Privacy & cookies policy

This policy explains what personal data I process when you visit werdeck.pl, write to me or sign up for the newsletter.

1. Data controller and contact

The controller of your personal data is Piotr Glabisz, running a business under the name Piotr Glabisz, Tax ID (NIP) 8862777570.

postal address: PO Box 105, 57-300 Kłodzko, Poland
e-mail: kontakt@werdeck.pl

I have not appointed a data protection officer, as this is not mandatory in my situation. For all matters concerning your data, please write to kontakt@werdeck.pl.

This policy applies only to the werdeck.pl website and contact through it. The data of clients to whom I provide legal assistance is processed under separate rules.

2. Professional secrecy of an attorney-at-law

As an attorney-at-law (radca prawny), I am bound by professional secrecy. It covers everything I learn in connection with providing legal assistance, including the content of your first message, a conversation or a consultation, even if we do not end up working together. This obligation arises from Article 3 of the Polish Act on Attorneys-at-Law (ustawa o radcach prawnych) and the Code of Ethics for Attorneys-at-Law.

Professional secrecy gives you stronger protection than data protection law alone:

it is not limited in time and continues after our cooperation ends,
it also protects the very fact that you approached me for legal assistance,
I also bind the people who work with me and have access to information,
I do not disclose information covered by secrecy to anyone, unless expressly required by law.

That is why I choose service providers, such as e-mail or hosting, that ensure confidentiality. Professional secrecy may also limit some of your GDPR rights described in section 10, for example the right of access, where disclosure would breach secrecy towards another person.

3. E-mail correspondence and telephone calls

What data: your e-mail address or phone number, your name and whatever you write in your message.
Why: to answer your question and correspond with you.
Legal basis: my legitimate interest in responding to messages (Article 6(1)(f) GDPR). When we discuss entering into a contract, e.g. a consultation, also steps taken at your request before entering into it (Article 6(1)(b) GDPR).
How long: for as long as needed to deal with the matter, and then in my correspondence archive until any claims become time-barred.

Providing your data is voluntary, but without it I cannot reply. A short description of the matter is enough in your first message; we will discuss the details later.

4. Newsletter

What data: your e-mail address and, if you provide it, your first name. The newsletter system also records the date of sign-up, the IP address you signed up from and mailing statistics: whether a message was opened and which links you clicked.
Why: to send you the newsletter with new blog posts, changes in the law and information about my services; I use the statistics to improve the content.
Legal basis: your consent given when signing up (Article 6(1)(a) GDPR and, as regards commercial information, Article 398 of the Polish Electronic Communications Law). I base the statistics and keeping proof of consent on my legitimate interest (Article 6(1)(f) GDPR).
How long: until you unsubscribe. After that, I keep only your e-mail address and consent history until claims become time-barred, so that I can show when you gave and withdrew your consent.

You can unsubscribe at any time by clicking the link at the bottom of every message or by writing to me. Withdrawing consent does not affect the lawfulness of mailings sent before you unsubscribed.

5. Comments on blog posts

What data: the name you comment under (a first name or a nickname), your e-mail address, optionally your website address, the content of the comment and its date. WordPress also records your IP address and information about the browser you used to post the comment.
What is public: only the name, the content of the comment, its date and, if provided, your website address. I do not publish your e-mail or IP address.
Why: to publish and moderate comments, protect the blog from spam and abuse and, if necessary, contact you about your comment.
Legal basis: my legitimate interest in hosting discussion under posts and protecting the blog (Article 6(1)(f) GDPR).
How long: until the comment is deleted by me or at your request.

Providing a name and e-mail address is voluntary, but you cannot post a comment without them.

Obligations under the Digital Services Act (DSA). By enabling comments, I provide a hosting service within the meaning of the DSA. Therefore I:

accept notices of illegal content in comments at kontakt@werdeck.pl,
inform users of my decisions with a statement of reasons and handle complaints against them,
provide information about users on the basis of an order from a competent authority,
notify law enforcement authorities when I suspect a criminal offence threatening the life or safety of persons.

To this extent I process data because the DSA requires it (Article 6(1)(c) GDPR). The point of contact for authorities and users is kontakt@werdeck.pl, in Polish or English.

6. Consultation booking and online payments

What data: your name, e-mail address, phone number, the chosen date and type of consultation, a short topic of the meeting, invoicing details and payment information (amount, status, transaction number). I do not receive your card or bank account details; they are handled by the payment operator.
Why: to book and conduct the consultation, accept payment, remind you of the appointment and issue an invoice.
Legal basis: entering into and performing the consultation contract (Article 6(1)(b) GDPR), and issuing an invoice as a legal obligation (Article 6(1)(c) GDPR).
How long: for the duration of the service, and then until claims become time-barred. I keep invoices for as long as tax law requires (section 7).

