Consent to Contact and Call Recording in Poland

Three acts a restaurant keeps confusing: confirming, reminding, offering

Ask an owner what messages the venue sends to guests and the answer is one word: "messages". Ask a lawyer, and the same stream splits into three things that live under different rules and are proved by different evidence.

Direct marketing — an approach to a named person carrying an offer. Under Polish electronic communications law (Prawo komunikacji elektronicznej, Dziennik Ustaw 2024 item 1221) it may not be sent to a subscriber or an end user through automatic calling systems or telecommunications terminal equipment unless that person gave consent beforehand — art. 398 ust. 1.

Booking confirmation — a message needed to perform what the guest asked for. It is not marketing, and it does not become marketing because it travels through the same channel. Nobody books a table and then argues that being told the table exists was an unsolicited offer.

The third thing sits between them and is the one that gets people into trouble: the reminder that carries a nudge. "Your table is at 19:00, and by the way we now serve breakfast" is two messages glued together. The first half is performance of a request. The second half is an offer to a named person — that is direct marketing, and the glue does not change its nature.

Where the guest data physically sits while all this happens is a separate question with a separate answer — that one is handled in automation and personal data: where the customer data physically lives.

Direct marketing needs prior consent — where that rule sits in Polish law

Art. 398 ust. 1 of Prawo komunikacji elektronicznej forbids using automatic calling systems and telecommunications terminal equipment — a phone in a hand, a messaging client on a laptop — to send commercial information, including direct marketing, to a subscriber or an end user unless that person previously consented. Two words carry the burden: previously and consented. Consent obtained after the call was made is not consent under this article; it is an apology.

The act defines both words rather than leaving them to intuition. A subscriber is a user who is a party to a contract for electronic communications services (art. 2 pkt 1). An end user is an entity using a publicly available electronic communications service, or requesting one, for its own needs (art. 2 pkt 86). Your guest is the second category on nearly every call you make.

Three further paragraphs of the same article are worth knowing because they change what a valid consent looks like:

• art. 398 ust. 2 — consent may be expressed by the person disclosing an electronic address that identifies them, for the purpose of receiving commercial information at that address. This is the legal shape of "leave your email and we will write to you", and it is narrow: the consent covers that address and that purpose.
• art. 398 ust. 3 — sending must not happen at the recipient's cost.
• art. 398 ust. 4 — sending without prior consent is also an act of unfair competition under the 1993 statute on combating unfair competition. That is a second front, opened by your competitors rather than by a regulator.

Read that twice: for a small venue, the fixed sum is the higher number.

What none of this touches is whether a given campaign is worth running at all. That is arithmetic, not law, and it lives in return on advertising counted on margin.

A booking confirmation and a new-menu mailing rest on different grounds

The two messages look identical in your outbox. They are not the same act, and the difference is visible in one question: did the guest ask for this?

The new-menu mailing has no request behind it. Nobody asked. That is why it needs consent obtained in advance, and why "they are our regular guests" is not a legal category: regularity is a business fact, and the law asks about a permission.

The mirror trap costs money rather than fines: venues frightened by the consent rule stop sending confirmations too, and their no-show rate climbs. Confirmations are not what the rule is aimed at. The chain that actually reduces empty tables is described in no-show in a restaurant: the confirmation chain, and none of its links is marketing.

Recording the call is a separate act with its own basis

Basis for recording — a reason to keep a person's voice that is separate from the permission to contact them at all. Recording a conversation is processing in its own right, and the notice about it has to be heard before the recording starts, not after the call ends.

Polish electronic communications law protects the secrecy of electronic communications. Art. 386 ust. 1 lists five categories that this secrecy covers, and the second of them is the electronic message itself. Art. 386 ust. 2 then states the default plainly: processing information covered by that secrecy by persons other than the sender and the recipient of the message is prohibited — except in four listed cases.

Two of those four are the ones a restaurant can actually stand on:

• art. 386 ust. 2 pkt 2 — it happens with the consent of the sender or the recipient whose data it is;
• art. 386 ust. 2 pkt 3 — the recording of electronic messages and the related transmission data is necessary as part of a lawful commercial practice, for the purpose of providing evidence of a commercial transaction, or for the purpose of communication in commercial activity.

The second one is not a loophole and must not be used as one. It is written for the situation where a business records order calls so the order can later be proved — a disputed booking for twelve, a special-diet instruction, an agreed price. It does not stretch to "we record everything in case it is useful", and it does not remove the notice duty. It gives you a basis; the guest still has to be told.

