JLSW advises on acquisition

Another exciting transaction completed

We had the pleasure of advising Karlik sp. z o.o. on the acquisition of the Renault and Dacia dealership business previously operated by Pieluszyńska sp. z o.o.

The transaction marks another step in the development of the Karlik Group and strengthens its position in the regional automotive market.

Our team provided comprehensive legal support throughout the process — from due diligence, through drafting and negotiating transaction documentation, to signing and closing. We also represented the client in proceedings before the President of the Polish Competition Authority (UOKiK) to obtain merger clearance.

The project was led by Tomasz Janaszczyk and Joanna Żemojtel (Partners), with support from Róża Dziewa (Legal advisor).

Congratulations to all parties involved and thank you for your trust 🤝

🔐 NIS2 becomes reality in Poland

🔐 NIS2 becomes reality in Poland

The President has signed the amendment to the National Cybersecurity System Act implementing the NIS2 Directive into Polish law. The new regulations significantly expand cybersecurity obligations for many organisations – as well as the responsibilities of management boards.

What does this mean in practice? Among other things, organisations may be required to:

• implement appropriate cybersecurity risk-management measures
• establish and maintain an information security management system
• organise incident handling and report serious incidents
• ensure adequate governance and oversight at the management level

The new regime also introduces significant administrative fines – up to EUR 10 million or 2% of global turnover, and in specific cases even up to PLN 100 million. The regulations also provide for the possibility of personal liability of management board members.

📅 Key dates:
2 April 2026 – the Act enters into force
2 May 2026 – publication of the list of key and important entities
2 April 2027 – deadline to implement the statutory obligations
2 April 2028 – first audit for key entities

Will your organisation fall within the scope of the new regulations?
What legal obligations will this create for your company and its management?

Contact us – We would be happy to help identify whether the new regulations apply to your organisation and clarify the legal obligations resulting from the new cybersecurity framework.

The Standard That Defines Our Practice

It’s not only about what we do.
It’s also about the standard we work to.
Based on client feedback, Legal 500 has recognised JLSW for Billing & Efficiency and NPS® – a measure of trust and willingness to recommend.
Behind this recognition is a philosophy we believe in: clarity, accountability and solutions grounded in real business needs.
We focus on long-term relationships and solutions that genuinely support our clients’ projects.
This standard is our starting point, not an exception.

.

reCAPTCHA or Risk? Free Protection, Real Accountability.

Google reCAPTCHA is one of the most commonly used tools for protecting online forms against spam and bots. It’s quick to deploy, technically efficient — and very often implemented by default, without much legal reflection.

For a long time, however, the free version of reCAPTCHA raised serious GDPR concerns: no data processing agreement, an unclear scope of data collection, and extensive behavioural analysis taking place in the background.

As of 2 April, the legal model is changing.

Does that mean the compliance issue disappears?
Not quite.


1. The previous model: a service paid for with data

Under the free model, website owners did not pay with money.
They paid with user data.

reCAPTCHA processes, among other things:

  • IP addresses,

  • browser and device identifiers,

  • behavioural interaction data,

  • cookies and related tracking information.

Until recently, the free version was not covered by the Google Cloud Data Processing Addendum (DPA). Google acted as an independent controller rather than a processor within the meaning of Article 28 GDPR.

In practice, this meant:

  • no formal data processing agreement,

  • data potentially processed for Google’s own purposes,

  • limited ability for the website owner to meaningfully control the scope of processing.

It was, in effect, a “free” service operating within a data-driven model.


2. From 2 April: Google as a processor

Google has announced that, from 2 April, the free version of reCAPTCHA will be covered by the Cloud Data Processing Addendum.

This is a significant development.

Under the updated framework, Google is expected to act as a processor on behalf of its customers. At a general level, the DPA contains the elements required under Article 28 GDPR.

From a formal perspective, this is clearly a step in the right direction:

  • the controller–processor relationship is contractually structured,

  • a data processing agreement is in place,

  • the legal framework becomes more predictable.

For European customers, the contracting entity will be Google Cloud EMEA Limited (Ireland), meaning the processor is an EU-based Google entity.

But a DPA alone does not automatically guarantee full compliance.


3. Transparency and data minimisation: still critical questions

The DPA defines the scope of data very broadly as:

“Data relating to individuals provided to Google via the Services, by (or at the direction of) Customer or by its End Users.”

It does not specify concrete categories of personal data.

Based on publicly available information, the processing appears to involve primarily technical and behavioural signals used to distinguish humans from bots, largely processed on a temporary basis.

However:

  • the categories of data are not exhaustively described,

  • the retention period may extend up to 180 days,

  • and each controller must verify how reCAPTCHA is actually implemented in their specific setup.

The core issue is not necessarily that the data is excessive.
The issue is whether the controller can demonstrate that it is proportionate and limited to what is strictly necessary.

Under the GDPR, accountability requires more than trust. It requires evidence.


4. Legal basis: legitimate interest or consent?

Preventing spam and abuse can, in principle, qualify as a legitimate interest under Article 6(1)(f) GDPR.

