Privacy Policy
Version dated 15 October 2026. Effective upon publication on the Website.
We explain how we process the data of visitors to the Biuro SANDRA public Website and of people making enquiries about cooperation, a preliminary proposal or a quotation. The Terms of Use govern use of the Website’s free functions. Detailed information about cookies and similar technologies is provided in the Cookie Policy.
1. Controller and contact details
The Controller is Aleksandra Włudarczyk, trading as Biuro Usług Podatkowych i Rachunkowości „SANDRA” Aleksandra Włudarczyk, tax identification number (NIP) 7731146207, statistical identification number (REGON) 592183648, with an address at ul. Sosnowa 95, 97-200 Tomaszów Mazowiecki.
For matters concerning personal data and to exercise your rights, you may contact us at biurosandra@biurosandra.pl or by post at: Biuro Usług Podatkowych i Rachunkowości „SANDRA” Aleksandra Włudarczyk, ul. Sosnowa 95, 97-200 Tomaszów Mazowiecki, Poland.
2. Data provided when contacting us
We process data voluntarily provided through the form, by e-mail or during a conversation. The form may include: your name or company name, e-mail address, telephone number, legal form, industry, current accounting arrangements, number of documents and employees, information about the employment of drivers, the expected scope of services, the planned start date of cooperation and a description of your enquiry. Information about the scale of a business, provided without data identifying particular individuals, is not necessarily personal data.
Your name or company name, e-mail address and a brief description of your matter or needs are required to send an enquiry. Other fields, including telephone number and legal form, are optional. Providing data is voluntary, but without the data needed to respond and assess your enquiry, we may be unable to handle it. The optional acknowledgement that you have read the Privacy Policy does not constitute consent to personal data processing and is not a condition of sending an enquiry.
At the initial contact stage, please give a brief description of your needs without PESEL identification numbers, identity documents, employees’ personal data, health information, complete accounting documentation or other confidential information. If documents are needed to assess your matter, we will agree on an appropriate method of submitting them.
3. Purposes and legal bases of processing
Enquiries about your own cooperation with us. If you contact us as a natural person with a view to concluding a contract with us, including as a sole trader, we process the necessary data to take steps at your request before entering into a contract – Article 6(1)(b) GDPR.
Other correspondence and contact on behalf of an organisation. If you send another question or represent a company or other organisation, we process data to respond, conduct discussions and maintain contact about that matter. The legal basis is our legitimate interest in handling correspondence and communicating with persons acting on behalf of current or prospective clients – Article 6(1)(f) GDPR.
Website operation and security. We process the technical data described in section 5 to provide the Website, detect errors, prevent abuse and investigate incidents. The legal basis is our legitimate interest in maintaining the Website’s operation and security – Article 6(1)(f) GDPR.
Blog search. We use your search terms to find and display relevant materials. If the terms contain personal data, the legal basis for processing is our legitimate interest in providing the search function requested by the User – Article 6(1)(f) GDPR. Do not enter confidential information or other persons’ data into the search function.
Remembering and documenting privacy choices. We process the data needed to apply your settings on the basis of our legitimate interest in respecting your choices and ensuring that the settings mechanism works properly – Article 6(1)(f) GDPR. To the extent necessary to demonstrate that consent was given, we process its record to fulfil the Controller’s obligation – Article 6(1)(c), in conjunction with Articles 7(1) and 5(2) GDPR.
Claims and legal obligations. Where needed in a particular matter, we process the necessary data to establish, exercise or defend legal claims – Article 6(1)(f) GDPR. We process requests to exercise GDPR rights and the records of how they were handled to fulfil the Controller’s obligations – Article 6(1)(c), in conjunction with Articles 12–22 GDPR.
Handling an ordinary enquiry does not require marketing consent. Sending an enquiry or acknowledging that you have read the Policy does not constitute consent to future commercial communications.
We document established personal data breaches and, where required, report them to the supervisory authority or notify the data subjects, in fulfilment of legal obligations – Article 6(1)(c), in conjunction with Articles 33–34 GDPR.
With your consent, we use Google Analytics 4 to measure use of the Website. The service provider is Google Ireland Limited. The service may process online identifiers, device information and pages visited. It runs only after consent to the Statistics group. You can withdraw consent in Privacy settings, where service, cookie and data processing details are available. We do not activate advertising services.
4. How long we retain personal data
Enquiries that do not result in a contract. We retain enquiry data for the time needed to respond and conduct discussions, and for no longer than 12 months after the correspondence ends. This period allows us to maintain continuity if you return to the same enquiry. We then delete or irreversibly anonymise the data, unless particular information remains necessary in a specific matter to meet a legal obligation or to establish, exercise or defend legal claims. Any such exception applies only to the data needed.
Calculating the enquiry period. For a matter that does not result in a contract, we treat the date of the last substantive message in that matter as the end of correspondence. Renewed genuine contact for the same purpose starts a new period; an automated message does not renew it.
