Below we explain what personal data we process, why we use it, on what legal basis, how long we keep it and what rights you have. If anything is unclear, write to us.
1. Who controls your data
The controller of your personal data is VKANCELARIA Sp. z o.o. with its registered office at al. Jana Pawła II 80/4, 00-175 Warszawa, District Court for the Capital City of Warsaw, 12th Commercial Division of the National Court Register, KRS 0001277504, NIP 5253114541, share capital PLN 5,000.
For anything concerning personal data, write to kontakt@vkancelaria.com.
This policy covers data whose processing VKANCELARIA decides on. Virtual office and accounting services are run by other companies in our group: VBIURO, VSTREFA and VKSIĘGOWOŚĆ. If you sign a contract with one of them, that company is the controller of the data you give it, and its own privacy policy sets out the rules.
2. What data we process
The data depends on what you are contacting us about.
| Who it concerns | What data |
|---|---|
| Person sending the form | Full name, email address, phone number if you give it, subject, the company you are asking about, number of shareholders for a registration, message, any extra offers you tick, language and the address of the page with the form, and, if you came to the website from an ad, the Google click ID (gclid, gbraid or wbraid) and the utm parameters from the page address |
| Person emailing us | Email address, full name and whatever you include in the message |
| Company buyers, registration customers, shareholders and management board members | Data needed for the documents: full name, PESEL number or identity document, address, and, when registering a new company, invoice details |
| Website visitors | IP address, browser type, pages visited and time of visit, saved in the server logs, and, with your consent, data from Google cookies and similar technologies: cookie identifiers, device and browser information, pages visited and events on the website, such as sending the form |
Details of shareholders and board members that we did not receive from them directly are provided by the buyer or the person ordering the registration. We process them within the scope shown in the table, and the person concerned has the rights described in section 5.
3. Why we process data and on what basis
| Purpose | Legal basis | How long we keep it |
|---|---|---|
| Answering your enquiry and preparing an offer | Art. 6(1)(b) and (f) GDPR: steps before entering a contract and our legitimate interest in handling enquiries | For as long as the correspondence lasts |
| Entering and performing a contract: handling the purchase of a company, preparing documents for registration and changes | Art. 6(1)(b) GDPR: performance of a contract | For the time needed to perform the contract and then until claims become time-barred |
| Issuing invoices and keeping accounting records | Art. 6(1)(c) GDPR: legal obligation under tax and accounting law | 5 years from the end of the year in which the tax payment deadline passed |
| Establishing, pursuing and defending claims | Art. 6(1)(f) GDPR: legitimate interest | Until the limitation period for claims ends |
| Website security and protecting the form against abuse | Art. 6(1)(f) GDPR: legitimate interest | Server logs for no more than 60 days |
| Seeing which ad an enquiry came from | Art. 6(1)(f) GDPR: legitimate interest in assessing how well our ads work | Together with the enquiry, for as long as the correspondence lasts |
| Website traffic analysis (Google Analytics) and measuring how well our ads work (Google Ads), including counting sent forms | Art. 6(1)(a) GDPR: your consent given in the consent window; storing and reading cookies on your device: Art. 399 of the Polish Electronic Communications Law | Until you withdraw consent; data in Google Analytics for no more than 14 months, Google cookies expire after 2 years at the latest |
| Counting visits and conversions without consent, with Google tools in limited mode (no cookies) | Art. 6(1)(f) GDPR: legitimate interest in measuring how well our ads work | Nothing is stored on your device; Google processes the information sent under its own rules |
Giving us your data is voluntary, but without the data needed to reply or to enter a contract we cannot answer your enquiry or perform the service.
