Privacy Policy at AFK Business Service Centre (AFK COB)

General information

The personal data:

  1. disclosed by users over the following web sites:

  1. processed in enova365 in connection with the provision of accountancy services by AFK COB
  2. processed in connection with the services of AFK COB virtual office
  3. processed in connection with the rental of premises at the company’s offices, is controlled by

by AFK Centrum Obsługi Biznesu Sp. z o.o. (AFK COB) with its registered office in Wrocław (50-559), ul. Świeradowska 51/57, entered to the Register of Entrepreneurs of the National Court Register maintained by the District Court for Wrocław Fabryczna in Wrocław, 6th Commercial Division of the National Court Register under KRS number 0000327942, NIP: 8992664769.

The users whose data is processed shall be referred to as follows:

re: a) Company web sites

re: b) Accounting services

re: c) Rental of Virtual Office

re: d) Rental of rooms.

Legal basis for personal data processing

AFK COB processes personal data on the basis of consent provided by data subjects (that is on the basis of Art. 6.1.a of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter GDPR). We further reserve that AFK COB is also authorised to process the data to protect its legitimate interests when such interests override the interests of the data subjects – pursuant to Art. 6.1.f of GDPR.

The personal data referred to above will be processed by AFK COB for the time the data subject use the Company web sites, Accounting services, Rental of a virtual office, Rental of premises, until the following time:

re: a) such data subject files a request to remove their account from the Company web sites or a request to delete the personal data collected on the Company web sites

re: b) dissolution, termination or expiry of the Accounting Services contract

re: c) dissolution, termination or expiry of the Virtual Office Rental contract

re: d) dissolution, termination or expiry of the Premises Rental contract.

The purposes of personal data processing by AFK COB


The purposes of data processing

Company web sitesAccess service to web sites.
Information and marketing purposes.
Accounting servicesCorrect service provision.
Office rentalCorrect service provision.
Rental of roomsCorrect service provision.


Cookie files are understood as IT data, in particular text files that are saved on users’ end-devices and support the use of web sites. in particular, the files help recognise the user’s device and display the site adapted to their individual preferences. Cookies usually contain the name of the web site they originate from, the storage time on the end device and their unique number.

AFK COB uses three types of cookies – session, persistent and external cookies. Session cookies are temporary files. The cookies remain on the user’s device until log out from the Company web site, logout from the Customer Panel or closing of the software (web browser). Persistent cookies remain on the user’s device over a time determined in the cookie file parameters or until they are manually deleted by the user. External cookies mean cookies placed by partners of AFK COB.

AFK COB uses (session and persistent) cookies to adjust the content of the Company web sites to the users’ preferences and needs and to maintain the service user’s session (after login) and therefore the user does not have to enter their login and password on such service sub-page. The cookies are required to optimise the Company web sites and to ensure reliability and security in their functioning and to perform detailed research, analyses and anonymous statistics. External cookies are used to present multimedia content that is downloaded from external web services, e.g., to collect general and anonymous statistics with analytical tools, e.g. Google Analytics, to present advertisements tailored to the user’s preferences with web advertising tools, e.g. Google AdWords, and to use interactive functions to popularise web sites with social services, for instance

The cookies mechanism does not collect any personal data or confidential information from the device. The data is collected solely to perform certain functions for the users.

Standard software used to browse web sites as a default admits the storage of cookies on end devices. The settings may be modified in order to block automatic support to cookies in web browser settings or notify each time they are saved in the user’s devices. Detailed information on the possibilities and methods to support cookies are available in software (browser) settings.

Disabling cookies will prevent correct operation of functions available at the Company web sites.

The data processed after login to the Customer Panel enova365

AFK COB is a distributor of enova365 ERP. AFK COB administers personal data of the company’s services in the system and the data provided to it by enova365 users. Although the disclosure or the personal data to AFK COB for processing is not obligatory, without such data the provision of Accounting services will not be possible.

With enova365 ERP, users may enter personal data with respect to which it has administrator status (data of their counterparties, employees or associates). AFK COB does not control that data – the enova365 ERP system is solely a tool made available to users in that respect. Due to the specific nature of the enova365 ERP system, the data uploaded to it will be saved on servers of AFK COB. Such data will be processed in compliance with Art. 28 et seq. of GDPR. AFK COB is the Processor in that case.

