Skip to content
Certa Poland

Privacy Policy

This policy explains how personal data is processed on certapoland.com and in connection with our services, and what rights you have. Legal notice and liability terms are published separately at Legal Notice.

I. Data controller

The controller of your personal data is Biuro Rachunkowe Precyzja Sp. z o.o., ul. Twarda 18, 00-105 Warszawa, Poland (KRS 0000854434, NIP 5252832004, REGON 386751000). Certa Poland is a brand of Biuro Rachunkowe Precyzja Sp. z o.o. Contact in data-protection matters: office@certapoland.com.

II. What we process, why, and on what basis

  1. Assessment requests and enquiries (form, e-mail, phone). Purpose: responding to your enquiry and taking steps at your request before a contract (Art. 6(1)(b) GDPR); maintaining business correspondence and the ability to establish or defend against potential claims and keep a record of business dealings (Art. 6(1)(f) — legitimate interest). Providing this data is voluntary, but necessary for us to respond. How the form works: data submitted through the “Book an assessment” form is transmitted to us as an e-mail message to the controller’s mailbox; this website does not keep it in databases of its own. Standard technical logs of our infrastructure providers may apply (see §III). As of the date of this policy, form data is not entered into any external CRM system, but it may be recorded by the controller in an internal enquiry/lead register for follow-up and record-keeping purposes.

  2. Service delivery (accounting, payroll, compliance). Basis: contract performance (Art. 6(1)(b)) and the controller’s legal obligations under Polish accounting and tax law (Art. 6(1)(c)). Roles under the GDPR: where our clients (employers) entrust us with personal data of their employees or contractors for payroll and accounting purposes, we act as a processor (Art. 28 GDPR) and the client remains the controller — except where the law imposes obligations directly on us (e.g. AML, our own tax and accounting duties), in which case we act as a controller. Individuals whose data we process in the course of services receive separate information clauses; this policy is the general information layer of the website.

  3. Anti-money-laundering (AML). Where — at the relevant stage of the relationship — the controller is legally obliged to apply financial-security measures, we verify identity as required by the Polish AML Act. Basis: Art. 6(1)(c). Providing this data is a statutory requirement; without it we cannot provide the services concerned (Art. 41 of the AML Act). AML documentation is retained in secured archives of the controller.

  4. Analytics. Purpose: understanding how the site is used. Basis: your consent (Art. 6(1)(a)), given via the cookie banner. You may withdraw consent at any time (see §IV and §VI) — withdrawal does not affect the lawfulness of processing before withdrawal. Until you consent, Google Analytics does not run. For separate cookie-less aggregate traffic statistics, see point 6 below.

  5. Enquiry source attribution. If you consent to analytics via the cookie banner and you arrive at our site from a link containing campaign parameters (such as utm_*, gclid or li_fat_id), we keep those parameters — together with the domain name of the referring site — in your browser’s sessionStorage for the duration of your visit; this information is erased when you close the browser tab and is not used to track you across visits. If you then submit the “Book an assessment” form, this information (and, if you choose to answer it, the optional question “How did you hear about us?”) is attached to your enquiry, so that we know which channel it came from. Purpose: measuring the effectiveness of our marketing channels. Legal basis. Storing campaign parameters in your browser’s sessionStorage and reading them during your visit requires your consent under Article 399 of the Polish Law on Electronic Communications — this mechanism runs only under the ‘Statistics’ consent category. The subsequent processing of this information as part of your enquiry (attaching it to the lead we receive) is based on our legitimate interest (Article 6(1)(f) GDPR) in evaluating the sources of enquiries. This mechanism is internal to our lead handling and does not send any data to Google Ads; Google Ads conversion measurement is described separately in point 7. No profiling takes place and the information is not combined with any other data source. You may object at any time (see §VI).

  6. Aggregate traffic statistics (Cloudflare Web Analytics). To check whether our website is available and receiving traffic, we use Cloudflare Web Analytics. According to Cloudflare’s current documentation, this tool does not use cookies, localStorage or other client-side storage for analytics purposes, and is designed to provide aggregate traffic and performance statistics without identifying visitors across sites. It operates independently of the Google Analytics consent choice described above. To the extent that technical request data or other personal data are processed as part of website delivery or analytics-related transmission, the basis is our legitimate interest (Art. 6(1)(f) GDPR) in monitoring the availability, performance and basic traffic of our website. We monitor Cloudflare’s documentation for changes and will update this policy if the technical facts change.

  7. Google Ads — advertising conversion measurement. If you consent to the “Advertising measurement” cookie category in our consent banner, we use Google Ads conversion-tracking cookies to measure whether visits to certapoland.com result in an enquiry (e.g. a submitted contact form). This tells us which advertising channels are worth continuing — nothing more. This category concerns Google Ads conversion measurement only. The separate mechanism described in point 5 above (attribution of an enquiry’s source for our internal lead handling) operates independently of this category and does not send any data to Google Ads.

