Privacy Policy

1. Data controller

The controller of your personal data is ATTAIN EUROPE Aneta Jarecka, a sole proprietorship registered in Poland in the Central Register and Information on Economic Activity (CEIDG).

• Taxpayer’s Identification Number (NIP): 8181221742
• National Official Business Register (REGON): 120196289
• Correspondence address: Aneta Jarecka, Aleja Powstania Warszawskiego 15, 31-539 Kraków, Poland
• Email: hello@attaineurope.com
• Website: attaineurope.com

If you have any questions about this Privacy Policy or wish to exercise your rights regarding your personal data, you can contact us at any time by sending an email to hello@attaineurope.com.

2. What this policy covers

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have in relation to your data. It applies to personal data collected through the Website (attaineurope.com), online forms, email correspondence, video calls, messaging platforms (such as WhatsApp), social media profiles operated by Attain Europe, and in connection with the Professional Services we provide.

This Privacy Policy should be read together with our Terms of Service and our Cookie Policy, which is published as a separate document on the Website. Where cookies and tracking technologies are concerned, please refer to the Cookie Policy for detailed information.

Attain Europe processes personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”). For Users and Clients located in the United Kingdom, the applicable framework is the UK General Data Protection Regulation, as incorporated into UK law through the Data Protection Act 2018 and subsequent amendments (“UK GDPR”). References to “GDPR” in this document should be understood as including UK GDPR where applicable.

3. What personal data we collect

The scope of personal data we collect depends on the nature of your interaction with Attain Europe. We process the following categories of data, among others:

4. Special categories of personal data – Article 9 GDPR

The services provided by Attain Europe relate to confirming Polish citizenship by descent, which involves working with historical documents, archival records, and civil status certificates spanning multiple generations. By their nature, these documents may contain information that constitutes special categories of personal data (“sensitive data”) under Article 9 of the GDPR.

In particular, documents obtained during the course of our services may reveal data concerning ethnic or racial origin (e.g. nationality declarations, citizenship records), religious beliefs (e.g. parish registers, baptismal or marriage records from religious institutions), and in some cases health-related information or data concerning political opinions or affiliations, where such details appear in historical archival records. These categories of data may relate to the Client, their living family members (spouse, children, parents, siblings), or their deceased ancestors.

The processing of such data is strictly prohibited under Article 9(1) GDPR unless a specific exception applies. In the case of Attain Europe, the applicable exception is Article 9(2)(a) GDPR – the data subject has given explicit consent to the processing of such data for one or more specified purposes.

5. Legal basis for processing (Article 6 GDPR)

Attain Europe processes personal data on the basis of the following legal grounds, depending on the purpose of processing:

Performance of a contract or pre-contractual steps (Article 6(1)(b) GDPR). We process your data when it is necessary to take steps at your request before entering into an agreement (e.g. conducting the Eligibility Check, case profiling, preparing a Service Proposal) and to perform the agreement once concluded (e.g. preparing applications, communicating with Polish authorities on your behalf, managing your case).

Legal obligations (Article 6(1)(c) GDPR). We process certain data to comply with our legal obligations under Polish and EU law, including tax and accounting regulations, invoicing requirements, and any obligations arising from administrative proceedings.

Legitimate interests (Article 6(1)(f) GDPR). We may process your data where it is necessary for purposes arising from our legitimate interests, provided that these interests are not overridden by your rights and freedoms. Our legitimate interests include defending against legal claims and protecting our rights in the event of a dispute, preventing fraud and responding to chargeback procedures, maintaining contact with former Clients or Users who expressed interest in our services (unless you object), ensuring the security and proper functioning of the Website, and improving the quality of our services.

Consent (Article 6(1)(a) GDPR). Where none of the above legal bases applies, we process your data on the basis of your freely given consent. This includes the use of analytical and marketing cookies (see Cookie Policy), the processing of special categories of personal data as described in Section 4, and any future marketing communications such as newsletters. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

6. How we collect your data

We obtain your personal data from the following sources:

• Directly from you – through forms on the Website (such as the Eligibility Check form hosted by Tally), email correspondence, video calls (Google Meet), telephone calls, WhatsApp messages, online scheduling tools (used for booking consultations), and documents you send to us by email or post.
• From your family members or representatives – where a Client submits data concerning their spouse, children, parents, or other relatives for the purpose of carrying out the agreed services.
• From public and institutional sources – including documents obtained from archives, civil registry offices, courts, and other public institutions in Poland and abroad during the course of the citizenship confirmation procedure or document search.
• From social media platforms – if you interact with our profiles on platforms such as Facebook, Instagram, LinkedIn, YouTube, or other platforms we may use in the future, we may receive data about your interactions (comments, reactions, messages) through these platforms.

