Privacy and Personal Data Processing Policy

Paralion Sp. z o.o. | version dated 23 October 2026

This Policy explains how Paralion Sp. z o.o. processes personal data in connection with its analytical activities, including the preparation and delivery of the „Poland in Brief” report to Clients, handling inquiries, entering into and performing Contracts, contacting Clients, and the use of the Website.

Capitalised terms, in particular Client, PNPK Client, Report, Edition, Contract, and Authorised Recipient, shall have the meanings assigned to them in the Paralion Terms and Conditions for the Provision of Electronic Services, available at www.paralion.pl/regulamin (hereinafter the „Terms and Conditions”).

1. Who processes personal data?

1.1. The Data Controller is Paralion Sp. z o.o., with its registered office in Poznań, ul. Św. Marcin 29/8, 61-806 Poznań, Poland, entered into the Register of Entrepreneurs of the National Court Register maintained by the District Court Poznań – Nowe Miasto i Wilda in Poznań, 8th Commercial Division of the National Court Register, under KRS number: 0001274699, NIP (TAX ID): 7831965637, REGON: 54601963700000 (hereinafter „Paralion” or the „Data Controller”).

1.2. Contact details of Paralion: e-mail: office@paralion.pl, postal address: ul. Św. Marcin 29/8, 61-806 Poznań, Poland.

1.3. Paralion has not appointed a Data Protection Officer. In all matters concerning personal data, including for the purpose of exercising the rights described in Section 9, you can contact us via the contact details provided above.

2. Whose data do we process and when do we collect it?

We process personal data of the following Data Subjects:

  • persons sending an offer request or contacting us in any other way (including via the contact form on the Website, by e-mail, or by telephone);

  • persons entering into a Contract or conducting arrangements on behalf of a Client, persons representing the Client, and contact persons designated by the Client;

  • Clients who are natural persons conducting business activity (sole proprietors);

  • Authorised Recipients, i.e. individuals to whose named e-mail addresses we deliver the Report under the License;

  • persons who subscribed to our newsletter or consented to receiving commercial information;

  • visitors to the Website www.paralion.pl.

3. What data do we process, for what purpose, on what legal basis, and for how long?

The table below specifies the purposes of processing, scope of data, legal bases, and storage periods. The storage period depends on the purpose of processing, applicable legal provisions, and limitation periods for specific claims. The periods indicated in the table should be applied taking into account the circumstances of a given case.

Purpose

Scope of data

Legal basis

Storage period

Responding to inquiries and preparing an offer

first name and surname, company name, position, e-mail address, telephone number, content of the inquiry

Article 6(1)(f) GDPR (responding to an inquiry); in the case of a sole proprietor – Article 6(1)(b) GDPR (taking steps prior to entering into a contract)

until the inquiry is fully handled, and if no Contract is concluded – up to 12 months

Conclusion and performance of a contract with a Client operating as a sole proprietorship

first name and surname, company name, address, NIP (TAX ID), VAT number, e-mail address, telephone number, payment details

Article 6(1)(b) GDPR

for the duration of the contract, and thereafter until the expiry of the limitation period for claims

Contract administration and contact with Client representatives and designated contact persons

first name and surname, position, e-mail address, telephone number, signature

Article 6(1)(f) GDPR – our legitimate interest in the efficient management and administration of contractual relations with the Client

for the duration of the contract, and thereafter until the expiry of the limitation period for claims

Delivery of the Report to Authorised Recipients, License administration, and protection against unauthorised distribution of the Report

first name and surname, position, business e-mail address, message delivery logs

Article 6(1)(f) GDPR – legitimate interest in performing the contract concluded with the Client, delivering the Report to designated recipients, and protecting rights to the Report; regarding data of a Client who is a natural person – Article 6(1)(b) GDPR, if processing is necessary for the performance of the Contract

for the duration of the contract, and thereafter until the expiry of the limitation period for claims

Accounting, bookkeeping, and tax obligations (including KSeF – National e-Invoicing System)

data contained in invoices and accounting documents

Article 6(1)(c) GDPR in conjunction with accounting and tax regulations

5 years from the end of the calendar year in which the tax payment deadline expired

