Privacy policy

Document version

HEREDITAS — Paweł Ciechanowski, ul. Armii Krajowej 29/30, 30-150 Kraków, Poland, tax ID (NIP) 6771110770. Contact: kontakt@hereditas.biz. Version 3.0, updated 17 September 2026. This document describes the website after installation of update 1.2.0.

1. Controller and contact

The controller of personal data is HEREDITAS — Paweł Ciechanowski, ul. Armii Krajowej 29/30, 30-150 Kraków, Polska, NIP 6771110770. For privacy matters contact kontakt@hereditas.biz, call +48 883 30 93 13, or write to the controller’s postal address.

2. Scope

This policy covers data processed in connection with use of the website, case submission form, email and telephone correspondence, case qualification, entering into and performing cooperation, settlements, website security and protection against claims.

Where HEREDITAS obtains a person’s data from sources other than directly from that person, the separate Article 14 GDPR notice also applies.

3. Categories of data

Depending on the relationship, data may include name, email, telephone number, location and address of the property, type and description of the matter, ownership and share information, family and inheritance information, correspondence, contractual and billing data, and technical website data.

The open form is not intended for national identification numbers, identity document numbers, complete files, health, religion, origin, criminal data or other special categories. Such information may be processed outside the open form only where genuinely necessary and supported by an appropriate legal basis.

4. Form, email, telephone and WhatsApp — purposes and legal bases

Data provided to obtain an offer, initial assessment or cooperation are processed under Article 6(1)(b) GDPR to take steps at the person’s request before entering into a contract or to perform a contract.

Where a message is general or concerns a third party, processing may rely on Article 6(1)(f) GDPR — the controller’s legitimate interests in handling correspondence, assessing the matter, organising work, ensuring security and establishing, exercising or defending legal claims.

The form does not rely on consent as the basis necessary to respond. The checkbox only confirms that the Privacy Policy has been read.

Contact through WhatsApp is voluntary. The website button opens the external WhatsApp service with a prepared message. If the message is sent, the controller receives its content and the profile data made available by the user in that service. The controller relies on Article 6(1)(b) or (f) GDPR, depending on the purpose of contact. WhatsApp processes data under its own terms.

5. Required and optional data

The form requires name, email, property location, type of matter and a brief description. Without these data the submission cannot be sent or meaningfully reviewed.

Telephone number and information about how the person learned about HEREDITAS are optional. Additional information in the description is voluntary and should be limited to what is genuinely needed.

6. Contract, services and accounting

Contract-related data are processed to prepare, enter into and perform cooperation under Article 6(1)(b) GDPR. Accounting and tax data are processed to comply with legal obligations under Article 6(1)(c) GDPR.

Data may also be processed under Article 6(1)(f) GDPR to document arrangements, manage the relationship, control quality, prevent abuse and establish, exercise or defend claims.

7. Technical data, logs and form security

The server may automatically record IP address, date and time, requested URL, browser and device information and technical errors. These data are used for availability, diagnostics, security and abuse prevention under Article 6(1)(f) GDPR.

The form uses a security token, a hidden anti-spam field and a temporary rate limit. After a successful submission, a hash of the IP address is technically retained for approximately 2 minutes to limit automated submissions. The form does not create a separate public database; the message is sent by email.

8. Recipients

Data may be accessed by service providers supporting the controller, in particular LH.pl for hosting and infrastructure, Google Workspace for email and office tools, WhatsApp/Meta only when the user voluntarily chooses WhatsApp contact, and providers of IT support, security, backups, accounting and organisational services.

Where necessary for a specific matter, data may be disclosed to independent lawyers, genealogists, brokers, engineers, valuers or other specialists after defining the scope, legal basis and confidentiality rules. Data are not sold.

9. Transfers outside the EEA

Some technology providers may process data or provide access outside the European Economic Area. In such cases the controller uses mechanisms under Chapter V GDPR, including adequacy decisions, standard contractual clauses or other appropriate safeguards.

Information about safeguards can be requested from the controller.

10. Retention

Submissions and correspondence are retained until the matter is handled and then for the time needed to demonstrate the course of contact and until applicable limitation periods expire, unless there is a basis for earlier deletion.

Contract records are kept for the duration of cooperation and applicable limitation periods. Accounting and tax documents are kept for the period required by law, generally five years counted from the end of the year in which the tax payment deadline expired.