Other sources of personal data for AFK COB

In order to correctly perform its services AFK COB will also process other data provided by its Customers. The data may be provided to AFK COB by letter (by post or courier), personally, by e-mail or via other communication channels.

The processing method of personal data

In order to assure the security of the entrusted personal data, AFK COB shall process such data applying the approved security principles and with all available technical measures. Persons authorised by AFK COB to access the processed personal data shall be obliged to comply with the above regulations and to keep confidence the content of the processed personal data and the measures applied to keep it secure.

Entrusting personal data processing to third entities

AFK COB reserves the right to entrust personal data processing to third entities – subcontractors and service providers (e.g. server operators, providers of IT services applied to service customers). The data is disclosed to such entities to a minimum possible extent as necessary to assure the provision of relevant services. Authorised subcontractors or service providers are obliged to comply with the principles and guidelines ensuring the security of the entrusted processed personal data.

Additionally, by operation of law, AFK COB may be required to disclose the personal data it processes by courts, prosecutor’s offices, law enforcement agencies, treasury administration and other institutions and entities legally authorised to request such data.

AFK COB further stressed that the entrusted personal data may be transferred to servers in third countries with all efforts taken to transfer it to counterparties that hold a Privacy Shield certificate or applying standard contractual clauses.

AFK COB does not sell or disclose the entrusted personal data to any other entities. The processing of the data entrusted to AFK COB by third parties is aimed solely at the efficiency and performance of the services provided by AFK COB.

AFK COB represents that the entrusted data may also be transferred to third parties – legal counsels, tax advisors and the specialists cooperating with AFK COB in the provision of the Services. Such entities will be provided with personal data to the extent required for correct performance of the Services subject to their acceptance of the security rules of personal data processing approved by AFK COB.

Commercial information

JAlong with their consent to process personal data, the users may agree to receive commercial information within the meaning of the Act of 18 July 2002 on electronic services, that may be provided by AFK COB. The e-mail correspondence sent pursuant to the consent is of information and marketing nature, covering news and tips on all types of regulations applicable to entrepreneurs in Poland and in the European Union, and information on new functionalities of the web site and on offers of AFK COB and its partners.

Direct marketing

With reference to Art. 14.1 and Art. 14.2 of GDPR, we inform as follows:

In compliance with Art. 6.1.f of GDPR and motive (47) of GDPR, AFK COB may process personal data for the purposes of direct marketing subject to legitimate interests of the controller. The data is acquired from the CEiDG public base, covering: business name, address of operations, address for correspondence, e-mail address, NIP, Regon, data of business registration, PKD. The personal data is disclosed to Poczta Polska SA (correspondence data). The acquired data is not subject to automatic decisions. The data is not disclosed to recipients in third countries.

The data storage time is limited to the time required to develop an advertising card. At dispatch, the data will be deleted from the marketing base.

The persons whose data has been acquired shall be entitled: demand access to their personal data, have it corrected, deleted or have the processing restricted, to object to the processing, to have the personal data transferred, withdraw their consent at any time without affecting the lawful processing made in compliance with their consent before it is withdrawn, file a complaint with the President of Personal Data Protection Office (PUODO) if they decide that the processing of their personal data violates the provisions of GDPR.

Rights of the data subjects

The persons whose personal data is processed by AFK COB, may demand:

  1. a confirmation that their personal data is processed by AFK COB COB along with the information specified in Art. 15.1 of GDPR, detailed in this Privacy Policy. Such persons shall also be entitled to request the provision of a copy of their personal data that is processed by AFK COB;
  2. immediate correction of their personal data or supplement to incomplete personal data if the data processed by AFK COB is incompliant with the truth or incomplete;
  3. to have the data processed by AFK COB deleted in the following situations:
  1. the data is no longer required for the purposes underlying the processing thereof;
  2. the consent underlying the processing of the personal data was revoked by the data subject;
  3. a justified objection has been field as referred further down in this Policy;
  4. the personal data was processed by AFK COB contrary to applicable laws;
  5. the duty to delete the personal data is based on EU or domestic laws;
  6. the consent for personal data processing was provided by a minor under 16 years of age.

