Information for people whose data is in the company database

1. Who this information is for

firmowekontakty.pl builds databases of business entities and supplies exports from them to businesses (Polish company database – being expanded; Czech company database; other EU countries on request). Information about businesses is personal data only where it relates to a natural person. This information is addressed to:

• sole traders and partners in civil partnerships (spółki cywilne) whose business name, address and contact details relate to them as natural persons;
• members of liberal professions listed in public registers and lists, in particular advocates, tax advisers, property valuers and people running professional healthcare practices;
• contact persons whose name or contact details identifying the person (e.g. an email address containing their name) a business has published.

Website users, people who contact the controller and clients are informed by the Privacy policy.

2. Controller

Martin Adamec (entrepreneur – natural person)
Mírová 1541, 516 01 Rychnov nad Kněžnou, Czech Republic
Czech business ID (IČO): 19552319
email: info@firmowekontakty.pl · phone: +420 720 950 900

The controller has not appointed a data protection officer (see Privacy policy, section 13).

3. Categories of data

For each record, the controller processes the following, where the source provides it:

Identification data

the business name (for a sole trader usually containing the first name and surname), and the NIP, REGON or KRS number – only where one of the sources listed in section 4 provides it; for liberal professions, the profession. [[ TODO: confirm whether entry numbers in professional registers are taken over ]]

Address

the address of the place of business given in the source, and the voivodeship and county derived from it. For a sole trader this address may also be the home address.

Contact details

phone number, email address and website address published by the business or in the register.

Activity

the activity category given in the source; in future also the assignment to an industry and PKD code. PKD 2007 or PKD 2025, depending on the source.

The controller does not process special categories of personal data (Article 9 GDPR) or data relating to criminal convictions and offences (Article 10 GDPR). [[ TODO: confirm that dates of birth, PESEL numbers and home addresses other than the business address are not taken over from the registers ]]

4. Sources of data

All data comes from publicly accessible sources. A detailed description is on the Data sources and methodology page.

Polish company database

• the pkt.pl business directory: name, address, phone, email address, website and business category;
• the Panorama Firm business directory: name, address, contact details and business category;
• OpenStreetMap (openstreetmap.org): names and addresses of business locations and – where entered – contact details and websites; data © OpenStreetMap contributors, ODbL licence;
• Register of healthcare providers (RPWDL) (rpwdl.ezdrowie.gov.pl): name, address, NIP, REGON and contact details of healthcare entities and professional practices;
• Register of schools and educational institutions (RSPO) (rspo.gov.pl): name, address, REGON and contact details;
• Register of advocates of the Polish Bar Council (rejestradwokatow.pl): law office address and contact details;
• list of the National Chamber of Tax Advisers (KIDP) (kidp.pl): address and contact details of tax advisers;
• Central Register of Property Valuers (CRRM) (dane.gov.pl): data from the public extract of the register;
• database of craft organisations of the Polish Craft Association (ZRP) (zrp.pl): chambers of crafts and guilds;
• company websites: phone number, general email address and website address that the business has published itself.

The controller does not download data directly from the Central Register and Information on Economic Activity (CEIDG) or from the National Court Register. It uses GUS data (REGON register) only to determine the overall size of the market, without data on individual entities.

Czech company database

• ARES, the administrative register of economic entities (ares.gov.cz);
• the commercial register and the trade licence register (or.justice.cz, rzp.gov.cz);
• the VAT payer register (adisspr.mfcr.cz);
• the ISIR insolvency register (isir.justice.cz);
• company websites: contact details published by businesses.

On request, the controller will tell you which source the data in your record comes from.

5. Purposes of processing

The controller processes the data in order to build and update databases of business entities and to make exports from them available to businesses for purposes related to their business (B2B), in particular for postal correspondence, arranging meetings, enriching data in CRM systems and market analysis. The controller does not offer data for sending commercial information by email or for telemarketing without the recipient’s consent; clients are contractually obliged to comply with Article 398 of the Polish Electronic Communications Law (§ 8 of the Terms).

