Online sales on platforms such as Allegro, Empik, and others – must a data processing agreement be signed with each one, and will there be third countries involved?

ANSWER

This is a broad topic. A data processing agreement is concluded by the controller (the data owner, i.e., the seller selling online) with each entity to whom they entrust the processing of their customers' data. Where processing is being entrusted to such large, well-known service providers, this is most often already regulated in the standard contractual terms used by such providers, for example in the case of Allegro: https://allegro.pl/regulamin/zalacznik/19. Can data transfers to third countries (outside the European Economic Area) occur? Yes. For example, if we run our own online shop and use the Google Analytics tool, we are in effect transferring personal data to the USA (/wiedza/blog/czy-google-analytics-jest-zgodne-rodo-decyzja-cnil: After this information is collected, it is sent to Google Analytics servers. All data collected by Google Analytics is stored in the United States.)