Art. 387 ust. 1 puts the duty to keep that secrecy on the entities taking part in electronic communications activity, and art. 387 ust. 2 adds the duty of due care in securing devices, networks and data against disclosure of it. In plain terms: having a basis to record does not end the obligation, it starts a different one.

If the person on the line is your own employee rather than the guest, a second statute joins in. The Labour Code (Kodeks pracy, Dziennik Ustaw 2025 item 277) regulates monitoring at work. Art. 22³ § 4 says that the rules on email monitoring apply accordingly to other forms of monitoring, where their use is necessary to achieve the same purposes — and recording an employee's calls is one of those other forms. Art. 22³ § 2 draws a limit that is easy to cross: monitoring must not breach the secrecy of correspondence or other personal rights of the employee.

The employer-side procedure comes from art. 22² through the reference in art. 22³ § 3: the purposes, scope and manner of monitoring are set in the collective agreement, in the work regulations or in an announcement (art. 22² § 6); employees are informed no later than 2 weeks before it is launched (art. 22² § 7); and the monitored premises are marked visibly and legibly, with signs or sound announcements, no later than one day before launch (art. 22² § 9). Those two periods are notice periods. They are not retention periods, and this page does not treat them as such.

What a guest must hear before the recording started

A notice cannot be moved to the end of the call, because a notice after the fact cannot influence a decision already made. If the guest learns at minute four that minutes one to three are on tape, the choice they were entitled to never existed.

The wording that has to be said, not implied

Four things belong in the sentence, and they fit into one breath:

1. That the call is recorded. Not "may be recorded" — that phrasing is a hedge, and a hedge tells the guest nothing about their own call.
2. Why. The purpose you actually chose: confirming order details, proving what was agreed, training. One purpose, stated, not a list of every purpose imaginable.
3. Who is doing it. The name of the venue, not the name of the phone system vendor.
4. Where the rest of the information lives. One address where the full notice sits.

Under art. 400, the rules on personal data protection apply accordingly to obtaining the consent of a subscriber or an end user. That single sentence is what pulls the whole information duty of data protection law into a phone call. It is also why the notice cannot be reduced to a beep: a beep tells a person something is happening, not what, why, or by whom.

An automated line adds a fifth item, and it is not optional. If the voice on the line is a machine, the guest is entitled to know that before they start explaining a nut allergy to it. What Polish law says about machines in guest service is a page of its own: artificial intelligence in guest service and what Polish law says. The reception side of the same problem — who picks up and what they are allowed to do — is the subject of AI reception.

Consent per channel: phone, email and messenger are not one consent

Channel consent — permission to make contact by one specific means. Phone, email and messenger are different channels; one checkbox covering all three does not produce three consents, it produces one ambiguous record nobody can rely on.

The shape of art. 398 ust. 2 is the clearest argument here: consent may be expressed by disclosing an identifying electronic address for the purpose of sending commercial information to that address. The permission is tied to the address it was given for. Extending it to a phone number the guest also happened to leave is an extension you invented, not one the guest gave.

So the record carries four things per person and per channel: the channel, the moment consent was given, the wording that was shown, and where it came from. The wording matters most, because consent to "receive information from us" and consent to "receive promotional offers by phone" are not the same permission — and a year later nobody remembers which was on the screen.

This is a job for the place where guest history already lives rather than for a spreadsheet nobody opens — see CRM for the record itself and automated messages for the sending side that has to read it before every send.

The booking form: the minimum set and what each extra field costs

A booking form is the cheapest place to break everything above, because every field on it is a decision about data you will later have to justify keeping.

The minimum set

That is the minimum. Everything below the line is a choice you make with your eyes open:

• Date of birth collected for birthday offers is marketing data and is not covered by the booking. It needs the consent, and it survives scrutiny far better if you say plainly what it is for.
• Dietary requirements are frequently health data in substance: genuinely useful and genuinely sensitive. A free-text field guests fill voluntarily is a different thing from a mandatory dropdown that forces the disclosure.
• A second phone number "just in case" has no purpose you can name, which is exactly the test it fails.

What each extra field costs

Each extra field costs three things at once: a lower completion rate, one more item you must justify keeping, and one more item to delete when the guest asks. The first cost is immediate; the other two arrive on the worst possible day.

The completion side of this is not speculation — the reasons people abandon a form before finishing it are collected in why customers do not leave inquiries. The mechanics of the form itself are the subject of lead forms, and the booking flow behind it is booking.

