Version of 29 September 2026. The current version is at docdoc.mirkit.com/en/privacy-policy/.
1. Who processes your data
The data controller is MIRKIT sp. z o.o. (spółka z ograniczoną odpowiedzialnością (limited liability company), registration number KRS 0000818540, REGON 385074112), address: ul. Chełmżyńska 180A, 04-464 Warszawa, Poland. The service and the website operate under the name DocDoc; the data controller remains MIRKIT sp. z o.o.
Questions about data processing: docdoc@mirkit.com.
This policy is written in line with the EU General Data Protection Regulation (GDPR) and applies to everyone who uses the website docdoc.mirkit.com and our services.
2. What data we process
2.1. When you use the website
| Data | Source |
|---|---|
| IP address, device and browser type, pages visited and time of visit | automatically, server logs |
| Country derived from the IP address | determined while the page is being served, using the local DB-IP database installed on our own server |
| Cookies and similar technologies | see section 8 |
About country detection. We match your IP address to a country in order to pre-fill the dialling code in the form — that is the only purpose. The matching happens on our server: no request leaves it, no external geolocation service is involved, and the address itself is not stored as a result of this operation, is not linked to your enquiry and is not used for profiling. Only the country is determined, not the city or the address. No cookies are set in the process.
2.2. When you send an enquiry or write to us
Your name or how you wish to be addressed; phone number, email address, messenger identifier; a description of your situation; the language you prefer; the content of our correspondence.
2.3. When we handle your case
This is the most sensitive part, and its scope depends on the service:
- identity data: surname, given name, date and place of birth, citizenship, passport and ID details, personal identification numbers;
- family and descent data: details of a spouse, children, parents, grandparents and earlier ancestors — to the extent required by the competent authority;
- documents: civil status certificates and extracts, archival references, criminal record certificates, education documents and language certificates, powers of attorney, copies and translations;
- case progress data: file number, correspondence with authorities, decisions, deadlines;
- payment data: information about invoices and payments. We neither receive nor store full bank card details.
2.4. Special categories of data
Some documents may contain data that the GDPR treats as special categories:
- religious belief — parish registers and church records used to prove descent are often kept by denomination;
- health data — medical documents, where your state of health exempts you from certain procedures or you request special arrangements.
We process such data only when it is necessary for your case, and on the basis of your explicit consent or for the establishment and exercise of legal claims (Art. 9(2)(a) and 9(2)(f) GDPR). You may withdraw consent; this may make the service impossible to deliver, and we will tell you so in advance.
We do not request information about political opinions, membership of organisations, sexual life or other special categories unrelated to the case. If such data reaches us by accident — inside a document — it is not used and is deleted, unless that would compromise the integrity of the file.
3. Why and on what legal basis
| Purpose | Legal basis |
|---|---|
| To answer your enquiry, assess your situation, prepare an estimate | Art. 6(1)(b) — steps prior to entering into a contract |
| To provide the services: prepare documents, run the case, communicate with you | Art. 6(1)(b) — performance of a contract |
| To engage subcontractors and organise their work | Art. 6(1)(b) and 6(1)(f) — legitimate interest in delivering the service |
| To process special categories of data (see 2.4) | Art. 9(2)(a) — explicit consent; Art. 9(2)(f) — legal claims |
| To issue invoices, keep accounts, retain documents | Art. 6(1)(c) — legal obligation |
| To defend our rights in disputes and handle complaints | Art. 6(1)(f) — legitimate interest |
| To keep the website running and secure | Art. 6(1)(f) — legitimate interest |
| To determine the country by IP and pre-fill the dialling code | Art. 6(1)(f) — legitimate interest: convenience of filling in the form |
| Website analytics and newsletters about our guides | Art. 6(1)(a) — your consent; withdrawable at any time |
We do not take decisions about you based solely on automated processing and do not carry out profiling with legal effects. The free eligibility check on the website is an indicative calculation based on what you enter; its result is not a decision and does not bind you to anything.
4. Other people’s data
Cases of citizenship by descent require data about your relatives, including deceased ones, and about children included in the application.
By giving us such data you confirm that you are entitled to do so and that you have informed the living relatives about the processing. Children’s data is processed on the basis of consent from a parent or legal guardian.
5. Who we share data with
We do not sell data and do not pass it on for anyone else’s marketing. Disclosure only happens to the extent necessary for a specific purpose:
| Recipient | Purpose | What is shared |
|---|---|---|
| Subcontractors: translators, archival researchers, partners in the country of application, language schools | carrying out part of the work | only the necessary minimum; the subcontractor sees the client anonymised where the full name is not needed for a document |
| Competent authorities, archives, consular offices, notaries | filing and obtaining documents on your instructions | whatever the authority requires |
| IT service providers: hosting, email, case management system, mailing services and messengers | technical operation of the service | the data that reaches the service in question |
| Banks and payment providers | settlements | payment details, payment reference |
| Accounting and legal advisers, auditors | bookkeeping and defence of rights | to the extent necessary |
| Public authorities | where we are required to by law | on request |
With IT providers and subcontractors processing data on our instructions we conclude data processing agreements under Art. 28 GDPR: they act strictly on our instructions, do not use your data for their own purposes and are bound by confidentiality.