    Legal basis. Storing and reading information on your device for this purpose requires your consent under Article 399 of the Polish Law on Electronic Communications (Prawo komunikacji elektronicznej); the resulting processing of personal data (an identifier tied to your browser and the fact that a form was submitted) is based on your consent under Article 6(1)(a) GDPR. This consent is separate from your consent to analytics cookies: you can give or refuse either of them independently, and neither choice affects your access to this website.

    What we do not do. We do not use this category to personalize or target advertising to you, to build an advertising profile, or for remarketing. We configure Google’s tools so that the “ad_personalization” signal remains set to “denied” for every visitor at all times, regardless of the choice made in the banner — this reflects our configuration of Google’s tools rather than an independent technical guarantee given by Google.

    Recipient. Conversion data is sent to Google Ireland Limited and may be further processed by Google LLC (USA). For data it receives through these tools, Google also acts as an independent controller under its own privacy policy (policies.google.com/privacy); our configuration limits how Google may use this data for our account, but does not govern Google’s own processing. Recipients and the basis for transfers outside the EEA are described in §III of this policy.

    Retention. The conversion-tracking cookie (_gcl_aw) is currently retained for up to 90 days, as set by Google and published in Google’s cookie documentation (status as at 31 July 2026); we monitor that documentation and will update this policy if this changes. The record of your consent choice is kept by our consent-management tool for 12 months, or until you change or withdraw it, whichever comes first.

    Withdrawing consent. You can withdraw this consent at any time via “Cookie settings” in the website footer and select “Reject” for this category (or “Reject All”). Withdrawal does not affect the lawfulness of measurement already carried out, and never affects your access to the website.

III. Recipients and international transfers

  1. Public bodies (tax offices, ZUS, GUS) — only where the law requires, in the course of service delivery.
  2. Processors / providers:
    • Cloudflare, Inc. (USA) — website hosting and delivery, e-mail routing, consent & analytics layer (Cloudflare Zaraz), aggregate traffic statistics (Cloudflare Web Analytics — see §II point 6);
    • Google Ireland Ltd. (Ireland — service provider for Google Analytics 4 and Google Ads in the EEA) with possible processing by Google LLC (USA) as part of Google’s infrastructure;
    • Zenbox.pl (Poland) — mailbox hosting of the controller.
  3. Transfers outside the EEA: where a recipient holds an active certification under the EU–US Data Privacy Framework (Commission adequacy decision of 10 July 2023), we rely on the DPF; otherwise we rely on Standard Contractual Clauses together with supplementary measures where required. For the US-based providers above (Cloudflare, Inc. and Google LLC), transfers rely on active DPF certification verified as at the date of this policy, or on Standard Contractual Clauses where certification does not apply; Zenbox.pl processes data in Poland. For Google LLC, the primary basis for transfer is the European Commission’s adequacy decision for the EU–U.S. Data Privacy Framework (Google LLC holds an active certification, verified as at the date of this policy); Standard Contractual Clauses apply as a fallback mechanism in the event that certification lapses or the framework is invalidated. Certification status is verified as at the date of this policy and periodically.

IV. Cookies

We use a consent-management banner (Cloudflare Zaraz). Categories:

Legal basis for storing/accessing cookies: your consent, as required by the Polish Electronic Communications Law (PKE), except for cookies strictly necessary to provide the service. Refusing consent is as easy as giving it, and you can change your choice at any time via “Cookie settings” available on the site.

This site also uses mechanisms that do not rely on cookies: (a) Cloudflare Web Analytics (see §II point 6) uses no client-side storage; (b) enquiry source attribution (see §II point 5), which runs only if you consent to analytics, uses the browser’s sessionStorage solely for the duration of your visit and is erased when you close the tab.

V. Retention periods

V-bis. Data obtained from other sources

In connection with our statutory duties (in particular AML), we may obtain personal data of clients’ representatives and beneficial owners from the client and from public registers (e.g. KRS, CEIDG, CRBR): identification and contact data within the scope required by law. Where the law expressly governs obtaining or disclosing such data, the exemption of Art. 14(5)(c) GDPR may apply.

VI. Your rights

You have the right to: access your data and obtain a copy; rectification; erasure (where no statutory retention duty applies); restriction of processing; objection to processing based on legitimate interest; data portability; and — for processing based on consent — the right to withdraw consent at any time, without affecting processing carried out before withdrawal.

You may lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa. We do not make automated decisions producing legal effects (Art. 22 GDPR).

VII. Contact

Data-protection matters and exercising your rights: office@certapoland.com.

Last updated: 31 July 2026. Polish version: /polityka-prywatnosci/.