One more rule belongs on the form and is routinely missed. Storing information on the guest's terminal device, or reading information already stored there — what a website calls cookies — is allowed under art. 399 ust. 1 only if the person is first informed, unambiguously and understandably, about the purpose and about how to set the conditions through their own software settings (pkt 1 lit. a and b), consents after that information (pkt 2), and the storage changes nothing in the device configuration (pkt 3). Consent may be given through software settings (art. 399 ust. 2). None of this applies where storage or access is necessary to transmit a message or to deliver a service the person actually requested (art. 399 ust. 3 pkt 1 and pkt 2).

Doing this wrong is an offence in its own right under art. 444 ust. 1 pkt 82. The same form is also subject to accessibility rules from a different direction, and those are covered in accessibility of the site and online ordering.

Withdrawing consent so that it stops collecting complaints

Three properties make a withdrawal mechanism work, and all three are operational rather than legal:

It has to be as easy as the consent was. If consent was one tap on a form, withdrawal cannot require an email with a subject line in a set format. The asymmetry is what generates complaints, and complaints generate supervisory attention.

It has to reach the sending system, not a person. A withdrawal that depends on somebody remembering to update a list will be forgotten exactly once, and that once is the one that gets reported. It must switch the state in the same record the sender reads before every send.

It has to be granular where the consent was granular. If you took consent per channel, withdrawal per channel is what the guest expects. Turning off everything because they asked to stop the calls is a loss you inflicted on yourself.

The systemic version of this is a single queue that every inbound signal lands in, whatever door it came through; that pattern is described in one queue for handling inquiries, and what happens to a request after the first conversation is in follow-up automation.

Retention of recordings and correspondence: why "forever" is not an answer

We looked for a statutory retention period for call recordings in the acts this page stands on, and there is none there. Prawo komunikacji elektronicznej does not set one for this case. The Labour Code sets a period for image recordings from workplace monitoring — the word in the act is obrazu, image — and that is video, not voice. Carrying that figure over to a recorded phone call would mean quoting a number the law did not give for the thing we are discussing, which is worse than quoting no number at all: a plausible number reads as a rule.

So the honest statement is this. The period is set by the holder of the data, derived from the purpose it was collected for, and it must be capable of being justified. If the purpose is proving what was agreed on a booking, the period follows the life of that obligation. If the purpose is training, the period is short by construction — a recording kept for training and never used for it has quietly acquired a different purpose.

Three tests will tell you whether your own period is defensible:

1. Can you name the purpose in one sentence, without the word "just in case"? If not, the period is not derived from anything.
2. Does the period end by itself? A retention rule that requires a person to remember to delete is a rule that produces an archive.
3. Would you say the number out loud to the guest? If the answer makes you uncomfortable, the discomfort is information.

What the law gives you here is a security duty rather than a clock. Art. 401 requires appropriate technical and organisational protection measures and names a floor of three: access only by a person holding an authorisation from the controller (pkt 1); protection of stored and transmitted data against destruction, loss, alteration and unlawful access or disclosure (pkt 2); a security policy for the processing (pkt 3). An archive with no defined period and no access control fails that floor twice over.

The supervisory authority: where Polish law names it

Supervisory authority — art. 402 ust. 1 of Prawo komunikacji elektronicznej requires an electronic communications service provider to notify Prezes Urzedu Ochrony Danych Osobowych — referred to in the act itself as Prezes UODO, the President of the Personal Data Protection Office — of a personal data breach, within the time and on the terms set out in Commission Regulation (EU) No 611/2013.

• Prezes UODO imposes the fines under art. 445 ust. 1 — for failing to implement the art. 401 protection measures, for failing the notification duties in art. 402 ust. 1 and ust. 4, and for failing to keep the register of personal data breaches under art. 405 ust. 1. The ceiling there is up to 3 % of the fined entity's revenue for the previous calendar year.
• Prezes UKE, the President of the Office of Electronic Communications, imposes the fines for the offences listed in art. 444 — including marketing without prior consent (pkt 81) and mishandling data on terminal devices (pkt 82). Art. 446 ust. 1 sets that at up to 3 % of previous-year revenue, and art. 446 ust. 5 adds the separate rule already quoted for the art. 398 consent: up to 3 % of revenue or up to 1 000 000 PLN, whichever is higher.

Where the guest database itself lives, and what it has to be able to show, is a system question rather than a legal one — see an AI restaurant management system.

Two measurements that tell you whether the rule is actually working

A policy nobody measures is a document, not a practice. Two ratios are enough, and both can be computed from records you already have.

