Privacy Policy

Last updated: May 2026

1. Data Controller

The controller of your personal data is Everlegal.pl Ludmiła Zawalewska, ul. Żurawia 32/34 lok. 50, 00-515 Warsaw, email: biuro@everlegal.pl, phone: +48 668 668 171.

2. What data do we collect?

We collect personal data that you voluntarily provide to us, including:

• Contact data: first name, last name, email address, phone number
• Identification data: PESEL, passport number, nationality (when required to provide services)
• Legalisation case data (documents, residence history, employment, etc.)
• Technical data: IP address, cookies, browser data (collected automatically)
• Client portal account data: login email, history of assigned cases, access to uploaded files
• Booking data: first name, last name, email, preferred consultation language

3. Purpose and legal basis for processing

• Provision of legalisation services — legal basis: performance of a contract (Art. 6(1)(b) GDPR)
• Responding to enquiries via the form — legal basis: legitimate interest of the controller (Art. 6(1)(f) GDPR)
• Fulfilment of legal obligations — legal basis: legal obligation (Art. 6(1)(c) GDPR)
• Marketing of own services — legal basis: legitimate interest or consent (Art. 6(1)(a) or (f) GDPR)
• Operation of the client portal and management of legalisation cases — legal basis: performance of a contract (Art. 6(1)(b) GDPR)
• Handling consultation booking requests — legal basis: pre-contractual steps taken at the data subject's request (Art. 6(1)(b) GDPR)

4. Who do we share data with?

Your data may be shared with:

• Public administration authorities — only to the extent necessary for handling your case
• Partners and subcontractors — sworn translators, law firms, accounting offices
• IT service providers — Supabase Inc. (database and document storage), Vercel Inc. (hosting), Resend Inc. (transactional email), Google LLC (Analytics) — under data processing agreements or Standard Contractual Clauses

5. How long do we store data?

• Client data: for the duration of the contract and then for 5 years (as required by law)
• Contact form data (without a contract): 12 months from contact
• Marketing data: until consent is withdrawn or an objection is raised
• Portal account data and case files: 5 years from case closure
• Documents uploaded to the portal: until case closure + 5 years (earlier deletion possible on written request)
• Booking data (without a concluded contract): 12 months from the appointment date

6. Your rights

You have the following rights:

• Right of access to data
• Right to rectification of data
• Right to erasure of data ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time

To exercise your rights, contact us: phone +48 668 668 171 or email: biuro@everlegal.pl

You have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.

7. Cookies

Our website uses cookies — small text files stored in your browser. They are used to remember your preferences, analyse traffic and display relevant content. You can manage cookie settings in your browser.

8. Changes to the Privacy Policy

We reserve the right to change this policy. We will inform about any significant changes on the website. The date of the last update is visible at the top of the document.

9. Special Categories of Personal Data

In the course of handling legalisation cases, we may process data falling under special categories as defined in Article 9 GDPR, such as data relating to nationality, identity documents, and employment and residence history. Such data is processed solely to the extent necessary to deliver the service, on the basis of Article 9(2)(b) GDPR (obligations under employment and social security law) or — where that provision does not apply — on the basis of the client's explicit consent (Article 9(2)(a) GDPR).

10. International Data Transfers

Some of our IT service providers (Supabase Inc., Vercel Inc., Resend Inc., Google LLC) are based in the United States. Data transfers to these entities are carried out on the basis of Standard Contractual Clauses adopted by the European Commission (Article 46(2)(c) GDPR), ensuring an adequate level of data protection. Google Analytics data is processed only after the user has given consent via the cookie banner on our website.