PRIVACY POLICY

Lexcarta Capital Group

This Privacy Policy describes the principles and procedures for the protection of personal data applied by entities within the Lexcarta Capital Group in order to comply with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereinafter: GDPR).

1. Data Controllers (Joint Controllers)

Your personal data is jointly controlled by the following entities, which together provide legal, advisory, accounting, payroll, and other business services within the Lexcarta group:

Both entities have entered into joint controllership arrangements in accordance with Article 26 of the GDPR, defining their respective responsibilities for the processing of your personal data.

Primary contact point: For all data protection matters, including the exercise of your rights under the GDPR, please contact LEXCARTA Sp. z o.o.:

E-mail: office@lexcarta.pl

Postal address: ul. Żwirowa 8D, 05-506 Wilcza Góra, Poland

Regardless of these arrangements, you may exercise your rights with respect to and against each of the Joint Controllers (Article 26(3) GDPR).

2. Personal Data and Processing

Personal data means any information relating to an identified or identifiable natural person. Processing means any operation performed on personal data, whether or not by automated means, such as collection, recording, storage, organisation, adaptation, retrieval, use, disclosure, restriction, erasure, or destruction.

This Privacy Policy applies to all instances in which a Lexcarta group entity acts as a data controller and processes personal data, whether obtained directly from the data subject or from other sources.

3. Scope of Personal Data Processed

We collect and process only those personal data of our clients and users of our services that are necessary to provide information about our services, to deliver legal, accounting, payroll, and other services offered by the Lexcarta group, and to fulfil our legal obligations. Where processing is based on a legitimate interest, we take into account the interests of the data subject.

The personal data we may collect include, among others:

• First name and surname
• Employer name and job title of the contact person
• Telephone number and e-mail address or other business contact details
• Payment data, including data necessary for online payments such as credit card numbers and bank account numbers
• Any other data necessary for the performance of the service

We may also collect data of representatives and employees of legal entities.

4. Professional Secrecy

Personal data obtained in the course of providing legal services are subject to the professional secrecy of an attorney-at-law (radca prawny) or advocate (adwokat) and may only be disclosed in strictly defined circumstances prescribed by law, on the basis of a court decision.

5. Legal Basis for Processing

5.1 Clients

The processing of personal data of our clients is based on:

• Performance of a contract (the ordered service) – Article 6(1)(b) GDPR
• Legitimate interest of the controller (direct marketing of own services, debt collection, securing documentation for defence against or pursuit of claims) – Article 6(1)(f) GDPR
• Consent (including consent to e-mail marketing or telemarketing) – Article 6(1)(a) GDPR
• Compliance with legal obligations (e.g. tax law, accounting regulations) – Article 6(1)(c) GDPR

5.2 Prospective Clients

The processing of personal data of prospective clients is based on:

• Legitimate interest of the controller (direct marketing of own services) – Article 6(1)(f) GDPR
• Consent (including consent to e-mail marketing or telemarketing, responding to enquiries) – Article 6(1)(a) GDPR

5.3 Website Users

In accordance with the Act of 18 July 2002 on the provision of electronic services (Polish law), we collect and process only those data of users visiting our websites and using electronically provided services that are necessary for the provision of such services.

6. Cookies

We may collect personal data automatically through cookies placed on our websites. Cookies are small text files stored on the user’s computer or mobile device while using internet services. They serve, among other things, to enable various website functionalities and to confirm that a user has viewed certain content.

Categories of cookies we use:

• Essential cookies: session maintenance, session state, authorisation, anonymous login
• Functional cookies: language preferences, currency, font size, and similar usability settings

We use Google Analytics cookies to monitor traffic on our websites. Data is collected on an anonymised basis and includes aggregate statistics on website usage, anonymous user counts, content frequency, and user location information. You may block Google Analytics at any time via your browser. More information is available at: https://tools.google.com/dlpage/gaoptout.

7. Data Retention Periods

The retention period for personal data depends on the legal basis and purpose of processing:

1. Consent-based processing – until the consent is withdrawn.
2. Legitimate interest – until the interest ceases or the data subject successfully objects to processing.
3. Legal obligation – for the period required by applicable law.
4. Google Analytics data – 14 months.
5. In the absence of specific legal or contractual requirements, records and documentary evidence created during the performance of a contract are retained for a maximum of 10 years.

8. Recipients of Personal Data

Personal data may be disclosed to third parties only where permitted by law. Data is transferred to recipients on the basis of data processing agreements containing all necessary provisions on security and safeguards. Recipients may include:

• Attorneys-at-law, advocates, tax advisors, or other lawyers providing legal services on our behalf
• Entities within the Lexcarta Capital Group
• Hosting service providers
• Marketing campaign providers
• Subcontractors providing software, hardware servicing, or IT services
• Accounting and tax service providers
• Credit information bureaux (to the extent permitted by law)
• Debt collection companies
• Auditors and statutory auditors
• Supervisory, regulatory, and other public authorities (to the extent permitted by law, taking into account the special legal protection of data arising from attorney-client privilege)

9. International Data Transfers

We do not transfer the personal data of our clients or users to persons or institutions outside the European Economic Area (EEA), unless this is required by the interest of the data subject or in cases specified by law.

10. Your Rights

Under the GDPR, you have the following rights with respect to your personal data:

• Right of access – you may request confirmation of whether we process your data and obtain a copy thereof.
• Right to rectification – you may request correction or updating of inaccurate or incomplete data.
• Right to erasure (‘right to be forgotten’) – you may request deletion of your data where, for example, the data is no longer necessary for the purposes for which it was collected, you have withdrawn your consent, or the data has been processed unlawfully.
• Right to restriction of processing – you may request restriction of processing, for example while we verify the accuracy of your data.
• Right to data portability – where processing is based on consent or a contract and is carried out by automated means, you may request that your data be provided in a structured, commonly used, and machine-readable format.
• Right to object – you may object to processing based on legitimate interest (including profiling) on grounds relating to your particular situation, or to processing for direct marketing purposes at any time.
• Right to withdraw consent – where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of the above rights, please contact us at:

E-mail: office@lexcarta.pl

Postal address: ul. Żwirowa 8D, 05-506 Wilcza Góra, Poland

11. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. The competent supervisory authority in Poland is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.

12. Contact

If you have any questions, concerns, or complaints regarding this Privacy Policy or the way we process your personal data, please contact us at:

E-mail: office@lexcarta.pl

Postal address: LEXCARTA Sp. z o.o., ul. Żwirowa 8D, 05-506 Wilcza Góra, Poland

We will review all complaints received and respond to them.
13. Cookies Policy

Last updated: February 2026