Privacy policy

Controller of personal data:
Kancelaria Radcy Prawnego Przemysław Kołakowski (Harbor LEGAL)
VAT ID (NIP): 952 198 35 01
ul. Lekarska 2/1, 00-610 Warsaw, Poland
E-mail: office@harbor.legal
Phone: +48 453 390 849

1. Scope of processing

I process personal data to the extent necessary to: provide legal services, make the online diagnostic tools available (GDPR Audit, B2B Contract Check, NIS2 Compliance Check, AI Act Classification and other tools on the app.harbor.legal platform), maintain User accounts on app.harbor.legal, answer enquiries sent through the contact and quote forms, handle e-mail correspondence, send an informational e-mail sequence (with the User’s consent), keep visitor statistics for the site and measure conversions from advertising (with consent) and meet legal obligations.

2. Data collected in the online tools

2.1. Diagnostic form (without an account)

When you fill in the form in the GDPR Audit, B2B Contract Check, NIS2 Compliance Check or AI Act Classification tools, you provide: an e-mail address (used as an identifier and for communication), the company’s tax identification number (NIP, used to fill in the company details automatically) and answers to the form’s questions (about the organisation, its processes or the terms of cooperation).

Legal basis in all tools: Article 6(1)(b) GDPR. Using the tools means accepting the Terms of the online tools (in Polish), which are terms for providing services by electronic means, and processing the data from the form is necessary to prepare the result and the documents you ask for.

2.2. User account

When you create an account on app.harbor.legal, you also provide your name and a password (stored in hashed form). The account gives access to the generated documents, the history of your use of the tools and communication with the law practice. Legal basis: Article 6(1)(b) GDPR.

2.3. Generated documents

Personalised working documents are generated from the answers in the form. They contain the User’s company data and are stored in the User’s account for as long as the account exists.

3. Newsletter and e-mail communication

If you give your consent, you may receive e-mails from Harbor LEGAL, including notifications about the results of the diagnostic tools, a newsletter about changes in the law, new tools and services of the law practice, and invitations to a consultation with an attorney at law.

Legal basis: Article 6(1)(a) GDPR (consent). You can withdraw your consent at any time by clicking the unsubscribe link in any e-mail or by writing to office@harbor.legal. Withdrawing consent does not affect the lawfulness of processing carried out before it was withdrawn.

4. Visitor statistics

On the site I use Google Analytics 4, implemented through Google Tag Manager, to know how many people visit the site and which content they read. Google Ads conversion measurement also runs through Google Tag Manager: it tells me whether a visit from an advertisement ended with contacting the law practice. I do not use this data for remarketing or personalised advertising.

Analytics and conversion measurement cookies are stored only after you give consent in the cookie consent window. Without consent, Google tags run in Consent Mode: they do not store or read cookies and send Google only measurement signals without cookie identifiers, which Google Ads uses to estimate the number of conversions. You can withdraw consent at any time by choosing “Cookie settings” in the site footer or by clearing cookies in your browser. Withdrawing consent does not affect the lawfulness of processing before it was withdrawn.

Legal basis: Article 6(1)(a) GDPR (consent) for personal data, and Article 399 of the Polish Electronic Communications Law of 12 July 2024 (Prawo komunikacji elektronicznej) for storing information in terminal equipment. Measurement signals sent without consent do not involve storing or reading information on your device. To the extent they include personal data (the IP address of the connection), the basis is Article 6(1)(f) GDPR: the legitimate interest of measuring the effectiveness of ads.

Recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the United States on the basis of the European Commission’s adequacy decision (Data Privacy Framework), under which Google LLC holds an active certification.

Retention: I keep event and user data in Google Analytics for no longer than 14 months from the last activity. The Google Ads conversion cookie stores the advertisement click identifier in the browser for up to 90 days.

Scope: the cookie identifier, information about the device and browser, the pages visited, the source of the visit and an approximate location derived from the IP address. Google Analytics 4 does not log or store IP addresses: the address is used only to determine an approximate location at the time of collection and is then discarded. I do not combine this data with the data you send through a form.

5. Other legal bases for processing

Data are also processed on the basis of: performance of a contract or steps taken before entering into it (Article 6(1)(b) GDPR) for legal services and platform services, the controller’s legitimate interest (Article 6(1)(f) GDPR) in pursuing claims, keeping the platform secure and analysing how the tools are used in order to improve them, and a legal obligation (Article 6(1)(c) GDPR) for tax and accounting duties.

6. Retention periods

• Correspondence and data from the contact form and the quote form: 12 months from the last contact, unless a contract is concluded.
• Client case files: for as long as necessary to handle the matter and meet an attorney at law’s obligations, and no longer than 10 years from the end of the year in which the data were obtained (Article 5c(2) of the Polish Attorneys at Law Act). I review the need for further storage at least every 2 years, and after that period I delete the data.
• Data from the free tools (form without an account): 12 months from filling in the form. If you create an account, the data are linked to the account.
• User account data on app.harbor.legal: for as long as the account exists and for 30 days after it is deleted, after which they are permanently erased.
• Tax and accounting data: for the period required by law (5 tax years).
• E-mail communication data (newsletter): until consent is withdrawn, and then for 6 months for accountability purposes.
• Visitor statistics data: 14 months from the last activity (section 4).

7. Rights of the data subject

You have the right to access your data, to rectification, erasure, restriction of processing, data portability, to object to processing and to withdraw consent at any time. You also have the right to lodge a complaint with the supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland).

To exercise your rights, write to office@harbor.legal.

8. Recipients of data

Data may be passed to the following recipients, only to the extent necessary to provide the services:

• website hosting, CDN and protection against attacks: Cloudflare, Inc. (Cloudflare Pages),
• hosting of the app.harbor.legal platform and its database: Supabase, Inc.,
• sending e-mails from the platform: Resend, Inc.,
• handling the contact and quote forms: Formspree, Inc.,
• booking online calls: Cal.com, Inc.,
• payments: Stripe, LLC,
• visitor statistics and conversion measurement: Google Ireland Limited,
• e-mail for the law practice: Hostinger International Limited (Cyprus),
• providers of accounting and IT services to the law practice,
• public authorities, where required by law.

Data covered by an attorney at law’s professional secrecy are passed on only where the law requires it.

9. Transfers to third countries

Some recipients are based in the United States. Google LLC, Stripe, LLC, Cloudflare, Inc. and Resend, Inc. hold an active certification under the Data Privacy Framework, so transfers to them take place on the basis of the European Commission’s adequacy decision. Transfers to the other recipients in the United States take place on the basis of the standard contractual clauses (Article 46(2)(c) GDPR) together with supplementary safeguards (encryption of data in transit and at rest).

10. Cookies

Without your consent, harbor.legal stores in your browser only the information needed for the site to work, including your choice in the consent window. Google Analytics and Google Ads cookies are stored only after you give consent (section 4). The app.harbor.legal platform uses session cookies needed to keep a logged in User’s session.

11. Automated decision making

The diagnostic tools produce a Score using a points based (rule based) algorithm. The Score is not a decision producing legal effects or similarly significantly affecting the User within the meaning of Article 22 GDPR. It is an indicative assessment only.

12. Data security

I apply appropriate technical and organisational measures: encryption in transit (TLS/HTTPS), password hashing, role based access control (RLS), regular backups and limiting access to data to what is strictly necessary.

13. Contact

In matters concerning the processing of personal data: office@harbor.legal.

Last updated: 17 September 2026