{"id":2797,"date":"2026-10-12T12:32:02","date_gmt":"2026-10-12T12:32:02","guid":{"rendered":"https:\/\/sawaryn.com\/us\/?p=2797"},"modified":"2026-10-12T12:32:21","modified_gmt":"2026-10-12T12:32:21","slug":"poland-lead-generation-platform-gdpr-roles","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/us\/poland-lead-generation-platform-gdpr-roles\/","title":{"rendered":"Lead Generation Platforms in Poland: Mapping GDPR Roles to Your Data Flows"},"content":{"rendered":"

Lead Generation Platforms in Poland: Mapping GDPR Roles to Your Data Flows<\/h1>\n

A customer completes a form and clicks \u201cSend.\u201d In the seconds that follow, the data may move through three different legal roles. Your product team sees one workflow; a regulator may see three sets of obligations. If your platform earns a commission when a customer signs a contract with a contractor, the way you obtain consent for follow-up contact may also affect your ability to verify that commission.<\/p>\n

This matters if you operate a marketplace, lead generation service, or comparison site that connects customers with contractors in Poland. The central task is to assign the right role to each processing activity\u2014not to give the entire platform one label. Your privacy policy<\/a> must then describe what the product actually does.<\/p>\n

The terms behind the role map<\/h2>\n

The EU General Data Protection Regulation (GDPR), known in Poland as RODO<\/em>, uses roles that depend on who determines the purposes and means of a particular processing activity.<\/p>\n\n\n\n\n\n\n\n\n\n\n
Term<\/th>\nWhat it means for a platform operator<\/th>\n<\/tr>\n<\/thead>\n
Controller<\/strong><\/td>\nThe entity that determines why and how personal data is processed. If you decide why to collect inquiry data and what to do with it, you act as a controller for that activity.<\/td>\n<\/tr>\n
Processor<\/strong><\/td>\nAn entity that processes data on a controller\u2019s documented instructions, without setting its own purposes for that processing.<\/td>\n<\/tr>\n
Joint controllers<\/strong><\/td>\nTwo or more entities that jointly determine purposes and means. Article 26 GDPR requires an arrangement between them.<\/td>\n<\/tr>\n
Legitimate interests<\/strong><\/td>\nA possible legal basis under Article 6(1)(f) GDPR. It calls for a documented balancing test between your interest and the individual\u2019s rights; you must be able to substantiate your position (GDPR, Recital 69<\/a>).<\/td>\n<\/tr>\n
Commercial communication<\/strong><\/td>\nCommunication promoting a business\u2019s goods, services, or image. Telephone or electronic contact for that purpose requires prior consent under Article 398 of Poland\u2019s Electronic Communications Law, commonly abbreviated PKE<\/em> (Article 398 PKE<\/a>).<\/td>\n<\/tr>\n
Processing records<\/strong><\/td>\nArticle 30 GDPR provides for a controller\u2019s record of its processing activities and a processor\u2019s record of categories of activities carried out for controllers. A platform acting in both roles needs to address both.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

One platform, different roles at different stages<\/h2>\n

A GDPR role belongs to a processing activity, not to a software system.<\/strong> A customer\u2019s name, telephone number, and inquiry description can be handled under different roles as the inquiry moves from your form to a contractor and into the contractor\u2019s dashboard.<\/p>\n

1. Collecting the inquiry: the operator as controller<\/h3>\n

When a customer submits your form, you decide which fields it contains, why the data is collected, how long it is kept, and which contractor receives it. The purposes may include matching, verification, and commission settlement.<\/p>\n

For this stage, you are a controller<\/strong> under Article 4(7) GDPR<\/a>. You need an Article 6 legal basis, an Article 13 privacy notice, and a controller\u2019s processing record under Article 30(1).<\/p>\n

The approved approach in the source is to display the name of the contractor who will receive the inquiry before the customer submits the form<\/strong>, addressing the recipient information under Article 13(1)(e). Do not leave that identification solely for a confirmation email or buried terms: show it on screen before the customer clicks \u201cSend.\u201d<\/p>\n

2. Delivering the lead: the contractor as a separate controller<\/h3>\n

After receiving the inquiry, the contractor decides independently whether and when to contact the customer, what to offer, and how long to retain the data. On that model, the contractor is a separate controller<\/strong>, not a joint controller with the platform. Joint controllership under Article 26 requires jointly determined purposes and means; the fact that both businesses handle the same lead does not, by itself, establish that arrangement.<\/p>\n

The practical consequences are distinct:<\/p>\n

    \n
  1. The contractor has its own Article 14 GDPR information obligation to the customer whose data it receives.<\/li>\n
  2. Your privacy policy should explain the separate roles; on this model, you do not need a joint-controllership arrangement for delivering the lead.<\/li>\n
  3. The platform\u2019s confirmation email should provide the recipient\u2019s registration details and a link to its privacy policy.<\/li>\n<\/ol>\n

    The platform remains the disclosing controller<\/strong> when it delivers the lead. It also needs a process for handling and forwarding relevant erasure and recipient-notification requests under Articles 17 and 19 GDPR.<\/p>\n

    3. Hosting contractor dashboard data: the operator as processor<\/h3>\n

    A contractor may upload employee contact details, service descriptions, and photographs of completed work to its dashboard. Where the contractor supplies and controls that material for its own purposes and you provide the tool, you act as a processor<\/a> for that processing.<\/p>\n

    Article 28 GDPR then calls for a data processing agreement, processing on documented instructions, and breach-reporting arrangements. You also need the processor\u2019s Article 30(2) record of categories of processing carried out for contractors.<\/p>\n

    When dashboard content becomes platform marketing<\/h3>\n

    Suppose your marketing team takes a photograph from a contractor\u2019s dashboard and posts it on the platform\u2019s social media account. That is no longer merely providing the dashboard:<\/p>\n