Privacy policy

The controller of your personal data is Polska Grupa Wierzytelności sp. z o.o. with its registered office at: ul. Gwiaździsta 6/5, 53-413 Wrocław (NIP: 6912503202, KRS: 0000478567, REGON: 022256449), hereinafter “PGW”, “we”.

Contact the controller: email kontakt@e-pgw.pl, phone +48 720 13 14 15.

PGW's technology provider is Insignis Polska sp. z o.o., a processor within the meaning of Article 28 GDPR, which processes data only to the extent necessary to provide the service and on PGW's instructions.

For all matters relating to personal data processing and exercising your rights, write to: iod@e-pgw.pl. Your enquiry goes directly to the data controller. iod@e-pgw.pl

• Creating and maintaining an account, Article 6(1)(b) GDPR (performance of the agreement for electronically supplied services).
• Performing a legal services assignment (agreement with PGW), Article 6(1)(b) GDPR.
• Compliance with legal obligations (accounting, case file archiving), Article 6(1)(c) GDPR.
• Health data (compensation cases, medical errors), Article 9(2)(f) GDPR (establishment, exercise and defence of legal claims).
• Marketing our own services, Article 6(1)(f) GDPR (the controller's legitimate interest); carried out only with consent.

• Account data: until account deletion + 12 months (technical logs).
• Case files: 10 years after closure (a period corresponding to limitation periods for claims, including those established by a final judgment; establishment, exercise and defence of legal claims).
• Accounting data: 5 years after the end of the financial year.
• Marketing data: until consent is withdrawn.
• Case correspondence and chat (messages with clients and debtors, the case channel and dashboard attachments): 10 years after case closure, the same period as the case files, because case discussions form part of its documentation and an acknowledgement of debt in a message interrupts the limitation period (Article 123 § 1(2) of the Polish Civil Code).
• Website chat and conversations with the assistant: 12 months after contact.
• Platform account applications (employee or partner registration): rejected applications or applications abandoned without a decision, 90 days; approved applications (an account was created), 12 months, after which employee documentation retention periods apply.
• Job applications and candidates' CVs: 6 months after submission, based on Article 6(1)(f) GDPR (the controller's legitimate interest in defending potential claims from candidates). If a candidate gives SEPARATE consent to participate in future recruitment: 3 years after submission. Consent may be withdrawn at any time; withdrawal restores the shorter 6-month period.

• Access to, rectification and erasure of data (the “right to be forgotten”).
• Restriction of processing and portability of data to another controller.
• Objection to processing based on legitimate interests.
• Automated decision-making (Article 22): in e‑PGW, no legal decision with significant effects is made solely by automated means.
• Lodging a complaint with the President of UODO (Polish Personal Data Protection Office, ul. Stawki 2, Warsaw).

Your data may be disclosed to:

• Courts, enforcement authorities and prosecutors, to the extent relevant to your case.
• Advocates' / legal advisers' firms and representatives acting in your case.
• Insurers, ZUS, KRUS and court-appointed experts, to the extent necessary.
• Technical subprocessors (hosting, infrastructure) listed in the register of processors.

Data is stored within the European Economic Area. The database, file storage and authentication are currently provided by Supabase Inc. as a processor (Frankfurt region, Germany); Microsoft Azure is intended to take over this role. The application layer and AI services run on Microsoft Azure. The current list of processors and their locations is available in the subprocessor register. We do not transfer data outside the EEA without a basis under Article 46 GDPR (standard contractual clauses) and without notifying the data subject.

• Data encryption at rest and in transit.
• Data isolation for each client (Row-Level Security in the database).
• Hosting with ISO 27001-certified providers (list and locations in the subprocessor register); monitoring and auditing event logs.
• Breach response procedures (Articles 33/34 GDPR), notification to the President of UODO within 72 hours.