Privacy Policy
Last updated: September 17, 2026
1. Data controller
The controllers of personal data processed in connection with the use of the brat-pit.pl website and the provision of accounting services are the partners conducting business as a Polish civil law partnership (spółka cywilna):
B. Mikołajewska and N. Strzelecka, trading as Biuro Rachunkowe Brat-PIT s.c.
Address: Opałowa 15 lok. 2, 93-487 Łódź - Górna, Poland
NIP (Polish Tax ID): [to be completed]
REGON (Polish statistical business number): [to be completed]
Contact email: biuro@brat-pit.pl
Phone: +48 537 664 661
For all matters concerning the processing of personal data, you can contact the Controller using the details above.
2. What data we process and why
| Purpose of processing | Scope of data | Legal basis (GDPR) |
|---|---|---|
| Responding to an inquiry sent by phone or email, prior to concluding a contract | Full name, contact details, message content | Art. 6(1)(b) GDPR — pre-contractual measures |
| Provision of accounting and HR/payroll services | Identification data (name, PESEL — Polish national identification number, NIP — Polish Tax ID), contact details, employment and payroll data, accounting and tax data, data on the client's business activity | Art. 6(1)(b) GDPR — performance of a contract |
| Fulfilment of legal obligations placed on the accounting office | Data necessary to maintain accounting records and prepare filings and settlements | Art. 6(1)(c) GDPR — legal obligation (the Polish Accounting Act, Tax Ordinance Act, Labour Code, and Social Insurance System Act) |
| Archiving of documentation | Accounting, HR, and tax documents | Art. 6(1)(c) GDPR — legal obligation |
| Website traffic analysis and visitor statistics (Google Analytics 4) | Device data, approximate location, on-site behaviour, IP address (anonymised) | Art. 6(1)(a) GDPR — consent given by accepting cookies |
Providing contact details is voluntary but necessary to respond to an inquiry, or to conclude and perform an accounting services agreement.
3. Cookies
The website uses cookies in two categories:
- Essential — necessary for the website to function correctly (e.g. remembering your cookie consent choice). No consent required.
- Analytics (Google Analytics 4) — help us understand how visitors use the site. The analytics script is not loaded until you accept it via the cookie notice shown on the site. You can withdraw consent at any time by changing your browser settings or contacting the Controller.
Declining analytics cookies does not restrict access to the website's content.
4. Data recipients
Data may be shared with the following categories of recipients:
- Polish tax offices and ZUS (the Polish Social Insurance Institution) — to the extent necessary to fulfil legal obligations.
- Banks — to the extent necessary to process payments related to client service.
- External tax advisors or statutory auditors — only in matters requiring licences the office does not hold itself, and with the client's separate consent.
- Google LLC (Google Analytics 4) — for analytics data, only where consent to analytics cookies has been given. Google may process data outside the European Economic Area; such transfers rely on standard contractual clauses approved by the European Commission.
- Providers of hosting, IT, and website maintenance services.
- Entities authorised under law (e.g. public administration bodies).
The Controller does not sell personal data to third parties.
5. Data retention periods
- Accounting documents: 5 years from the end of the financial year to which they relate.
- Tax documents: 6 years, counted from the end of the calendar year in which the tax payment deadline fell.
- HR documents: for the period required by Polish labour law — generally 10 years from the end of employment; for employees hired before 2019, this period may be longer under transitional provisions.
- Data from contact inquiries (where no contract was concluded): for the period necessary to respond.
- Analytics data (Google Analytics 4): in line with Google Analytics retention settings — standardly up to 14 months.
6. Rights of data subjects
Every person whose data is processed has the right to:
- access their data and receive a copy of it,
- rectify (correct) their data,
- erasure of their data — subject to the retention periods arising from the legal obligations described in section 5,
- restrict processing,
- data portability,
- object to processing based on legitimate interest,
- withdraw consent at any time (without affecting the lawfulness of processing carried out before withdrawal),
- lodge a complaint with the President of the Personal Data Protection Office (UODO — the Polish data protection authority), ul. Stawki 2, 00-193 Warsaw, Poland.
7. Automated decision-making
The Controller does not use automated decision-making, including profiling, in relation to client and website user data.
8. Data security
The Controller applies appropriate technical and organisational measures to secure processed data, including:
- encryption of transmitted data (SSL),
- access control for personal data,
- regular backups,
- data processing agreements with external entities.
9. Changes to this policy
This Privacy Policy may be updated. The current version is always available at brat-pit.pl/en/privacy-policy.html.
This document is a draft prepared for approval and does not constitute legal advice — review by a lawyer is recommended before publication, in particular regarding registration data (NIP, REGON) and current HR document retention periods. The authoritative version of this policy is the Polish-language original; this translation is provided for convenience.