Consilaris privacy policy. Your data, our obligations.

1. Data controller

The controller of the personal data described in this Policy is MIVARE GROUP PROSTA SPÓŁKA AKCYJNA, with its registered office in Krasnobród (22-440 Krasnobród; the full registered office address is disclosed in the National Court Register (KRS)), entered in the Register of Entrepreneurs maintained by Sąd Rejonowy Lublin-Wschód w Lublinie z siedzibą w Świdniku, VI Wydział Gospodarczy KRS, under KRS number 0001268091, NIP 9223092251, REGON 545767254, operating under the Consilaris brand, hereinafter “Mivare”.

Contact for personal data matters: hello@mivaregroup.com or in writing to the registered office address disclosed in the National Court Register (KRS). A Data Protection Officer has not been appointed.

2. Scope of the Policy

This Policy concerns data whose purposes and means of processing Mivare determines in connection with the Consilaris service: data of persons who create a Firm Account and use the Application (Users), persons designated for billing, persons contacting support, and technical data related to the use of the Application.

This Policy does not cover data that the law firm (Customer) enters into the Application about its clients, their opponents and representatives, witnesses, employees, co-workers and other persons, the content of cases and documents, nor the time records of the law firm's team together with activity descriptions. The controller of that data is the law firm, and Mivare processes it solely on its behalf, under the Consilaris Data Processing Agreement (CNS-LEG-003), in compliance with the rules for protecting professional secrecy set out in the Terms of Service and the Data Processing Agreement. Persons to whom that data relates should address their requests to the law firm; if a request reaches Mivare, Mivare forwards it to the law firm and does not disclose whether the law firm processes that person's data.

Capitalised terms have the meanings given to them in the Consilaris Terms of Service (CNS-LEG-001).

3. Purposes, legal bases and retention periods

• Registration, maintenance of the Firm Account and provision of the service (first and last name, e-mail address, telephone number if provided, position, language, account settings): Article 6(1)(b) GDPR for the person concluding the Contract, and Article 6(1)(f) GDPR for other Users (the legitimate interest in providing the service to the Customer). We retain the data for the duration of the Contract and until the Firm Account is deleted on the terms of the Terms of Service.
• Verification of registration (NIP number, name from the REGON register, entry number in the register of the bar of advocates or legal advisers, the chosen verification method and the law firm’s official e-mail address and telephone number from the bar register, used solely for verification): Article 6(1)(f) GDPR (legitimate interest in limiting the service to advocates and legal advisers and in protecting law firms against registration in their name by an unauthorised person). We delete an unverified registration once the periods set out in the Terms have expired (up to 48 working hours and a further 72 working hours). Each verification leaves an entry in the log without personal data (a hash of the NIP number, the date and the result), kept for 12 months.
• Authentication and security (password in hashed form, two-factor authentication data, trusted devices, login history and failed login attempts, IP address, event log in the Application): Article 6(1)(f) GDPR (the legitimate interest in protecting the Application and data). The event log is retained for the period set by the Customer, from 30 to 180 days (90 days by default); other data is retained until the User's account is deleted.
• “Recently opened” list (type and identifier of the records recently opened by the User and the time they were opened, without the content of the records): Article 6(1)(f) GDPR (legitimate interest in making it easy to return to current work). The list is visible only to that User; each entry is deleted 90 days after the record was last opened, and the whole list is deleted immediately together with the Firm Account.
• Record of acceptance of documents (document version, date, IP address): Article 6(1)(c) and (f) GDPR (demonstrating conclusion of the Contract). We retain it for the duration of the Contract and, after the Firm Account is deleted, in an archive for 5 years.
• Billing, payments and invoices (law firm details, EU VAT number and the result of its check in the VIES system, billing e-mail address, payment history): Article 6(1)(b) and (c) GDPR. We retain billing documents for the period required by tax and accounting law, as a rule 5 years from the end of the calendar year in which the tax payment deadline expired.
• Handling of requests, complaints and correspondence: Article 6(1)(b) and (f) GDPR. We retain the data until the matter is closed and then until the limitation period for claims expires, no longer than 3 years from the last contact.
• Service messages concerning the service (security, changes to documents, payments, technical interruptions): Article 6(1)(b) and (f) GDPR. We do not send Users commercial information without separate consent.
• Establishment, exercise or defence of legal claims: Article 6(1)(f) GDPR, until the limitation period expires.

Providing data is voluntary but necessary to create an account and use the service. Data of Users other than the person creating the account is provided by the Account Administrator.

