.

Entities that process data on our behalf do so under a data processing agreement and only in line with our instructions.

7. Transfers of data outside the European Economic Area

As a rule, we process data within the European Economic Area (EEA). Some of our providers (e.g. the provider of e-mail or of an analytics tool) may process data outside the EEA. In that case the transfer takes place on the basis of a European Commission decision confirming an adequate level of protection (e.g. the EU-U.S. Data Privacy Framework) or of standard contractual clauses approved by the European Commission.

8. Your rights

In connection with the processing of personal data, you have the right to:

• access your data and receive a copy of them (Article 15 GDPR);
• have your data rectified (Article 16 GDPR);
• have your data erased (Article 17 GDPR);
• have processing restricted (Article 18 GDPR);
• data portability (Article 20 GDPR) – for data processed on the basis of a contract or consent;
• object to processing (Article 21 GDPR) – for data processed on the basis of a legitimate interest;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal;
• lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, Poland) if you consider that the processing infringes the GDPR.

To exercise your rights, contact us in the way described in section 2. We will reply without undue delay, and no later than one month after receiving the request.

9. Providing data is voluntary

Providing data is voluntary. However, without contact data we will not be able to reply to your enquiry, and without the data necessary to enter into a contract we will not be able to conclude and perform it. Where providing data is required by law (e.g. data for an invoice), it is a statutory requirement.

10. Automated decision-making

We do not make decisions about you that are based solely on automated processing, including profiling, and that would produce legal effects or similarly significantly affect you.

11. Cookies

The Website uses cookies, that is, small text files saved on your device while you browse, and the browser’s local storage, which works in a similar way. We use the following kinds of cookies:

• Necessary – they make the Website work properly, e.g. by remembering your choice about cookies and by keeping the people who manage the Website logged in. They do not require consent.
• Analytics – they help us understand how people use the Website and improve its content. We use Google Analytics for this purpose. We use these cookies only after you have given your consent.

On your first visit to the Website we display a banner in which you can accept analytics cookies or choose necessary cookies only. You can change your choice at any time using the “Cookie settings” link in the footer of the Website. You can also manage or delete cookies in your browser settings; restricting necessary cookies may, however, affect how the Website works.

List of cookies

Name	Provider	Purpose	Type	Storage period
if-cookies (browser local storage)	In-Finance	remembering your choice about cookies	necessary	until the Website’s data are cleared in the browser
wordpress_test_cookie	In-Finance (WordPress)	checking whether the browser accepts cookies; set only on the login page of the administration panel	necessary	session
wordpress_logged_in_* wordpress_sec_*	In-Finance (WordPress)	keeping the people who manage the Website logged in; does not apply to visitors	necessary	session or up to 14 days
wp-settings-* wp-settings-time-*	In-Finance (WordPress)	remembering administration panel settings; does not apply to visitors	necessary	up to 12 months
_ga	Google Analytics (Google Ireland Limited)	telling visitors apart for visit statistics	analytics	up to 2 years
_ga_*	Google Analytics (Google Ireland Limited)	keeping the session state for visit statistics	analytics	up to 2 years

12. Data security

We apply appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration or disclosure. The Website uses an encrypted connection (SSL/TLS), and only authorised people who are bound by confidentiality have access to the data. As a firm providing accounting and advisory services, we attach particular importance to the confidentiality of the information our Clients entrust to us.

13. Links to other websites

The Website may contain links to other websites, including our social media profiles. We are not responsible for the privacy practices of those services and encourage you to read their privacy policies.

14. Changes to the Privacy Policy

The Privacy Policy may be updated, in particular because of changes in the law, the development of the Website or changes in the tools we use. The current version is always available on the Website, together with the date from which it applies.