Personal data processing information
This document explains in one place who processes personal data, for what purposes and legal grounds, how long it is retained and what rights data subjects have.
Last updated: 16 October 2026.
1. Data controller
The controller is BackOffice Outsourcing Sp. z o.o., with its registered office at Aleja Stanów Zjednoczonych 72/12, 04-036 Warsaw, Poland. You may contact the controller by post or at cok@backofficeoutsourcing.de.
2. Data protection contact
For questions about personal data and the exercise of rights, contact Robert Kütz at cok@backofficeoutsourcing.de or write to the company address marked “Data protection”.
3. Data categories and sources
Depending on the relationship, we may process identification and professional data, company name, role, contact details, correspondence, information required to prepare an offer or perform a contract, and billing data. Data comes directly from the data subject, their employer or contractor, website forms, correspondence, or lawful public sources such as business registers and company websites.
4. Purposes and legal grounds
We process data only to the extent necessary for a defined purpose:
- preparing an offer, pre-contract contact and contract performance - Article 6(1)(b) GDPR;
- compliance with accounting, tax and other legal duties - Article 6(1)(c) GDPR;
- handling enquiries, establishing or defending claims, service security and direct marketing carried out in accordance with applicable law - Article 6(1)(f) GDPR;
- activities requiring voluntary consent, including selected marketing communications - Article 6(1)(a) GDPR. Consent may be withdrawn at any time.
5. Providing data
Providing data is voluntary but may be necessary to receive a response, obtain an offer, enter into or perform a contract. Data required by law is mandatory to the extent specified by law. Failure to provide necessary data may make the requested action or service impossible.
6. Retention
Enquiry and negotiation data is kept for the time needed to handle the matter and then for the period necessary to protect against claims. Contract data is kept while the contract is performed and afterwards until claim limitation periods expire. Accounting and tax records are kept for the period required by law. Consent-based data is kept until consent is withdrawn or the purpose ends earlier.
7. Recipients
Data may be shared only with entities supporting our services or legal duties, including IT and hosting providers, postal and courier operators, printers and subcontractors, accountants, banks, legal advisers, auditors and authorised public bodies. Processors receive only the data necessary for their tasks and act under appropriate agreements.
8. Transfers outside the EEA
Where a technology provider involves transfers outside the European Economic Area, we use the safeguards required by law, in particular an adequacy decision or standard contractual clauses.
9. Your rights
Subject to GDPR conditions, you have the right to:
- access your data and receive a copy;
- rectify your data;
- erase data or restrict processing;
- data portability;
- object to processing based on legitimate interests, including direct marketing;
- withdraw consent without affecting prior lawful processing;
- lodge a complaint with the Polish President of the Personal Data Protection Office.
Send requests to cok@backofficeoutsourcing.de or to the company’s postal address.
10. Automated decisions
We do not make decisions producing legal or similarly significant effects solely through automated processing, including profiling.
11. Security
We use appropriate organisational and technical safeguards against loss, unauthorised access, alteration or disclosure. We follow the principles of lawfulness, data minimisation, purpose limitation, accuracy, storage limitation, integrity and confidentiality.
12. Postal services and processing on behalf of clients
For postal services, the parties’ roles and responsibilities follow postal law, GDPR and the nature of the service. Where we process data solely on a client’s behalf for other services, the data processing agreement defines the purpose, scope and rules. Postal secrecy information is used only as necessary to perform the service or comply with law.
Legal framework
Regulation (EU) 2016/679 (GDPR), the Polish Personal Data Protection Act of 10 May 2018 and the Polish Postal Law Act of 23 November 2012.
Online payments, refunds and personal data
Updated: 16 October 2026.
The collection portal uses Stripe for payments. We send the email address, order ID and reference, amount, currency and transaction-linking data. Card and BLIK details are entered on Stripe's page. BackOffice stores transaction identifiers and settlement statuses, without full card numbers, CVC or BLIK codes.
The legal bases are contract performance (Article 6(1)(b) GDPR), legal obligations (c) and legitimate interests in settlement, security and claims (f); for company representatives, managing the business relationship (f). Data is retained for statutory periods and as necessary for claims. Stripe, including Stripe Payments Europe, Limited, Stripe Technology Europe, Limited and Stripe Technology Company, Limited (Ireland), may act as a processor or separate controller depending on the purpose. Processing outside the EEA may occur under appropriate transfer safeguards. See Stripe's policy and Privacy Center.