Requests to exercise GDPR rights. We retain a request and the necessary records of how it was handled for the duration of the matter and then for no longer than 3 years after the final response, to the extent needed to demonstrate that the Controller fulfilled its obligations properly. If the matter is subject to proceedings, an inspection or a dispute, we retain only the necessary records until that matter has concluded and for any period required by applicable law.
Subsequent cooperation. If we begin working together, further processing connected with our services and the applicable retention periods are explained in a separate privacy notice for clients. The 12-month enquiry period does not replace statutory retention periods for accounting records, tax records or tax advisers’ documentation.
Technical and security logs. We retain the Website’s security log for up to 90 days and traffic log records for up to 30 days. Server and email logs kept by service providers are retained for the period set by their configuration. Records retained in connection with a particular incident or claim are kept only to the extent necessary, until that matter has concluded.
Backups. Website backups are made daily and retained in a rotation covering the 7 most recent sets. The hosting provider may additionally keep infrastructure backups dating back up to 56 days. Data deleted from the Website may remain in backups until they are overwritten in the rotation. If a backup is restored, previously completed data deletions are reapplied.
Privacy choices and evidence of consent. The Cookie Policy describes how long a choice is stored on a device. We retain the history of privacy choices recorded on the server for no longer than 365 days. Minimal evidence of consent actually given is retained during the processing based on that consent and afterwards only to the extent and for the period justified by a legal obligation or a specific claim.
Review and deletion. Once a month, we review completed matters and delete data whose retention period will expire before the next review. This also covers attachments, exports and working copies.
5. Technical data
When you use the Website, the server receives the data needed to handle the connection. This may include an IP address, the date and time of the request, the address of the requested resource, the response code and information supplied by the browser about its type and the device. These data are recorded in technical logs to the extent provided for by the configuration.
Information stored on or read from the device, such as cookies, localStorage and sessionStorage, is addressed separately in the Cookie Policy. The absence of a cookie does not itself mean that a service does not process personal data.
If search terms are recorded in server logs, they form part of the technical data and are subject to the retention periods described in section 4.
6. Data recipients
Data are accessible to authorised persons who operate the Website or handle your matter, to the extent needed to perform their tasks.
Data may also be disclosed to authorities or other authorised parties where this follows from a legal obligation, and to parties providing legal assistance where necessary in a particular matter.
Service providers. Data may be processed on our behalf by entities providing services to the Office: the hosting provider (Hostido), the provider of technical website support (Testin) and the email service provider. These entities have access to data only to the extent necessary to provide their services, under agreements concluded with the Office, including data processing agreements.
7. Fonts and Website mechanisms
Fonts used on the Website are loaded from the Website’s server. As a result, the browser does not directly download these resources from Google’s servers. The WordPress Emojis mechanism has been disabled.
We describe the security mechanisms and mechanisms that remember choices in the Cookie Policy and Privacy settings. Viewing information about the Office and sending an enquiry do not require marketing consent.
8. Transfers outside the European Economic Area
As a rule, we process data within the European Economic Area (EEA). If, in connection with the use of service providers, in particular email or technical support services, data were to be transferred to a country outside the EEA, this will take place only using the mechanisms provided for in Chapter V GDPR, such as a European Commission adequacy decision or standard contractual clauses.
Information about the safeguards applied and how to obtain a copy of them will be provided on request sent to biurosandra@biurosandra.pl.
9. Your rights
You may request access to your personal data and a copy of them, rectification, erasure or restriction of processing, subject to the GDPR. If processing is carried out by automated means on the basis of your consent or a contract, you may also exercise the right to data portability within the scope of Article 20 GDPR.
Objection. If processing is based on our legitimate interest, you may object on grounds relating to your particular situation. We will then stop processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or grounds for establishing, exercising or defending legal claims. An objection to direct marketing is unconditional.
Withdrawal of consent. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. For consent concerning Website functions, you may use the Privacy settings link permanently available in the Website footer.
We accept requests at biurosandra@biurosandra.pl or by post at the Controller’s address. We normally respond within one month. If a matter is particularly complex or there are many requests, we may extend the time limit by up to two further months, informing you within the first month of the extension and its reasons. If we have reasonable doubts, we may ask for information needed to confirm your identity.
You may also lodge a complaint with the President of the Polish Personal Data Protection Office. Information about complaints and current contact details is available at uodo.gov.pl.
10. Client Area and changes to this Policy
The Client Area at panel.biurosandra.pl is a separate system. This document covers the public Website and initial contact. It does not cover personal data processing when providing services to clients through that separate system.
Within the scope described in this Policy, we do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.
We update the Policy when Website functions, processing arrangements or legal requirements change. The current version includes its effective date. A change to the Policy does not replace consent where new activity requires it.