Skip to main content
Totu Legal

Legal

Privacy Policy

How Totu Legal collects, uses and protects personal data on totulegal.com.

§1 General provisions

  1. The controller of personal data collected through the website www.totulegal.com (the "Website") is PODSKARBI SP. Z O.O., operating as Totu Legal, entered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0001202009, kept by the District Court in Koszalin, IX Commercial Division of the National Court Register, NIP (Polish tax ID): PL4990709359, REGON: 543071442, share capital: PLN 100,000.00, place of business and address for service: Nowy Świat 33/13, 00-029 Warsaw, Poland, with a second office at 9350 Wilshire Blvd, Suite 203, Beverly Hills, CA 90212, United States, email: office@totulegal.com, phone: +48 501 305 983 or +1 (310) 878-1022 (the "Controller", also acting as the "Service Provider").
  2. Personal data collected by the Controller through the Website is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter the "GDPR", and with other applicable data protection laws.
  3. Capitalized terms used in this Privacy Policy have the meaning given to them in the Terms of Service of the Website.

§2 Types of personal data, purposes and scope of processing

  1. Purposes and legal bases. The Controller processes the personal data of Users of the Website when they:
    • place an Order on the Website (for example, purchase a paid consultation), in order to perform the Sales Agreement, under Art. 6(1)(b) GDPR (performance of a contract), and to issue invoices and keep accounting records, under Art. 6(1)(c) GDPR (legal obligation);
    • use the Contact Form or the Chat, in order to respond to the message and assess whether we can help, under Art. 6(1)(b) GDPR (steps taken at the User's request before entering into a contract) and Art. 6(1)(f) GDPR (the Controller's legitimate interest in answering inquiries);
    • book a consultation through the booking system (Calendly), in order to schedule and hold the consultation, under Art. 6(1)(b) GDPR;
    • receive a confirmation email after submitting the Contact Form or the Chat, under Art. 6(1)(f) GDPR (legitimate interest in confirming receipt of an inquiry);
    • receive email notifications marketing the Controller's own services, under Art. 6(1)(f) GDPR (legitimate interest of the business), or, where required by law, on the basis of consent.
  2. Types of personal data. The User provides:
    • for an Order: first and last name, address, tax ID (NIP) where an invoice for a business is requested, email address, phone number; payment card details are entered directly into the payment system (Stripe) and are not received or stored by the Controller;
    • for the Contact Form: name, email address, optional phone number, the selected topic and the message;
    • for the Chat: the selected answers (country of the legal matter, type of matter, urgency), first and last name, email address, optional phone number and any additional information the User chooses to type;
    • for a consultation booking: the details entered into the booking form, such as name, email address, phone number and a description of the case;
    • for a Newsletter, if offered: name and email address.
  3. Retention periods. The personal data of Users is kept by the Controller:
    • where processing is based on the performance of a contract, for as long as necessary to perform the contract and afterwards for a period corresponding to the limitation period for claims. Unless a specific provision provides otherwise, the limitation period is six years, and three years for claims for periodic performance and claims related to running a business;
    • where processing is based on consent, until the consent is withdrawn, and after withdrawal for a period corresponding to the limitation period for claims that the Controller may raise or that may be raised against it. Unless a specific provision provides otherwise, the limitation period is six years, and three years for claims for periodic performance and claims related to running a business;
    • where processing is based on the Controller's legitimate interest (for example, inquiries that do not lead to an engagement), for as long as necessary to handle the inquiry and afterwards for a limited period, unless the User objects;
    • client files and accounting documents for the periods required by the rules of the legal profession and by tax law.
  4. While the Website is used, additional information may be collected, in particular: the IP address assigned to the User's device or the external IP address of the Internet provider, the domain name, browser type, access time and type of operating system. The IP address is used to deliver the Website securely and to limit spam and abuse of the forms; it is not stored in our records or sent to us. When the Contact Form or the Chat is submitted, the notification sent to the Controller includes the page the message was sent from, the referring website, campaign parameters (UTM) and an approximate location (city, region and country) derived from the IP address by our hosting provider.
  5. With separate consent, under Art. 6(1)(a) GDPR, data may also be processed to send commercial information by electronic means or to make telephone calls for direct marketing purposes, in connection with Art. 10(2) of the Polish Act of 18 July 2002 on the provision of electronic services or Art. 172(1) of the Polish Telecommunications Law of 16 July 2004 (or the corresponding provisions of the Electronic Communications Law), including messages targeted as a result of profiling, provided the User has given the relevant consent.
  6. Navigation data may also be collected from Users, including information about the links they click and other actions taken on the Website. The legal basis is the Controller's legitimate interest (Art. 6(1)(f) GDPR) in making the electronic services easier to use and improving their functionality. Analytics and advertising tools that use cookies are activated only after the User consents (see §5).
  7. Providing personal data is voluntary, but it is necessary to respond to an inquiry, book a consultation or perform a Sales Agreement.
  8. The Controller takes particular care to protect the interests of data subjects and, in particular, ensures that the data it collects is:
    • processed lawfully;
    • collected for specified, lawful purposes and not further processed in a manner incompatible with those purposes;
    • accurate and adequate in relation to the purposes for which it is processed, and kept in a form that permits identification of data subjects for no longer than necessary to achieve the purpose of processing.
  9. Please do not send confidential or sensitive information through the Website before the Controller has agreed to represent you. Submitting the Contact Form, using the Chat or booking a consultation does not create an attorney-client relationship.

