This policy explains what personal data we collect about you, why we collect it, who we share it with, and what you can do about it. It applies to this website and to the immigration services we provide.
1. Who is responsible for your data
STAYLEGAL sp. z o.o., registered office at ul. Stefana Batorego 18/108, 02-591 Warszawa, Poland, entered in the register of entrepreneurs of the National Court Register under KRS 0001191024, NIP 7011274638, REGON 542619790, is the controller of your personal data.
Our client office is at Ludna 2, office 513, 00-406 Warszawa. You can contact us about anything in this policy at sales@staylegal.pl, on WhatsApp at +48 789 900 768, or by post at either address.
2. What we collect
If you only visit the website or send an enquiry: your name, email address, phone number if you give one, the service you're asking about, and whatever you write in the message. If you book a consultation, the appointment details as well.
If you request the PESEL guide: The form requires your first name, WhatsApp number and email address. STAYLEGAL stores these contact details together to identify and manage your guide request. We use your email address to send you the PDF through Mailgun via the Netlify Email Integration. The marketing consent on this form covers email; entering a WhatsApp number does not add consent to WhatsApp marketing. We record the request time, the text and version of your marketing consent, the businesses it covers, and the sending status. These records are stored privately with Netlify. Sending a message does not establish that you own the address or that it has reached your inbox.
Marketing consent covers three named businesses: STAYLEGAL Sp. z o. o., ICG Mobility Sp. z o. o. and ICG Igor Brzózka. Your address and consent record may be used by each of them to send you emails about its immigration and relocation services, on the basis of your consent. STAYLEGAL’s details are above. ICG Mobility Sp. z o. o. is registered at ul. Stefana Batorego 18/108, 02-591 Warszawa, KRS 0001249257, NIP 7011319654; its privacy contact is kontakt@icg-mobility.com. ICG Igor Brzózka is the business operated by Igor Brzózka.
The guide form requires this marketing consent. You may withdraw it for any or all of the three businesses by emailing sales@staylegal.pl and specifying which consent you wish to withdraw. This does not affect your copy of the guide. Marketing use stops when you withdraw consent; a limited consent record may be retained where necessary to demonstrate compliance or handle a dispute. You can use the same contact to exercise the rights described in this policy in relation to the guide form.
If you become a client, we handle the documents your case requires. Depending on the permit, that can include your passport and other identity documents, address and contact details, PESEL number, employment or study details, income and financial documents, marriage and birth certificates, insurance documents, previous decisions and correspondence from Polish authorities, and the power of attorney you sign for us.
3. Sensitive data
Some immigration cases require documents that the GDPR treats as special categories of personal data, for example health or health-insurance information, or, in international protection cases, information about your religion, political opinions, or the circumstances you left your country under. We may also handle information about criminal records where an authority requires it.
We only handle this kind of data where it is necessary to establish, exercise or defend your legal claims before Polish authorities, or where you have explicitly consented. We do not use it for anything else.
4. Data about other people
Family cases involve information about people other than you, such as a spouse, partner, children, or in some cases your employer's representatives. If you give us someone else's personal data, please make sure they know that you've done so and that this policy explains how we handle it. We use their data only for the case it relates to.
5. Why we process it, and on what basis
To answer your enquiry and tell you which permit fits your situation, because you asked us to and it is in our legitimate interest to respond to people who contact us.
To provide the service you engaged us for, prepare your application and represent you before the authorities, because that is our contract with you.
To handle special-category documents, on the basis of legal claims as described above, or your explicit consent.
To issue invoices and keep accounting records, because Polish tax and accounting law requires it.
To defend ourselves if a dispute arises about the work we did, as our legitimate interest.
6. Who we share it with
Authorities and parties to your case. Where your case requires it, and on the basis of the power of attorney you sign: voivodeship offices, the Office for Foreigners, the Border Guard, courts, and where relevant your employer or university.
Service providers who process data on our behalf, under written data-processing agreements: Airtable (case and document database), Google Drive (document backup), Stripe (payments), SignRequest (electronic signature of contracts), Calendly (consultation booking), Netlify (this website and its contact forms), home.pl (email), and Todoist (internal task management). If you contact us on WhatsApp, that conversation is also processed by Meta under its own terms.
Sworn translators and, where your case needs one, a notary.
For PESEL guide requests: Netlify stores your first name, WhatsApp number, email address and consent record, and Mailgun processes your email address and the message to deliver the guide through the Netlify Email Integration. The three businesses named in the guide consent may use your address for the marketing purposes specified there.
We do not sell your data.
7. Transfers outside the European Economic Area
Several of the providers above are based outside the EEA, mainly in the United States. Where data is transferred outside the EEA, we rely on the safeguards those providers offer, such as the European Commission's Standard Contractual Clauses or an adequacy decision. You can ask us for details of the safeguards that apply to a specific provider.
8. How long we keep it
If you contact us and don't become a client, we keep your enquiry only as long as we need it to respond and for a short period afterwards, then delete it.
If you become a client, we keep your case file after the case ends for as long as we need it to defend against possible claims and to meet our professional obligations. Accounting records are kept for 5 years from the end of the tax year they relate to, as Polish law requires.
9. Your rights
You can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict how we use it, object to processing we base on legitimate interest, and ask us to transfer your data to another provider. Where we rely on your consent, you can withdraw it at any time, and that does not affect anything we did before you withdrew it.
Some of these rights have limits. We may not be able to delete data we still need for an ongoing case or that we are legally required to keep.
To exercise any of these, write to sales@staylegal.pl. If you think we've handled your data badly, you can complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa.
10. Is providing data required?
Giving us your data is voluntary, but we can't assess your situation or run your case without it, and specific documents are required by the authorities deciding your application.
11. Automated decisions
We do not make decisions about you by automated means, and we do not profile you.
12. Cookies and this website
Optional website analytics
With your consent, we use Google Analytics to measure page views, traffic sources and contact actions. Google receives the page address without query parameters or fragments, the referring origin, basic technical data and event names. We do not send form contents, email addresses or phone numbers. Contact clicks and form submission attempts do not prove that an enquiry was received. A guide request queued event only means the service accepted the guide request for processing, not delivery to an inbox.
The basis for this measurement is your consent. No Google Analytics script is loaded before consent. You may refuse or withdraw consent through “Analytics preferences” in the footer. Your choice and analytics cookies last up to 180 days. Detailed user and event data retention in GA4 is set to 2 months; this does not limit most aggregated reports. Advertising personalisation, Google Signals and automatic form measurement are disabled.
Google provides the analytics service and may process data outside the EEA. See Google’s privacy policy and how Google uses information from partner sites. Withdrawal does not affect processing before consent was withdrawn.
The website loads the Poppins typeface from Google Fonts. Your browser requests font files from Google, which receives your IP address as part of that request. Netlify handles the contact forms and the guide request service.
13. Changes
If we change how we handle personal data, we'll update this page and change the date at the top.