Privacy policy

Version dated 9 September 2026

1. Data controller

The controller of personal data processed in connection with the use of jtwpoland.com (the “Site”) is Zbyszko Pora, licensed tax advisor (registration no. 14787), conducting business under the name Doradztwo Podatkowe Zbyszko Pora, ul. Promień 11/3, 51-659 Wrocław, Poland, tax ID (NIP) 6112712298, REGON 544668930, entered in the Central Register and Information on Economic Activity (CEIDG) — the “Controller”. Contact regarding personal data: kontakt@jtwpoland.com or by post to the above address.

We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR), the Polish Act of 10 May 2018 on the Protection of Personal Data, the Act of 18 July 2002 on the Provision of Services by Electronic Means and the Act of 12 July 2024 — Electronic Communications Law.

2. What data we process, for what purpose and on what basis

Contact form and e-mail correspondence

Full name, e-mail address, selected topic and the content of the message. Purpose: replying to the enquiry, conducting correspondence and — where the enquiry aims at it — agreeing the scope of cooperation. Legal basis: Article 6(1)(f) of the GDPR (the Controller’s legitimate interest in handling enquiries and conducting correspondence) and, as regards steps taken with a view to concluding a contract, Article 6(1)(b) of the GDPR.

Server logs

IP address, date and time of the request, address of the requested resource, browser and operating system information — recorded automatically by the hosting provider. Purpose: ensuring security, the proper functioning of the Site and detecting abuse. Legal basis: Article 6(1)(f) of the GDPR.

Establishing, exercising or defending legal claims

Correspondence data may be retained to document its course and to establish, exercise or defend claims. Legal basis: Article 6(1)(f) of the GDPR.

3. Retention period

Data from the contact form and correspondence is retained for the time necessary to handle the enquiry and then — to document the course of the correspondence and to establish, exercise or defend claims — for no longer than 3 years from the end of the correspondence, unless a longer period results from the law or from a concluded contract. Server logs are retained for the period resulting from the hosting provider’s configuration, no longer than necessary for security purposes.

4. Recipients of data and transfers outside the European Economic Area

Data may be processed by the providers of technical services used to maintain the Site and to handle e-mail:

• IONOS — the hosting provider of the Site and of the technical mailbox in the jtwpoland.com domain (an IONOS group company established in the United Kingdom). Data may be processed on servers in the European Union or in the United Kingdom. Transfers to the United Kingdom take place on the basis of the European Commission’s adequacy decision (Article 45 of the GDPR) — the decision of 28 June 2021, renewed by the decisions of 19 December 2025 valid until 27 December 2031.
• Google — messages sent through the contact form are forwarded to the Controller’s mailbox operated in the Gmail service (Google LLC, United States). Transfers to the USA take place on the basis of Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the EU-U.S. Data Privacy Framework (Article 45 of the GDPR); Google LLC is certified under this mechanism. Should this decision or certification cease to be valid, the Controller will apply other safeguards provided for in Article 46 of the GDPR (in particular standard contractual clauses).

Data is not disclosed to other entities unless such an obligation results from the law (e.g. at the request of a competent authority).

5. Voluntary provision of data

Providing data is voluntary but necessary to reply to your enquiry — without an e-mail address we are unable to respond. Failure to provide data has no other consequences.

6. Rights of data subjects

Under the GDPR you have the right of access to your data (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and the right to object to processing based on legitimate interest (Article 21). Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before its withdrawal (Article 7(3) of the GDPR). To exercise these rights, simply send a message to kontakt@jtwpoland.com.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office of Poland (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

7. Cookies and other technologies

The public pages, including pages for requesting and downloading e-books and for confirming or withdrawing newsletter consent, do not use cookies. We do not use analytics tools, advertising pixels or marketing cookies. The administrator panel uses only an essential session cookie for authentication and access protection. The session expires no later than 20 minutes after login; the cookie uses Secure, HttpOnly and SameSite=Strict protections.

