Personal Data Processing Policy

Fully compliant with GDPR / RODO and Polish legislation

1. General Provisions

This Policy defines the procedure for processing and protecting personal data of users of the Statizen CRM system, operated by Statizen.

This Policy has been developed in accordance with:

  • — Regulation (EU) 2016/679 (GDPR / RODO)
  • — Act of 10 May 2018 on the Protection of Personal Data (Poland)

This Policy applies to all data received from:

  • — legalisation agencies using the Platform
  • — natural persons — clients of those agencies
  • — visitors to the Statizen website and services

2. Data Controller (ADO)

Personal Data Controller

Company: Statizen

3. Categories of Data Processed

3.1 Basic Data

  • — First name, last name, middle name
  • — Phone number
  • — Email address

3.2 Document Data

  • — Passport details
  • — Residential address
  • — Visa, temporary / permanent residence permit data
  • — Migration procedures and status data
  • — Uploaded documents (scans, PDFs, photos)

3.3 Interaction Data

  • — Contact history
  • — Comments and CRM records
  • — Data provided by agencies on behalf of their clients

3.4 Technical Data

  • — IP address
  • — Browser and device data
  • — System activity log files

3.5 — Statizen does not process special categories of data (Art. 9 GDPR) unless voluntarily provided by the data subject.

4. Data Sources

Data may be received:

  • — Directly from the data subject
  • — From legalisation agencies acting as processors or joint controllers — depending on the agreement
  • — Automatically upon use of the Platform

5. Purposes of Data Processing

5.1 Primary Purposes

  • — Providing access to the CRM system
  • — Managing migration cases for agency clients
  • — Storing and processing legalisation documents
  • — Tracking application statuses and deadlines
  • — Communicating with users

5.2 Additional Purposes

  • — Ensuring Platform security
  • — Improving service quality
  • — Technical support

Statizen does not use data for marketing without separate consent.

6. Legal Basis for Processing (Art. 6 GDPR)

6(1)(a)Consent of the data subject
6(1)(b)Performance of a contract or pre-contractual measures
6(1)(c)Compliance with a legal obligation
6(1)(f)Legitimate interests of the Controller: security, service improvement

7. Data Transfers

Data may be transferred to:

  • — Legalisation agencies managing their clients' cases
  • — IT service providers supporting the Platform
  • — Legal advisors — where necessary
  • — Public authorities — only as required by law

The Controller does not transfer data outside the EU, except where necessary for migration procedures and agreed with the data subject.

8. Data Retention

Data is stored:

  • — On secure cloud servers within the EU
  • — For the duration of Platform use
  • — Additionally — for the period required to fulfil legal obligations

Upon expiry of the retention period, data is deleted or anonymised.

9. Data Subject Rights (Art. 15–22 GDPR)

The data subject has the right to

Access to data
Rectification of data
Erasure ('right to be forgotten')
Restriction of processing
Data portability
Objection
Withdrawal of consent
Lodge a complaint with the UODO

10. Cookies and Analytics

Statizen does not use cookies or third-party analytics tools (Google Analytics, Meta Pixel, etc.).

11. Data Security

The Controller applies the following security measures:

  • — Data encryption
  • — Access control
  • — Activity logging
  • — Data backups
  • — Protection against unauthorised access