Starting an Online Store in Poland: Registration, Consumer Law, GDPR, and Tax Basics

Starting an Online Store in Poland: Registration, Consumer Law, GDPR, and Tax Basics

An online store in Poland is a form of distance selling where a trader offers goods or digital services to customers through a website or app, and the contract is concluded without the simultaneous physical presence of the parties. From a legal perspective, this typically qualifies as a “distance contract” (when concluded with a consumer) under the Act on Consumer Rights [4] and as a service provided by electronic means under the Act on Providing Services by Electronic Means [5], which triggers specific registration, consumer protection, data protection, and tax obligations.

Business registration and legal structure for e-commerce in Poland

Before the first sale, the business model should be aligned with the correct legal form and registration route. Common options include:

• Sole proprietorship (jednoosobowa działalność gospodarcza) registered in CEIDG – often used for small-scale operations and faster start-up.
• Limited liability company (sp. z o.o.) registered in the National Court Register (KRS) – frequently chosen for risk management, scalability, and investor-friendly structure.

Key legal consequences of structure selection include liability exposure, governance requirements, reporting, and the ability to bring in shareholders. For sp. z o.o., incorporation requires articles of association and registration in KRS under the Commercial Companies Code [1]. For sole proprietorship, registration is made via CEIDG under the Entrepreneurs’ Law [2].

Depending on the planned activities, additional registrations may be needed, including:

• VAT registration (mandatory in some cases, including when the business is required/chooses to be an active VAT taxpayer, and in certain cross-border models depending on EU VAT rules and thresholds).
• Beneficial owner disclosure for companies to the Central Register of Beneficial Owners (CRBR) under AML rules [3].
• Sector permits if selling regulated products (e.g., alcohol, medicinal products/medical devices, or other regulated categories). The exact requirements depend on the product catalogue and supply chain.

Website and pre-contract information duties under Polish consumer law

Polish e-commerce must be designed around mandatory disclosures. The core framework is the Act on Consumer Rights [4] and the Act on Providing Services by Electronic Means [5], supported by EU consumer rules. The store must provide clear, accessible information before the customer places an order, including:

• business identification data and contact details,
• main characteristics of goods/services,
• total price (including taxes) and delivery costs,
• payment, delivery, and complaint procedures,
• right of withdrawal rules (if applicable) and model withdrawal form,
• functionality and interoperability (compatibility) information for digital content/services, where relevant.

Regulatory risk is often not the “missing policy” itself, but inconsistency between marketing, product pages, checkout, and terms. In disputes, unclear wording may be interpreted against the trader, and consumer authorities may view non-compliant UX patterns as misleading.

Withdrawal (returns) and refunds – rules that affect logistics and cash flow

As a baseline, consumers buying at a distance have a 14-day right of withdrawal under the Act on Consumer Rights [4]. The detailed mechanics matter operationally:

• the period is generally counted from receipt of goods (with specific rules for multiple deliveries),
• refund timing and method requirements apply,
• certain categories are exempt (e.g., custom-made goods, sealed goods not suitable for return after opening for health/hygiene reasons, and certain digital content/digital services scenarios) – applicability depends on facts and correct disclosures.

For digital content/digital services, the “loss of withdrawal right” is conditional and requires proper consumer request/consent and confirmation (including acknowledgement of losing the right, where applicable), so checkout flows should be reviewed for enforceability [4].

Complaints, warranty, and conformity of goods

Consumer complaint handling in Poland is driven by statutory conformity rules. For consumer sales, the seller’s liability for lack of conformity and remedies is regulated in the Act on Consumer Rights [4] (as amended to implement EU rules on sale of goods and on digital content/digital services). This impacts internal processes, supplier contracts, and response timelines.

GDPR and cookies: data protection basics for online stores

Most online stores process personal data for order fulfillment, payments, delivery, returns, marketing, and analytics. The governing act is the GDPR (Regulation (EU) 2016/679) [6], supplemented by Polish sector rules. Key baseline steps include:

• mapping processing purposes, legal bases, and data categories,
• issuing a GDPR-compliant privacy notice (Articles 13-14 GDPR),
• implementing data processing agreements with processors (e.g., hosting, email tools, payment providers) – Article 28 GDPR,
• setting retention periods aligned with limitation periods and accounting obligations,
• implementing technical and organizational measures (Article 32 GDPR),
• documenting breach response and, where applicable, DPIA (Article 35 GDPR).