The list above sets out categories of recipients, as required by Art. 13 GDPR. We do not disclose the specific subcontractors, partners and service providers: their identity is a trade secret, and the anonymity of the parties is a condition of our work that protects you as well. If you submit a subject access request, we will answer to the extent the law provides.
Bear in mind how messengers work. If you choose to communicate via a messenger, the metadata of that correspondence is processed by its operator under its own rules. We ask you to send documents through the Client Area, not through a messenger.
6. Transfers outside the EEA
Descent cases almost always involve archives and authorities outside the European Economic Area — above all in Moldova and Ukraine.
Data is transferred to such countries:
- under the EU standard contractual clauses, where the subcontractor acts on our instructions; or
- under Art. 49(1)(b) GDPR — where the transfer is necessary to perform the contract with you: an archival request, for instance, physically cannot be carried out any other way; or
- under Art. 49(1)(e) — for the establishment and exercise of legal claims.
Before any such transfer we assess whether it is necessary and send the minimum required.
7. How long we keep data
| Data | Retention |
|---|---|
| Enquiries that did not lead to a contract | up to 12 months from the last contact — so that we can pick up your question if you write again |
| Case materials and correspondence | for the duration of the case and 3 years after it closes — to answer authorities’ queries and defend the parties’ rights |
| Accounting documents | the period set by the accounting legislation of Poland: 5 years from the end of the financial year |
| Data processed on the basis of consent (newsletters, analytics) | until consent is withdrawn |
| Technical web server logs | no more than 30 days: rotated daily, files older than that are deleted automatically |
| Country derived from an IP address | not stored: used only while the page is being served |
Web server logs are technical records of requests (address, time, page requested) created automatically. We do not use them to analyse visitor behaviour, do not link them to enquiries or cases and do not pass them to third parties; they exist for troubleshooting and security. Deletion is automatic: the logs rotate every 24 hours and entries older than thirty days are removed without our involvement.
If the retention period has expired but the data is needed to defend rights in an unresolved dispute or to comply with an order of an authority, it is kept until that procedure ends and deleted immediately afterwards. You may ask us to delete data earlier — we will delete everything we are not required by law to keep.
Original documents are returned to you once the case is closed. Electronic copies are deleted or anonymised once the retention period expires.
8. Cookies
The website uses technical cookies only: they are needed for the pages and contact forms to work and to remember your settings. Such files are set without consent, because the site does not work without them.
We do not set analytics or advertising cookies, and no third-party advertising trackers are used on the site. Should this change, we will update this policy and add a consent banner before any such files are set.
External services. When serving pages the site does not contact any third-party service: fonts, images and scripts are served from our own domain, so your IP address does not become known to anyone but us. There is no analytics or advertising on the site.
Country detection by IP likewise works without external services: it uses the DB-IP Country Lite database installed on our server (source: db-ip.com, licence CC BY 4.0).
You can manage cookies in your browser settings: they can be deleted or blocked. Refusing technical cookies may break the forms on the site.
9. How we protect data
- access to cases is role-based and granted only to those employees and subcontractors who need it for their work;
- data is transmitted on the site and in the Client Area over a secure connection (TLS);
- scans of identity documents are not stored in the customer relationship management system: it holds only case statuses and metadata;
- backups, access logging, regular review of permissions;
- in the event of a breach that threatens your rights, we notify the supervisory authority within 72 hours and you without undue delay.
10. Your rights
You have the right to:
- access your data and obtain a copy of the processing;
- rectify inaccurate data;
- erase data (the “right to be forgotten”) — where we are not obliged to keep it;
- restrict processing;
- object to processing based on legitimate interest;
- receive your data in a machine-readable format and transmit it to another controller;
- withdraw consent at any time — this does not affect the lawfulness of processing before withdrawal;
- lodge a complaint with the data protection supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), uodo.gov.pl, and also with the authority of your country of residence.
Send your request to docdoc@mirkit.com. We reply within one month; in complex cases the period may be extended by a further two months, and we will tell you if it is. To protect your own data we may ask you to confirm your identity.
Making a request is free. A fee is possible only for manifestly unfounded or repetitive requests, within the limits the GDPR allows.
11. Changes to this policy
We update the policy when our processes or the law change. The new version is published on this page with its date. We additionally notify significant changes affecting your rights by email, if we have your address.
12. Contact
MIRKIT sp. z o.o. ul. Chełmżyńska 180A, 04-464 Warszawa, Poland General enquiries: docdoc@mirkit.com · Data protection enquiries: docdoc@mirkit.com Phone: +33 7 57 69 12 89