GDPR
Acting in accordance with Art. 13 section 1 and section 2 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, referred to as GDPR), we would like to inform you that Backoffice Outsourcing Sp. z o. o. and companies belonging to the Group presents the Privacy Policy, in particular regarding your rights regarding the protection of personal data.
This Privacy Policy contains information regarding the processing of personal data of our current customers, as well as potential customers.
The following points will be discussed:
- who is the personal data controller,
- how and what data is obtained from Users,
- what is the purpose of obtaining and processing personal data, legal basis for processing personal data,
- what are the principles and scope of personal data processing, in particular their disclosure to other entities,
- what are the rights of Users in connection with the processing of personal data,
- what are the procedures related to the protection and security of personal data.
Legal basis:
This Privacy Policy applies to the following legal provisions regarding the protection of personal data of natural persons:
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as GDPR), in force from May 25, 2018.
- new provisions of Polish legislation.
Details of the Personal Data Administrator
Pursuant to Art. 13 section 1 and section 2 of the general regulation on the protection of personal data of April 27, 2016, we would like to inform you that the administrator is:
Backoffice Outsourcing Sp. z o. o. and companies belonging to the Group with their registered office in Warsaw, at Al. United States 72/12, 04-036 Warszawa (detailed data of the Group's companies can be found in the "Registration data" tab at the link https://backofficeoutsourcing.eu/dane-zdrowie/.
The administrator can be contacted by traditional mail or electronically at the following e-mail address: cok@backofficeoutsourcing.de(details indicated below).
Details of the Personal Data Inspector
The Inspector of your Personal Data is:
Robert Kütz, Al. United States 72/12, 04-036 Warszawa.
The inspector can be contacted by traditional mail or electronically at the following e-mail address: cok@backofficeoutsourcing.de.
Purposes of personal data processing and legal basis for processing
Backoffice Outsourcing Sp. z o. o. and companies within the Group collect personal data only for specified, explicit and lawful purposes. The personal data in question may include your identification data: name, surname, company name, contact details, i.e. e-mail address, telephone number, and in cases required by law - PESEL number and identity document number.
Your personal data may come from many sources, including based on your consent or from publicly available sources.
Personal data is also obtained by providing it during our e-mailing campaigns, as well as manually in connection with providing data during ongoing cooperation.
In the first stage of the procedure, the Administrator processes personal data, which is an e-mail address obtained from publicly available sources (including the National Court Register, CEIDG, Internet resources), and after receiving the notification, it processes personal data solely for the purpose of presenting you with a commercial offer related to the outsourcing of correspondence and other back office activities, after prior quantitative analysis carried out on the basis of a voluntarily completed survey. Then, personal data obtained during contact with the Customer are processed solely for the purpose of implementing the concluded cooperation agreement and, above all, conducting commercial correspondence.
The purpose of data processing is primarily to send you a request for quotation, and then a specific commercial offer regarding the outsourcing of correspondence and other back office activities and, if accepted, execution of the contract.
Personal data are processed on the basis of the consent expressed by the User and in cases where the law authorizes the Administrator to process personal data based on a specific legal provision or in order to implement the contract concluded between the parties.
Legal basis for the processing of personal data:
- 6 para. 1 letter b GDPR**, which states that the processing of personal data is permitted to the extent that it is necessary to perform the contract or it is necessary to take action at the request of the data subject before concluding the contract;
- 6 para. 1 letter c GDPR*, which states that processing is necessary to fulfill the legal obligation imposed on the administrator. (e.g. to issue and store invoices);
- 6 sec. 1 letter f GDPR**, which states that data processing is necessary for the purposes of the legitimate interests pursued by the administrator. The legitimate interest of Backoffice Outsourcing Sp. z o. o. and companies belonging to the Group is to process personal data, such as e-mail addresses, for direct marketing and information purposes, by sending an inquiry with a request for contact, and then presenting a commercial offer regarding outsourcing of correspondence and other back office activities;
- Art. 6(1) 1 letter a of the GDPR, which states that the data subject has consented to the processing of his or her personal data for one or more specific purposes.
Information on the requirement or voluntary nature of providing data and the consequences of failure to provide it
In terms of the processing of personal data for the purposes referred to in the previous paragraph (Article 6(1)(c) of the GDPR), the obligation to provide data is a statutory requirement. In turn, in the case of data processing for the purposes referred to in point 2** (Art. 6(1)(b) of the GDPR) and 3** (Art. 6(1)(f) of the GDPR), the obligation to provide data is a contractual requirement - providing personal data for all the purposes referred to above is voluntary, but is necessary to conclude and perform the contract with the Administrator.
Consequences of not providing personal data
- refusal to conclude a contract or present an offer;
- the possibility of seeking compensation or our refusal to provide services;
- loss of entitlement to insurance coverage;
- negative consequences before state authorities in the form of administrative penalties, etc.
Personal data storage period
Backoffice Outsourcing Sp. z o. o. and companies belonging to the Group stores personal data:
- for the purpose of concluding a contract, we store it for the period of negotiating the contract and until the end of the calendar year following the year in which you last contacted us regarding its conclusion;
- in connection with the conclusion of the contract, we process until the end of the period of processing potential claims under the contract, and in each case for the period required by law until the end of the period of processing potential claims under the contract, for example: Pursuant to Art. 74 of the Accounting Act indicate that accounting books and accounting documents should be kept for a period of at least five years from the beginning of the next financial year;
- in order to fulfill the Administrator's legal obligations - until the obligations arising from the law expire;
- settlement documents Books and documents related to their maintenance until the expiry of the tax liability limitation period, unless tax laws provide otherwise.
Users' rights in connection with the processing of personal data
In connection with the processing of your personal data, you have the following rights:
- request from the Administrator access to your personal data - i.e. obtaining information about the purpose and method of processing personal data;
- request that the Administrator rectify your personal data - i.e. correct personal data when they are incorrect or have changed;
- request that the Administrator restrict the processing of your personal data;
- request the Administrator to delete your personal data ("right to be forgotten") - i.e. to delete data that is processed without a legitimate legal basis;
- the right to object to the processing of your personal data;
- the right to transfer data - i.e. obtain your personal data that you have provided to us or indicate another administrator to whom we should transfer the data;
- the right to submit a complaint to the supervisory authority - the Inspector General for Data Protection, and after changes in legislation, to the President of the Office for Personal Data Protection;
- in the event of giving voluntary consent to the processing of personal data pursuant to Art. 6 section 1 letter a GDPR, you have the right to withdraw your consent at any time by sending an e-mail to the Administrator's address, which does not affect the lawfulness of processing based on consent before its withdrawal.
You can exercise the above rights by contacting the Administrator at the e-mail address: cok@backofficeoutsourcing.de, or written contact via traditional mail.
Moreover, if the processing we perform violates the provisions of the GDPR in a justified way, you have the right to lodge a complaint with the supervisory authority, i.e. the President of the Personal Data Protection Office - PUODO.
Information about automated decision-making, including profiling
As part of the processing of Users' personal data, your personal data is not subject to automated decision-making and is not subject to profiling referred to in Art. 22 section 1 and 4 GDPR. However, we reserve the right to process data in an automated manner, including in the form of profiling, about which we will inform our users.
Sharing personal data with other entities
Your personal data will generally not be made available to third parties. Only with your consent, personal data may be made available to entities indicated in the consents, depending on the content of the consent to processing and sharing. In addition, we will transfer them to third parties only if there is a legal basis for this, e.g.:
- subcontractors, i.e. entities we use to process them;
- law firms, which include, among others, law firms of legal advisers, attorneys, statutory auditors, notaries, accounting offices;
- state administration bodies and entities exercising public authority as part of the obligations imposed by law;
- to purchasers of receivables;
- Economic Information Offices, including: Economic Information Office InfoMonitor S.A. and the National Debt Register Economic Information Office S.A.;
- entities conducting postal, courier or printing activities;
- auditors;
- to regulatory authorities;
- entities supporting us in our activities on our behalf, in particular suppliers of external systems supporting our activities, e.g. IT support;
- hosting;
- to banks;
- if it is necessary to conduct settlements, to state authorities or other entities authorized under the law, in order to fulfill our obligations (Tax Office, KAS, PIP, ZUS, PFRON, GUS).
Principles of personal data processing and procedures related to the protection and security of personal data
As part of the processing of your personal data, Backoffice Outsourcing Sp. z o. o. and companies belonging to the Group, taking into account the provisions of Art. 5 GDPR, attaches importance to ensuring that these data are processed in a safe, reliable, lawful and transparent manner for the User ("lawfulness, reliability and transparency").
We follow the principle of data minimization, i.e. we collect personal data only to the minimum extent necessary to achieve the purposes for which they are collected (“data minimization”).
The purposes of collecting your personal data are clearly defined and based on legal provisions. We do not process data in a manner that is incompatible with these purposes ("purpose limitation").
We also ensure that personal data is up-to-date and correct and respond promptly to requests for correction or update of data ("accuracy").
All information constituting personal data is treated confidentially and is protected against accidental disclosure to third parties ("integrity and confidentiality").
To ensure the security of your processed data, we make every effort to provide all means to protect personal data.
To ensure the security of the data entrusted to us, we have developed internal procedures and recommendations to prevent data from being made available to unauthorized persons. We control their implementation and constantly check their compliance with relevant legal acts.
Postal operator
Backoffice Outsourcing Sp. z o. o. is a postal operator within the meaning of Art. 3 point 12 of the Act of November 23, 2012, Postal Law, i.e. an entrepreneur authorized to conduct postal activities on the basis of entry in the register of postal operators. In accordance with the provisions of Art. 42 above of the Act, information or data covered by postal secrecy may be collected, recorded, stored, processed, changed, deleted or made available only when these activities concern the postal service provided or are necessary for its performance or separate provisions provide otherwise.
Backoffice Outsourcing Sp. z o. o., at the moment of providing it with personal data for the purpose of providing the service, becomes the administrator of these data.
Only if the Postal Operator does not provide postal services, but other services, the transfer of the addressee's (or other entity's) personal data to this entity must take place on the basis of an agreement entrusting the processing of personal data for the purpose and scope provided for in this agreement. Only then will the postal operator have the status of a processor (an entity entrusted with the processing of personal data), and not a data controller (as will be the case in the case of obtaining personal data while providing postal services).
Legal basis:
Act of September 19, 2019 on the protection of personal data ( single text: OJ Laws of 2019, item 1461).
Act of November 23, 2012 – Postal Law ( monotext: OJ of 2020, item 1041, 2320).
Entrustment agreement
As a general rule, only the personal data controller may process the personal data under its management. If he wants to make them available to other entities, he usually must conclude an agreement with them to entrust the processing of personal data.
e-mail: cok@backofficeoutsourcing.de
Address: Data Protection Inspector Backoffice Outsourcing Sp. z o. o. Robert Kütz, Al. United States 72/12, 04-036 Warszawa.