When you close the notice on a public page, we save only a dismissal flag in the browser’s local storage. It is not used for tracking and is not sent to the server. You can remove it by clearing the site data in your browser settings. The essential administrator cookie and storage of your explicit request to close the notice support a function requested by the user (Article 399(3) of the Polish Electronic Communications Law; Article 5(3) of Directive 2002/58/EC). We do not require marketing consent on this basis. If we introduce technologies that require consent, we will implement a suitable mechanism before using them.

8. Automated decision-making and profiling

The Controller does not take decisions based solely on automated processing, including profiling, which would produce legal effects concerning the user or similarly significantly affect them (Article 22 of the GDPR).

9. Security and confidentiality

The Site is served over an encrypted connection (HTTPS/TLS). Only authorised persons have access to correspondence. The contact form is not a channel for transmitting special categories of data, passwords, login details or documents containing information covered by professional secrecy — in such matters we agree a secure method of transferring materials in advance.

10. Nature of the Site’s content

Materials published on the Site are educational and informational in nature. They do not constitute tax advice, a tax opinion or a guarantee of a particular outcome in any specific case. Neither using the Site nor sending a message through the form creates an advisor–client relationship.

11. Changes to this Policy

This Policy may be updated in connection with changes to the Site’s functionality, technology providers or the law. The current version is always available at jtwpoland.com/polityka-prywatnosci.html (Polish) and at this address (English translation). In the event of any discrepancy, the Polish version prevails.

12. E-books and newsletter

The data controller is Doradztwo Podatkowe Zbyszko Pora, ul. Promień 11/3, 51-659 Wrocław, Poland. Contact: kontakt@jtwpoland.com.

Your email address, selected publication, language and technical request data are used to deliver the e-book you requested (Article 6(1)(b) GDPR). The link is valid for 48 hours. The email address used for delivery becomes eligible for deletion after 72 hours; the technical record of a pending confirmation may remain for 7 days.

Separately, with your voluntary consent, we process your address, language and newsletter subscription history (Article 6(1)(a) GDPR; Article 398 of the Polish Electronic Communications Law). A separate confirmation is required; an unconfirmed address is not added to the active mailing list. Unconfirmed subscriptions become eligible for deletion after 7 days. Confirmed subscriptions remain active until you withdraw consent or the newsletter ends. You can unsubscribe using the link in each newsletter message or by contacting us. Withdrawing consent does not affect the lawfulness of earlier processing.

After you unsubscribe, we retain a limited record of consent and withdrawal for up to 3 years solely to document consent and defend legal claims; we retain it longer only in connection with a specific unresolved dispute (Article 6(1)(f) GDPR). Data used to limit abuse, including a pseudonymised IP address identifier, is kept for up to 24 hours based on our legitimate interest in protecting the site (Article 6(1)(f) GDPR). These periods apply to this module's data; retention of the hosting provider's separate logs is described elsewhere.

Only authorised persons can access the mailing list. Hosting, email and technical service providers acting on our behalf may receive data. Information about providers and transfers outside the European Economic Area is available in the relevant section of this Policy.

You may request access, rectification, erasure, restriction of processing and portability where the law provides for these rights. You may object to processing based on legitimate interests and may object to direct marketing unconditionally. You may lodge a complaint with the President of the Polish Personal Data Protection Office. Providing your address is voluntary but necessary to receive a link by email; consent to marketing is not required.

The module does not profile recipients or make automated decisions about them. The download pages do not use cookies. The administrator panel uses only an essential, short-lived session cookie; we do not use marketing or analytics cookies.

Data that becomes eligible for deletion after the retention periods above is physically deleted in maintenance cycles performed at least daily, no later than 24 hours after the relevant period ends. This applies to all stated data retention periods for this module. Link validity is checked separately: a download link expires after 48 hours and a subscription confirmation link after 7 days; the maintenance schedule does not extend their validity.