Security Policy
Information security, service quality and business continuity are part of the processes delivered by BackOffice Outsourcing Sp. z o.o. We apply organisational and technical measures appropriate to the information, service scope and identified risks.
Last updated: 16 October 2026
Standards we apply
We apply the following standards in our processes and procedures:
- ISO 9001:2026 - Service quality and process improvement
- ISO/IEC 27001:2022 - Information security management
- ISO/IEC 27002:2022 - Information security controls
- ISO 22301:2019 - Business continuity
- ISO/IEC 27701:2025 - Privacy information management
- ISO 37500:2014 - Outsourcing management
- ISO 15489-1:2016 - Records management
1. Scope
This policy covers correspondence handling, printing and enveloping, electronic and paper records, other outsourcing processes, and the use of the website, forms and portals. We protect client, business partner and employee information within the scope of the relevant service.
2. Responsibilities and access
We assign responsibilities for information and grant access to authorised people according to their duties. We apply least privilege, individual accounts and role separation. Access rights are reviewed and changed or withdrawn when access is no longer needed.
3. Personal data protection
We process data for specified purposes and only to the extent needed, following GDPR principles. We distinguish our responsibilities as a controller from those of a processor acting on a client’s behalf. Processing scope, responsibilities and safeguards are established according to the service and applicable agreement. Details of purposes, legal bases, recipients, retention and individual rights are provided on the GDPR page.
4. Systems and communications
We apply access controls, login safeguards and system monitoring. HTTPS protects communications with the website and portals. Technical safeguards, updates, event logging and access scope are adapted to each system’s needs and risks.
5. Records and correspondence confidentiality
Access to paper and electronic records is restricted to people involved in the relevant process. We register correspondence handling in the COK system and control record circulation, transfer and storage. Information subject to postal confidentiality is used only as needed to deliver the service or fulfil a legal obligation.
6. Backups and business continuity
We create backups of systems and data covered by our procedures, restrict access to them and check recovery capability. Contingency and recovery measures are proportionate to the importance of each process. They aim to limit disruption and restore access to information and services.
7. Incidents and reports
Reports of data loss, unauthorised access or other threats are assessed, documented and referred to the responsible people. We take measures to limit the impact and prevent recurrence. Where legally required, we notify the appropriate authority and affected individuals.
8. Providers and client cooperation
We define the scope and responsibilities of providers and people involved in each process. Information sharing is limited to what is necessary. Data processing, confidentiality, retention and the end of cooperation are governed by the applicable agreements and procedures.
9. Training, risk and improvement
We train employees in information security and personal data protection. We assess risks, incidents, complaints and non-conformities and use the findings to update procedures and improve service quality and security.
Related information
Report threats or send questions about information security to Show email.
Online payments, refunds and personal data
Updated: 16 October 2026.
Card and BLIK payments take place on Stripe Checkout over an encrypted connection. BackOffice does not store full card numbers, CVC or BLIK codes in the portal. Before crediting a payment, the server verifies its confirmation, amount, currency and link to the order.