7. Accounting records and archive

If I issue you an invoice, it becomes part of my accounting records. I keep it for the period required by tax law, as a rule 5 years from the end of the year in which the tax payment deadline expired. The legal basis is my legal obligations (Article 6(1)(c) GDPR in conjunction with tax and accounting law).

I may also keep data from correspondence, contracts and settlements until claims become time-barred. I do this so that, in the event of a dispute, I can demonstrate the course of our cooperation and establish, exercise or defend legal claims, which is my legitimate interest (Article 6(1)(f) GDPR).

8. Website operation and server logs

The website runs on my hosting provider’s servers, which record every connection in server logs. The logs contain the IP address, the date and time of the visit, the address of the page visited and information about the browser and operating system.

Why: to keep the website running and secure, and to detect errors and attacks.
Legal basis: my legitimate interest in ensuring the operation and security of the website (Article 6(1)(f) GDPR).
How long: in line with the hosting settings. I do not combine logs with other data or use them to identify you, unless this is necessary to investigate an attack on the website.

The website’s fonts, scripts and images are stored on my server.

9. Recipients of data

Your data may be accessed by companies whose services I use in running my business:

the hosting provider whose servers run the website,
the e-mail service provider,
the newsletter system provider,
the booking tool provider and the payment operator, once I launch consultation booking,
an accounting office or invoicing system provider,
people and companies providing technical support for the website, only to the extent needed for their work.

These entities process data on my instructions, under data processing agreements (Article 28 GDPR). Where necessary, data may also be passed to another attorney-at-law or advocate bound by professional secrecy, and to public authorities where required by law, e.g. the tax office or a court.

Transfers outside the European Economic Area. As a rule, data does not leave the EEA. If a provider stores data outside the EEA, e.g. in the USA, this is based on a European Commission adequacy decision (e.g. the EU-U.S. Data Privacy Framework) or standard contractual clauses.

10. Your rights

The GDPR gives you the following rights:

to access your data and receive a copy of it,
to have inaccurate data rectified,
to have your data erased where there is no longer a basis for processing it,
to restrict processing, e.g. while it is being checked whether the data is accurate,
to object to processing based on my legitimate interest, on grounds relating to your particular situation,
to data portability for data you provided to me under a contract or on the basis of consent,
to withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal.

To exercise these rights, write to kontakt@werdeck.pl or to Piotr Glabisz, PO Box 105, 57-300 Kłodzko, Poland. I will reply without undue delay and within one month at the latest. These rights are not absolute; for example, I will not delete an invoice that I am required by law to keep.

If you believe that I process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.

I do not make decisions about you based solely on automated processing, including profiling.

11. Cookies and browser storage

The website uses a few cookies necessary for it to work. Cookies are pieces of information stored by a website in your browser. The website also uses similar mechanisms: the browser’s local storage (localStorage) and session storage (sessionStorage).

The law (Article 399 of the Polish Electronic Communications Law) does not require consent for storage that is necessary for the website to work or for a feature you request yourself, such as choosing a language. The website uses only such storage.

Name	Type	Purpose	Duration
pll_language	cookie	remembers the selected language version of the website (PL or EN)	5 days
werdeck-theme	local storage	remembers your choice of the “Contrast” version; stored only when you click the switch	until you clear your browser data
wpEmojiSettingsSupports	session storage	checks whether your browser displays emoji natively	until you close the browser tab
comment_author_… (3 cookies)	cookies	remember your name, e-mail and website for future comments; only if you tick this option when commenting	347 days

The “Contrast” version may also switch on automatically if increased contrast is enabled in your system settings. In that case, the website stores nothing.

12. Managing cookies

In your browser settings you can delete stored cookies and site data at any time, or block them for all websites or only for werdeck.pl. You can also use private (incognito) mode, in which stored data disappears when you close the window.

The website also works without this storage. If you delete it, your browser will simply not remember your chosen language and the “Contrast” version, so the website will open in Polish and in the dark version.

13. Changes to this privacy policy

I will update this policy when the law, the tools I use or the website’s features change, e.g. after launching comments or consultation booking. The current version is always available on this page, and I will provide previous versions on request sent to kontakt@werdeck.pl.

Version of 4 November 2026.