Following the introduction of the DPA, relying on legitimate interest may be more defensible than before. That said, controllers still need to:

  • carry out and document a proper balancing test,

  • assess proportionality,

  • verify the actual scope of data processed in practice.

There is also the ePrivacy dimension.

If reCAPTCHA relies on non-essential cookies or similar technologies, prior consent may be required under applicable ePrivacy and national cookie rules — unless the tool can genuinely be considered strictly necessary for a service explicitly requested by the user.

And here the tension becomes practical.

A user wants to submit a form.
They do not explicitly request that their behavioural data be analysed by a third party.

If consent is treated as the safest legal basis and reCAPTCHA is only loaded after opt-in:

  • no consent means no protection,

  • the form remains vulnerable,

  • and a bot is unlikely to click “Accept”.

This illustrates that the choice of legal basis is not merely a theoretical compliance debate. It directly affects how your website operates.


5. New DPA. Familiar compliance questions.

As of 2 April, the formal legal position of the free version is clearly stronger than before.

From a contractual standpoint, this is an important improvement. The controller–processor relationship is now structured, and the framework aligns more closely with Article 28 GDPR standards.

But compliance is not achieved by contract alone.

Controllers must still:

  • determine the actual scope of personal data processed in their specific implementation,

  • properly define and document the chosen legal basis,

  • ensure consistency between privacy notices and real data flows,

  • update records of processing activities,

  • assess any international data transfers and applicable safeguards.

Google is undoubtedly moving closer to European data protection expectations.

However, the responsibility for demonstrating GDPR compliance remains with the controller.


What about your website?

Your privacy policy is not just a formality.

It is visible not only to users — but also to competitors, dissatisfied customers, business partners, and, if necessary, supervisory authorities.

A privacy notice should reflect what truly happens behind the scenes.

Are you confident that:

  • all tools used on your website are properly disclosed?

  • the roles of third parties are accurately defined?

  • your legal basis has been genuinely assessed rather than assumed?

  • your documentation would withstand regulatory scrutiny?

We help our clients ensure that what they declare publicly accurately reflects the data processing taking place internally.

If you would like to understand whether your reCAPTCHA setup is simply a security feature — or a potential compliance exposure — let’s talk.

Building Trust and Relationships Beyond Borders

Trust doesn’t happen overnight.
It is built through conversations, shared perspectives, and years of working together.

Madrid marks the next chapter.
At the LNA Europe Winter Meeting, together with colleagues from across Europe and beyond, we continue strengthening what defines @Legal Netlink Alliance — trust-based relationships that make cross-border cooperation seamless when clients truly need it.

We are grateful to be part of a community where knowledge flows freely and collaboration comes naturally.
Thank you @Fourlaw Abogados for hosting — see you in Madrid.

.

JLSW at the upcoming LNA Europe Winter Meeting 2026 in Madrid – relationships, knowledge, and cross-border collaboration.

Our team is excited to be heading to the LNA Europe Winter Meeting 2026 in Madrid.

As long-standing members of Legal Netlink Alliance, we truly value these in-person gatherings that bring together trusted colleagues from across Europe and beyond. Over the years, LNA has been much more than a professional network for us – it’s a community built on shared values, collaboration, and lasting relationships.

From exchanging know-how and perspectives to strengthening cross-border cooperation and friendships, these meetings always remind us why being part of LNA matters.

We’re looking forward to insightful discussions, reconnecting with familiar faces, meeting new members, and continuing to build meaningful international cooperation – this time in Madrid, hosted by Fourlaw Abogados.

.

.

JLSW as a knowledge partner to the POLAGRA 2025 trade fair.

Once again, JLSW returned as POLAGRA’s knowledge partner.

We discussed how to run HoReCa promotions legally and safely: contest vs. lottery, what a solid set of rules must include, GDPR/DPAs, platform policies (Instagram/Facebook/YouTube), IP rights to submissions – and even VAT and receipts when awarding prizes.

Thank you! It was a great round of conversations and questions — see you next year!

Renewable energy and green hydrogen — the law powering the transition

We couldn’t miss it! JLSW Managing Partner Tomasz Janaszczyk is attending European Hydrogen Week 2025 – a gathering of leaders and practitioners focused on real-world deployments, regulation, and financing of hydrogen and renewable energy projects.

At JLSW we support investors, companies, and institutions with:

  • legal and regulatory advisory,
  • structuring and financing of investments,
  • safeguarding contractual interests,
  • developing innovative solutions for the green transition.

Events like this are more than networking — they’re how we help shape the legal framework for a safe, competitive, and clean economy.

Want to talk? Get in touch.

#GreenHydrogen #RenewableEnergy #EnergyLaw #HydrogenEconomy #EnergyTransition

 

New powers of the National Labour Inspectorate to determine the existence of an employment relationship

Change of civil law contract to employment contract

The draft bill of 1 September 2025 primarily provides for granting the National Labour Inspectorate (PIP) a new power – the ability to determine the existence of an employment relationship in a situation where the parties have concluded a civil law contract, even though, pursuant to Article 22 § 1 of the Labour Code, an employment contract should have been concluded.