4. Recipients of data

• Contabo GmbH (Germany): the Application server, database, file store and backups (Object Storage), data centres in the European Union; we encrypt files and backups before they are written; acts as a processor.
• OVH Sp. z o.o. (OVHcloud group): e-mail, Mivare's domains and websites, data centres in the European Union; acts as a processor.
• Mistral AI SAS (France, Paris): preparation of summaries, answers and document drafts by the Mivi assistant, only in Firm Accounts in which the Account Administrator has enabled it, and only for Users who have enabled it for their own account; acts as a processor; queries are processed and stored in the European Union and are not used to train models; Mistral AI retains them for no more than 30 days solely for the purpose of detecting abuse, after which it deletes them.
• Stripe Payments Europe, Limited (Ireland): handling of Subscription payments. Stripe receives the law firm's name, billing e-mail address, country, language and technical account identifier; the Account Administrator enters card details directly on the Stripe page, and Mivare neither receives nor stores them. With regard to payment data, fraud prevention and its own legal obligations, Stripe acts as a separate controller under its own privacy policy, and otherwise as a processor. Stripe does not receive Firm Data.
• European Commission (VIES system): checking the EU VAT number of a Customer from another European Union member state, to determine the tax treatment.
• Minister of Finance of the Republic of Poland (National e-Invoicing System, KSeF): invoices issued by Mivare for the service, to the extent required by the provisions on value added tax; acts as a separate controller.
• Professional advisers (legal, tax, accounting) bound by confidentiality: to the extent necessary for handling billing and legal matters.
• Public authorities: only where an obligation to disclose data arises from the law.

Mivare does not sell personal data and does not share it for marketing purposes.

5. External services

The Application does not load any resources in the User's browser from servers other than Mivare's, except for the Stripe payment page opened by the Account Administrator when making a payment. The Application's fonts, icons and libraries are loaded from Mivare's server.

The Application does not use analytics, advertising or tracking tools. Data is sent to the artificial intelligence service (Mistral AI) only where the Mivi assistant has been enabled by the Account Administrator for the law firm and by the User for their own account, and only data to which that User has access. Each User decides for themselves whether to use the assistant and may disable it at any time in their account settings; the scope of the data transferred is described in the Data Processing Agreement. In the Mivi+ module, the User's history of conversations with the assistant is stored in the Application for 90 days, and the User may delete it at any time. The Application does not read the device's location.

If the Account Administrator enters the law firm's token for the National e-Invoicing System (KSeF) in the Application, the Application sends to KSeF the invoices issued by the law firm in the Application (with the seller's and buyer's data, line items and amounts) on behalf of the law firm and under its authorisation. In this way the law firm performs its obligation under the provisions on value added tax and is the controller of that data; the Minister of Finance, who operates KSeF, processes it as a public authority on the basis of those provisions, and Mivare acts solely as a sending tool on the law firm's instructions, on the terms of the Data Processing Agreement. The token is stored only in encrypted form and is used solely for that sending; the same applies to the law firm's KSeF offline-mode certificate, with which the Application signs the verification code of an invoice issued in that mode.

6. Cookies and browser storage

The Application uses only cookies that are strictly necessary for its operation and do not require consent:

• the Application's session cookie (name beginning with “MIVARE”): maintaining the logged-in session; deleted when the browser is closed or on logout; inaccessible to scripts, sent only over an encrypted connection;
• mw_td: remembering a trusted device after two-factor authentication, at the User's request; valid for 30 days.

In browser storage (localStorage) the Application stores only the expanded or collapsed state of the side menu; it is not sent to the server.

Cookies can be deleted in the browser settings; blocking them prevents logging in to the Application.

7. Transfers of data outside the European Economic Area

Mivare processes the data described in this Policy on servers in the European Union. Stripe, as the payment operator, may transfer billing data to entities within its group, including Stripe, Inc. in the United States, on the basis of a European Commission adequacy decision (EU-U.S. Data Privacy Framework) and standard contractual clauses. Any other transfer of data outside the European Economic Area will take place only using a mechanism compliant with Chapter V GDPR, after this Policy has been updated in advance.

8. Rights of data subjects

You have the right to access your data, to rectification, erasure, restriction of processing, data portability and the right to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before its withdrawal.

Please send requests to hello@mivaregroup.com. We respond without undue delay and no later than one month from receipt of the request; in justified cases this period may be extended in accordance with the GDPR, of which we will inform you.

You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw) or with the supervisory authority in the European Union member state of your habitual residence, place of work or place of the alleged infringement.

9. Automated decisions

Mivare does not take decisions concerning Users based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect them. Automatic suspension of access after unsuccessful payment attempts results from the Payment Terms and concerns the Customer as an entrepreneur; the decision can be clarified with support at any time.

10. Security

Mivare applies technical and organisational measures appropriate to the risk, in particular encryption of connections, storage of passwords solely in the form of a cryptographic hash, two-factor authentication, logical separation of each law firm's data, event logging, encryption of files before they are written to the file store, and encrypted backups kept in the European Union separately from the Application server. Data deleted from the Application remains in backups for no more than 30 days and is then deleted as the backups rotate. A detailed description is contained in the Data Processing Agreement (CNS-LEG-003).

11. Changes to the Policy

This Policy is updated when the manner of processing data, the recipients or the law change. We inform Account Administrators of material changes by e-mail and in the Application. The current version is available at https://mivaregroup.com/en/legal/consilaris/privacy/

This Policy is made available in Polish and English; in the event of any discrepancy, the Polish version prevails. This Policy is effective from 29 October 2026.