GDPR notice
Your data has a purpose. And limits.
1. Who is responsible for data?
The system for companies and employees is operated by BackOffice Outsourcing Sp. z o.o., Aleja Stanów Zjednoczonych 72/12, 04-036 Warszawa, Poland, tax ID 1132867570. For data protection enquiries, use the contact form.
As a rule, your employer is the controller of employee data concerning leave and absences. Its full name, address, contact details and data protection officer’s details, if appointed, must be provided in the notice specific to your company before processing starts. When handling such data on the employer’s instructions, BackOffice acts as a processor under an agreement compliant with Article 28 GDPR. Actual activities and agreements determine the final allocation of roles.
BackOffice is a separate controller for its own correspondence and enquiries. Operating the system does not give BackOffice the right to use employee records for unrelated purposes.
2. Purposes and legal bases
Employee administration data is used to identify authorised employees, receive and process requests for different types of leave, record sickness absence and fulfil employment obligations.
The employer’s processing follows, in particular, labour and social security obligations under Article 6(1)(c) GDPR. For health data, Article 9(2)(b) GDPR applies within the rights and obligations established by law. Specific provisions and bases must be identified for each process and employment type. Article 6 alone is insufficient for processing health data.
System protection and legal claims may rely on Article 6(1)(f) GDPR where permitted by law, after assessing individuals’ interests and rights. BackOffice enquiries rely on Article 6(1)(f); steps before a contract with an individual may rely on Article 6(1)(b).
Signing in or reading the terms does not constitute consent to processing health data. Fulfilling employment duties should not depend on general consent to personal data processing.
3. Which data and sources?
Data includes necessary identification and work details, employer association, absence type and dates, and information required to manage it. Sources may be you, your employer and its authorised personnel. Statutory sources may be used only through lawful access that is actually in place.
Information about a medical certificate is health data. Limit it to what is needed to manage the absence. Do not provide a diagnosis, disease code, symptoms, treatment history or medical records. Do not send such data through the general contact form.
4. Who may receive the data?
Only people authorised by the relevant controller, including HR and payroll staff, and providers necessary for the service under appropriate agreements should access records. A manager’s access must be limited to information needed for their duties. Health information must not appear in a public calendar or reach unauthorised people.
Data is shared with public authorities where required by law. The relevant employer identifies recipients of employment data.
5. Retention and transfers
Retention depends on the record type, legal basis and applicable employment and social security rules. The relevant controller determines retention of accounts, backups, logs and request data. There is no single retention period for all this data.
Data location and subcontractor access must be determined before processing starts. Transfers outside the European Economic Area require an appropriate basis under Chapter V GDPR, such as an adequacy decision or standard contractual clauses, and the required assessments. The relevant controller provides information about processing locations.
6. Your rights
Under the conditions in the GDPR, you can request access and a copy, rectification and restriction of processing. Erasure, portability and objection apply where provided by law and are not absolute. Record-keeping duties may prevent deletion on request. Where processing relies on consent, it can be withdrawn without affecting the lawfulness of earlier processing.
Contact your employer about employee records, and BackOffice about processing for which it is responsible. You may lodge a complaint with the President of Poland’s Personal Data Protection Office: uodo.gov.pl.
7. Required data and decisions
Legally required data may be necessary to manage employment and a particular absence. Consequences of not providing data depend on the specific duty; no more than necessary should be collected. Authorised people make decisions on requests. Recording a medical absence does not grant annual leave.
8. Subscription billing and Stripe
The employer pays the subscription through its authorised administrator after sign-in. BackOffice controls data relating to contracting, billing and payment handling: company and representative details, invoice data, customer and subscription identifiers, amounts and transaction statuses. Bases are Article 6(1)(b) GDPR for a contract with an individual, Article 6(1)(c) for accounting and tax duties, and Article 6(1)(f) for contact with company representatives and protection of claims.
For Stripe payments, data needed for the transaction is sent to the relevant Stripe group entity. Depending on the purpose, Stripe may act as processor or separate controller, particularly for fraud prevention and legal duties. We do not send leave requests, employee records or health data to Stripe. Relevant entities, retention periods and safeguards for transfers outside the EEA are described in the Stripe privacy policy.
Billing data is retained for contract performance, mandatory accounting and tax retention, and pursuing or defending claims. Billing data is needed for a paid company subscription, not employees’ private payments. Send related requests through the BackOffice contact form.