GDPR

  • Home
  • GDPR

GDPR – Privacy Notice

This page explains how Kancelaria Podatkowa Mencel (Mencel Tax & Accounting) processes the personal data of our clients, of people who call or write to us, and of visitors to mencel.com.pl. We have tried to keep it simple — if anything is unclear, just ask.

If you have been referred here by the message on our phone line, information about call recording is in the section “Call recording”.

Who is responsible for your data

The controller of your personal data is Kancelaria Podatkowa Mencel sp. z o.o., a limited liability company with its registered office in Warsaw, ul. Mieczysława Pożaryskiego 32, 04-703 Warsaw, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) kept by the District Court for the Capital City of Warsaw, 14th Commercial Division, under KRS number 0001012067, tax ID (NIP) 952-223-61-14, REGON 524120106, share capital PLN 50,000 (the “Firm”, “we”, “us”).

You can contact us about anything related to personal data:

  • by email: biuro@mencel.com.pl (ideally with “GDPR” in the subject line),
  • by phone: +48 22 153 34 60, on business days from 8:00 to 16:00 (CET),
  • by post: to our office — ul. Patriotów 77, 04-950 Warsaw, Poland.

We have not appointed a Data Protection Officer because, given the size and nature of our business, the law (Article 37 GDPR) does not require one. Data protection matters are handled directly by the Firm’s management board.

Why we process data and how long we keep it

Each purpose has its own legal basis and its own retention period. Providing data is voluntary, but without some of it we cannot reply to your enquiry or enter into a contract, and data required under anti-money-laundering law is mandatory.

Purpose
What data
Legal basis (GDPR)
How long
Replying to enquiries and preparing an offer (contact form, email, phone)
name, email, phone number, company name, tax ID, content of the message
Art. 6(1)(b) — steps prior to entering into a contract; Art. 6(1)(f) — our legitimate interest in responding
12 months from the last contact if no engagement follows
Concluding and performing an accounting, payroll or tax services agreement
data of the client’s representatives and contact persons, company data, billing data
Art. 6(1)(b); for the client’s contact persons — Art. 6(1)(f)
for the term of the agreement and then until claims become time-barred
The Firm’s own tax and accounting obligations (invoices, books)
data contained in billing documents
Art. 6(1)(c) in conjunction with the Polish Accounting Act and Tax Ordinance
5 years from the end of the year in which the tax payment deadline expired
Identifying and verifying clients and beneficial owners (AML)
ID document data, PESEL number, citizenship, address, PEP status
Art. 6(1)(c) in conjunction with the Polish Act on Counteracting Money Laundering and Terrorist Financing
5 years from the end of the business relationship
Recording and analysing phone calls
voice, phone number, date and time of the call, content of the conversation
Art. 6(1)(f)
see the section below
Establishing, pursuing and defending legal claims
data needed in the specific matter
Art. 6(1)(f)
until claims become time-barred
Newsletter and email information about our services
first name, email
Art. 6(1)(a) — consent, also required under the Polish Electronic Communications Law
until consent is withdrawn
Comments under blog articles
display name, email, comment content, IP address
Art. 6(1)(a)
for as long as the comment is published
The Firm’s profiles on Facebook, LinkedIn and Instagram
profile name, comments, messages
Art. 6(1)(f) — running our profiles and replying to messages
until you object or the content is deleted
Website statistics and measuring advertising effectiveness (statistics and marketing cookies)
adres IP, identyfikatory plików cookies, dane o urządzeniu i przeglądarce
Art. 6(1)(a) — consent given in the cookie banner
until consent is withdrawn or the cookie expires

For our social media profiles we are joint controllers together with the operator of the platform (Meta, LinkedIn); how those companies process data is described in their own privacy policies.

Call recording

Calls made through the Firm’s switchboard (+48 22 153 34 60) are recorded — we inform you of this with a message at the start of the call.

Why we record. Over the phone, clients often give us arrangements and instructions that we then post to the books or file with the authorities. A recording lets us go back to exactly what was said, look after the quality of our service and — in the event of a dispute — show how the conversation went. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).