If personal data is disclosed publicly in the situation referred to above, the data subject may demand that reasonable actions are taken (subjects to costs and available technologies) in order to notify other controllers that process copies or replicas of the data on the request to have the data deleted (the right to be forgotten);

  1. to have the processing of data AFK COB restricted in the following situations:
  • the person questions that the data is correct in the manner specified in item 2 above or in view of an objection referred to further below in this Privacy Policy – for a time allowing AFK COB to verify the correctness of he processed data or to review the grounds for the objection;
  • in a situation when despite the incompliance of data processing with the applicable laws, the data subject – instead of having the data deleted – requests solely that the content of the data is restricted in the set of AFK COB;
  • the need for AFK COB, to process personal data has expired, but the data subject requires further processing thereof to determine, pursue or defend their claims;

During the restricted processing of personal data, AFK COB shall be entitled to store the data and the data may be processed solely subject to a consent of the data subject or to determine, pursue or defend claims, or to protect the rights of other natural or legal persons or due to material public interests of the European Union or an EU Member State.

  1. have the personal data issued as provided to the controller, in a structured commonly used machine-readable format. The data may be issued to such persons and – if technically feasible – transferred directly to the controller designated by the data subject.

Any refusal to comply with such requests by AFK COB must be rely on applicable laws, in particular GDPR.

CFor the avoidance of any doubts, it should be noted that any person who have provided their consent to have their personal data processed is also entitled to have the processing restricted and/or to withdraw their consent for the above and demand that AFK COB deletes the processed personal data. AFK COB notes that due to the specific nature of the Company web sites, such request may block certain functionalities of the sites or the User’s account may be deleted which may prevent the use of the Company web sites.

The data subjects may exercise the rights specified above by:

  • • using the dedicated form;
  • • sending the relevant request to the e-mail address of the Data Controller – rodo@AFK;
  • • sending the relevant request to the address of AFK COB – AFK Centrum Obsługi Biznesu Sp. z o.o. with its registered office in Wrocław, ul. Świeradowska 51/57, 50-559 Wrocław.


Notwithstanding the rights referred to hereabove, the data subjects shall be entitled to file an objection to the processing of their personal data:

carried out within:

  • • activities required to perform a task that is of public interest or as a part of public authority accorded to the controller – pursuant to Art. 6.1.e of GDPR, or
  • • protection of legitimate interests of AFK COB when such interests override the interests or fundamental rights and freedoms of the data subjects – pursuant to Art. 6.1.f of GDPR, or
  • • carried out automatically (profiling), or
  • • pursued for a direct marketing purpose.

When an objection is filed, AFK COB shall immediately restrict the processing of the personal data in compliance with the principles set forth in the preceding chapter. If the objection is justified, the personal data will be deleted by AFK COB, unless further processing thereof is required on the basis of other valid, not related to marketing, legitimate interests, overriding the interests, rights and freedoms of the data subject or such data is required to determine, pursue or defend claims. If an objection is field to the processing of personal data for direct marketing purposes, AFK COB shall discontinue such data processing for the purpose.

The data subject may file an objection as follows:

  • • using the dedicated form;
  • • sending the relevant request to the e-mail address of the Data Controller – rodo@AFK;
  • • sending the relevant request to the address of AFK COB – AFK Centrum Obsługi Biznesu Sp. z o.o. with its registered office in Wrocław, ul. Świeradowska 51/57, 50-559 Wrocław.

Data Protection Controller and Supervisory Authority

The Data Protection Controller is a supervisory body over the security of personal data processing and ensuring the enforcement of all the rights of the data subjects.

The Data Protection Controller in any matter concerning personal data processing may be contacted at: rodo@AFK or by traditional post addressed to: AFK COB – AFK Centrum Obsługi Biznesu Sp. z o.o. with its registered office in Wrocław, ul. Świeradowska 51/57, 50-559 Wrocław, To the Personal Data Controller.

The data subjects are also entitled to file complaints to the local Supervision Authority – President of the Personal Data Protection Office at ul. Stawki 2, Warszawa 00-193.

Final provisions

All matters not provided for in this Privacy Policy shall be subject to applicable laws, in particular GDPR.

AFK COB reserves the right to modify this Privacy Policy. The valid text of the Privacy Policy will be always available at: Information on modifications to this Privacy Policy shall be provided to the persons who have provided their relevant consents to the extent allowing AFK COB to provide the relevant information via e-mail.

This Privacy Policy becomes effective on 29.10.2018.