Virtual office and GDPR — data protection in practice (2026)

Who is responsible for the data — you or the operator

Your company is the data controller. You decide why the data is collected and what happens to it. The virtual office operator acts on that data on your behalf and, in that role, is a processor. The split sounds formal, but the consequence is practical: if the operator fails, the controller's liability still sits with your company.

The GDPR only permits you to entrust data to a party offering sufficient guarantees of appropriate safeguards. Vetting the operator is therefore not caution or good practice — it is the controller's obligation, which means yours. It is the obligation people forget most often, because it looks like a courtesy towards a supplier.

Why the operator holds your data at all

Providing a registered address is an activity covered by anti-money-laundering law. The operator is an obliged institution and, before releasing the address, has a statutory duty to establish the identity of the client and of the beneficial owner. The ID document it asks for when you sign is not officiousness.

That particular data is not processed on your instruction — it is processed because a statute requires it. Different legal basis, different rules: you cannot withdraw it, and the operator cannot delete the records early even if you both wanted to. It keeps them for five years after the relationship ends. The same duty determines which documents it will ask for when you register a company at the address.

An operator that does not ask for an ID document is not protecting your privacy — it is breaking the law. That one is the risk, not the operator that asks.

What a service contract cannot replace

The address contract governs the service: what the operator does, for how much and for how long. Entrusting personal data takes a separate document, required by Article 28 GDPR, and it has to settle four things. Our contract terms are set out on the virtual office page.

What the operator may do with your mail

Protection of correspondence neither begins nor ends with the GDPR. Confidentiality of communication is guaranteed by Article 49 of the Polish Constitution, and reading someone else's letter without authorisation is an offence under Article 267 of the Criminal Code — regardless of what the parties wrote into their contract.

Scanning is lawful because it happens on your instruction and on your behalf. Reading for any other purpose does not become lawful through any contractual clause.

What to ask before you entrust the data

An evasive answer to any of the six questions below tells you more about an operator than every assurance about security put together. They concern data processing only — you ask about the service itself separately.

How this works at The Nest

We sign the processing agreement as standard, together with the address contract, rather than on request. Access to a letter from the moment it enters the building until it is handed to the client rests with reception alone — not an organisational detail but a security measure, because official and court correspondence contains data no one but the addressee should see.

Data collected under anti-money-laundering law we keep for the five years the statute requires, and we say so before the contract is signed, not after. How the site itself processes data is set out in the privacy policy.