The controller does not create personality profiles, does not evaluate personal aspects and does not take decisions based solely on automated processing within the meaning of Article 22 GDPR.

6. Legal basis and legitimate interests assessment

The legal basis for the processing is Article 6(1)(f) GDPR. The legitimate interest of the controller and its clients is making available and using information on business entities in dealings between businesses; recital 47 GDPR states that direct marketing may also be regarded as a legitimate interest.

The controller has assessed that the processing is necessary for this interest (without identification, address and contact data a company database does not fulfil its function) and that this interest is not overridden by your interests, rights and freedoms. The assessment took into account in particular that:

• the data concerns your business or professional activity, not your private life;
• the data is publicly available – its publication follows from the law (public registers, professional lists) or from your decision to make the data available for business contact (business directories, website);
• the controller does not process special categories of data and does not create profiles;
• safeguards have been applied: this information, a simple objection form, a block list preventing the data from being collected again after an objection, and a contractual obligation on clients to comply with the GDPR and the ban on sending commercial information without consent (Article 398 of the Electronic Communications Law).

[[ TODO: document the written balancing test (LIA); state whether it is made available on request ]]

7. Recipients of data

• Clients – businesses that purchase an export. They process the data as separate controllers, need their own legal basis and fulfil the information obligation towards you themselves.
• Processors, in particular the server provider (Hostinger International Ltd., Larnaca, Cyprus), under agreements compliant with Article 28 GDPR.

If you have received advertising from another business, that business is responsible for the contact; please (also) address your objection to the contact to that business.

8. Transfers outside the EEA

The controller processes the data within the European Union. [[ TODO: whether exports are supplied to clients outside the EU/EEA (e.g. Switzerland, the United Kingdom); if so – an adequacy decision or a safeguard under Article 46 GDPR ]]

9. Retention period

The controller keeps a record for as long as the entity appears in the sources as carrying on business and as long as the record is needed for the purpose stated in section 5. If the entity no longer appears in the sources as carrying on business, the controller deletes the personal data within [[ TODO: deletion period after disappearance from the source ]].

Once an objection has been upheld, the controller deletes the record. So that the data is not collected again from the sources at a later update, it keeps only the necessary identifying attributes (e.g. the NIP number, phone number or email address) on a block list for [[ TODO: retention period of the block list ]].

10. Rights of data subjects, in particular the right to object

In addition, under the conditions set out in the GDPR, you have the right of access to your data (Article 15 GDPR), to rectification (Article 16 GDPR), to erasure (Article 17 GDPR) and to restriction of processing (Article 18 GDPR). The right to data portability (Article 20 GDPR) does not apply to processing based on Article 6(1)(f) GDPR.

The controller informs clients to whom it has previously supplied your data of any rectification, erasure or restriction of processing, unless this proves impossible or involves disproportionate effort (Article 19 GDPR). by email where the controller has the client's email address

The controller replies without undue delay and at the latest within one month of receiving the request; where necessary this period may be extended by two further months, of which the controller will inform you within one month (Article 12(3) GDPR). If there are reasonable doubts about the identity of the person making the request, the controller may request additional information (Article 12(6) GDPR). If the error is in an official source, the controller corrects its own record; a lasting correction also requires a change in the source register.

11. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority (Article 77 GDPR). The lead supervisory authority (Article 56 GDPR) is the Czech Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, Czech Republic (uoou.gov.cz). People in Poland may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw (uodo.gov.pl).

12. How this information is provided

The company databases contain a large number of records obtained from public sources, not from the data subjects. The controller makes this information publicly available on the website, relying on Article 14(5)(b) GDPR, and applies the safeguards described in section 6. On request, the controller will provide information concerning your record individually. [[ TODO: lawyer – whether reliance on Article 14(5)(b) GDPR is permissible, see the note ]]

13. Changes

The controller updates this information when the sources, scope or purposes of the processing or the law change. The version published at firmowekontakty.pl/en/gdpr-information/ applies. [[ TODO: lawyer – decide which language version prevails in case of discrepancies (the Polish original is the source of this translation) ]]

Status: October 2026 (draft)