7. Who we share your data with

Attain Europe may share your personal data with the following categories of recipients, to the extent necessary for the purposes described in this Privacy Policy:

• Sworn translators who translate foreign documents into Polish as part of the citizenship confirmation procedure or related services. Translators receive only the documents necessary for translation.
• Polish administrative authorities and public institutions, including Voivodeship Offices, the Ministry of the Interior and Administration, Civil Registry Offices, archives (state, church, and other), courts, and other public bodies involved in the Client’s case. Depending on the specifics of the case, Attain Europe may also contact libraries, museums, educational institutions, or other organisations in Poland to locate records relevant to the Client’s ancestry. This sharing is required by the nature of the administrative proceedings or the document search.
• Polish consulates and embassies abroad, where it is necessary to discuss or resolve matters related to the Client’s case, such as document verification, passport procedures, or other consular matters.
• Notaries, where notarised copies of documents are required for the purposes of the procedure.
• Payment service providers and financial institutions – Stripe, Wise, and PayPal – who process payments on behalf of Attain Europe. Banks involved in the processing of transfers may also have access to transaction-related data. These providers and institutions receive only the data necessary to process the transaction.
• IT and cloud service providers – Google (Google Workspace, including Gmail, Google Drive, Google Meet, Google Forms, and Gemini AI, as well as Google Analytics), Hostinger (website hosting), OVH (domain registration), Tally (online forms), Cookiebot (cookie consent management), and scheduling or appointment tools used for booking consultations. Google Workspace for Business operates under a Data Processing Addendum and does not use business customer data to train its AI models. Attain Europe does not enter identifiable client data into publicly accessible AI tools; where AI-assisted analysis is used, only anonymised data is processed in general-purpose environments.
• Advertising and analytics providers – Google (Google Analytics), Meta (Facebook Pixel, Instagram), LinkedIn (Insight Tag), and other advertising platforms we may use in the future, for the purpose of website analytics, remarketing, and measuring the effectiveness of advertising. These providers may use cookies and tracking technologies as described in our Cookie Policy.
• Accounting and tax advisory services that assist Attain Europe with bookkeeping, invoicing, and tax compliance.
• Legal advisors, where consultation is necessary in connection with a Client’s case or in the event of a dispute.
• Postal and courier services for the delivery of documents between Attain Europe and the Client or Polish institutions.

Attain Europe does not sell, rent, or trade your personal data to third parties. Data is shared only to the extent necessary to fulfil the purposes described above, and where required, appropriate data processing agreements are in place with third-party service providers.

8. International data transfers

Due to the cross-border nature of the services provided by Attain Europe, your personal data may be transferred outside the European Economic Area (EEA). Such transfers occur primarily because our Clients are located in countries outside the EEA and because some of our service providers operate internationally.

Attain Europe ensures that all international data transfers are carried out in compliance with Chapter V of the GDPR, using one of the following mechanisms:

Adequacy decisions. The European Commission has recognised certain countries as providing an adequate level of data protection. For Clients and data transfers involving the United Kingdom, Israel, Argentina, and Uruguay, data flows freely on the basis of the applicable adequacy decision. For Brazil, the mutual adequacy arrangement between the EU and Brazil, finalised in early 2026, applies.

EU-US Data Privacy Framework. For transfers to the United States involving certified service providers (such as Google, Stripe, Meta, and PayPal), Attain Europe relies on the EU-US Data Privacy Framework, under which these providers have committed to adequate data protection standards.

Contractual necessity. For transfers to Clients located in countries not covered by an adequacy decision (such as Australia), and where the transfer is necessary to perform the agreement with the Client or to take pre-contractual steps at the Client’s request, Attain Europe relies on the derogation provided in Article 49(1)(b) GDPR.

Where none of the above mechanisms applies, Attain Europe will implement appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission, before transferring personal data to a third country.

9. Data security

Attain Europe takes appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or destruction.