Cookie compliance is connected primarily to the Telecommunications Law and EU ePrivacy rules (implemented in Poland) as well as GDPR consent standards, especially for non-essential cookies (analytics, marketing). The correct approach depends on the specific tracking technologies, purposes, and roles (controller/joint controller) – and should be assessed case-by-case.

Tax basics: VAT, OSS, PIT/CIT, and practical e-commerce triggers

Tax positioning should be addressed early because it affects pricing, invoicing, and marketplace integrations. The main areas are:

• VAT under the VAT Act [7] and EU VAT rules. Cross-border B2C sales of goods and certain services to consumers in other EU countries may trigger the One Stop Shop (OSS) and specific place-of-supply rules.
• Income tax – PIT for individuals (sole proprietors) under the PIT Act [8] or CIT for companies under the CIT Act [9].
• Accounting and evidence – proper sales records, returns evidence, and documentation of promotions/discounts.

Important: marketplace sales (platform-based) and cross-border fulfillment can materially change VAT responsibilities and reporting. Warehousing goods in another country, using fulfillment services, or selling to multiple EU jurisdictions can create additional registrations and compliance work.

Operational compliance that reduces disputes and regulatory exposure

Well-designed legal implementation supports business continuity. Typical risk points include:

• Terms and conditions not aligned with the actual checkout flow, delivery promises, or complaint handling.
• Incorrect pricing communication and discount presentation – particularly relevant under EU “Omnibus” consumer rules implemented into Polish law (including amendments to the Act on Consumer Rights) [4].
• Incomplete company identification and missing service provider disclosures on the website [5].
• GDPR gaps with marketing consents, newsletter flows, and third-party tracking [6].

This is informational material, not legal advice. For a legally robust launch plan aligned with the specific product range, sales channels, and cross-border setup, it is recommended to contact us at Lawyersinpoland.com by Kopeć & Zaborowski.

FAQ: Starting an online store in Poland

1) Is a Polish company required to sell online to customers in Poland?

Not always. The required structure depends on where the business is established, where management is located, and how sales are performed. However, Polish consumer rules (when selling to consumers in Poland), GDPR, and tax rules may still apply when targeting Polish customers, and VAT obligations may arise depending on the model.

2) What documents should be published on a Polish online store website?

Typically: terms and conditions, privacy notice (GDPR), cookie information and (where required) a consent mechanism, withdrawal information with a model form, complaint procedure details, and clear seller identification data. Exact scope depends on products, digital elements, and sales channels [4][5][6].

3) Does every Polish e-commerce store have to accept returns within 14 days?

As a rule for consumer distance contracts, yes – the 14-day withdrawal right applies, but statutory exceptions exist and must be assessed against the actual goods/services and how the sale is structured and disclosed [4].

4) When is GDPR consent needed in an online store?

GDPR consent is not the only legal basis, and many processing activities rely on contract necessity or legal obligation. Consent is commonly required for certain marketing activities and for non-essential cookies/tracking, depending on the technology and purpose [6].

5) Is VAT registration always required for an online store in Poland?

No. VAT status depends on turnover thresholds, the nature of sales (domestic vs cross-border), and the specific goods/services. Cross-border sales can trigger OSS or other VAT duties even when domestic turnover is low, depending on circumstances [7].

6) Can selling via marketplaces change legal responsibilities?

Yes. Marketplaces may impose platform terms, consumer communication standards, and specific VAT treatment for certain transactions. Liability allocation for complaints, returns, and data roles should be reviewed contractually and operationally.

Bibliography

1. Act of 15 September 2000 – Commercial Companies Code (Kodeks spółek handlowych).
2. Act of 6 March 2018 – Entrepreneurs’ Law (Prawo przedsiębiorców).
3. Act of 1 March 2018 on Counteracting Money Laundering and Terrorist Financing (AML Act).
4. Act of 30 May 2014 on Consumer Rights (Ustawa o prawach konsumenta), as amended.
5. Act of 18 July 2002 on Providing Services by Electronic Means (Ustawa o świadczeniu usług drogą elektroniczną).
6. Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR).
7. Act of 11 March 2004 on Goods and Services Tax (VAT Act) (Ustawa o podatku od towarów i usług).
8. Act of 26 July 1991 on Personal Income Tax (PIT Act) (Ustawa o podatku dochodowym od osób fizycznych).
9. Act of 15 February 1992 on Corporate Income Tax (CIT Act) (Ustawa o podatku dochodowym od osób prawnych).