Law and compliance in a service business
Deadlines, consents and contracts that apply whether or not anyone reminded you about them.
A small firm's obligations do not arrive by post. The clock on a reply starts the day a complaint reaches the business, not the day someone notices it. This section gathers those moments in one place and shows, for each of them, what the time is counted from.
The first axis is customer data. Which form fields you genuinely need and which you collect just in case; what a processing agreement with your CRM, booking system or SMS gateway provider has to contain; when a small firm keeps a record of processing activities despite its modest scale; how to handle a request for erasure and when you may refuse. Marketing consent sits apart, because an appointment reminder and a promotional text are two different messages, and only one of them needs consent.
The second axis is deadlines and documents. Replying to a complaint, withdrawal from a distance contract and a service begun before that window closes, payment terms between businesses, booking terms and conditions, and the coming dates for KSeF and the AI Act. Wherever a matter turns specific to your case, we say so plainly: that is the point for a lawyer or a tax adviser, not for an article.
Questions this category answers
- How long do I have to answer a consumer complaint?
- When does KSeF start to apply to a small service business?
- What must a processing agreement with a CRM provider contain?
- Do I need consent to send an appointment reminder by text?
- A customer asks me to erase their data — what must I do?
- What payment terms can I set on an invoice to another business?
- Does a chatbot have to say that it is a machine?
Who it is for. For the owner who keeps track of deadlines, consents and contracts personally, because a small firm has no one else to do it.
What is not here. We do not replace a lawyer or a tax adviser — we show what to ask about, and when to ask.
Articles in this category — 15 articles, Page 1 of 2
A customer asks you to delete their data: how to handle the request in your CRM and when to reply
Customer requests data deletion — you have one month to reply. Find out when you must delete, when you can refuse, and which systems to check: CRM, calendar, SMS, email, accounting.
Read article → September 14, 2026 · 13 min readThe Polish Accessibility Act and a micro-business website: who is covered, who is exempt and why WCAG still pays off
Since June 28, 2025, Poland enforces the Accessibility Act. Check if it applies to your micro-business and why implementing WCAG standards still makes sense.
Read article → September 14, 2026 · 11 min readServices ordered online: starting before the 14 days and what happens on withdrawal
A customer buys a service package online and wants to start immediately, but a week later submits a withdrawal declaration. Learn how the 14-day withdrawal right works, when you can start the service earlier, and how to settle the performed portion.
Read article → September 14, 2026 · 16 min readData processing agreement with your CRM or software vendor: what to check before you sign
When you connect a CRM, online booking system, SMS gateway, or VoIP phone system, you are entrusting your customers' data to an external vendor. Check what the agreement must contain and what questions to ask.
Read article → September 14, 2026 · 10 min readB2B invoice payment terms in Poland: 60 days, interest and the EUR 40 compensation
A client pays an invoice whenever it's convenient, and the owner doesn't know what payment term is even allowed. We explain the 60-day statutory cap, when interest applies without a formal demand, how much compensation for debt recovery costs is owed, and how to build a reminder ladder.
Read article → September 14, 2026 · 13 min readConsent for SMS and email marketing in Poland: how to collect it and keep proof
Promotional SMS and newsletters need consent collected in advance under article 398 PKE. How to tell a service message from an advertising one, where to collect consent, and what proof to record.
Read article → September 14, 2026 · 15 min readRecord of processing activities in a small business: when you need one despite having fewer than 250 staff
A company employing fewer than 250 people is not automatically exempt from maintaining a record of processing activities. UODO indicates three situations where the obligation exists despite small scale.
Read article → September 14, 2026 · 12 min readTerms for online booking and client accounts in Poland: what the law requires
When you add appointment booking or client account registration to your website, your business provides an electronic service. The law specifies what the terms must contain and how to make them available — otherwise the provisions don't bind the client.
Read article → September 14, 2026 · 14 min readCustomer reviews on your business website: verification, negative reviews and the law
UOKiK clearly states that businesses must verify whether published reviews come from people who actually used their service or product. You cannot publish paid reviews or remove genuine negative reviews — violations can result in penalties of up to 10% of revenue.
Read article → September 14, 2026 · 12 min readData minimisation in your inquiry form: which fields you do not need and how to check
Every field in an inquiry form is data you become responsible for. The GDPR data minimisation principle says data must be adequate, relevant and limited to what is necessary. A three-question test for each field will help you eliminate unnecessary data and avoid liability.
Read article → September 14, 2026 · 10 min readCustomer complaints in a service business: 14 days to reply and how not to miss it
The law gives a business 14 days to reply to a consumer complaint, counted from the day it's received through any channel — silence means acceptance. Learn how to count that deadline, how a complaint differs from withdrawing from a contract, and how to build one intake process for complaints.
Read article → September 14, 2026 · 12 min readAI receptionist recordings and transcripts: what you must settle with the vendor and tell the caller
A call with an AI receptionist leaves a recording, a transcript and a CRM entry — and a specific party is responsible for each. What to settle with the vendor before signing and what to tell the caller, with real UODO enforcement decisions.
Read article →Other categories
What we do
Let us look at your numbers
Tell us how enquiries are handled today — how many there are, who picks them up, where they get lost. Aura walks the process with you and shows what can be taken off a person, and what is better left alone.
Talk to AuraThe home page with Aura opens. Give a company name — she looks at it in public data and shows what a client sees. No promises of a result.
Prefer to write? marketing@auraglobal-merchants.com
Next step
Let us check whether Aura fits your place
We do not take everyone: first we look at your processes, sales and current systems and tell you honestly whether it makes sense for us to come in. A few questions, about five minutes.
Take the assessment →