Electronic data, including documents, correspondence, and case files, is stored on Google Workspace (Google Drive), which provides encryption in transit and at rest, access controls, and security certifications. Original paper documents provided by Clients are kept in a secure physical location in Kraków until they are submitted to the relevant Polish authorities or returned to the Client. Access to personal data is limited to the Service Provider and, where necessary, to the specific third parties described in Section 7.

While Attain Europe applies reasonable safeguards, no method of electronic storage or transmission is completely secure. Attain Europe cannot guarantee the absolute security of your data but will notify you promptly in the event of a data breach that is likely to affect your rights and freedoms, in accordance with Article 34 GDPR.

10. How long we keep your data

Attain Europe retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

Clients and their family members. Personal data related to a Client’s case is retained for the duration of the engagement and for a period of 6 years following its conclusion. This period corresponds to the general limitation period for civil claims under Polish law (Article 118 of the Polish Civil Code) and ensures that Attain Europe can defend against potential claims if needed. Where tax and accounting regulations require longer retention (currently 5 years for invoices and financial records), the relevant data is retained accordingly.

Eligibility Check submissions (non-Clients). If you submit the Eligibility Check form but do not proceed to become a Client, your data is retained for up to 12 months from the date of your last communication with Attain Europe, after which it is deleted. If you request earlier deletion, we will comply promptly.

Website analytics data. Data collected through cookies and analytics tools is retained in accordance with the retention periods set by the respective providers (see Cookie Policy for details).

Social media interactions. Data from social media interactions (comments, reactions) is retained for as long as the interaction remains publicly visible on the platform, or until you delete it or request its removal.

After the applicable retention period expires, personal data is deleted or anonymised. Where deletion is not technically feasible for certain backup systems, access to such data is restricted until deletion can be carried out.

11. Your rights under GDPR

As a data subject, you have the following rights in relation to your personal data processed by Attain Europe:

• Right of access – you have the right to obtain confirmation as to whether your personal data is being processed, and if so, to request a copy of that data together with information about the purposes and scope of processing.
• Right to rectification – you have the right to request the correction of inaccurate personal data or the completion of incomplete data.
• Right to erasure (“right to be forgotten”) – you have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent and no other legal basis applies, or where the data has been unlawfully processed. Please note that this right is subject to limitations: Attain Europe may be required to retain certain data to comply with legal obligations (e.g. tax and accounting records), to defend against legal claims, or because the data forms part of official administrative proceedings conducted by Polish authorities.
• Right to restriction of processing – you have the right to request that Attain Europe restricts the processing of your data in certain circumstances, for example while the accuracy of your data is being verified.
• Right to data portability – you have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller, where the processing is based on consent or a contract and is carried out by automated means.
• Right to object – you have the right to object to the processing of your data where the processing is based on legitimate interests (Article 6(1)(f) GDPR), including for direct marketing purposes. If you object to processing for direct marketing, your data will no longer be processed for that purpose.
• Right to withdraw consent – where processing is based on your consent, you may withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. As noted in Section 4, withdrawal of consent to the processing of special categories of data results in the inability to continue providing services and is treated as termination of the agreement.

12. Supervisory authority

If you believe that the processing of your personal data by Attain Europe violates the GDPR, you have the right to lodge a complaint with the competent supervisory authority.

In Poland, the supervisory authority is the President of the Office for Personal Data Protection (Prezes Urzędu Ochrony Danych Osobowych, PUODO), ul. Stawki 2, 00-193 Warszawa, Poland. More information is available at https://uodo.gov.pl/.

For individuals located in the United Kingdom, the supervisory authority is the Information Commissioner’s Office (ICO). Details and contact information are available at https://ico.org.uk/.

Individuals located in other EU or EEA Member States may lodge a complaint with the data protection authority in the country of their habitual residence, place of work, or where the alleged infringement occurred.

13. Changes to this policy

Attain Europe reserves the right to update or modify this Privacy Policy at any time. The date of the most recent update is indicated at the top of this document. Where changes are material and affect the way we process your data, we will take reasonable steps to inform you (e.g. by publishing a notice on the Website). Previous versions of this Privacy Policy are available upon request.

14. Contact

If you have any questions about this Privacy Policy, wish to exercise your rights, or have any concerns about how your personal data is handled, please contact us: