Personal data processing information

1. Data controller

The controller is BackOffice Outsourcing Sp. z o.o., with its registered office at Aleja Stanów Zjednoczonych 72/12, 04-036 Warsaw, Poland. You may contact the controller by post or at cok@backofficeoutsourcing.de.

2. Data protection contact

For questions about personal data and the exercise of rights, contact Robert Kütz at cok@backofficeoutsourcing.de or write to the company address marked “Data protection”.

3. Data categories and sources

Depending on the relationship, we may process identification and professional data, company name, role, contact details, correspondence, information required to prepare an offer or perform a contract, and billing data. Data comes directly from the data subject, their employer or contractor, website forms, correspondence, or lawful public sources such as business registers and company websites.

4. Purposes and legal grounds

We process data only to the extent necessary for a defined purpose:

• preparing an offer, pre-contract contact and contract performance — Article 6(1)(b) GDPR;
• compliance with accounting, tax and other legal duties — Article 6(1)(c) GDPR;
• handling enquiries, establishing or defending claims, service security and direct marketing carried out in accordance with applicable law — Article 6(1)(f) GDPR;
• activities requiring voluntary consent, including selected marketing communications — Article 6(1)(a) GDPR. Consent may be withdrawn at any time.

5. Providing data

Providing data is voluntary but may be necessary to receive a response, obtain an offer, enter into or perform a contract. Data required by law is mandatory to the extent specified by law. Failure to provide necessary data may make the requested action or service impossible.

6. Retention

Enquiry and negotiation data is kept for the time needed to handle the matter and then for the period necessary to protect against claims. Contract data is kept while the contract is performed and afterwards until claim limitation periods expire. Accounting and tax records are kept for the period required by law. Consent-based data is kept until consent is withdrawn or the purpose ends earlier.

7. Recipients

Data may be shared only with entities supporting our services or legal duties, including IT and hosting providers, postal and courier operators, printers and subcontractors, accountants, banks, legal advisers, auditors and authorised public bodies. Processors receive only the data necessary for their tasks and act under appropriate agreements.

8. Transfers outside the EEA

Where a technology provider involves transfers outside the European Economic Area, we use the safeguards required by law, in particular an adequacy decision or standard contractual clauses.

9. Your rights

Subject to GDPR conditions, you have the right to:

• access your data and receive a copy;
• rectify your data;
• erase data or restrict processing;
• data portability;
• object to processing based on legitimate interests, including direct marketing;
• withdraw consent without affecting prior lawful processing;
• lodge a complaint with the Polish President of the Personal Data Protection Office.

Send requests to cok@backofficeoutsourcing.de or to the company’s postal address.

10. Automated decisions

We do not make decisions producing legal or similarly significant effects solely through automated processing, including profiling.

11. Security

We use appropriate organisational and technical safeguards against loss, unauthorised access, alteration or disclosure. We follow the principles of lawfulness, data minimisation, purpose limitation, accuracy, storage limitation, integrity and confidentiality.

12. Postal services and processing on behalf of clients

For postal services, the parties’ roles and responsibilities follow postal law, GDPR and the nature of the service. Where we process data solely on a client’s behalf for other services, the data processing agreement defines the purpose, scope and rules. Postal secrecy information is used only as necessary to perform the service or comply with law.

Legal framework

Regulation (EU) 2016/679 (GDPR), the Polish Personal Data Protection Act of 10 May 2018 and the Polish Postal Law Act of 23 November 2012.