Firma RODO

Privacy policy

Jak zbieramy i przetwarzamy dane osobowe — zgodnie z RODO.

Effective date: 10 August 2026 · Version: 1.0

1. General information

This Privacy policy explains how inPL Group Sp. z o.o. processes personal data of persons who:

  • use the inPL Group website, including contact forms;
  • contact us by telephone, e-mail or otherwise;
  • are interested in our offer;
  • are clients, contractors, or their representatives, attorneys, employees or contact persons;
  • use the inPL Client Panel;
  • receive marketing information from us;
  • take part in recruitment conducted by inPL Group.

The Policy describes in particular the purposes and legal bases of processing, categories of recipients, retention periods and the rights of data subjects.

Detailed information on cookies and similar technologies is set out in a separate Cookie policy.

2. Data controller and contact

The controller of personal data is inPL Group Spółka z ograniczoną odpowiedzialnością, with its registered office in Lublin, ul. Garbarska 18/10, 20-340 Lublin, entered in the register of entrepreneurs of the National Court Register under KRS 0000605773, NIP 7123309690, REGON 363908422, hereinafter “inPL Group” or the “Controller”.

For matters relating to the processing of personal data and the exercise of GDPR rights, you may contact us:

  • by e-mail: info@inpl.eu;
  • by post: inPL Group Sp. z o.o., ul. Garbarska 18/10, 20-340 Lublin, Poland.

3. What data we may process

Depending on how you contact us, the type of relationship and the services provided, we may process the following categories of data:

  • identification data, e.g. first name, last name, job title, function in an organisation;
  • contact data, e.g. e-mail address, telephone number and correspondence address;
  • company or business data, e.g. company name, NIP, KRS, country of registration and details of persons who represent the company;
  • data contained in enquiries, correspondence, documents and materials provided to us in connection with preparing an offer or performing a service;
  • data needed to conclude, perform and settle a contract;
  • payment and settlement data, provided that we do not store full payment-instrument details if the payment is handled by an external operator;
  • data related to complaints, requests and technical support;
  • data on marketing preferences and consents given;
  • data provided in application documents during recruitment;
  • technical data related to use of the website or Client Panel, e.g. IP address, date and time of the connection, browser type, operating system, device information, the URL of the page visited, and data stored via cookies or similar technologies.

Please do not include in forms or ordinary correspondence data that are not needed to handle the matter, in particular special categories of personal data, unless providing them is necessary to perform the requested service and has been agreed with us in advance.

4. Sources of data

We usually receive data directly from the data subject. We may also receive them:

  • from a client or contractor who has indicated their representatives, employees, associates or contact persons;
  • from a person representing a company or organisation;
  • from our partners and subcontractors involved in performing the service;
  • from publicly available registers and sources, e.g. KRS, CEIDG, the VAT taxpayers’ list or company websites;
  • from entities authorised to provide data under the law.

If we received data from another person or another source, we may process in particular identification, contact and professional data, information about the function performed, and data related to the represented organisation.

5. Purposes, legal bases and retention periods

5.1. Use of the website and its security

We process technical data, in particular the IP address and information recorded in server logs, in order to:

  • ensure the website works properly;
  • maintain system security;
  • detect errors, unauthorised-access attempts and other abuse;
  • administer the website and prepare basic technical statistics.

The legal basis is our legitimate interest in ensuring the security, stability and proper operation of the website — Article 6(1)(f) GDPR.

As a standard we retain logs for up to 90 days. We may retain selected information longer if this is necessary to investigate a security incident, counteract abuse, or pursue or defend claims.

5.2. Contact form, correspondence and enquiries

We process data provided in the contact form or during contact in order to:

  • reply;
  • handle correspondence and the request;
  • provide information about our services;
  • prepare an offer;
  • take steps at the request of the interested person before concluding a contract.

If the contact concerns a possible contract, the legal basis is Article 6(1)(b) GDPR. In other cases the basis is our legitimate interest in handling correspondence and business relationships — Article 6(1)(f) GDPR.

Data relating to an enquiry that did not lead to a contract are stored for the period of correspondence and then, as a rule, for a maximum of 24 months from the last contact. If the data are needed to establish, pursue or defend claims, we may store them until the relevant limitation period expires.

5.3. Conclusion and performance of a contract

We process data of clients who are natural persons in order to conclude and perform a contract, provide ordered services, maintain operational contact, keep accounts, handle requests and provide support. The legal basis is Article 6(1)(b) GDPR.

We process data of representatives, attorneys, employees and contact persons of a client or contractor on the basis of Article 6(1)(f) GDPR. Our legitimate interest is concluding and properly performing a contract with the organisation they represent, maintaining business contact and documenting arrangements.

We store the data for the term of the contract and then until the limitation periods for claims under the contract or the law expire.

5.4. Legal obligations and settlements

We process data to fulfil obligations under tax, accounting and anti-money-laundering law and other laws applicable to the services we provide. The legal basis is Article 6(1)(c) GDPR.

We retain documentation for the period required by applicable law, counted according to the rules for the relevant type of documentation.

5.5. Complaints, claims and preventing abuse

We may process data to handle complaints, detect abuse, establish liability, and establish, pursue or defend claims. Depending on the situation, the legal basis is performance of a contract — Article 6(1)(b) GDPR — a legal obligation — Article 6(1)(c) GDPR — or our legitimate interest in protecting the Controller’s rights and the security of the business — Article 6(1)(f) GDPR.

We store the data until the proceedings or the matter are concluded, and then until the relevant limitation period for claims expires.

5.6. Marketing of our own services

We may process data of clients, prospective clients and persons representing clients in order to inform them about our services and maintain business relationships. The legal basis for processing for direct marketing of our own services may be our legitimate interest — Article 6(1)(f) GDPR.

