PLEN

Law firm of legal counsels · Warsaw

Business first,
then the law

We first ask our Clients about their business activities – particular conditions, needs or risks – and then provide possible legal solutions.

How we work

Compliance that works in practice

We write procedures so that the department which has to use them can apply them without a lawyer at the desk.

Specialisation, not a full‑service offer

We carry out projects in areas that we are experts in — data, technology, intellectual property.

From implementation to dispute

We defend the adopted solutions before the authorities and in court — including those we designed ourselves.

Areas of advisory

Fourteen areas of practice

From audits and documentation, through team training, to handling inspections and proceedings.

Arrange a meeting

GDPR

Personal data processing

Audits, documentation, incidents and inspections.

Whistleblowing

Whistleblower protection

Reporting procedure, channels, follow-up investigations.

New technology law

Online services, cloud, IT implementations, AI.

E-commerce

On-line contracts, platform audits, digital content.

Consumer protection law

Terms and conditions, prohibited clauses, UOKiK.

Labour law

Workplace regulations, contracts, dismissals, disputes.

Industrial property law

Trade marks, designs, brand protection.

Copyright law

Licences, transfer of rights, infringements.

Media and advertising law

Campaigns, sponsorship, product placement.

Marketing

Promotions, lotteries, databases, online advertising.

Protection of personal interests

Image, good name, privacy online.

ISO 27001 implementation

Audit, risk analysis, ISMS, training.

Company law

Incorporation, corporate services, registrations.

Foundation law

Statute, registration, day-to-day support.

About us

Twenty years at one table with our Clients

We carry out projects in areas that we are experts in and where we can bring real value.

We have been active since 2005 and are open to challenges posed by market, law and technological development. Our offer is dedicated to medium entrepreneurs as well as large companies and public authorities.

Satisfaction of the Client is our priority, thus we provide professional support on each stage of the cooperation, always seeking the most beneficial solutions while strictly obeying the law. It is our advantage that we take into account the international environment that our Client operates in — besides Polish law we consider European Union law and judgments of the Court of Justice of the European Union.

  • 01Fairness and integrity toward our Clients and business partners.
  • 02High quality of services.
  • 03Professionalism at every stage of the matter.
  • On the market

    since 2005twenty years of uninterrupted practice

  • Team

    7 lawyersattorneys-at-law, advocates and doctors of law

  • Membership

    Omni Modo Groupaudit and training background beyond the law firm itself

  • We run

    www.gdpr.plthe largest Polish website on personal data protection and the #RODOłamacz podcast

  • Clients

    Business and administrationmedium enterprises, large corporations, public authorities

Let’s start with a conversation about your business

Tell us what you are planning. We will tell you what the law requires and how much work it really involves.

Our team

The people who handle the matters

Attorneys-at-law, advocates and doctors of law. Part of the team gained experience on the other side — at the Personal Data Protection Office and the Bureau of the Inspector General for Personal Data Protection.

Tomasz Osiej

Tomasz Osiej

Managing partner

Attorney-at-law, European Patent Attorney, graduate of the Faculty of Law and Administration at the University of Warsaw and the Institute of Intellectual Property Law at the Jagiellonian University.

Author of numerous publications and books, co-founder of the largest website on the subject of personal data protection, www.gdpr.pl, co-host of the #RODOłamacz podcast.

  • personal data protection
  • trade marks
  • unfair competition
  • new technologies
Michał Czarnecki

Michał Czarnecki

Partner

Ph.D. in Law, graduated from Law and Philosophy faculties at Cardinal Stefan Wyszyński University in Warsaw.

He has large experience gained through advising his clients as well as during his work at the Bureau of the Inspector General for Personal Data Protection. Author of, among others, “GDPR in 15 steps – Practical Guide for Entrepreneurs”.

  • personal data protection
  • administrative law
  • economic law
  • foundation law
Martyna Gosz

Martyna Gosz

Associate

Attorney-at-law (advocate), law graduate at the Adam Mickiewicz University in Poznań and the L. Koźmiński Academy in Warsaw in the field of “New Technologies Law”.

She has extensive experience in conducting comprehensive audits and implementations of GDPR and providing ongoing legal advice in the field of personal data processing.

  • personal data protection
  • new technologies
  • e-commerce
  • insurance
  • criminal law
Bartłomiej Niezabitowski

Bartłomiej Niezabitowski

Associate

Attorney-at-law, law graduate at the John Paul II Catholic University of Lublin, post-graduate studies in the field of personal data protection and “New technologies law” at Kozminski University.

He specializes in commercial law, contract law, new technologies and data protection law. His interests include cybersecurity risk management.

  • commercial law
  • contract law
  • new technologies
  • cybersecurity
Andrzej Babczyński

Andrzej Babczyński

Associate

Attorney-at-law, graduate of the Faculty of Law and Administration of the University of Silesia in Katowice. He gained experience in reputable law firms.

Many years of experience in providing services to both corporate entities and local entrepreneurs — audits of personal data processing and implementation of GDPR-compliant documentation.

  • personal data protection
  • e-commerce
  • intellectual property
  • consumer law
Agnieszka Krajewska

Agnieszka Krajewska

Associate

Attorney-at-law at the Warsaw Bar Association, law graduate at the University of Warsaw and New Technology Law at the L. Koźmiński Academy in Warsaw.

She has experience with entities operating in IT, automotive, cosmetics, food and trade industries. Author of many publications and articles in professional press.