Establishment, exercise, or defence of legal claims

data necessary to prove a claim or raise a defence

Article 6(1)(f) GDPR

until the expiry of the limitation period for claims

Direct marketing and newsletter (e.g. information about new publications and offers)

first name and surname, company name, e-mail address, telephone number

Article 6(1)(f) GDPR within the scope of legitimate interest; e-mail dispatch or telephone contact solely upon obtaining consent required under applicable law

until an objection is lodged or consent is withdrawn

Dispatch deliverability statistics

e-mail address, date and time of message delivery

Article 6(1)(f) GDPR – ensuring the proper delivery of the Report and newsletter

12 months

Handling of complaints and requests concerning personal data

data contained in the complaint or request

Article 6(1)(c) and (f) GDPR

until the expiry of the limitation period for claims

Website analytics (cookies)

online identifiers, device data, and activity on the website

Article 6(1)(a) GDPR in conjunction with Article 399 of the Electronic Communications Law Act (consent)

in accordance with cookie settings and their validity period, until consent is withdrawn or cookies are deleted


4. Where does the data originate from?

4.1. As a rule, you provide us with your data directly, in particular in an inquiry, when concluding or performing a Contract, in correspondence, or when subscribing to the newsletter.

4.2. If you are an Authorised Recipient, a contact person, or a representative of a Client, we obtained your data from the Client (your employer, principal, or entity you cooperate with), most often in the body of the Contract or in a notification of a change of Authorised Recipient. Such data includes your first name and surname, position, business e-mail address, and optionally business telephone number.

4.3. We may verify Clients’ data in public registers, such as the National Court Register (KRS), Central Register and Information on Economic Activity (CEIDG), and the register of VAT taxpayers.

5. Is providing data mandatory?

Providing data is voluntary, but necessary to respond to an inquiry, conclude and perform a Contract, and deliver the Report. Providing data for billing purposes is required by tax law. Subscription to the newsletter is fully voluntary.

6. To whom do we transfer data?

6.1. Data may be transferred to the following categories of recipients:

  • providers of e-mail services and office software tools [insert actual providers];

  • provider of the tool for dispatching the Report and newsletter [insert tool name, if used];

  • providers of hosting and Website maintenance services [insert provider name];

  • accounting office, IT service providers, and legal advisors;

  • marketing agencies, if we cooperate with them [delete if not applicable];

  • banks in the scope of payment processing;

  • public authorities where the obligation to transfer data arises from legal provisions, including authorities of the National Revenue Administration via KSeF.

6.2. Entities processing data on our behalf act on the basis of data processing agreements and exclusively in accordance with our instructions.

6.3. Paralion and the Client are separate data controllers. Paralion does not process personal data on behalf of the Client.

7. Do we transfer data outside the European Economic Area?

Some of our service providers may process data outside the European Economic Area, in particular in the United States. In such cases, data is transferred on the basis of an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework) or standard contractual clauses approved by the European Commission. A copy of the safeguards applied can be obtained by contacting us.

8. Do we use profiling?

We do not make decisions based solely on automated processing, including profiling, which would produce legal effects concerning you or similarly significantly affect you.

9. What are your rights?

In connection with the processing of personal data, Data Subjects have the right to:

  • access their data and receive a copy thereof;

  • rectify inaccurate data;

  • erase data („right to be forgotten”);

  • restrict processing;

  • data portability, with respect to data processed on the basis of consent or contract;

  • object to processing based on legitimate interest, and in the case of direct marketing – at any time and without giving any reason;

  • withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; you may unsubscribe from the newsletter by clicking the link in the footer of the message or by contacting us;

  • lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).

To exercise these rights, please write to office@paralion.pl. We will respond without undue delay, and in any event within one month of receiving the request.

10. How do we protect data?

We apply technical and organisational measures appropriate to the risk, in particular access control, multi-factor authentication for key systems, connection encryption, and restricting data access solely to individuals who require it to perform their duties.

11. Cookies

The Website uses cookies necessary for its operation and — upon obtaining the required consent — analytical or marketing cookies, if used. Consent can be managed in the cookie settings on the Website. Detailed information regarding the cookies used should be provided in the cookie banner or a separate cookie policy upon implementation of these solutions.

12. Changes to the Policy

This Policy may be updated, in particular in the event of changes in legal provisions or the manner of data processing. The current version is available on the Website. Clients will be notified of material changes via e-mail.

This Policy is effective as of 23 October 2026.



Przewijanie do góry