4. Who receives your data
We do not sell data. The website, the form and our email run on a server leased from OVHcloud, visit data is processed by the Google tools described below, and if you tick an offer for a virtual office or accounting in the form, the company in our group that will prepare it also receives your data. We pass on other data only when the service or the law requires it.
| Recipient | Scope |
|---|---|
| OVHcloud: the server that runs the website and email | Storing form data and emails, and the server logs |
| Google: the Gemini service in our email spam filter | The content of emails arriving in our mailboxes, checked automatically for spam and fraud |
| Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC: Google Tag Manager, Google Analytics and Google Ads | Visit data: cookie identifiers, IP address, device and browser information, pages visited, events on the website (such as sending the form, without its content) and the ad click ID. In full with your consent; without consent only basic technical information in limited mode. For Google Analytics Google acts as our processor, for Google Ads also as a separate controller (rules: policies.google.com/privacy) |
| Companies of our group: VBIURO Sp. z o.o. (KRS 0001157043), VSTREFA Sp. z o.o. (KRS 0001224934), VKSIĘGOWOŚĆ Sp. z o.o. (KRS 0001156919) | Full name, email and phone number, only if you tick an offer for a virtual office or accounting in the form, to prepare that offer |
| The seller of the shares (the company named in the share sale agreement) | Buyer and shareholder data needed for the share sale agreement and change documents: name, PESEL or ID document details, address |
| Accounting office | Data needed for settlements |
| Registry court and public offices | Data in documents filed when a company is bought, registered or changed |
| State authorities | Only on a request based on the law |
The server with our website and email is in Poland, so we keep data from the form and the mailboxes in the European Economic Area. Emails checked by the Google spam filter and data from Google Tag Manager, Google Analytics and Google Ads may leave the EEA and reach Google LLC in the United States. Such a transfer is based on the European Commission’s adequacy decision (EU-US Data Privacy Framework, in which Google LLC participates) or on standard contractual clauses.
5. Your rights
You have the right to:
- access your data and receive a copy,
- rectify data that is incorrect or incomplete,
- erase data if we have no basis for processing it further,
- restrict processing, meaning that it is paused until the matter is resolved,
- data portability for data given to us on the basis of consent or a contract,
- object to processing based on our legitimate interest,
- withdraw consent at any time, for example with the “Cookie settings” link in the website footer; withdrawal does not affect the lawfulness of processing before it.
To use these rights, write to kontakt@vkancelaria.com. We will reply without undue delay and within one month at the latest.
If you believe we process your data unlawfully, you may lodge a complaint with the President of UODO, the Polish data protection authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa.
6. Automated decisions
We do not make decisions about you based solely on automated processing that would have legal effects or similarly significantly affect you. We do not use profiling in that sense either.
7. Cookies
Cookies are small text files saved in your browser. The website runs Google Tag Manager, which, with your consent, starts Google Analytics and Google Ads. We save your choice from the consent window in your browser storage (localStorage) so that we do not ask on every visit.
| Type | What they are for | Consent needed |
|---|---|---|
| Necessary | Remembering your choice in the consent window | No |
| Analytics (Google Analytics, e.g. _ga, _ga_*) | Visit statistics and how you use the website | Yes |
| Functional | Remembering settings and personalising content in Google tools | Yes |
| Marketing (Google Ads, e.g. _gcl_au) | Measuring how well our ads work, including counting sent forms, and tailoring ads on other websites | Yes |
You give consent in the consent window on your first visit. You can change or withdraw it at any time with the “Cookie settings” link in the website footer or by deleting the site data in your browser settings.
Without consent, Google tools work in limited mode: they do not save analytics or advertising cookies and send only basic technical information about the visit (including the page address, browser information, IP address and consent status), which Google uses to count and model visits and conversions. Data saved by Google tools while consent was in force stays in the browser until it expires or the site data is deleted; after you withdraw consent, no new data is saved.
We keep the ad click ID and utm parameters from your landing page only in the memory of the open tab, without saving them in your browser, and send them with the form. We use them only to see which ad an enquiry came from (Art. 6(1)(f) GDPR).
8. Security
We use technical and organisational measures appropriate to the risk. The connection to the website is encrypted, and only authorised people can access data, only as far as their work requires.
9. Changes to this policy
We update this policy when the law or the way our services work changes. The current version is always available at this address.
Version 1.0 of this policy applies from 7 November 2026.
Last updated: 7 November 2026.