Share of contacts with recorded consent = Contacts with stored consent and its timestamp ÷ All marketing contacts

• Contacts with stored consent and its timestamp — outbound marketing contacts where the sender could read a consent record with a time and a channel before sending, pieces;
• All marketing contacts — every contact classified as marketing in the period, pieces;
• the result is dimensionless, a share from 0 to 1.

Worked: 96 ÷ 120 = 0.80, that is 80 %. Reverse check: 0.80 × 120 = 96.

The denominator trap is the reason this ratio is usually flattering. If booking confirmations are swept into the count, they land in both parts at once — every confirmation trivially has the booking behind it — and the share climbs on its own: 436 ÷ 460 = 0.948. Nothing changed in the venue. Only the counting did. Confirmations do not belong in either part of this fraction.

Consent age = Today − Consent timestamp

• Today — the date of the measurement;
• Consent timestamp — the recorded moment consent was given, per person;
• the result is a number of days.

Worked: consent given on 2024-03-11, measured on 2026-08-28, gives 900 days.

Age alone does not cancel a consent. But a list where half the consents are older than three years, and where the channel has changed since, is worth rebuilding rather than defending.

An order you can hang on the wall by the phone

The wall sheet

1. Before dialling: is this call performance of something the guest asked for, or an offer? If it is an offer, is there a consent record with a timestamp for this channel?
2. On answering: the recording notice comes before anything else — before the greeting collects a name.
3. In the notice: that it is recorded, why, by whom, and where the full information is.
4. On the form: the minimum fields, one consent checkbox that is not pre-ticked and not bundled with the terms.
5. On a withdrawal: change the state in the record the sender reads, keep the trace, do not turn off more than was asked.
6. On retention: a period derived from the purpose, ending by itself, that you would say out loud.
7. On a breach: the authority is named in the act — Prezes UODO, art. 402 ust. 1.

The neighbouring question of what you may ask a guest for afterwards, and what you may do with what they write, sits in guest reviews and what the law allows.

Frequently asked questions

Does a restaurant need consent before calling a guest with an offer?

Yes. Art. 398 ust. 1 of Prawo komunikacji elektronicznej prohibits using automatic calling systems or telecommunications terminal equipment to send commercial information, including direct marketing, to a subscriber or an end user unless that person consented beforehand. The word that does the work is beforehand: consent collected during or after the call does not cure it.

Is a booking confirmation the same as marketing?

No. A confirmation performs what the guest asked for, and there is a booking record standing behind it. It does not turn into marketing because it goes out through the same channel as your offers. It does turn into marketing the moment you attach an offer to it — at which point the whole message needs the consent, not just the attached half.

Do I need a separate basis to record a phone call?

Yes. The permission to contact someone and the permission to record them are different acts. Art. 386 ust. 2 prohibits processing information covered by the secrecy of electronic communications by persons other than the sender and recipient, except in listed cases — among them consent of the sender or recipient (pkt 2), and recording within a lawful commercial practice for the purpose of evidence of a commercial transaction or communication in commercial activity (pkt 3).

When must the guest be told that the call is recorded?

Before the recording starts, which in practice means before the greeting. A notice delivered later cannot restore a choice that has already been taken away, and the greeting is exactly where guests volunteer a name and a phone number. For monitoring on the employee side, the Labour Code sets its own advance periods: information to employees no later than 2 weeks before launch (art. 22² § 7), and marking of the premises no later than one day before launch (§ 9).

Is one checkbox enough for phone, email and messenger?

No, and it is also bad for you commercially. Art. 398 ust. 2 ties consent expressed through an electronic address to sending at that address, which is a narrow permission by design. Separate consents also mean a guest who wants the calls to stop can stop the calls without leaving your list entirely.

How long may booking data and recordings be kept?

The acts this page relies on do not set a period for call recordings, and this page does not invent one. The holder of the data sets the period from the purpose the data was collected for and must be able to justify it. Two useful tests: the period should end without anyone remembering to act, and you should be willing to state it out loud to the guest.

Which authority supervises this in Poland?

Both a data protection authority and a communications authority, in different lanes. Prezes UODO — named directly in art. 402 ust. 1 — receives breach notifications and imposes the fines under art. 445 ust. 1. Prezes UKE imposes the fines for the offences in art. 444, including marketing without prior consent, with the separate ceiling in art. 446 ust. 5 of up to 3 % of previous-year revenue or up to 1 000 000 PLN, whichever is higher.

Sort your guest messages into three piles: performing a request, reminding about it, and offering something. The third pile is usually bigger than anyone expects, and it is the only one that needs a consent record with a timestamp — see the whole restaurant section at /en/restaurants.