§3 Disclosure of personal data

  1. The personal data of Users is transferred to service providers that the Controller uses to run the Website and its practice, in particular:
    • payment system providers (Stripe);
    • the accounting office;
    • the hosting provider (Vercel Inc.);
    • providers of software used to run the practice, including email and video calls (Google Workspace and Google Meet, Google LLC) and the consultation booking system (Calendly LLC);
    • providers of software needed to run the Website, including email delivery and, with consent, analytics and advertising tools (Google LLC, Meta Platforms Ireland Ltd.).
  2. Depending on contractual arrangements and circumstances, the service providers referred to in point 1, to which personal data is transferred, either follow the Controller's instructions as to the purposes and means of processing (processors) or determine the purposes and means of processing themselves (controllers).
  3. Some of these providers are based in the United States or process data there. Where personal data is transferred outside the European Economic Area (EEA), the transfer is based on an adequacy decision (including the EU-U.S. Data Privacy Framework for certified providers) or on the Standard Contractual Clauses approved by the European Commission, subject to §5 and §6 of this Privacy Policy. Because the Controller also practices in the United States, data relating to U.S. matters may be handled by the Beverly Hills office.

§4 Right to control, access and correct your data

  1. Data subjects have the right to access their personal data and the right to rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
  2. Legal bases of the User's requests:
    • access to data: Art. 15 GDPR;
    • rectification of data: Art. 16 GDPR;
    • erasure of data (the "right to be forgotten"): Art. 17 GDPR;
    • restriction of processing: Art. 18 GDPR;
    • data portability: Art. 20 GDPR;
    • objection: Art. 21 GDPR;
    • withdrawal of consent: Art. 7(3) GDPR.
  3. To exercise the rights referred to in point 2, send an email to office@totulegal.com.
  4. When a User exercises any of the above rights, the Controller fulfills or refuses the request without undue delay, and in any event within one month of receiving it. If, due to the complexity or number of requests, the Controller cannot fulfill the request within one month, it will do so within the following two months, informing the User within one month of receiving the request of the intended extension and the reasons for it.
  5. If a data subject considers that the processing of personal data infringes the GDPR, they have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, Poland, or with the supervisory authority of their place of residence in the EU. California residents may have additional rights under California law and may exercise them using the email address above.

