Privacy policy

This English version is provided for convenience. In the event of any discrepancy, the Polish version prevails.

1. Controller

The controller is Paweł Porowski, running a business under the name Lykta Paweł Porowski, ul. Władysława Pytlasińskiego 16/13, 00-777 Warsaw, Poland, tax ID (NIP) 9661363371, REGON 541716521. The detective services business is entered in the Polish register of regulated activities under no. RD-14/2026 (the “Controller”).

Contact for data protection matters: biuro@lyktaofficial.eu, phone +48 696 746 862, or by post to the Controller’s address. The Controller has not appointed a data protection officer because it is not required to do so (Article 37 GDPR).

This policy describes how we process the data of visitors to lyktawywiad.pl, people who contact us and clients (section 2), and people affected by detective activities carried out on assignment (section 3).

2. People who contact us and clients

You do not need to include details of your case or third parties’ data in your enquiry. A general description and contact details are enough – we will discuss details directly.

We do not send marketing messages electronically without your separate consent (Article 398 of the Polish Electronic Communications Law).

3. People affected by detective activities

This section fulfils the obligation under Article 28d of the Polish Act of 6 July 2001 on detective services. It concerns people about whom we obtain information during an assignment: people being traced, checked or observed, witnesses and others connected with the case.

Legal basis and scope. Under Article 28a of the Act, we process data collected during detective activities without the consent of the people concerned, solely to the extent needed to perform the service. The GDPR basis is Article 6(1)(f) – the client’s legitimate interest, e.g. establishing facts in a civil, commercial or employment matter, pursuing claims or tracing people and assets. We process special categories of data only where necessary to establish, exercise or defend legal claims (Article 9(2)(f) GDPR).

Categories of data and sources. Depending on the case, these may include identification and address data, information on employment, business activity, assets, conduct and events. Sources include the client, public registers and records, open sources, information from individuals, businesses, institutions and public authorities (Article 9 of the Act) and our own observations. We do not use technical means or operational methods reserved for state authorities (Article 7 of the Act).

Recipients. Once the service is completed, we hand the data over to the client together with the final report (Articles 23b and 28b(1) of the Act). We may pass it only to another detective appointed to cooperate or take over the case (Article 28b(5)) and to authorities entitled by law.

Retention. We process the data while performing the service and hand it over to the client. If the client declines or fails to collect it within the agreed time, we destroy it 5 years after the service ends, and in any case immediately after removal from the register (Article 28b(2)). We keep a copy of reports in matters related to criminal proceedings for 2 years from their preparation (Article 23b(3)). Handover or destruction is recorded in the contract performance log.

Limitations of rights. Under Article 28c of the Act, the following do not apply to data collected during detective activities:

• Article 13(1) and (2) GDPR – the duty to inform when data is collected from the person concerned,
• Article 15(1)(a), (c) and (g) GDPR – the right to information about the purposes of processing, recipients and the source of the data.

Where data comes from other sources, we do not inform the person concerned insofar as obtaining it is expressly laid down by law (Article 14(5)(c) GDPR) or providing the information would render impossible or seriously impair the purposes of processing (Article 14(5)(b) GDPR).

Other rights, including rectification, erasure, restriction and objection, apply under the GDPR. They may be limited where the data is needed to establish, exercise or defend legal claims. You also have the right to lodge a complaint with the President of the UODO.

4. Detective’s professional secrecy

Sources of information and the circumstances of a case learned in connection with performing a contract are covered by professional secrecy (Articles 12 and 23a of the Detective Services Act). This obligation continues after the case ends. We do not disclose that a case is being handled or its content to third parties. Release from secrecy is possible only under the Polish Code of Criminal Procedure.

We store case files in Microsoft OneDrive under a data processing agreement, with access restricted to the people handling the case. The case folder is encrypted and the account is protected by multi-factor authentication. The provider stores the data only on our instructions and does not use it for its own purposes.

5. Recipients and transfers outside the EEA

We do not sell data or share it for marketing purposes. Recipients may include:

• Hostinger International Ltd., 61 Lordou Vironos, 6023 Larnaca, Cyprus – website hosting and sending messages from the contact form,
• Google Cloud EMEA Limited (Ireland) – email in Google Workspace,
• Microsoft Ireland Operations Limited (Ireland) – storing case files in OneDrive,
• Google Ireland Limited (Ireland) – Google Analytics 4, only after you give consent,
• our accounting office – for accounting documents,
• the client – for data collected during detective activities (section 3),
• courts, law enforcement and the authority keeping the register of detective services – where required by law.

Technical service providers process data under data processing agreements. Using Google Analytics and Google Workspace email may involve transferring data to Google LLC in the USA on the basis of the European Commission decision of 10 July 2023 on the EU-US Data Privacy Framework (Article 45 GDPR), under which Google LLC is certified. OneDrive data is stored in data centres in the European Union. If, exceptionally, Microsoft Corporation accesses it from the USA for service purposes, the basis is the same EU-US Data Privacy Framework decision, under which Microsoft Corporation is certified. Otherwise, we do not transfer data outside the European Economic Area.

6. Your rights

Subject to the limitations described in section 3, you have the right to:

• access your data and obtain a copy (Article 15 GDPR),
• rectification (Article 16),
• erasure (Article 17),
• restriction of processing (Article 18),
• data portability for data processed on the basis of consent or a contract (Article 20),
• object to processing based on legitimate interest, on grounds relating to your particular situation (Article 21),
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Article 7(3)),
• lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

Send requests to biuro@lyktaofficial.eu. We will reply without undue delay and in any event within one month. We may ask you to confirm your identity so that we do not disclose data to an unauthorised person.

Providing data in an enquiry or contract is voluntary, but without it we cannot reply or conclude a contract. We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

7. Cookies and analytics

The website uses only a mechanism necessary to remember your choice and – after you consent – Google Analytics 4 cookies. We do not use advertising or profiling cookies, do not run online advertising and do not share data with data brokers.

Under Article 399 of the Polish Electronic Communications Law, the analytics script loads only after you consent in the banner – before that the website does not connect to Google servers. You can accept or reject analytics with one click, and refusing does not limit access to the website.

GA4 does not store IP addresses. We do not combine analytics data with form data or case data. Provider’s privacy policy: https://policies.google.com/privacy.

You can withdraw consent at any time by clicking “Cookie settings” in the footer. Google Analytics cookies will then be deleted. You can also delete or block cookies in your browser settings.

8. Security and changes to this policy

We apply technical and organisational measures appropriate to the risk, including encrypted connections (SSL/TLS), access control over correspondence and case files, and protection of media containing case files.

We update this policy when the law, the scope of our services or the tools used on the website change. The current version is always available at lyktawywiad.pl/en/privacy-policy.html.

Last updated: 6 October 2026.