1. Who We Are
The data controller for this website and all related services is:
| GM Solution Hub Spółka z ograniczoną odpowiedzialnością ul. Domaniewska 47/406, 02-672 Warszawa, Poland KRS: 0001205856 · NIP: 7011286943 · REGON: 543275950 Email: info@gmshub.pl · Website: gmshub.pl |
2. What We Do and Why It Matters for Your Data
GM Solution Hub provides company formation, accounting, bookkeeping, payroll, tax advisory, virtual office, and business compliance services in Poland. To deliver these services, we necessarily process personal data – including identity documents, tax identification numbers, financial records, and employment data – on behalf of our clients and their employees or shareholders.
We take this responsibility seriously. This policy explains exactly what we collect, why, and how we protect it.
3. What Data We Collect and Why
| Purpose | Data collected | Legal basis |
| Website enquiry / contact form | Name, email address, phone number, company name, message content | Art. 6(1)(b) GDPR – steps prior to entering a contract |
| Company formation services | Full name, date of birth, nationality, passport/ID number, PESEL (where applicable), residential address, share structure, beneficial ownership data | Art. 6(1)(b) GDPR – performance of a contract; Art. 6(1)(c) – legal obligation (Polish company law, KRS registration requirements) |
| Accounting & bookkeeping | Financial records, invoices, bank details, VAT/NIP numbers, transaction data | Art. 6(1)(b) GDPR – performance of a contract; Art. 6(1)(c) – legal obligation (Polish Accounting Act, tax law) |
| Payroll & HR administration | Employee names, PESEL, salary data, bank account details, employment contracts, ZUS/social insurance data | Art. 6(1)(b) GDPR – performance of a contract; Art. 6(1)(c) – legal obligation (Polish Labor Code, ZUS regulations) |
| Tax advisory & compliance | PIT/CIT/VAT data, tax identification numbers, financial statements | Art. 6(1)(b) GDPR – performance of a contract; Art. 6(1)(c) – legal obligation (Polish Tax Ordinance) |
| Virtual office / registered address | Name, contact details, correspondence received on your behalf | Art. 6(1)(b) GDPR – performance of a contract |
| Anti-money laundering (AML) / KYC | Identity verification documents, beneficial ownership information | Art. 6(1)(c) GDPR – legal obligation (Polish AML Act of 1 March 2018) |
| Website analytics | Anonymized IP address, pages visited, session duration, device/browser type | Art. 6(1)(f) GDPR – legitimate interest in understanding how the site is used |
| Marketing communications | Email address | Art. 6(1)(a) GDPR – consent; Art. 10 UŚUDE (Polish Electronic Services Act) |
We do not process special-category data (health, ethnicity, religion, biometric data) unless you explicitly provide it in the course of a service engagement and it is strictly necessary for that purpose.
4. Cookies
We use:
- Strictly necessary cookies – required for the site to function. No consent needed.
- Analytics cookies – anonymized traffic data via a privacy-first analytics tool. Set only with your consent via our cookie banner.
You can withdraw cookie consent at any time through your browser settings or our cookie preference tool.
5. Who We Share Your Data With
We do not sell your data. We share it only where necessary:
- Polish public authorities – KRS (National Court Register), US (tax office), ZUS (social insurance), UODO – where legally required as part of company formation, accounting, or payroll obligations.
- Service providers acting as data processors – cloud hosting, accounting software, payroll platforms, email delivery – each bound by a data processing agreement.
- Professional advisers – lawyers, auditors – where legally required or to protect our legal rights.
- Other third parties – only with your explicit consent or where required by law.
Where any provider is based outside the EEA, we ensure appropriate safeguards are in place, such as EU Standard Contractual Clauses (SCCs) or an EU adequacy decision.
6. How Long We Keep Your Data
| Data type | Retention period |
| Accounting records and financial documents | 5 years from the end of the financial year (Polish Accounting Act requirement) |
| Tax records | 5 years from the end of the tax year in which the tax liability arose (Polish Tax Ordinance) |
| Payroll and ZUS records | 10 years (for documents submitted from 2019 onwards, per Polish social insurance law) |
| AML/KYC records | 5 years after the end of the business relationship (Polish AML Act) |
| Company formation documents | Duration of engagement + 5 years after termination |
| Enquiry / contact data (no contract formed) | 12 months from last contact |
| Marketing consent and communications | Until you unsubscribe or withdraw consent |
| Analytics data (anonymized) | 13 months rolling |
| Website logs (security) | 90 days |
Where multiple retention periods could apply, we retain data for the longest applicable period.
7. Your Rights
Under GDPR (RODO), you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate data
- Erase your data (“right to be forgotten”), subject to our legal retention obligations
- Restrict processing in certain circumstances
- Object to processing based on legitimate interests
- Data portability for data processed by consent or contract
- Withdraw consent at any time (this does not affect the lawfulness of prior processing)
Please note that some rights – particularly erasure and restriction – may be limited where we are required by Polish or EU law to retain your data (e.g. tax records, AML documentation).
To exercise any of these rights, email us at info@gmshub.pl. We will respond within one month.
You also have the right to lodge a complaint with the Polish supervisory authority:
| Urząd Ochrony Danych Osobowych (UODO) ul. Stawki 2, 00-193 Warszawa www.uodo.gov.pl |
8. Data Security
We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, alteration, or disclosure. These include access controls, encryption of sensitive data in transit, regular security reviews, and confidentiality obligations for all personnel who handle personal data.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify UODO within 72 hours and, where required, inform you directly.
9. Data Processing on Behalf of Clients
When we process personal data on your behalf – for example, your employees’ payroll data, or your clients’ data as part of bookkeeping – we act as a data processor under Art. 28 GDPR. In these cases, you (as our client) remain the data controller and are responsible for the lawfulness of the underlying processing.
We will enter into a Data Processing Agreement (DPA) with you for any such processing, setting out the nature, purpose, and scope of the processing, as well as our respective obligations.
10. Changes to This Policy
We may update this policy as our services evolve or legal requirements change. Material changes will be communicated via email (to active clients) or a notice on our website, with at least 14 days’ notice before they take effect. The current version is always available at gmshub.pl/privacy-policy.
11. Contact
Questions about this policy or how we handle your data: