At SARE, I am responsible for the technical side of the whole system. Privately, I have become an adviser on web pages, websites, or e-businesses. Quite frequently, I have helped people to find their way in the maze of “e-reality”. Hosting, website design, promotion, fees - this is the first stage for people who would like to start their Internet-based business adventure. When their ideas catch on, the second stage arrives - “professionalisation”.

As long as we are the owners of an e-shop (or other business, even non-commercial), and the e-shop is rather our hobby than part of our life, we decide to operate at the lowest costs possible. Virtual hosting in the US, free software, WWW templates for a couple of dollars, free email marketing tool and personal data collected on the verge of breaking the law. All right, we can understand that. However, there comes a moment when you need to make a step forward. One of my friends was exactly at this stage, and asked me about personal data registration at GIODO (General Inspector for Personal Data Protection). Earlier, he had not bothered with GIODO because “nobody cares, anyway”. In some cases, GIODO does not require database registration, e.g. information needed for invoices (I recommend reading the law on that). The situation gets worse when apart from invoice data we begin to gather additional bits of information, such as sex or age.

I explained to my friend that if he needs to register a database, earlier he needs to comply with a number of requirements on e.g. data safety. Practically, he needs to forget all “virtual” hosting and purchase a hosting service on a dedicated Polish server. In addition, he needs to ensure that all appropriate physical protective devices are operational, and he needs to get hold of statements signed by people who have got access to the server, etc., according to the law. Practically, not feasible within reasonable costs. The simplest solution would be to buy a server, put it in the cellar, lock the cellar, and wait for an inspection. When we carried on and began to discuss the costs, it dampened his enthusiasm, and I did not want to devastate him with a list of software requirements.

I began to think about the most cost-effective solution to his problem, as more and more frequently I witness suchlike dilemmas. I thought of hosting solutions, and at one the blogs I found the following piece of news: “According to my research, in Poland THERE IS NO hosting service for a little company to ensure the conformity to the personal data protection law. In other words: 99% services store personal information illegally.” It wasn’t too optimistic. At least, a couple of hundreds of Polish zloty per month seemed to be the minimal price (excluding initial costs).

Today morning, when I was commuting to work, I had a flash: SARE conforms to GIODO requirements! I have often helped to fill in registration forms myself. It is enough to separate the personal information from an existing portal, and the problem’s gone. I asked my colleague from the customer service department, and the whole solution sounds promising. SARE does not charge their clients with any fees when helping out with personal data registration. There are no fees for personal data processing, either. I don’t know if I shall give my friend a ring as he may think I am trying to offer him an email marketing tool, and he “has got it included in the website, and he can send emails”. But when I tell him how much he will not have to spend on GIODO…

Tomasz Kusy

Tagi: GIODO