Contact
Spadochron nad chmurami - hero RODO

PRACTICE AREAS

Stable orbit for your data EU Data protection

GDPR isn’t a one-time checkbox – it’s an ongoing operating standard for how you collect, move, and protect EU personal data. We give US SaaS, AI, and e-commerce companies a practical, maintainable GDPR program: scoped to what you actually do, built for your team to run, and proportionate to your real risk.

Get in touch

COMMON ISSUES

GDPR compliance breaks when it lives only in documents

The US companies that run into GDPR problems aren’t the ones that ignored it. They’re the ones that signed a template DPA, posted a privacy policy, and assumed the rest followed. It doesn’t.

Your GDPR setup is paper-deep You have a privacy policy. You have a DPA template. Neither reflects how your product actually works, who sees what data, or what happens when something goes wrong.
We audit your actual data flows against your documentation and close the gap - contracts, policies, subprocessor mapping, transfer mechanisms, so what's on paper matches what runs.
You don't know which GDPR rules apply to your product GDPR distinguishes between controllers and processors, special categories, automated decisions, legitimate interest and consent and the wrong classification changes your obligations significantly.
We map your product's data model against GDPR's framework - roles, legal bases, high-risk processing and tell you exactly what's required, what's recommended, and what's not your problem.
Your GDPR program doesn't scale with your product A privacy policy from your seed round doesn't cover your enterprise tier. A DPA from 2021 doesn't cover your AI features. Every product update and new market creates new GDPR surface you're not tracking.
We design your GDPR program as a living system — with update triggers, an annual review cadence, and clear ownership — so it grows with your product instead of lagging behind it.

Senior Associate

  • Precise
  • Tech-savvy
  • Matter-of-fact

Łukasz Wyrzykowski

Since 2017, I've focused on data protection and privacy, helping companies design processes that hold up under GDPR, sector-specific rules, and real business needs. I work mostly with IT, gaming, e-commerce, finance, industrial, and healthcare organizations. I help sort out legal roles, data flows, processing agreements, DPIAs, data transfers, and internal documentation. What interests me most are technology projects where data protection has to work not just on paper, but in the product, the system, and the daily process. My focus is on solutions that are practical: workable, easy for teams to understand, and proportionate to the actual risk. Off the clock, you'll usually find me at Muay Thai training, listening to metal, or watching MMA.

Senior Associate

Schedule an introductory call Poznaj mnie

WHO THIS IS FOR

built for companies that process EU data at scale

We work best with founders, GCs, and operators who are past the “is GDPR real?” stage and into the “what do we actually have to do?” stage. The work pays off fastest when EU customers, enterprise procurement, or product growth are on the line.

You're a SaaS scaling into EU enterprise

Enterprise procurement asks for GDPR documentation you don't have. You need it built fast and correctly.

  • CEO
  • GC
  • Head of Sales

You're an AI company processing EU personal data

Your AI features involve personal data in ways GDPR regulates specifically. You need clarity before launch.

  • CTO
  • CPO
  • GC

You're a US e-commerce company selling to EU consumers

You need consent, cookies, DSARs, and marketing data flows set up the way EU regulators expect.

  • CEO
  • CMO
  • Head of E-Commerce

OUTCOMES

what you can expect

A functioning GDPR program isn’t just about avoiding fines. It’s what makes EU enterprise sales move faster, diligence cleaner, and your product team’s launches smoother. Here’s what that looks like in practice.

Enterprise deals close faster

Your DPA and privacy documentation pass procurement review on the first round — no three-week delay while your privacy posture gets interrogated.

Product teams launch without the GDPR fire drill

Every new feature and EU market entry gets reviewed against a baseline GDPR setup that already exists - no scramble, no retrofit.

Lower regulatory exposure

Your actual data processing matches your documentation. Regulator questions get answered from a file, not improvised under pressure.

Incidents stay manageable

When something goes wrong, you have a response playbook, not a legal crisis. 72-hour notifications get filed; no breach becomes a reputational event it didn't need to be.

Diligence-ready at any round

Your GDPR program stands up under VC and M&A privacy due diligence: documentation, data flows, and processing agreements in order.

Chcesz się dowiedzieć więcej o naszym podejściu?

Poznaj nas

HOW WE WORK TOGETHER

from audit to program

How we run a GDPR engagement​.

Assess

We map your data flows, roles, and legal bases and show you exactly what's missing.

  • GDPR Audit
  • Privacy by Design
  • AI Products

Build

We draft the documentation, agreements, and processes your GDPR program requires.

  • GDPR Audit
  • Vendor Privacy
  • E-Commerce
  • AI Products

Respond

We handle the live situations - breaches, DSAR requests, regulator questions, procurement reviews.

  • Breach Response
  • Vendor Privacy

Maintain

We keep your program current as your product, team, and EU footprint evolve.

  • Ongoing Program
  • Privacy by Design
  • AI Policy
Get in touch

BLOG

knowledge base

Practical reads on Polish and EU law, written for the people actually running the business – not studying it.

Read all articles

YOU OFTEN ASK

FAQ

Most questions come down to two things – what applies, and who’s personally liable. Here are the answers we give most often.

Yes, it can. GDPR applies to any company offering goods or services to EU residents, or monitoring their behavior, regardless of where the company is based. A US SaaS with EU users, a US e-commerce site shipping to EU addresses, or a US analytics platform tracking EU visitors are all typically in scope.

A controller decides why and how personal data is processed. A processor handles data on a controller’s behalf. Most US SaaS companies are controllers for their own user data and processors for what their customers put into the product. The distinction matters because obligations differ — and a wrong classification creates gaps in your contracts and compliance posture.

If you’re based outside the EU and process EU personal data regularly (not just occasionally), Article 27 likely requires you to appoint an EU representative. It’s a common gap for US companies. We assess whether you need one and, if so, appoint one and document it properly.

At minimum: a valid data processing agreement (DPA) with each enterprise customer, a lawful basis for processing, a documented record of processing activities, a mechanism for EU data transfers (DPF or SCCs), and the ability to handle data subject requests. In practice, enterprise procurement will also check your privacy notice, subprocessor list, and security measures.

A complaint filed with an EU supervisory authority usually triggers a written inquiry first, not a raid. The authority will ask for documentation, your processing records, and an explanation of your data practices. If that documentation matches reality and reflects a genuine compliance effort, outcomes are typically manageable. If it doesn’t, remediation gets expensive fast.