When PIP reclassifies a contract of mandate: a staffing register your firm can defend
On 18 August 2026 Poland's National Labour Inspectorate published the first numbers after 8 July: 690 complaints, more than 100 inspections, 121 written orders and 201 voluntary conversions from a civil-law contract to an employment contract. Your staffing agency does not need another compliance slide. You need a register of mandates, hours and instructions you can put in front of an inspector.
On 18 August 2026 the National Labour Inspectorate published the first results of its reviews of whether a civil-law contract was the right choice. This is not a “something will change next year” press note. It is a field report after 8 July 2026, when inspectors received new tools to examine and reclassify civil-law contracts concluded in conditions that belong to an employment relationship. From 8 July to 13 August the Inspectorate received 690 complaints. Since 1 January 2026 the total is already 1,794 — against 619 in the same stretch of the previous year. If you run a staffing agency, a placement desk or temporary work, those figures are not television wallpaper. They are your inspection season.
Chief Labour Inspector Janusz Krasoń said plainly that a large share of complaints concern periods that ended before 8 July, and that many filings have formal gaps. That does not excuse disorder today. Since 8 July inspectors have already opened more than 100 inspections and closed 35. They issued 121 written orders to confirm employment under a contract of employment. By the date of the communiqué no administrative case for a decision of a district inspector had yet been opened. In parallel, employers themselves converted 201 civil-law contracts into employment contracts — before the inspector had finished the findings. Your register of civil-law contracts will either make that move honestly or hide it. The second option will not survive a second week of inspection.
This article does not replace the staffing-agency system piece. That text is about the candidate card, KRAZ and GDPR. Here we add what the August PIP note will not leave alone: the label on the contract does not defend the facts. If a person receives hours, a place, tools and instructions like an employee, and the file says “mandate”, the inspector will not ask about the colour of your ATS. The inspector will ask about subordination. A civil-law contract register has to show who, on what basis, since when, for which user undertaking, which hours were confirmed, which instructions were logged and when the contract was meant to end. GESOFT — Paweł Matusiak, Laravel, Vue, Android — builds that panel when Excel, Telegram and three SaaS tools fail to hold a hall together. If Traffit plus payroll is enough — buy those.
We do not invent statutory fines and we do not promise that an app will “reclassify the contract for you”. We do not replace PIP, ZUS, the revenue administration or the National Register of Employment Agencies. We do not burn a working system if it already holds one truth about a person. Write to contact: how many people sit on a mandate and how many on an employment contract, how many client halls, whether you have a user-undertaking portal, whether hours live in the plant’s time clock. The offer comes back in 24 hours. If a boxed product is enough, we will say so. If the model is odd (piecework, night shift, third-country nationals, several client VAT numbers) we will say you need your own panel, not another valley subscription.
What PIP wrote on 18 August 2026 — and what you must not invent on top
The note is dated 18 August 2026 and covers 8 July–13 August 2026 for complaints and 8 July–6 August for voluntary conversions. Those windows are narrow. Do not stretch them into “the whole reform year” or “every agency in Poland”. PIP wrote that complaints arrive from small firms and large ones, from private and public employers, from services, trade and manufacturing. There are cases involving healthcare providers, nationwide restaurant chains, platform work and the security sector. No single industry was named as dominant. If a conference slide says “PIP is targeting agencies”, the communiqué does not say that. It says the tool is general and the complaints are scattered.
The vast majority of complaints concern an incorrect contract of mandate or a contract for services to which the mandate rules apply. That is your everyday document, not an exotic B2B invoice. An agency that staffs a hall, a warehouse, a security post or a catering line lives on mandates “because that is faster when a shift is short”. After 8 July speed is not an argument. The argument is the facts: does the person decide time and method, or do they receive a roster and instructions. A civil-law contract register has to keep those facts next to the contract, not in the head of a coordinator who is driving to a second site on Friday.
Seven decisions of the Chief Labour Inspector on individual interpretations are a small sample, but the direction is readable: in 2 cases the GIP accepted the civil-law qualification, in 5 he rejected it and held that an employment relationship was the proper choice. We do not project those proportions onto your agency. We take the operational lesson: the facts you send in an interpretation request must match the facts in your system. If the request says “freedom over working time” and the roster shows a 06:00–14:00 shift with the plant’s attendance list, you do not have an interpretation. You have a contradiction the inspector will see faster than counsel.
- 690 complaints and requests about an incorrect civil-law form from 8 July to 13 August 2026.
- 1,794 complaints since 1 January 2026 against 619 in the same period a year earlier.
- More than 100 inspections since 8 July, 35 already closed — the note does not give each outcome.
- 121 written orders to confirm employment under a contract of employment.
- 201 voluntary conversions from a mandate to an employment contract from 8 July to 6 August, before the inspector wrote up findings.
- 7 individual interpretations by the GIP: 2 civil-law, 5 employment.
- No — on the date of the note — administrative cases opened for a district inspector’s decision.
We quote those figures only from the PIP note. We do not add an “average fine”, a “share of agencies” or “how many cases will reach court”. PIP did not write that on 18 August. A vendor who puts “we cut risk by 80 percent” in a proposal is selling weather. You are buying a dossier: contract, annex, assignment, hours, instructions, correspondence with the plant. The rest is a compliance play. If you want to see how we bind the same person card to recruiting and GDPR, go back to the staffing-agency programme — this article is about the layer PIP is now poking with a stick.
8 July 2026: new inspector tools, not a new colour in your ATS
On 8 July 2026 PIP announced a “new order on the labour market”. The Sejm heard the Marshal Włodzimierz Czarzasty, the family and labour minister Agnieszka Dziemianowicz-Bąk, Chief Labour Inspector Janusz Krasoń and ZUS president Liwiusz Laska. That is not protocol trivia. It is a signal that PIP, ZUS and the revenue service will exchange data and pick inspection targets together. The ZUS president spoke of risk analysis and sharper targeting. Your spreadsheet of PESEL numbers “because filtering is easier” stops being an internal mess. It becomes a set three authorities can match to returns and payroll. A civil-law contract register must be able to show the same person ZUS sees, not an “ops version” and a “payroll version”.
Krasoń said inspectors will go where civil-law contracts replace employment contracts, and that — judging by the rising complaints — this work may dominate the Inspectorate. He did not pick an industry. That is bad news for anyone who hoped “they will not touch us, we are an agency, not a plant”. An agency is the employer of a temporary worker and often a party to a mandate. You are in view whether the complaint comes from a hall, a security post, a platform or a clinic. The minister spoke of holiday pay, protection from same-day dismissal, overtime and dignity at work. Your application does not defend “dignity”. It defends facts that either support a mandate or kill it.
The new power does not mean every contractor in Poland becomes an employee overnight. It means the facts weigh more than the heading of the contract. That is why a system that only stores a scan named “mandate.pdf” is not enough after 8 July. You need an event layer: who issued an instruction, who built the roster, who confirmed a gate entry, whether the person could refuse an hour, whether they used the plant’s tools, whether they replaced an absent employee. Those fields are not in a valley ATS, because an ATS recruits. You run work. The difference shows up at the first inspection, not at the demo.
We do not promise that a GESOFT panel will “perform the PIP act”. The act and the inspection method sit with the state. We build the place where your attorney does not hunt a binder for two hours, but opens a person card and exports a dossier. Laravel on the server, Vue in the office panel, Android in the shift coordinator’s hand. If you already have payroll and only want a facts layer glued on — we glue, we do not burn. The “SaaS or custom” decision is in boxed software or software to order. The point here: after 8 July a missing facts layer costs more than the subscription you dislike.
Three legal relationships you must not pour into one “people on the hall” funnel
The usual agency sin in a system: one “temp” card and three legal realities. A temporary worker is employed by you (or — more rarely and more carefully — on another basis under the temporary-work act) and goes to a user undertaking on an assignment. A mandate contractor has a civil contract with you or with the client; if it is with you and the facts are those of employment, that is exactly the dispute PIP is writing about. Placement ends in a contract at the client, not at your firm. When one sheet lists “people at site X”, the inspector does not know who employs whom. Neither do you, when the coordinator is off sick. A civil-law contract register starts from the type of relationship, not from a first name.
Temporary work has its own papers: arrangements with the user undertaking, the assignment, information on conditions, time records, health-and-safety on the plant’s side. A mandate has another set: the subject of the work, freedom (or the lack of it), a deadline, pay for a result or for due care, no subordination. If in practice the contractor receives the same assignment as a temporary worker and stands in the same clock roster, the label will not defend you. The system should shout when you try to issue a temporary-work assignment against a card marked as a mandate. That is not “UX validation”. It is a brake before the 121st order PIP wrote about on 18 August.
A B2B invoice is not a fourth kind of magic
A B2B contract with a person who yesterday sat on a mandate and today invoices the same hours on the same hall does not leave the radar of PIP, ZUS or the revenue service. The 18 August note speaks mainly of mandates and service contracts, but the facts test is the same. The panel does not “turn B2B into a job”. The panel shows: the same personal VAT number, the same site, the same hours, no other clients in the period, invoices written under a coordinator’s dictation. Those are facts that will come out anyway when you line them up with KSeF. Better you see them before the authority does.
- Temporary work: you are the employer, the plant is the user, the steering document is the assignment.
- Placement: the relationship arises at the client; your card is a candidate and a fee, not hall timekeeping.
- Mandate / services: subject of the work and no subordination — or facts that kill that story.
- B2B: an invoice does not cancel the subordination test; the same hours and one payer are a red flag.
- Platform: PIP lists platform work separately — do not hide it inside a “marketing mandate”.
- A mixed week: the same person cannot be “temp” on Monday and “B2B” on Tuesday without a new contract and a new card type.
If your current ATS does not distinguish these types, you will not “fix it with a tag”. The tag dies on export to payroll. You need the relationship type as a data-model key: different required fields, a different annex set, a different termination workflow, a different GDPR retention. That is the moment a recruiting boxed product stops fitting and a custom panel starts to make sense. Not because Laravel is prettier. Because the inspector asks about the relationship, not about a funnel.
A civil-law contract register you are not ashamed to open at an inspection
A civil-law contract register is not a folder of “PDFs in 2026/mandates”. It is a card that shows: the parties, a PESEL or document number, the dates of conclusion and termination, the subject of the work in the contract’s language (not “various tasks”), the place of performance if one was named, the pay rules, the person on your side entitled to accept the result or confirm due care, linked annexes, linked sites, linked hours. If hours are forbidden on a genuine result mandate — the system should not demand them. If hours exist in practice — the system should show them, not hide them because “a mandate has no time record”. Hiding is worse than the truth.
An inspection does not start with your slide. It starts with a name from a complaint or from targeting. You must find the person in seconds, not on Saturday. Then the chain: contract → annex → correspondence on scope → proof of performance → payment → invoice or payroll → a ZUS registration if there was one. A gap in the chain is an answer. “We will send it on Monday” is another answer. A GESOFT panel binds that chain in one agency tenant: office roles, a counsel role (dossier read-only), a coordinator role (events, not contract edits). Authentication and 2FA in Laravel are not decoration. They are why the file does not leave by private email.
Versioning matters more than a template. The contract you signed in March, the June annex and the “chat agreement” in July are three layers. The inspector will ask which one was in force on 9 July, the day after the new tools arrived. If the chat is gone and the annex never reached the file, you are left with the March text, which may say something other than August practice. The system should date every version, keep a file hash and the person who uploaded the scan. We do not replace a qualified signature or e-Deliveries. We keep your copy of the operational truth that you can still defend when the managing director’s mailbox dies.
- A contract id, relationship type, status (draft, signed, terminated, dispute, archive).
- Dates: conclusion, start of performance, end, notice, notice period if there was one.
- Subject of the work in the contract’s wording plus a “how it really is” field — the split must be visible.
- Place, tools, line management: fact fields, not ornament.
- Linked payments, KSeF, hours, sites, authorised people on the client side.
- An access log: who opened the dossier on inspection day, who exported the PDF.
- Retention: the date when the contract and personal data must vanish or move to restricted access.
If you currently run that list as five sheets and a Drive folder, you are not “agile”. You are one stolen account and one complaint away from a person you cannot find. Count the cost of two full-time people for two weeks of inspection — PIP does not even have to fine you for August’s margin to disappear. A mandate-contract register is there to cut that cost. The kanban colour can wait. Write to contact how many civil contracts live next to employment contracts. We start the quote from that number, not from an “HR module”.
Hours, instructions, tools: the facts that kill the “mandate” label
The subordination test does not live in a recital. It lives at 05:40 on a Monday when a coordinator writes “be at the gate at 06:00, plant-logo vest, scanner from trolley 4”. That is an instruction, a place, a tool and a time. If you have a hundred such messages a week on Telegram, and the contract says “freedom to perform the work”, you have a document that lies. A civil-law contract register without an instruction layer is a half-truth. You do not need to record people. You need a channel where an instruction is a task with an author, a time and a site — or you consciously have no such channel because you truly buy a result.
Time records on a mandate are where even tidy payroll teams trip. If you pay by the hour and require presence in a slot, you have working time in practice, even if the contract calls it a “lump sum for a duty”. The system must hold both truths: the civil settlement (a cycle, a milestone, a lump sum) and the event log (in, out, break, refusal). The inspector will compare that with the plant clock. If the plant sends a PDF whose total differs from your sheet, the fight over the 121st order starts with arithmetic, not with civil-code philosophy. The field-service app shows how we keep a visit report. Here the report is the shift.
Tools and clothing are not a detail. A vest with the client’s logo, an account in the plant WMS, an access card in the agency’s name, a work phone with a task list — those are facts of being built into a structure. The panel should carry a facts checklist on the contract card, filled at the start of the engagement and at every site change. Not so that it “looks like an audit”. So that you see yourselves that ten “employment-like” boxes on a mandate are a red flag before a complaint arrives. The GIP also stressed the voluntary conversions. A visible flag in the panel is cheaper than the 201st conversion under inspection pressure.
- Record who builds the roster: you, the client, or “there is no roster, there is a result deadline”.
- Record the instruction channel: panel, company mail, silence. Telegram as the only source is out.
- Bind a gate entry to the contract card, not to the coordinator’s private phone.
- Separate a billable hour from a presence hour — if both exist, both must be visible.
- Collect the client’s confirmation as its own status, not as a chat emoji.
- Watch whether the person replaces a plant employee — that is a fact for the card, not gossip.
- Each month compare the event total with pay and with the clock file, if the plant provides one.
- When a subordination flag crosses a threshold you set yourselves, the case goes to payroll and counsel, not under the carpet.
We do not set your “how many boxes equal a job” threshold. That is a legal assessment, not a rule in code. Code must not lose the signals. If your lawyer says a mandate on that hall can be defended, the system should be able to drop the roster and move to a result. If the lawyer says it is time for an employment contract, the system should re-link the card, keep the history and not pretend the mandate “expired by itself”. History is your shield when someone asks since when you knew. PIP does not ask about the intent of a slide. It asks about dates.
A user-undertaking portal: arrangements that do not die in a shift manager’s inbox
Agencies fail at the plant interface. A shift manager sends a photo of a list, “three more for tomorrow”, then claims they asked for two and that the rate was “definitely agreed by mail in May”. Without a portal you have folklore. With a portal you have a staffing order, a confirmation of conditions, an acceptance of hours and a thread that does not depend on whether the manager changed jobs. This is not “bank-style self-service”. It is one truth about what the plant asked for. After 8 July that truth is also your defence: who issued instructions — you or the user.
The portal does not replace the framework contract or the arrangements the temporary-work act requires. It keeps a copy and the operational descendants: line, shift, skills, medicals, health-and-safety validity, banned tasks. When the plant asks for “a person on a truck” and the assignment has no licence, the system blocks the fill. That is cheaper than an accident and cheaper than a fight over who sent whom illegally. GESOFT is not the plant’s health-and-safety system. It is your side of the paper. The plant may run SAP. You need your trail, not a SAP dump in a PDF that arrives after the inspection.
Portal permissions are delicate. A shift manager should not see PESEL numbers for the whole agency. They should see their line’s fill and a “I confirm the hours” status. Plant HR — assignments and medicals. Procurement — the rate and an order number. GDPR is not a poster here. It is a role list. We describe that more broadly in GDPR in web applications. In an agency we add context: the same person is a candidate (the plant must not see CVs from other clients), then a temporary worker on this hall, then a contractor on another site. The portal filters by site and by relationship, not by “all our people”.
- A fill order with a date, headcount, skills and a site — not a phone call that says “sort it”.
- Hour acceptance by a named plant person, with a timestamp, not an emoji.
- A library of arrangements and annexes to the framework contract, versioned.
- A block on assignment when a medical, a licence or a processing consent is missing.
- A read-only role for the plant’s counsel or yours — a dossier without editing facts.
- A “for inspection” pack export for named people and a period, with a checksum of the files.
If the client does not want a portal because “they have email”, you give them the thinnest layer: a magic link to confirm a week, no account, an expiring token. That is still better than a photo of a scrap of paper. Laravel and a signed URL do this without opening 400 accounts nobody will activate. You keep Android for yourselves: a coordinator at the gate does not open Excel. They tick people and photograph a board only as an attachment to an event, not as the only source. The source is the record.
Android for the shift coordinator instead of a “hall 3 night” group chat
The coordinator is your weakest and strongest link. Strongest, because they fill the shift. Weakest, because they hold PESEL numbers, rates and “who came in today” on a private phone. When they leave, a hole remains. When they lose the phone, a GDPR incident remains. When they give evidence at an inspection, memory remains. An Android app is not meant to be the agency’s Instagram. It is meant to be a thin event client: the people list for a site, arrival status, a refusal, a substitute, a document photo only when the process requires it, offline mode on a hall with no signal, sync when the network returns. Laravel API, a queue, an audit. No chat in which an instruction dies.
Permissions on the phone are tighter than in the panel. The coordinator sees the shift, not the whole foreign-national database. They do not export a PESEL spreadsheet onto a memory card. Biometrics or a PIN, remote logout, no screenshots of sensitive data if a policy can enforce it. Laravel application security covers the server side. Here we add the pocket side. PIP will not ask about Android. The data-protection authority will, when a phone with last month’s attendance list is sold on a classified site with the account still on it. That is not a conference scenario. It is a scenario from firms where “it somehow worked”.
Offline mode is a duty, not a firework. A hall, a warehouse, night security, a building site — coverage dies. If the app dies without LTE, people go back to a notebook. A notebook has no author. An offline record has: the device, local time, server time after sync, a conflict when two people ticked differently. The office resolves conflicts, not an algorithm that “AI just knows”. We do not promise artificial intelligence at the gate. We promise that Saturday night will not vanish because the plant Wi-Fi died.
Not every GESOFT client needs Android in phase one. If you have one hall and three people in the office, we start with the panel and the contract register. We add the phone when coordinators are in the field and Telegram has become the time record. You write the order on contact. We do not sell a “mobile pack” to make the invoice larger. We sell the layer without which subordination facts will leak back into chat.
KSeF, an invoice for person-hours, and a number you will not type from memory
From 1 February 2026 the duty to issue invoices in KSeF covers taxpayers whose 2024 gross sales exceeded PLN 200 million. From 1 April 2026 it covers the rest, except those whose monthly sales documented by invoices do not exceed PLN 10,000 gross; they enter on 1 January 2027. Receiving invoices through KSeF has been mandatory since 1 February 2026. Sources: ksef.podatki.gov.pl — scope and the ministry note on the second stage. For 2026 the ministry announced no sanctions for KSeF-use errors. No sanctions is not no duty. It is time to tidy, not time to postpone.
An agency invoices person-hours, recruitment, a success fee, accommodation, clothing. Each of those lines must be able to show where the number came from. If the hours on the invoice do not descend from the same register you will show PIP, you have two worlds. The revenue service will see KSeF. PIP will see a complaint. ZUS will see registrations. A civil-law contract register is the glue. KSeF in a company application describes the panel hook-up. Here we add the agency twist: one invoice to a plant may cover forty people and three relationship types. An invoice line without a contract id is a line you will not defend to the client or to an authority.
We do not replace the finance-and-accounting programme. We integrate or we hand over a file that bookkeeping can swallow without a night of gymnastics. If you use an accounting office, they read the same story in software for an accounting office: a client portal, KSeF, e-Deliveries. An agency that sends the bookkeeper a zip of Excel on the 27th of the month is buying an error. An error on a bulk hall invoice is either an undercharge (the client complains), an overcharge (your margin) or a split from the hours PIP will see in a person’s complaint. The system should close the month on the same total in three places: hours, payroll or bills, invoice.
- A contract id and a site on every invoice line, even when the client wants one bulk PDF.
- A split of rates: ordinary hours, night, holiday, piecework, a recruitment fee — separate components.
- KSeF status: sent, number, rejection, an offline invoice mode if it is ever needed.
- An invoice correction bound to an hours correction, not to “we will add it next month by feel”.
- No hand-typing of a total from Excel into finance — either an API or a file with a checksum.
- An audit path: who approved the client month before it went to KSeF.
The duty to quote a KSeF number on payments between active VAT payers is deferred until the end of 2026 — so says the KSeF legal basis page. We will not rush you into a panic about that. We build the field for the number so that in 2027 you are not starting an implementation from zero. That is the difference between a panel built to order and a subscription that will “add KSeF when everyone is ready”. You have invoices now. The field can wait empty. The data model cannot.
e-Deliveries: a mailbox your agency cannot “check with Friday coffee”
From 1 January 2026 e-Deliveries are the primary electronic channel between public bodies and non-public ones, unless a special rule says otherwise — gov.pl note. KRS companies registered before 2025 have had an ADE duty since 1 April 2025. CEIDG firms registered before 2025 — from 1 October 2026. New registrations from 1 January 2025 open a mailbox at registration. Schedule: biznes.gov.pl and ou709. If you are a limited company, the duty already applies. If you are a sole trader, 1 October 2026 is weeks away from this text, not “sometime next year”.
On 5 August 2026 the digitalisation ministry said the system is approaching 100 million shipments, with more than 4.6 million active addresses in the Electronic Address Base; users have completed more than 50 million shipments since the start of 2026, and since 1 July 2026 the mailbox works in mObywatel (more than 600,000 shipments) — 100 million e-Delivery shipments. That is not trivia. It is confirmation that an authority really sends letters this way. A PIP summons, ZUS, a voivodeship labour office, the tax office — they can land in a mailbox nobody watches because “the director has the password on a sticky note”. Deemed delivery does not wait until you return from holiday.
GESOFT does not replace the public e-Deliveries mailbox or a qualified provider. We can integrate metadata and alerts, bind a letter to a case card (inspection, person, site) and force a two-person confirmation that the letter was read. That is an internal process. The state will still treat the letter as delivered under its own rules. Your panel must not allow a situation in which you learn about an inspection from the inspector at the door because the mailbox sat for two weeks. SMS or mail alerts to two people, not one. Holiday is not an argument against an authority.
- The ADE stored in the firm dossier: identifier, activation date, who administers the mailbox.
- A second person with access — always. A one-person “the director will pick it up” is an incident waiting for a holiday.
- A link from a letter to an inspection, a person or a client when that can be done without breaking official content.
- A deadline register: delivery date under the e-Deliveries rules, reply date, the person responsible.
- No pasting of summons text into Telegram — metadata in the panel, content in the state mailbox.
- A reminder of 1 October 2026 for sole traders who still have no ADE.
If you run several companies (the agency, a housing company for workers, a transport company), each has its own ADE and its own duty. A group panel can show a list of mailboxes, not one shared box. Mixing company correspondence is a legal and an operational error. We do not build a “holding in the cloud”. We build a list of entities and a list of mailboxes. The rest sits in the electronic-deliveries act, not on our roadmap.
GDPR, a former contractor’s complaint, and retention that does not live in the director’s inbox
PIP writes about complaints on the form of work. In parallel the same person may file an access or erasure request. If the CV, the contract, the attendance list and the mail sit in three places, you will miss the deadline because you do not know where the set is. GDPR in web applications covers roles, retention and a log. In an agency we add states: candidate, contractor, temporary worker, a person after a dispute, a person after an inspection. Each state has another basis and another storage time. “Leave it, they may come back for the season” with no basis is convenient until spring. Then it is a complaint.
A PIP complaint and a GDPR request like to travel in pairs. A person who believes they were an employee wants the file. A person whose mandate you did not extend wants to vanish from the spreadsheet. The system must be able to export a person pack and to restrict processing without deleting evidence you need for a defence. That tension is not solved by a “delete” button. It is solved by counsel plus a status on the card: dispute / inspection / limitation. Code does not decide the legal basis. Code does not let an intern wipe a file because “the person asked on Facebook”.
Data on third-country nationals, residence papers, passport numbers, certificates — higher sensitivity, less patience from an authority. Keeping scans “just in case” on a Drive with last year’s password is an invitation. The panel keeps them behind a role, with an expiry date and an expiry alert. A residence-document alert is operations, not GDPR. But the same file is a GDPR object. One place. Two reasons for it not to live in a messenger.
We do not replace a data-protection officer and we do not write your processing records “as a gift with the implementation”. We can generate a record of processing from what the system actually does — that is more honest than a Word file that has been lying for a year. The rest sits with your DPO. If you do not have one, and the volume of hall-people data is large, that is not an IT problem. It is a problem you should name before you buy another screen.
Catering, security, platforms, healthcare: complaints do not have one industry
On 18 August PIP listed examples, not a ranking. Nationwide restaurant chains, security, platform work, healthcare providers. An agency that staffs a kitchen, a hospital gate, an e-commerce warehouse or drivers on an app sits in every one of those sentences. Not because you are a target. Because people work there on mandates and complaints flow from there. Your system cannot assume “we are temps on a hall, the rest is not our problem”. The site type should drive the facts checklist: catering — shifts and no-shows; security — a post and orders; a platform — an algorithm of jobs; healthcare — licences and a duty roster.
Platform work is listed separately for a reason. If you place people into an app or you are yourselves a layer between a platform and a person, the subordination test may run through a third-party application. The panel must be able to record: whether the person could reject a job, who set the rate, whether there was a rating, whether an account block meant no income. We do not integrate with every platform on earth. We integrate with your process: an event import, a manual description, a flag “no data — we do not guess”. Guessing is worse than a gap described in plain words.
Healthcare and security drag licences, medicals and often night work with them. Those are employment-like facts even under a civil label. If you staff an admissions desk or a hospital lodge, and the contract speaks of “reception services”, the inspector will not be moved by vocabulary. The system should watch medicals and duties. It does not replace medical records or the hospital system. It watches your side of the assignment. That is enough not to confuse a person without a valid certificate with a person you may send.
- Catering: shifts, lateness, no-shows, holiday work — hour facts that are hard to defend as a pure mandate.
- Security: an order, a post, a uniform, a weapon or the lack of one — a structure like a workplace.
- Platform: job rejection, a rating, a block, a dictated rate — record it, do not interpret it in code.
- Healthcare: licences, medicals, a duty, liability — a checklist before a fill.
- Warehouse and production: the plant clock versus your hours — a monthly agreed total.
- The public sector: a purchase order, a protocol, e-Deliveries — a different paper rhythm than a private hall.
We do not build a separate product “for catering in an agency” and “for security in an agency” in order to sell two subscriptions. We build a site type and a field set. That is exactly the moment a recruiting ATS goes quiet and a custom Laravel panel starts work. If you staff one industry and one contract type, a solid payroll system plus discipline may be enough. Say that on contact. We will not push you into a project you do not need.
A boxed ATS, boxed payroll, or your own panel: when not to burn what works
The GESOFT rule is dull and honest. If eRecruiter, Traffit, HRlink, TomHRM or your payroll system already holds one person card, hours and contracts, we do not burn it. We glue on a PIP facts layer: instructions, subordination flags, a dossier export, a client portal. If the truth about a person lives in four SaaS tools and three sheets, gluing on a fifth screen will do nothing. Then we build a civil-law contract register as the core, and we bind recruiting and payroll by integration or — if the licence allows — leave them as satellites. The decision comes from an audit of a working week, not from a demo.
SaaS wins when you are small, you have one contract type and one bookkeeper who does not want another login. Custom wins when: many client VAT numbers, piecework, a night shift, third-country nationals on different residence bases, a plant portal, Android, an odd fee split, several companies, a role for counsel. What a Laravel application costs explains the quote components. We will not publish an “agency implementation price” here, because we would be lying. We will give a scope after your description. Twenty-four hours for an offer, not for a guess from a price list.
Migration is part of the project, not “we will import it later”. Contract PDFs, hour sheets, attendance lists, client contacts, CV retention. Without migration the panel is an empty shopfront. With migration you have continuity the inspector will see as history, not as “we went live in August, before that we do not know”. History from before 8 July still matters: PIP wrote that many complaints concern earlier periods and the new tools do not reach there. That does not mean you may burn the old files. It means the new tools count from 8 July, and the evidence may still be needed in court or at ZUS.
- Write down how many civil contracts and how many employment contracts live in parallel — a number, not a feeling.
- Point to one source of truth for hours, or admit that you do not have one.
- List the systems that must not be touched (finance, payroll, the plant clock).
- Describe the worst week in the last three months: a complaint, a no-show, an inspection, a coordinator walking out.
- Decide who in the office will own the dossier, and who only posts events.
- Only then ask about screens. A screen without an owner dies in the second sprint.
WordPress is not an agency system. We wrote that in WordPress or Laravel. A brochure site can stay on whatever you like. A contract register, hours and roles cannot. If the agency “has a website and Excel”, you do not have a tool for PIP. You have marketing and risk. GESOFT does not do employer branding. It does a panel in which you can find a contract.
What GESOFT does not replace and what we will not promise at an inspection
We do not replace the National Labour Inspectorate, we do not issue individual interpretations, we are not counsel in proceedings. We do not replace ZUS, the revenue service, KRAZ, STOR, e-Deliveries, KSeF, the finance-and-accounting programme or the plant clock. We do not replace a tachograph, BDO.gov or a DPO decision. An application that promises “PIP compliance in the Premium pack” is lying. We promise a dossier, roles, an audit and integrations. The rest is the statute and counsel. We leave that sentence in the offer, not in six-point type in a footer.
We do not promise that the 121 orders in the communiqué “will not apply to you because you have our system”. We promise that when an order arrives, you will find the contract, the hours and the correspondence without a night in the archive. We do not promise that the 201 voluntary conversions are a KPI for you to beat. We promise a flag that lets you change the form before the inspector walks in, if you yourselves decide the facts are those of employment. We do not promise artificial intelligence that “classifies the relationship by itself”. That would be legal advice in a model costume. We do not do that.
We do not take responsibility for the wording of contracts you upload. The template is yours or counsel’s. We watch versions, dates and links. We do not publish a “PIP-proof mandate template”, because a template without facts is decoration. The facts sit in the roster and in the instructions. That is where the work goes. If you need a law firm, look for one separately. We can give counsel a read-only account. That is all.
- PIP / a district inspectorate — an authority, not a module.
- ZUS and the revenue service — the payer and the returns; a declaration feed only when it makes sense and an official channel exists.
- KRAZ / STOR — a state register; we keep a copy of the number and the service scope.
- e-Deliveries and KSeF — state systems; we keep alerts, numbers, links.
- Finance and payroll — they stay; we hand over components and totals.
- The plant clock — the client’s source; we keep an agreed copy, not a “better truth”.
- Legal advice and a DPO — people, not a screen subscription.
That list is not marketing modesty. It is a boundary without which an implementation ends in a grievance: “we thought the app would handle the inspection”. It will not. It will shorten preparation and cut the number of places where the truth dies. That is enough for an inspection season not to eat your August. On contact you write what not to touch. That sentence in the brief is worth more than a wish-list from a demo.
A 90-day checklist: from the PIP note to a dossier you can export
You are not implementing a “digital HR transformation”. You are implementing the ability to find one person in fifteen minutes. Ninety days is a real horizon if you are not also building a new brand and a new ledger. It can be shorter when the scope is only the contract register and a dossier export. It will be longer with a client portal, Android and a five-year PDF migration. The list below is an order, not a price list. The inner dates are yours. The state’s dates are hard: 8 July 2026 the PIP tools already run, 1 October 2026 ADE for older sole traders, KSeF is already on the calendar from February and April.
- Weeks 1–2: an inventory of civil contracts, employment contracts and “we do not know” cards. One table, one owner.
- Weeks 2–3: a map of instructions and rosters — where they live today. Decision: we kill Telegram as a time record, or we do not start the project.
- Weeks 3–4: a brief on contact — industry, headcount, site count, untouchable systems, the worst week.
- Weeks 4–5: a GESOFT offer within 24 hours of a complete brief; a SaaS / glue / custom-core decision.
- Weeks 5–7: the data model for relationship, roles and dossier; sign-off from counsel or a DPO if you have them.
- Weeks 7–10: the office panel, contract import, scan versioning, the first inspection-pack export.
- Weeks 10–12: a portal or a magic link for one willing client; hours matched to the invoice.
- Weeks 12–13: Android only if Telegram is still the time record; otherwise we park the phone.
- Throughout: ADE, KSeF, CV retention — not as “phase 4”, but as dossier fields from day one.
The usual way to kill those 90 days: a parallel spreadsheet “because the new system is still crawling”. Then after a quarter you have two sources and none. The rule: from cut-over day the old channel is read-only. Two weeks of pain is cheaper than a year of double truth. The second trap: an implementation with no owner on your side. GESOFT will not be your shift manager. Paweł Matusiak will build the panel. You supply the fill and the discipline of entries. Without that even the best Laravel is an empty cupboard.
After 90 days you do not have a “go-live with balloons”. You have a test: pick three people at random — a mandate, a temp, B2B if you have it — and assemble a dossier as if for an inspection. If any card needs a call to a former coordinator, you are not finished. If all three open with a contract, annexes, hours, an invoice and an access log, you have finished stage one. Stage two is dull hygiene: retention, 2FA, backups, training a deputy for the person who “knows everything”. Hygiene does not sell at a conference. It sells in year two, when the first person leaves the office.
How to ask for a quote so that a 24-hour offer is not a guess
On contact we do not need a moodboard or a vision of “employee experience”. We need: the legal form and whether you sit in KRAZ (service scope), headcount on employment contracts and on civil ones, the number of active plants, whether you take hours from the client clock, which finance and payroll systems must stay, whether there is a DPO, whether the e-Deliveries mailbox is watched, whether KSeF already issues from your system. Plus one concrete pain from August 2026: a complaint, an inspection, a coordinator walking out, an invoice mismatch. On that we can build an offer in 24 hours. On the slogan “we want to be digital” — we cannot.