Logs, security data and backups are retained according to providers’ technical cycles and for the time needed to detect, investigate and document incidents. Data may be retained longer where required by law, proceedings or protection of claims.

11. Third-party data

A person submitting a matter should provide data about other persons only where necessary and lawful. HEREDITAS may process data of owners, co-owners, heirs, representatives, family members and other persons connected with the matter.

The categories, sources, purposes and rights of those persons are described in the notice on data obtained from other sources.

12. Special categories and criminal data

The controller does not expect such data to be submitted through the form. If processing becomes necessary in the course of a matter, it will be limited to what is necessary and based on an appropriate condition under Article 9(2) GDPR or applicable rules concerning criminal convictions and offences, with additional safeguards.

13. Rights

Depending on the legal basis and circumstances, a person may request access and a copy, rectification, erasure, restriction, portability, and may object to processing based on Article 6(1)(f) GDPR.

Where particular processing relies on consent, consent may be withdrawn at any time without affecting prior lawful processing. Some rights may be limited where data are needed to comply with law or establish, exercise or defend claims.

Requests may be sent to kontakt@hereditas.biz. The controller may request information necessary to verify the requester’s identity.

14. Complaint

A person may lodge a complaint with the President of the Polish Personal Data Protection Office if they consider that processing infringes the GDPR. Information is available at uodo.gov.pl.

15. Automated decisions and profiling

Data are not used for decisions based solely on automated processing that produce legal or similarly significant effects. The website does not conduct marketing profiling. Initial case qualification involves human review.

16. Cookie policy

With analytics consent, Google Analytics is activated through Site Kit. It measures page visits, events and technical information about the device and browser. Google receives connection data including an IP address; GA4 does not store individual IP addresses in its reports. The purpose is to understand website use and improve it. The basis is consent under Article 6(1)(a) GDPR and consent to optional device technologies under Article 399 of the Polish Electronic Communications Law. The _ga and _ga_* cookies distinguish browsers and sessions. Their standard lifetime is up to two years and may be renewed on subsequent visits; browsers may impose shorter limits. Cookie lifetime is distinct from data retention in the Analytics account. Google explains its processing and retention in its information for websites using Google services. We use Basic Consent Mode v2: the Google tag is blocked before consent and after refusal. Analytics consent changes only analytics_storage. ad_storage, ad_user_data and ad_personalization remain denied. This update does not enable advertising campaigns or personalised ads. Google Signals is disabled in tag configuration. Refusal does not prevent reading articles or using the form. Google services in the European Economic Area are provided by Google Ireland Limited. Other Google entities, including Google LLC in the USA, may participate in processing. Data may be processed outside the EEA under the service terms and applicable transfer mechanisms, such as an adequacy decision or standard contractual clauses. See Google’s legal frameworks for transfers. Open “Cookie settings” in the footer or on this page at any time. You may reject optional technologies, save your own choices or change them. Withdrawal stops further loading; the page reloads to remove running scripts and players. Accessible analytics cookies are removed. This does not automatically delete data already sent to Google or data stored under another domain. Withdrawal does not affect the lawfulness of earlier processing. You may also delete website data in your browser. After deletion, 180 days or a change of policy version, we ask for a new choice. If browser storage is unavailable, the choice applies only during the current visit.

17. Security

The controller applies organisational and technical measures appropriate to risk, including access controls, HTTPS, form security, backups and limiting access to persons who need the information for their tasks.

No method of transmission or storage guarantees absolute security. If a breach occurs, the controller takes the actions required by the GDPR.

18. Changes

This policy may be updated when law, website functionality, providers or processing methods change. The current version is published with the update date. Adding analytics, marketing, a newsletter or new integrations requires reassessment and appropriate information and consent mechanisms.

YouTube and social media

The website provides links to HEREDITAS profiles on Instagram, Facebook and YouTube. They are ordinary links without automatically loaded social plugins, counters, pixels or platform scripts. Data is processed under the selected platform’s own rules only after the user follows a link.

The latest public videos from the HEREDITAS channel are detected automatically. The website server retrieves public titles, dates, video identifiers and thumbnails, while thumbnails are cached locally. The visitor’s browser does not connect to YouTube merely by displaying the video section.

A player from youtube-nocookie.com is created only after the user consciously clicks the play button. From that moment Google/YouTube may receive the IP address, device and browser information and playback data, and may use its own cookies or local storage. Loading the player is optional; the material can also be opened directly on YouTube.