Privacy & Data Processing Policy

The Data Controller is DOMUS V Sp. z o.o., seated in Warsaw (02-495), ul. Dzieci Warszawy 27c/49, entered into the Polish National Court Register under KRS: 0001198474, Tax ID (NIP): 5223350030, REGON: 542936213.

We process personal data necessary for rigorous legal representation and consultations:

• Identification & contact: full name, phone number (WhatsApp/Telegram), email address;
• Immigration records (upon client request): Voivodeship case number, PESEL, permit type, procedural status;
• Telemetry: anonymized IP, session tokens, security cookies for the Client Portal.

Data processing is anchored on the provisions of GDPR Art. 6:

• Art. 6(1)(b) GDPR — preparation and performance of legal services requested by the data subject;
• Art. 6(1)(c) GDPR — compliance with legal and statutory accounting/tax obligations;
• Art. 6(1)(f) GDPR — legitimate interests pursued by the controller (defense against claims, operational security).

You retain all rights guaranteed under the EU GDPR framework:

• Right of access and data portability (Articles 15 & 20 GDPR);
• Right to rectification of inaccurate records (Article 16 GDPR);
• Right to erasure ('right to be forgotten') (Article 17 GDPR);
• Right to restriction of processing and objection (Articles 18 & 21 GDPR).

Inquiry records are kept for the duration of communication and up to 24 months thereafter. Contractual and billing records are stored for 5 years as required by Polish statutory accounting law.

All data transfers use 256-bit TLS encryption, role-based database permissions, and SOC-2 compliant EU data centers.

We entrust data only to companies that help us provide our services, under data processing agreements (Art. 28 GDPR). Depending on the contact channel and service, recipients may include:

• hosting and infrastructure: Vercel Inc. (server functions in the Frankfurt region), Supabase (database in the EU, Frankfurt), Cloudflare;
• AI models powering the chat and document analysis: Google (Gemini), Anthropic; chat answers are generated by AI and are not decisions with legal effects (Art. 22 GDPR); Text sent to the chat or to the document check is passed to the provider only to generate the answer and is not stored in our database — except a phone number you choose to leave in the chat to create a request. The provider may keep requests for a limited time to detect abuse, under its own terms. Please do not give the AI children’s data, health data or document numbers.
• payments: PayPro S.A. (Przelewy24), PayU S.A., Stripe;
• messengers you choose to use: Telegram, WhatsApp and Messenger (Meta), Viber;
• Telegram as the team’s internal channel: requests and documents sent in the client portal arrive there so a lawyer can review them;
• email delivery (confirmations, portal PIN): Resend;
• error monitoring and analytics: Sentry, PostHog, Google Analytics — only as permitted by your cookie settings;
• our accounting office and, where your case requires it and with your consent, an adwokat, radca prawny, sworn translator or notary.
• Some of these companies are based in the USA. Transfers rely on the European Commission decision on the EU-US Data Privacy Framework (Art. 45 GDPR) or standard contractual clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards at the address above.