Automated analysis. Recordings may be transcribed and assessed by an AI-based tool built into our phone system. This is used solely to assess the quality of our service. We do not make any decisions on this basis that would have legal effects for you.

Who has access. Only the Firm’s management board listens to recordings. We do not share them with other clients or with anyone outside the Firm unless the law requires it (e.g. at the request of a court).

How long. We keep recordings for 90 days from the call. We keep a recording longer only if it is needed as evidence in a specific matter, and no longer than until the relevant claims become time-barred.

If you do not want your call to be recorded, you can hang up and email us at biuro@mencel.com.pl. You may also object at any time or ask us to delete a recording.

Data entrusted to us by clients

When we keep our clients’ books and run their HR and payroll, we process data of their employees (including sick-leave information to the extent required by employment law), contractors, employees’ family members, shareholders and business partners. Here the client (e.g. the employer) is the controller, and we act as a processor under a data processing agreement (Art. 28 GDPR) that we sign with every client.

  • We process this data only on the client’s instructions and only to the extent needed to provide our services.
  • Within 30 days after the engagement ends, we return the data to the client or to an accounting firm they designate, or we delete it. We keep only what the law requires us to keep and copies needed to defend against possible claims — until those claims become time-barred.
  • We notify the client of any data breach within 24 hours of discovering it.
  • An employee or business partner of our client who wishes to exercise their rights should first contact their employer or business partner. If they contact us, we will promptly pass their request on to the client.

Legal and tax advice for our clients is provided by a partner law firm (attorneys-at-law), with which the client signs a separate agreement. In that respect, the law firm is a separate controller of the data.

Who we share data with

We do not sell data or share it for marketing purposes. Access is limited to those we could not work without:

  • software and IT service providers — accounting and payroll software, document workflow platform, email and office suite, CRM system, internet telephony, website hosting,
  • the agency that technically maintains our website,
  • our partner law firm — when a client uses its services,
  • postal operators and couriers,
  • our professional liability insurer — only if a claim is made,
  • public authorities and institutions (tax offices, the Social Insurance Institution ZUS, the General Inspector of Financial Information, courts) — where required by law or where we act on behalf of a client.

Service providers process data on our instructions under data processing agreements that bind them to confidentiality and appropriate security measures. We provide clients with an up-to-date list of the providers to whom we entrust client data as an annex to the data processing agreement.

Transfers outside the European Economic Area. As a rule, data stays within the EEA. Some providers (e.g. Microsoft, Google, Meta, LinkedIn) may also process data in the United States or other third countries. This happens only on the basis of a European Commission adequacy decision (including the EU-US Data Privacy Framework) or standard contractual clauses. On request, we will tell you which safeguard applies and how to obtain a copy.

Your rights

You may at any time request:

  • access to your data and a copy of it (Art. 15 GDPR),
  • rectification of inaccurate or incomplete data (Art. 16),
  • erasure of your data (Art. 17),
  • restriction of processing (Art. 18),
  • portability of the data you provided to us (Art. 20),
  • and you may also object to processing based on our legitimate interest (Art. 21) and withdraw your consent — without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3)).

Just write to biuro@mencel.com.pl. We reply within one month; in complex cases this may be extended by a further two months, and we will let you know in advance. Some rights are limited — for example, we will not delete data we are required to keep under tax or AML law.

If you believe we are breaching data protection law, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).

We do not make decisions about you based solely on automated processing, including profiling.

How we protect data

Only authorised members of our team, bound by confidentiality obligations, have access to data. We use encrypted connections, multi-factor authentication, backups and a secure portal for exchanging documents. We hold professional liability insurance covering our business.

Cookies

mencel.com.pl uses cookies that are necessary for the website to work and — with your consent — also statistics cookies (Google Analytics) and marketing cookies (Google Ads). You can change your consent at any time in the cookie settings available in the website footer. Details are set out in the Cookie Policy [LINK to the Cookie Policy page].

Changes

We update this notice when our tools or the law change. The current version is always available in the GDPR section of mencel.com.pl. In the event of any discrepancy, the Polish version prevails. Last updated: October 2026.