  • personal data protection
  • e-commerce
Piotr Andruszaniec

Piotr Andruszaniec

Associate

Attorney-at-law, graduate of law at the University of Warsaw. He has acquired professional experience in law firms and public sector.

A long-time employee of the Personal Data Protection Office — preparing opinions and standpoints of the supervisory authority and handling administrative proceedings.

  • personal data protection
  • Data Protection Officer function

Contact us

We will be glad to talk

Call or write to us — we reply on the same business day.

Address

OSIEJ i Partnerzy Kancelaria Prawna
355 Grochowska Street, 03-822 Warsaw (Poland)

OSIEJ i Partnerzy Kancelaria Prawna

Privacy policy

This is an English translation of the Polish-language Privacy Policy, provided for information purposes. In the event of any discrepancy, the Polish version shall prevail.

In connection with its business activity, Kancelaria Prawna Osiej i Partnerzy Tomasz Osiej, with its registered office in Warsaw (03-937), at ul. Zwycięzców 45/29, collects and processes personal data in accordance with the applicable legislation, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter: the “GDPR”), and the data processing principles laid down therein.

1. Controller’s details

The controller of your personal data within the meaning of the GDPR is Kancelaria Prawna Osiej i Partnerzy Tomasz Osiej, with its registered office in Warsaw (03-937), at ul. Zwycięzców 45/29, correspondence address: Al. Jerzego Waszyngtona 40a, 03-910 Warszawa (the “Controller”).

In matters concerning the protection of personal data, the Controller can also be contacted by e-mail at: biuro@kancelariaosiej.pl

2. Purposes and legal bases of processing

Your personal data may be processed by the Controller on the basis of:

a) the Controller’s legitimate interest (Art. 6(1)(f) GDPR), for the purpose of:

(i) conducting correspondence by e-mail or traditional mail, where the Controller’s legitimate interest is conducting correspondence addressed to the sender in connection with the Controller’s business activity,
(ii) the use of contact forms made available on the Controller’s website, where the Controller’s legitimate interest is the need to resolve a reported matter related to the Controller’s business activity,
(iii) marketing of the Controller’s own products and services, including for analytical purposes, where the Controller’s legitimate interest is direct marketing of its own products and services,
(iv) pursuing or defending against possible claims, where the Controller’s legitimate interest is pursuing or defending claims.

b) a contract or steps taken prior to entering into it (Art. 6(1)(b) GDPR), for the purpose of performing a specific contract between the Controller and the data subject or taking steps prior to entering into it.

3. Transfer of personal data

Data may be transferred to entities processing them on our behalf under agreements concluded with the Controller, but only for the purpose and to the extent necessary to achieve the above purposes, including, among others, entities providing IT services or other services ensuring the proper functioning of the Controller’s website; such entities process the data solely in accordance with the Controller’s instructions.

We transfer your data only to entities located within the European Economic Area, and therefore subject to strict EU data protection rules, or to entities bound by an appropriate security standard. Transfers of data to third countries are not currently practised or planned by us.

4. Personal data retention period

We process your personal data only for the period necessary to fulfil the purpose of their storage or for as long as we are required to do so by law, in particular until any claims become time-barred or the statutory archiving obligation expires, including the obligation to retain accounting documents.

Where your data are processed on the basis of the Controller’s legitimate interest, the Controller will stop processing the data earlier if you object to the processing and such a request is justified.

5. Your rights

Right of access

You have the right to obtain information about the personal data concerning you that are stored by the Controller, including a copy of those data.

Right to rectification

You have the right to request the rectification of your personal data that are inaccurate. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to erasure

You have the right to request the erasure of your personal data stored by us in the following cases:

  • your personal data are no longer necessary for the purposes for which they were collected,
  • you have objected to the processing and there are no overriding legitimate grounds for the processing, or the objection concerns processing for direct marketing purposes,
  • the personal data have been processed unlawfully,
  • the personal data have to be erased for compliance with a legal obligation under Union or Member State law,
  • the personal data have been collected in relation to the offer of information society services referred to in Art. 8(1) GDPR.

Right to data portability

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, where the processing is based on consent or a contract and is carried out by automated means.
If you request that these data be transmitted to another controller, this will be done where technically feasible.

Right to restriction of processing

You have the right to request that the processing of your personal data be restricted in the following cases:

  • you contest the accuracy of the personal data – for a period enabling us to verify the accuracy of the data,
  • the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead,
  • we no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims,
  • you have objected to processing pursuant to Art. 21(1) – pending the verification whether the legitimate grounds of the controller override the grounds of the objection.

Right to object to processing

Where your personal data are processed on the basis of the controller’s legitimate interest, you have the right to object to the processing at any time, in accordance with Art. 21 GDPR.

If you wish to exercise your rights, please send a message to the Controller at: biuro@kancelariaosiej.pl or by traditional mail to: Al. Jerzego Waszyngtona 40a, 03-910 Warszawa.

The security of personal data is a priority for the Controller; however, if you consider that the Controller infringes the provisions of the GDPR when processing your personal data, you have the right to lodge a complaint with the President of the Personal Data Protection Office.

6. Changes to the Privacy Policy

In order to ensure that this Privacy Policy meets the current requirements of the law at all times, the Controller reserves the right to make changes at any time. The above also applies where the Privacy Policy needs to be amended to cover new or modified products or services of the Controller.

Cookies