Privacy and cookie policy

Last updated: 17 September 2026.

1. Data controller

The controller of personal data is Kancelaria Adwokacka Andrzej Bołtryk, ul. Plażowa 67, 15-502 Białystok, Poland, NIP 9661683584. Legal Stay is the trading name under which the firm handles residence matters for foreign nationals.

Contact on data protection matters: kontakt@legal-stay.eu, tel. +48 600 900 353. No data protection officer has been appointed; correspondence on these matters is handled by the firm.

2. Purposes and legal bases

• Answering an enquiry sent through the form, by e-mail, by phone or in a messenger, including a preliminary assessment of whether the case can be taken - Art. 6(1)(b) and (f) GDPR (steps prior to entering into a contract, and the legitimate interest in handling correspondence).
• Entering into and performing a contract for legal services - Art. 6(1)(b) GDPR, and as regards the obligations binding on an advocate, including those under the Polish Bar Act and tax law - Art. 6(1)(c) GDPR.
• Visit statistics and our own marketing - solely on the basis of freely given consent expressed in the cookie banner, Art. 6(1)(a) GDPR. You can withdraw consent at any time through the Cookie settings link in the footer.
• Protecting the contact form against automated submissions and abuse - Art. 6(1)(f) GDPR (the legitimate interest in protecting the site and the firm mailbox from a flood of messages).

Providing data is voluntary, but without contact details we cannot answer your enquiry. A general description of the matter is enough in an enquiry; do not send documents or sensitive data through the form - we tell you how to send them once the case is accepted.

3. Recipients of data

Data may be entrusted to providers supporting the technical operation of the site and the firm:

• Cloudflare, Inc. - hosting for the site and the content delivery network that all traffic passes through. The same provider secures the contact form with Turnstile, described in section 6.
• Plus Five Five, Inc., trading as Resend - delivery to the firm of the message created from your enquiry. The content of the enquiry passes through this service: the name, phone number, e-mail address and description of the matter you provide.
• Google Ireland Ltd. - tag manager and visit statistics, on the terms described in section 6.
• the firm e-mail provider and the firm IT service providers.

If you write to us in a messenger, processing on that provider's side follows the rules set by them: WhatsApp and Messenger - Meta Platforms Ireland Ltd., Telegram - Telegram FZ-LLC, Viber - Viber Media S.à r.l.

Using Cloudflare and Resend involves transferring data to the United States, regardless of any cookie consent. The transfer is based on standard contractual clauses and on the providers' certification under the EU-U.S. Data Privacy Framework.

Once marketing or statistical consent is given, recipients may also include providers of measurement and advertising tools, including Google Ireland Ltd. and Meta Platforms Ireland Ltd. Using these tools may involve transferring data outside the European Economic Area, including to the United States, on the basis of safeguards such as an adequacy decision (the EU-U.S. Data Privacy Framework) or standard contractual clauses.

4. Retention periods

• Correspondence about enquiries that did not lead to a contract - up to 12 months from the last contact.
• Data connected with a concluded contract - for the period required by law, including the rules on limitation of claims and on the retention of case files by an advocate.
• Accounting data - for the period required by tax law.
• Cookies - for the periods given in the table below.

5. Your rights

You have the right to access your data, to rectify it, to erase it, to restrict processing, to data portability, to object to processing based on a legitimate interest, and to withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before it was withdrawn.

To exercise these rights, write to kontakt@legal-stay.eu. You also have the right to lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warszawa, Poland.

Some data covered by a case handled by an advocate is subject to legal professional privilege. To that extent the exercise of certain rights may be limited by law, which follows from the statutory duty of professional secrecy.

6. Cookies

The site stores in your browser only the files essential to its operation and, once consent is given, statistical and marketing files. The full list is in the table below.

Google Tag Manager starts when you open the page, before you give consent, but with consent denied by default for every statistical and advertising purpose (Google Consent Mode). Until consent is given, measurement tools store no cookies and no identifiers and do not recognise your device; they only pass on signals that carry no identifiers. Giving consent changes that state, refusing it keeps it.

The contact form is protected by Cloudflare Turnstile, which tells a human apart from a bot. To do so it processes the IP address, the TLS connection fingerprint, the User-Agent header, and the security key together with the address of the page it sits on. It has no access to the content of your enquiry or to anything else typed into the form. It uses files necessary for the protection to work and the browser local storage; these need no consent, and without them the form cannot be sent.

If no statistical or advertising tool is running on the site at a given time, the consent banner is not shown and the files marked in the table as statistical and marketing are not stored.

You can change your decision at any time through the Cookie settings link in the footer or in your browser settings. Withdrawing consent restores the default denied state: measurement tools stop storing files and identifiers.

You can change your decision at any time through the Cookie settings link in the footer or in your browser settings. Withdrawing consent means the tools are not started on subsequent visits.

7. Final provisions

We do not take decisions about users of the site based solely on automated processing, including profiling, that would produce legal effects for them. This policy may be updated; the version published on the site, bearing the date given at the top, applies.