The domain's page has three settings about ownership:
- Registrar Lock - while on, the domain cannot be transferred to another registrar. Keep it on; turn it off only when you are deliberately transferring.
- EPP / AuthInfo code - the password a transfer needs. Get EPP Code shows it when you want to move the domain elsewhere. Treat it like a password: whoever has it can start a transfer.
- ID Protection - hides your details in the public WHOIS directory. The .pl registry does not publish private individuals' data anyway, so this mainly matters for global domains (.com, .net and similar).
Not every ending supports each option. If the registry does not allow something, the domain's page says so.
If you are leaving: turn off the lock first, then get the code, and give it only to the registrar you are moving to.