E-commerce Legal Services

On every price reduction you must show the lowest price of the item in the 30 days before the promotion — otherwise the "promotion" breaches consumer law. Omnibus also requires you to mark verified reviews, not publish fake ones, and disclose the criteria for ranking offers.

Breaches carry UOKiK fines of up to 10% of annual turnover. We set up your pricing mechanics, promotion banners and review collection so they are compliant — and show you where shops most often slip up.

Since 2023 a single "conformity with the contract" regime applies, but digital content and services have their own rules — including a duty to provide updates and liability for lack of conformity throughout the supply period. The consumer no longer relies on the old statutory warranty but on rights to repair, replacement, a price reduction or withdrawal.

If you sell subscriptions, online courses or apps, your terms and complaints procedure must reflect this. We set them up to be compliant while not giving away more than the law requires.

As a rule a consumer has 14 days to withdraw from a distance contract without giving a reason — and if you fail to inform them properly, that period extends up to 12 months. There are exceptions, though: made-to-order goods, sealed products opened after delivery, or digital content supplied with the consumer's express consent.

Well-drafted exceptions and a proper withdrawal notice protect you from mass returns and disputes. We identify which of your products fall under exclusions and how to communicate that correctly in the shop.

The minimum is a privacy policy, a cookie policy with a consent mechanism, a record of processing activities (RoPA), and data-processing agreements with vendors who handle your customers' data. Add information clauses in forms and a procedure for handling rights (e.g. access, erasure).

A bare "I accept" cookie banner without real consent and without documentation is a typical gap the data-protection authority picks up. We prepare the full set and keep it audit-ready.

The duty to issue invoices in KSeF starts in stages: from 1 February 2026 for large firms (sales over PLN 200m), and from 1 April 2026 for the remaining businesses. Receiving invoices in KSeF is required from February 2026, and a penalty-free transition period runs to the end of 2026.

For a shop this means changes to settlements with vendors and to your payment terms. We tell you exactly from when the duty applies to you and how to adapt contracts and invoicing processes.

You cannot block an EU customer's access to your shop or automatically redirect them to another version of the site solely because of their nationality, residence or place of establishment — the Geo-blocking Regulation (EU) 2018/302 prohibits it. A foreign customer must be able to buy on the same terms as a domestic one in the same situation (for example with collection or delivery where you actually sell).

This does not mean a single price across the EU or an obligation to deliver everywhere — you may run different country offers and limit your shipping area, as long as you do so without discrimination and do not block access. We set up your terms and checkout logic to comply, without forcing you into deliveries you do not want to make.

Your payment provider handles authorisation and, where PSD2 requires it, strong customer authentication (SCA); but it is the shop that refunds the consumer — as a rule within 14 days of withdrawal and by the same payment method (unless the consumer agrees to another, at no extra cost).

For returned goods you may withhold the refund until you receive the goods back or evidence they were sent. A chargeback is a card-scheme procedure, not a court one — so evidence that the order was fulfilled and clear refund terms are decisive. We tidy up your payment-provider contract, refund deadlines and complaints procedure to limit your losses in payment disputes.

Direct marketing — email, SMS and phone calls — requires the recipient's prior, freely given consent; since 10 November 2024 this is governed in Poland by the Electronic Communications Law, which replaced the former Article 10 of the e-services Act and Article 172 of the Telecommunications Law.

Consent must meet the GDPR standard — freely given, specific, informed and withdrawable at any time — and be clearly distinguishable from other statements; a pre-ticked box does not meet it. We set up your sign-up forms, consent wording and documentation so an email/SMS campaign is compliant and resistant to a complaint to the data-protection or telecoms authority.

Selling under your own brand makes you the manufacturer, and bringing goods in from outside the EU makes you the importer; in both cases you take on product-safety duties (GPSR) — documentation, labelling, traceability and reacting to hazards — and the product must have an EU "responsible person".

Add VAT settlements (the optional IOSS scheme for B2C consignments up to EUR 150) and liability to the consumer for the goods' conformity, which rests with the seller anyway — even if a supplier in Asia physically ships it. We help set up your dropshipping model so you know what you are actually responsible for.

As a hosting intermediary you are not liable for sellers' content as long as you do not know it is illegal and remove it expeditiously after a valid report (Article 6 DSA); a separate duty is the notice-and-action procedure (Article 16 DSA).

Actively shaping or promoting offers can remove that protection, and where the platform appears to be the seller the consumer may be protected despite the intermediation. In addition, the P2B Regulation (EU) 2019/1150 imposes duties towards sellers — ranking and terms transparency — though the internal complaint-handling system does not apply to small enterprises. We draft seller terms, notice procedures and ranking rules to protect the platform and meet both the DSA and P2B.

The heaviest are UOKiK fines for infringing the collective interests of consumers — up to 10% of annual turnover — and GDPR fines imposed by the data-protection authority, reaching EUR 20m or 4% of worldwide turnover.

Add market-surveillance sanctions for product-safety failures (GPSR) and claims from consumers themselves. In practice most of the risk is removed cheaply and in advance — with up-to-date terms, correct promotional pricing and a complete set of GDPR documents — rather than paying after an inspection.

Since 28 June 2025, e-commerce services must meet the digital-accessibility requirements of the European Accessibility Act (implemented in Poland by the accessibility-requirements act), based on the WCAG standard — with exemptions, including for micro-enterprises providing services.

In practice your shop, app and checkout must be usable by people with disabilities — screen-reader output, contrast, keyboard operation and clear error messages. We check whether the duty applies to you and what changes to the service and documentation are needed, before a supervisory authority does.