\n| Open-source or freeware product<\/td>\n | Ordinarily, there is no income from a free-of-charge benefit; a system developed internally and made available only within the group may be treated differently.<\/td>\n | Check license terms and internal records.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\nThe cloud supplier may control the timetable<\/h3>\nPolish law has no single statute dedicated to cloud computing. The source describes assignment of cloud contracts as a matter of general Civil Code provisions, the GDPR, sector guidance\u2014including that of Poland\u2019s financial supervisor, the KNF, and CSIOZ\u2014and, in practice, supplier terms.<\/p>\n For Google Workspace<\/strong>, the source identifies both the assignment restriction described above and operational steps for Domain Transfer:<\/p>\n\n- At least seven days to implement retention rules in Google Vault.<\/li>\n
- Forty-eight hours to convert a primary domain to a secondary domain, plus 24 hours for a test run.<\/li>\n
- No transfer of the primary domain while it remains the main domain.<\/li>\n
- Express authorization from administrators of both environments for the domain transfer team.<\/li>\n<\/ul>\n
For Microsoft 365 and Azure<\/strong>, the identified procedures include:<\/p>\n\n- Acceptance by the future owner before Azure subscription billing ownership transfers, followed by review and updating of role assignments.<\/li>\n
- An account with the owner role in both the existing and new Microsoft Entra directories to change an Azure subscription\u2019s directory; full visibility of data may take several hours afterward.<\/li>\n
- A relationship between both tenants\u2019 administrators for cross-tenant OneDrive and Exchange Online migration. Duration depends on user numbers and data volume.<\/li>\n
- Administrative permissions, rather than corporate documents such as an extract from Poland\u2019s National Court Register (KRS<\/strong>), as the condition identified in Microsoft\u2019s technical documentation for these operations.<\/li>\n<\/ul>\n
Put supplier procedures into the intercompany schedule. A company-to-company promise to finish in two weeks does not make an eight-week supplier process disappear.<\/p>\n Structure the handover to avoid access gaps and overlaps<\/h2>\nA gap<\/strong> leaves critical systems without an administrator and can cause downtime. An overlap<\/strong> gives both sides full administrative access to the same systems, creating a security and evidentiary problem if an incident occurs.<\/p>\nUse phases, with a separate transfer record for each asset:<\/p>\n \n\n\n| Phase<\/th>\n | Scope<\/th>\n | Timetable in the agreement<\/th>\n | Planning reason<\/th>\n<\/tr>\n<\/thead>\n | \n\n1. Cloud environments and accounts<\/strong><\/td>\n| Handover of administrative permissions<\/td>\n | Firm deadline<\/td>\n | The source treats this as the quickest technical handover, involving a change of credentials. Supplier contract changes must still be planned separately.<\/td>\n<\/tr>\n | \n2. Equipment<\/strong><\/td>\n| Physical transfer<\/td>\n | Firm deadline<\/td>\n | Requires logistics but not construction work.<\/td>\n<\/tr>\n | \n3. Network layer<\/strong><\/td>\n| Design, procurement, physical work, and possible rewiring<\/td>\n | Reasonable timeframe rather than a fixed date<\/td>\n | Duration depends on the scope of work.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n For each asset, specify a two-stage process. First, the transferring party supplies passwords, keys, and tokens through a secure channel, such as a password manager, one-time link, or encrypted channel. Second, the receiving party confirms receipt within a specified period; the source\u2019s proposed mechanism treats silence after that period as tacit confirmation.<\/p>\n Tie the contractual transfer of responsibility to confirmed receipt<\/strong>, not merely to signature of the overall agreement. Keep a register showing both the delivery and confirmation dates for every access item. Once receipt is confirmed, the receiving party changes passwords, keys, tokens, certificates, and MFA settings, while the transferring party deletes its credential copies.<\/p>\nDo not waive claims you have had no chance to investigate<\/h2>\nA broad \u201cno objections\u201d statement signed before the receiving party has administrative access asks it to approve IT support it could not verify. Limit any such statement to disclosed, verifiable matters. In particular, exclude unknown security configurations, access histories, personal data incidents, and GDPR compliance.<\/p>\n The source cites two Polish Supreme Court judgments on future claims. Judgment I CSK 125\/08<\/strong> permits a waiver where the legal relationship giving rise to future claims is defined sufficiently precisely. Judgment II CSKP 1361\/22 of April 24, 2024<\/strong> indicates that a waiver can cover claims \u201cthat may arise in the future\u201d if the clause says so expressly. Neither is a reason to accept an unrestricted waiver.<\/p>\nThe source advises excluding:<\/p>\n \n- Claims belonging to data subjects.<\/li>\n