The decision of the Labour Inspectorate confirming the existence of an employment relationship will specify:

1. the type of employment contract concluded between the parties;

2. the date of conclusion of the employment contract and the date of commencement of work;

3. the type of work;

4. the place of work;

5. the working time and

6. the amount of remuneration for work –

i.e. all the essential elements of an employment contract within the meaning of Article 29 of the Labour Code.

The draft also provides that if the labour inspector is unable to determine the remuneration on the basis of the evidence gathered, the decision will indicate an amount corresponding to the minimum wage.

Immediate enforceability of the decision

According to the draft, the decision establishing the employment relationship would be immediately enforceable in terms of the effects that labour law provisions attach to the establishment of an employment relationship and the obligations in respect of taxes and social security arising from the date of its issuance. Even if an appeal is lodged against the decision, the appeal will not suspend the enforcement of the decision in this respect.

At the same time, an exception to the above immediate enforceability is provided for. The enforcement of the decision will be suspended with regard to:

· tax obligations arising before the date of its issuance,

· social security obligations arising before the date of its issuance.

The suspension will remain in force until the deadline for lodging an appeal, and if an appeal is lodged, until a final court ruling is issued.

New procedure for determining the employment relationship

Under the new regulations, the decision of the district labour inspector on the existence of an employment contract would be subject to appeal to the Chief Labour Inspector (GIP), who will be able to uphold the contested decision, overturn it in whole or in part and decide on the merits of the case, or overturn the decision and refer the case back to the competent district inspector for reconsideration. The decision of the Chief Labour Inspector may be appealed to the court in accordance with the rules set out in the Code of Civil Procedure.

The draft also provides for an amendment to the Code of Civil Procedure by distinguishing between two types of proceedings:

· proceedings to determine the existence of an employment relationship – conducted as before before a court,

· proceedings in cases of appeals against decisions of the Chief Labour Inspector – as a new, separate type of proceedings.

The Ministry emphasises that cases concerning appeals against decisions of the Chief Labour Inspectorate are of a public law nature and result from the statutory tasks of the state in the field of employee rights protection. Therefore, importantly, the draft amendments exclude the possibility of concluding a court or out-of-court settlement and resolving the dispute through arbitration.

Impact of the changes on employers

The proposed changes pose significant risks for employers. In the event of a dispute

over the existence of an employment relationship, the case will have to be heard before a labour court, without the possibility of reaching a settlement or submitting the case to arbitration. In practice, this means a limitation of the parties’ freedom of choice, as even if the employee has chosen a civil law contract, the inspector will be able to consider it an employment relationship. Employers must also expect greater procedural burdens, as the inspectorate may issue separate decisions against many people, which may translate into an increase in the number of court cases. However, the most serious risk concerns the financial consequences. The inspector will specify the date of commencement of the employment relationship in their decision, which may lead to the accumulation of tax and contribution liabilities, together with interest, which the employer will have to settle even after several years of litigation.

Tax risks of the new powers of inspectors

The draft does not regulate many specific issues in the case of the transformation of a civil law contract into an employment relationship. A particular potential risk is the possibility of recognising the amount paid to a collaborator as net remuneration. This means that the employer should pay income tax and social security contributions on it. The tax authority may then demand additional payments for the previous five years, until the expiry of the limitation period. It does not matter if the employee has paid tax and social security contributions on account of their business activity. However, the employer will have a civil law claim for reimbursement. In such a situation, the employee should apply to the tax office for a refund of the overpayment, as they have unduly paid tax on their business activity. Otherwise, their remuneration would in fact be double taxed.

Potential inaccuracies also concern VAT settlement. After all, the prospective employer deducted VAT from the invoices received and recognised the net remuneration amounts as tax-deductible costs. In such a case, however, the recognition and settlement of such an ‘unreliable’ invoice will be incorrect, and the employer may be accused of tax fraud. In addition, risks also arise on the part of the collaborator who, as a result of the decision, has become an employee – the current wording of the draft law leads to the conclusion that invoices issued by an entrepreneur within the framework of B2B cooperation may be considered ‘empty’, which in turn gives rise to liability, including criminal tax liability.

Justification for the changes and summary

The authors of the draft argue that the current tools available to labour inspectors do not provide effective protection against the abuse of civil law contracts as a basis for the provision of work. In the ministry’s opinion, they are primarily non-authoritative in nature, require lengthy action and carry the risk of being rejected by the court in the event of an employee’s lack of cooperation in bringing an action to establish an employment relationship. Other available measures, such as proceedings in misdemeanour cases, have a limited scope of impact.

As discussed above, the proposed solutions are intended to counteract abuses in the labour market, while at the same time having serious consequences for employers – from limiting the parties’ freedom of choice, through an increase in the number of proceedings and costs, to tax and contribution risks dating back several years. The lack of detailed regulations on financial settlements further increases uncertainty about the practical application of the new provisions.

The draft is currently at the consultation stage, and according to the ministry’s declaration, the planned date for its adoption by the Council of Ministers is the fourth quarter of 2025. We invite you to follow our news – we will keep you informed about the legislative process.

Authors: attorney Martyna Kulikowska, Hubert Roszyk