This is a translation for information only. The Polish version is binding: Polityka prywatności

Privacy Policy

Information on personal data processing in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)

1. Data Controller

The controller of your personal data is PW MatysArt Michal Matysiak (hereinafter: "Controller"). The Controller operates the website forcen.pl and provides services in the field of assistance with the legalisation of residence of foreigners on the territory of the Republic of Poland.

The Controller has not appointed a Data Protection Officer. For all matters concerning the processing of personal data, please contact the Controller at: legal.stay@forcen.pl.

In services for businesses in which the Controller processes data of the business's employees or job candidates (e.g. an employment legality audit, a pre-employment check, document monitoring), the controller of that data is the business. The Controller then acts as a processor: it processes the data solely on the business's documented instructions, under a personal data processing agreement concluded with it (Article 28 GDPR). In matters concerning that data, data subjects may contact the business; the Controller assists it in fulfilling their rights.

2. Scope of data processed

In the course of using the website and the Controller's services, the following personal data may be processed:

• First and last name - identification of the Client and performance of the service
• Citizenship - necessary for the proper preparation of documentation
• E-mail address - contact and communication regarding the service
• Phone number - telephone contact with the Client
• Voivodeship (province) - determination of the competent voivodeship office
• Purpose of stay - preparation of the appropriate application
• IP address - collected automatically for technical and security purposes
• Source of the request - the address of the page from which the form was sent (with utm campaign parameters, if present in the address) and the address of the page you came from (referrer); collected when the form is sent, without cookies, to find out which pages lead to requests (Art. 6(1)(f) GDPR)
• Data processed in the course of service performance - date of birth, residential address, identity document data, data concerning employment or study, family members' data (where required by the procedure), scans of documents required by the residence procedure, data identifying the payment and contract (NIP or PESEL where required, amounts, bank account number).

3. Legal bases for processing

Personal data are processed on the following legal bases:

• Art. 6(1)(b) GDPR - processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract (performance of the residence legalisation assistance service).
• Art. 6(1)(a) GDPR - the data subject has given consent to the processing of their personal data (e.g. consent to contact via a form).
• Art. 6(1)(f) GDPR - processing is necessary for the purposes of the legitimate interests pursued by the Controller (ensuring website security, pursuing claims).
• Art. 6(1)(c) GDPR - processing is necessary for compliance with a legal obligation to which the Controller is subject, in particular obligations arising from tax and accounting regulations (issuing invoices, archiving documentation) and the transfer of data to public administration authorities within the scope of the granted power of attorney.

4. Special categories of data

Where the legalisation procedure requires the submission of documents containing data concerning health (e.g. proof of health insurance, medical certificates) or information on criminal convictions and offences (Art. 10 GDPR), the Controller processes such data solely on the basis of the Client's explicit consent (Art. 9(2)(a) GDPR), expressed by voluntarily providing those documents for inclusion in the application. The provision of such data is voluntary but necessary for the proper preparation of the application.

5. Data retention period

Personal data are stored for the duration of the service and for 5 years after its completion, arising from:

• obligations under tax and accounting regulations,
• the limitation period for civil law claims,
• any administrative or court proceedings.

Data processed on the basis of consent are stored until consent is withdrawn. Upon expiry of the retention period, data are permanently deleted.

Data submitted via the contact form but not utilised due to failure to conclude a contract shall be deleted no later than 6 months from the date of last contact, unless further storage is necessary for the pursuit of claims or the performance of legal obligations. Billing and accounting data are stored for 5 years from the end of the year in which the tax obligation arose.

6. Rights of data subjects

Every person whose personal data are processed by the Controller has the right to:

• Access to data - obtaining information about data being processed and receiving a copy thereof (Art. 15 GDPR).
• Rectification of data - requesting correction of inaccurate or completion of incomplete data (Art. 16 GDPR).
• Erasure of data ("right to be forgotten") - requesting deletion of data where there is no basis for their further processing (Art. 17 GDPR).
• Restriction of processing - requesting restriction of data processing in certain situations (Art. 18 GDPR).
• Data portability - receiving data in a structured, machine-readable format (Art. 20 GDPR).
• Right to object (Art. 21 GDPR) - lodging at any time an objection to the processing of data based on the Controller's legitimate interest.
• Withdrawal of consent - where processing is based on consent (Art. 6(1)(a) GDPR), the right to withdraw consent at any time; withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.
• Right to lodge a complaint - filing a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stanislawa Moniuszki 1A, 00-014 Warsaw, uodo.gov.pl.

To exercise the above rights, please contact us at: legal.stay@forcen.pl.

Personal data are not subject to automated decision-making, including profiling within the meaning of Art. 22 GDPR.

7. Cookies and localStorage

The website forcen.pl uses necessary cookies and the localStorage mechanism to remember that the cookies notice was closed:

• Session cookies - ensure the proper functioning of the website and are automatically deleted when the browser is closed.
• localStorage - stores user preferences (e.g. information about acceptance of the cookies policy and interface preferences).

The website does not use tracking, analytical or advertising cookies. Detailed information about cookies is available in the Cookies Policy.

8. Recipients of data

Personal data may be transferred to the following entities:

• Hosting service provider - HITME Spolka z ograniczona odpowiedzialnoscia (hitme.pl), providing server infrastructure and e-mail handling services, on the basis of a data processing agreement.
• Entities providing accounting services - to the extent necessary for the performance of the service, on the basis of a concluded data processing agreement.
• Entities cooperating in the performance of the service, including entities providing legal assistance - to the extent necessary for the performance of the service ordered by the Client.
• Public administration authorities - voivodeship offices, where necessary for the performance of the service (with the Client's knowledge and consent).

The Controller does not sell, disclose or exchange personal data with third parties for marketing purposes.

9. Transfer of data outside the EEA

The Controller does not transfer personal data outside the European Economic Area (EEA). All data are processed on servers located in Poland / the European Union.

10. Data security

The Controller applies appropriate technical and organisational measures to protect personal data, including:

• encryption of connections (HTTPS/SSL protocol),
• form security measures (blocking submissions sent from other websites, limit on the number of submissions, honeypot, server-side validation),
• restriction of access to data exclusively to authorised persons,
• regular updates of server software.

11. Changes to the Privacy Policy

The Controller reserves the right to amend this Privacy Policy. Users will be informed of any changes by publishing an updated version on the website. The current version of the policy is effective from the date of its publication.

This document was originally drafted in Polish. In the event that translations are made available, the Polish version shall be binding in case of discrepancies.

Last updated: October 2026

Back to home page