- Recourse under Article 82(5) GDPR and liability toward Poland\u2019s data protection authority, UODO<\/strong>.<\/li>\n
- Personal data breaches predating handover.<\/li>\n
- Breaches of the handover agreement itself.<\/li>\n
- Liability for intentionally caused damage, which cannot be excluded under Article 473 \u00a72 of Poland\u2019s Civil Code.<\/li>\n<\/ul>\n
Assess Polish tax treatment before choosing a free-of-charge transfer<\/h2>\nThe source treats a free-of-charge IT transfer between group companies as a controlled transaction for transfer pricing purposes. Under Article 12(1)(2) of the CIT Act, income includes the value of things and rights received and other wholly or partly free-of-charge benefits. In resolutions FPS 9\/02<\/strong> and II FPS 1\/06<\/strong>, Poland\u2019s Supreme Administrative Court described a gratuitous benefit as an economic advantage obtained at another party\u2019s expense without equivalent payment and with a specific financial value.<\/p>\nOn that approach, free use of a related party\u2019s IT infrastructure, ERP systems, server licenses, or support services generally creates income for the beneficiary. Ignoring the issue may lead the tax authority to increase assessed income.<\/p>\n \n\n\n| Requirement identified in the source<\/th>\n | Legal basis<\/th>\n | Stated consequence of non-compliance<\/th>\n<\/tr>\n<\/thead>\n | \n\n| Set related-party terms on an arm\u2019s-length basis<\/td>\n | Article 11c CIT Act<\/td>\n | Tax authority adjustment of income<\/td>\n<\/tr>\n | \n| Prepare local transfer pricing documentation if thresholds are exceeded<\/td>\n | Articles 11k\u201311l CIT Act<\/td>\n | The source describes absence of documentation as giving rise to a presumption that terms are not arm\u2019s length.<\/td>\n<\/tr>\n | \n| Submit the statement concerning arm\u2019s-length transfer pricing<\/td>\n | Article 11m CIT Act<\/td>\n | False certification may attract a fine of up to 720 daily rates under Article 56c of Poland\u2019s Fiscal Penal Code.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n There is a practical tension in declaring the terms of an inherently free-of-charge transaction to be at arm\u2019s length. Obtain a Polish tax review of the proposed arrangement before<\/strong> the agreement is signed.<\/p>\nPut enforceable terms around the transition period<\/h2>\nIf the receiving company continues to use the transferring company\u2019s network, informal permission is not enough. A Friday-evening outage exposes the problem: without agreed service terms, who must respond?<\/p>\n Address at least four points in the handover or TSA documents:<\/p>\n \n- Communications confidentiality.<\/strong> Include a prohibition on accessing communications content. The source refers to Poland\u2019s Electronic Communications Law (PKE<\/strong>), the Act of July 12, 2024 (Journal of Laws 2024, item 1221), and identifies traffic and location data as protected. Its stated processing restriction extends to people other than sender and recipient, including internal network operators.<\/li>\n
- Traffic-data limits.<\/strong> Restrict processing to security purposes and specify retention.<\/li>\n
- Notice.<\/strong> Require reasonable advance notice of planned work or disconnection, and notice of requests from authorities.<\/li>\n
- Minimum service levels.<\/strong> Identify response times, a contact person, and an outage-escalation route.<\/li>\n<\/ol>\n
An inventory may still miss assets. Include a subsequent-disclosure mechanism<\/strong> requiring free-of-charge provision of access, within a defined period after signing, to assets discovered once separation is underway. Examples include a service account known to one administrator, an overlooked backup location, an undisclosed API integration, or a SaaS subscription paid for by the transferring company but used by the receiving one.<\/p>\nAdd exit planning where DORA or NIS2 applies<\/h2>\nCheck whether either party is subject to DORA<\/strong> or NIS2<\/strong>. The source states that an intra-group ICT provider is not exempt simply because it belongs to the group.<\/p>\nIn particular, the source attributes to Article 28(2) DORA a requirement for financial entities to maintain a documented, tested exit plan for each ICT agreement supporting critical functions. That plan should cover contingency scenarios, migration timing, and continuity of operations. It describes NIS2 as imposing analogous ICT supplier-risk management requirements and points to PolishCloud 2.0 and 3.0<\/strong> as setting out exit-plan elements for the Polish market.<\/p>\n | | | | | |