§5 Cookies

  1. The Controller's website uses cookies and similar technologies (such as browser storage).
  2. Some cookies and similar technologies are necessary for the Website to work properly, for example to remember the User's cookie choices (the tl_consent cookie, kept for 180 days) and whether the chat preview has already been shown during the current visit (browser session storage). With the User's consent to Personalization, the browser also remembers the last service viewed or the visa quiz result (local storage, up to 90 days) to offer picking up where the User left off; this information is not sent to the Controller. Other cookies make it possible to compile general statistics on visits to the Website and to measure advertising; these are used only after the User consents in the cookie banner.
  3. Two types of cookies are used on the Website: "session" cookies and "persistent" cookies.
    • "Session" cookies are temporary files stored on the User's end device until the User logs out or leaves the Website.
    • "Persistent" cookies are stored on the User's end device for the time specified in the cookie parameters or until the User deletes them.
  4. The Controller uses analytics to better understand how Users interact with the content of the Website. These tools collect information about how the User uses the Website, the type of site from which the User was referred, and the number and duration of visits. This information does not record specific personal data of the User but is used to compile statistics on the use of the Website.
  5. With the User's consent, the Controller uses third-party cookies to collect general statistical data through Google Analytics (third-party cookie controller: Google LLC, based in the USA). Until consent is given, these tools are not loaded.
  6. With the User's consent, cookies may also be used by advertising networks, in particular Google (Google Ads) and, if enabled, Meta (Meta Pixel), to measure the effectiveness of ads and to display ads tailored to how the User uses the Website. For this purpose they may store information about the User's navigation path or the time spent on a given page.
  7. The User decides on the use of cookies in the cookie banner and can change that decision at any time using the "Cookie settings" link in the footer of the Website. The User can also manage cookies in the settings of their web browser. Details are available in the Cookie Policy.
  1. The Website does not use social plugins (such as "Like" or "Share" buttons) that connect to social networks when a page loads. The Website contains links to the Controller's profiles on social networks (including Facebook, Instagram, LinkedIn, YouTube, TikTok, Threads and X) and displays client reviews published on Google and Facebook, which are retrieved by our server; displaying them does not send the User's data to these services.
  2. If the User clicks a link to a social network or a review platform, the browser connects directly to the servers of that provider, which then receives information that the User came from www.totulegal.com, together with the User's IP address (some servers are located in the USA).
  3. If the User is logged in to one of these services, its provider may be able to associate the visit with the User's profile on that service.
  4. If the User interacts with content on these services, for example by clicking "Like" or "Share" there, the relevant information is sent directly to the provider's server and stored there.
  5. The purpose and scope of data collection and the further processing and use of data by these providers, as well as the User's rights and the settings available to protect the User's privacy, are described in their privacy policies:
  6. The consultation booking system (Calendly) is loaded only when the User opens the scheduler. From that moment Calendly LLC receives the User's IP address and the details entered into the booking form, and processes them in accordance with its privacy policy: https://calendly.com/privacy. When the User has used the Chat, the booking form may be pre-filled with the name, email address, phone number and case summary the User provided, to save typing them again; the User can change them before booking.
  7. Payments are processed by Stripe, which receives the payment details directly from the User and processes them in accordance with its privacy policy: https://stripe.com/privacy.
  8. The Controller uses remarketing tools, namely Google Ads, which involves the use of Google LLC cookies relating to the Google Ads service. Through the cookie settings mechanism, the User can decide whether the Service Provider may use Google Ads (third-party cookie controller: Google LLC, based in the USA) in relation to them.

§7 Final provisions

  1. The Controller applies technical and organizational measures ensuring protection of the personal data processed that is appropriate to the risks and categories of data protected, and in particular protects data against disclosure to unauthorized persons, removal by an unauthorized person, processing in breach of applicable law, and alteration, loss, damage or destruction.
  2. The Controller provides appropriate technical measures to prevent unauthorized persons from acquiring and modifying personal data sent electronically, including encrypted connections (HTTPS), spam and abuse protection of the forms and access controls for systems containing personal data.
  3. In matters not regulated by this Privacy Policy, the provisions of the GDPR and other applicable provisions of Polish law apply accordingly.
  4. The Controller may update this Privacy Policy. The current version is always published on this page.