Privacy and cookies policy

Last updated: 6 November 2026.

1 Controller and contact

The controller of personal data processed in connection with this website is ILT Analytics sp. z o.o., with its registered office at pl. Klasztorny 1/2, 59-220 Legnica, Poland, Tax ID (NIP) 6711862733, REGON 529122825, referred to below as the “Controller” or “we”.

For matters concerning your personal data, contact kancelaria@kancelariailt.pl or write to the postal address above. You may indicate that your message concerns privacy at ILT Analytics.

2 Data collected and voluntary provision

You do not need an account to browse the website. Technical connection data may be processed, including your IP address, the time and address of a request, browser information and error information. This supports delivery and protection of the website.

The contact form requires your full name, email address and a brief description of your enquiry. Your company name and telephone number are optional. The message also includes the selected topic, form language and chosen expert or resource, where you use these options. Providing data is voluntary, but the form cannot be submitted without the required fields. You may also contact us directly by email or telephone.

The website tools help organise answers, document availability and notes. Using a tool or downloading a checklist does not itself send the result to us. If you attach a summary to the form and submit the enquiry, we also receive the information in that summary. You can review or remove the attached summary before sending it.

A general description is sufficient at first. Please do not send health data, other special categories of data or unnecessary information about other people. We will agree separately how project documents should be provided.

3 Purposes and legal bases

We handle general enquiries and correspondence with people acting on behalf of companies under Article 6(1)(f) GDPR. Our legitimate interests are responding, maintaining business correspondence and establishing the scope of possible support.

Where we take steps at your request before entering into a contract with you as an individual, Article 6(1)(b) GDPR is the basis for processing the data necessary for those steps.

We process technical data and information about form submission attempts to maintain security, limit spam and detect and investigate errors. The basis is Article 6(1)(f) GDPR, and our legitimate interest is the reliable and secure operation of the website and correspondence.

Where necessary, we retain relevant data to establish, exercise or defend legal claims under Article 6(1)(f) GDPR. We comply with legal obligations concerning data under Article 6(1)(c) GDPR to the extent required by the applicable provisions, including obligations relating to handling data subject requests.

Contacting us through the form does not constitute marketing consent or a newsletter subscription. If we enter into an engagement, we provide information about the processing associated with the services concerned.

4 Recipients

Enquiries are sent to the shared mailbox kancelaria@kancelariailt.pl and are handled by people responsible for correspondence and ILT Analytics matters. The information passed to the person handling the matter depends on the subject of the enquiry.

For the website and correspondence, we use dhosting hosting services, Microsoft 365 email and providers maintaining our systems or supplying IT support. Providers may process data on our behalf within the services they deliver. Data may also be disclosed to competent authorities where required by law and to advisers where necessary to protect legal claims.

The form plugin passes the message to the email system. FluentSMTP retains a sending log in WordPress, which may include addresses, the subject and message content. Copies of correspondence may be held in Microsoft 365 and backups. This describes the overall sending process even though the ILT form module does not create a separate submissions database.

5 Transfers outside the EEA

Using international providers, particularly Microsoft 365, may involve processing outside the European Economic Area, including in connection with technical support or subprocessors. Choosing a European storage region should not be treated as excluding all such operations.

Where a transfer occurs, its basis depends on the recipient and service: it may be a European Commission adequacy decision or appropriate safeguards, particularly standard contractual clauses together with any required supplementary measures. You may contact us for information about the applicable mechanism and a copy of the relevant safeguards. Information disclosed may take account of the rights of others and confidential information.

6 Retention

We retain enquiry correspondence for the time needed to handle it and complete the agreed actions. After the matter is closed, we retain only data for which a further purpose and legal basis exist, such as a legal obligation or the need to establish, exercise or defend claims. Further retention depends on that obligation or the relevant limitation period and the actual need to keep the data.

The form submission counter uses a hash derived from the IP address and remains valid for 15 minutes after the last attempt counted. This is the duration of the security mechanism, not the retention period for messages. Expiry of the counter does not mean its backup copies are immediately deleted.

The FluentSMTP sending log is configured with a 14-day retention period. Deleting entries from this log does not delete messages in Microsoft 365 or their backup copies.

The retention period for technical logs is determined by the need to maintain security, identify an error or investigate a particular event. Where a record is needed as evidence, the applicable limitation period for claims or a legal obligation is also taken into account. Backups support recovery after a failure; their retention depends on the cycle for creating and replacing backups in the service concerned. Deletion from the system in active use does not immediately remove the data from all backups. You may contact us for information about the retention period applicable to your data.

7 Your rights

Subject to the GDPR, you have the right to access your data and receive a copy, and to request rectification, erasure or restriction of processing. Data portability applies to automated processing based on consent or a contract where the GDPR conditions are met.

You may object to processing based on legitimate interests on grounds relating to your particular situation. Where specific processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.

Send requests to kancelaria@kancelariailt.pl. If we have reasonable doubts, we may request information necessary to confirm your identity. We normally respond within one month; in circumstances specified in the GDPR, this may be extended, in which case we will inform you and explain why.

You may lodge a complaint with the President of the Polish Personal Data Protection Office. Information on making a complaint is available at uodo.gov.pl.

8 Tools and automated decisions

The tools provide supporting information to help you prepare for a conversation with an adviser. They do not provide a binding determination of tax obligations or a decision on accepting an engagement. Within the functions described, we do not make solely automated decisions producing legal or similarly significant effects concerning you.

9 Cookies and browser storage

Cookies are small pieces of information stored by a browser. The website also uses browser tab session storage, which can retain entered data when you change language.

The ilt-v3-language-draft sessionStorage mechanism saves state only when you use the PL/EN switch in the same tab. It may include form fields, the selected tool path, answers, document statuses, notes and an attached summary. The script reads and removes the entry on its next run; it restores it only on the matching page, in the matching language and if it is less than 10 minutes old. This does not send a message. If the next read does not occur, the entry remains associated with the browser tab session.

Polylang provides the language functionality. It may remember the last language used in the pll_language cookie to retain the language preference. This is a first-party mechanism; it is not used for advertising or storing enquiry content. You can check the expiry of stored cookies in your browser’s website data settings. Automatic detection of the browser’s preferred language is currently disabled; you select PL or EN yourself.

Signing in to the WordPress dashboard uses separate cookies for authentication and administrators’ preferences. You do not need to sign in to the dashboard to browse the website or use the contact form.

Mechanisms requiring consent may be enabled only after an appropriate choice has been implemented and consent obtained. This particularly concerns planned analytics, advertising and certain external embeds. Merely using the website does not constitute such consent. Withdrawing consent should be as easy as giving it. The current project does not include an active newsletter, advertising pixels or visitor analytics.

You can delete website data or restrict storage in your browser settings. This may affect language preferences or retention of entered data when switching between PL and EN.

10 External resources and websites

Fonts and line maps of office locations are served as local files. The maps do not embed Google Maps. Clicking a directions link, a resource on the ILT Law Firm website or another external link opens the relevant operator’s service, which then receives connection data. Separate forms and services are subject to the privacy information provided there. Using our contact form does not automatically subscribe you to external services.

11 Updates

We update this policy when website functions, data processing or applicable provisions change. The current version identifies its revision date.