If the law requires prior consent to use a particular communication channel, in particular e-mail or telephone, we send marketing information via that channel only after obtaining the required consent.

We process the data until an objection to marketing is raised, consent is withdrawn, or we end our marketing activities. We may retain information about an objection or withdrawal of consent to a limited extent in order to demonstrate that we have respected the user’s decision and to meet the accountability obligation.

5.7. Analytics and marketing tools on the website

If we use optional analytics or marketing tools that use cookies or similar technologies, we process data on the basis of consent — Article 6(1)(a) GDPR. Those tools should not be launched before consent is given.

Consent may be withdrawn at any time via the cookie-settings panel on the website. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Detailed information on the tools used, providers, retention periods and how consents are managed is set out in the Cookie policy and the cookie-settings panel.

5.8. Recruitment

We process candidates’ data in order to conduct recruitment: to the extent required by labour law — on the basis of Article 6(1)(c) GDPR — and to the extent of data voluntarily provided by the candidate — on the basis of consent under Article 6(1)(a) GDPR, and in the case of special-category data also Article 9(2)(a) GDPR.

We process the data until recruitment ends and then for the period needed to protect against possible claims. If the candidate has given a separate consent to take part in future recruitments, we store the data for the period indicated in that consent, but no longer than 12 months, unless consent is withdrawn earlier.

6. inPL Group as a processor

In the course of accounting, payroll, BPO, IT or other services performed for clients, inPL Group may process personal data of employees, associates, customers or contractors of our clients not as a controller but as a processor acting on the client’s documented instructions.

In that case the controller remains the inPL Group client, who determines the purposes and means of processing and fulfils the information obligation towards data subjects. We may forward a request concerning such data to the relevant client or cooperate with the client in handling it under the data-processing agreement in place.

7. Recipients of data

Data may be disclosed or entrusted, to the extent necessary to achieve a given purpose, to:

  • providers of hosting, servers, e-mail, IT systems, cybersecurity, archiving and technical support;
  • providers of the Client Panel, document-workflow systems, CRM, forms and communications;
  • banks, payment operators and financial-service providers;
  • providers of accounting, audit, HR, courier and translation services;
  • law firms, tax advisers, notaries and other specialists involved in performing the service;
  • providers of analytics and marketing tools — only to the extent consistent with consents given;
  • public authorities, courts and other authorised bodies where the duty to disclose data follows from the law;
  • other parties involved in performing the ordered service, of which the data subject will be informed if the law so requires.

Depending on the nature of the cooperation, recipients may act as processors on our behalf or as separate controllers.

8. Transfers outside the European Economic Area

Some technology providers may process data outside the European Economic Area or allow access to data from a third country.

If such a transfer takes place, we use a mechanism provided for in the GDPR, in particular:

  • a European Commission decision finding an adequate level of protection;
  • the recipient’s participation in a recognised mechanism ensuring an adequate level of protection, if applicable;
  • standard contractual clauses approved by the European Commission, together with additional safeguards if needed;
  • one of the exceptions in Article 49 GDPR, where it applies in the specific situation.

Information about the mechanism used for a particular provider and about how to obtain a copy of the safeguards can be obtained by contacting us at info@inpl.eu. Information on cookie-related transfers is also set out in the Cookie policy.

9. Voluntary or mandatory provision of data

Providing data when using the contact form is voluntary, but without the data marked as required we will not be able to reply to the enquiry.

Providing data needed to conclude and perform a contract is voluntary, but necessary to conclude the contract or perform the ordered service. Providing some data may be mandatory under the law, in particular tax, accounting or anti-money-laundering rules.

Giving marketing consent or consent to optional cookies is voluntary and is not a condition of concluding or performing a contract.

10. Rights of data subjects

On the terms set out in the GDPR, a data subject may have the right to:

  • access their data and obtain a copy;
  • rectify data;
  • erase data;
  • restrict processing;
  • data portability;
  • object to processing based on Article 6(1)(f) GDPR;
  • withdraw consent at any time if data are processed on the basis of consent;
  • lodge a complaint with the President of the Personal Data Protection Office (UODO).

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

If data are processed for direct marketing, an objection to such processing may be raised at any time without giving reasons. After we receive it, we will stop processing the data for that purpose.

To exercise these rights, contact us at info@inpl.eu. Before handling a request we may ask for information needed to confirm the identity of the person making it.

11. Automated decision-making

We do not take decisions concerning persons who use the website, contact us or use our services that produce legal effects or similarly significantly affect them and that are based solely on automated processing of personal data, including profiling.

If such a process is introduced in the future, before we start using it we will provide the required information about how it works, its significance and envisaged consequences, and we will ensure the rights required by the GDPR.

12. Data security

We apply appropriate technical and organisational measures to protect data against unauthorised access, loss, destruction, alteration or unauthorised disclosure. The scope of safeguards is adjusted to the nature of the data, how they are processed and the risks identified.

Access to data is granted only to authorised persons or to parties that need the data to perform tasks entrusted to them and that are required to ensure an appropriate level of protection.

13. External websites and links

The website may contain links to external websites, including social-media platforms and the Client Panel. After going to an external website, data are also processed in accordance with the rules set by its operator. We recommend reading that website’s privacy policy.

Simply displaying a link to a social-media service should not cause data to be transferred to that service. A transfer may occur after the link is clicked or an embedded function is launched and, in the case of technologies that require consent, after that consent has been given.

14. Changes to this Privacy policy

This Policy may be updated if the law, the scope of services, the technologies used or the ways of processing data change. The current version is always published on the website together with its effective date.

If a change is material for data subjects, we will inform them in an appropriate way, for example by a notice on the website, a message sent to the e-mail address we hold, or information in the Client Panel.