The answer will be one of three. Buy a boxed product and we name the class of tools, without pretending we must write them. We will glue a layer onto what already works. We will build a core in Laravel and Vue, with Android or without. Each of the three is a success if it fits your week. The failure is a fourth: another subscription next to Excel. We do not sell that. If after the call it turns out the problem is the client contract, not IT, we will say that too. Cheaper to hear it in the first day than after a kick-off.
GESOFT is one person with a project team, not an enterprise sales desk. That is why 24 hours is possible: there is no committee that “will come back after the holiday”. That is also why we do not take six agencies in the same sprint. If there is a queue, you get a date, not fog. That is the same honesty we demand from a contract register: a date, an owner, a status. The panel we build has those three fields everywhere. The firm that builds it does too.
The PIP note of 18 August 2026 is not a reason to buy anything in a panic. It is a reason to stop pretending that a folder named “mandates_final_v7” is a register. A civil-law contract register is a card, hours, instructions, an invoice and a mailbox that does not sleep until Friday. The rest is the statute, counsel and a decision whether the label on the contract still matches the facts. When you are ready to write that down — contact. When you are not — leave this text with the operations director, not with marketing.
The inspection pack: what you put on the table in the first fifteen minutes
An inspection does not start with a tour of your module. It starts with a list of names or a question about a period and a site. You must be able to lay out: the contract, annexes, proof the person knew the place and the rate, the event record, the payment, the invoice to the plant, correspondence on scope. If any of those elements lives only in the mailbox of someone on sick leave, you do not have a dossier. You have a dependency. A civil-law contract register is a dossier at rest. A PDF export with a checksum is a dossier in motion. The inspector does not have to love your UX. They have to receive a coherent pack.
The pack cannot be “everything about everyone”. That would be a leak. The pack is for named people and a named period, with the role that launched the export and with a log. If counsel asks for five files, five files leave, not a full database dump. If PIP asks for a site and a month, the site fill leaves, not PESEL numbers from other halls. That is the same discipline GDPR in applications teaches, only under inspection time pressure. Pressure does not justify a zip on a stick “to be quick”.
Rehearse the export before anyone knocks. Once a quarter draw a site and a week. Measure the time. Write down what was missing. A missing annex is a different problem from missing hours, and missing hours a different one from a missing invoice. Each gap has an owner in the office. Without an owner the rehearsal is theatre. With an owner it is hygiene. Hygiene is cheaper than the 121st order, because an order arrives when facts are invisible or when facts fight the label. The rehearsal shows both diseases earlier.
- A pack template: contract, annexes, assignment or scope, events, payment, invoice, access log.
- A filter: people, site, from–to. No “export everything, we will cut later”.
- A checksum and an export date on the pack cover sheet.
- A role that may export — not every coordinator.
- A quarterly rehearsal with a measured time and a gap list.
- A ban on memory sticks and private mailboxes as the path for handing over the pack.
If the rehearsal shows that half the contracts have no scan, do not buy Android first. Buy a scan and the discipline of uploading. Hardware does not replace a file. A GESOFT panel will show a red hole “contract file missing”. You close the hole. We do not sit in your archive. On contact it is worth adding how many contracts have no file at all. That changes the migration quote more than the “system users” number from a marketing brief.
Working with counsel and the accounting office without a third truth in email
An agency often has three translators of one person: operations say “temp on the hall”, payroll says “mandate”, bookkeeping says “service 20.30”. The inspector will hear all three. The panel should be the language you agree on. Counsel gets a dossier read and may add a note “assessment: subordination risk”; they may not rewrite hours. The accounting office gets components and a KSeF status; they do not get CVs. Operations get events; they do not rewrite the invoice amount. When those three roles meet again in one mail thread with an attachment named “final_version2.xlsx”, you are back at the start.
An accounting office after April 2026 lives with KSeF and e-Deliveries the same way you do. The text software for an accounting office is written for them. For you the sentence is: do not send them a different total than the one in the hours register. A split “we rounded it on the invoice” needs a correction document, not a spoken “it will come out next month”. Next month may be the month of a complaint. A complaint does not honour rounding.
After 8 July counsel gets more questions on qualification. Your job is not to replace an opinion. It is to give counsel the same set of facts the inspector will see. If the lawyer gets a contract and the inspector gets Telegram, you lose at the start. A read-only account, a filter by person, no way to download the whole base. That is cheaper than sending binders by courier and safer than a link to a folder with a whole year. Laravel security and 2FA are not decoration here; they are the condition for counsel getting access at all.
We do not bill counsel’s hours and we are not a lawyer marketplace. We can keep a counsel-matter id and an opinion date on the dossier. The rest is outside GESOFT. Honesty toward the client ends where the pretence begins that “the system has compliance built in”. Compliance sits in the decision of a human who sees flags. There will be no flags if operations do not log the instruction. That is why training the coordinator is part of the implementation, not an add-on “if budget remains”.
Frequently asked questions
- Does the PIP note of 18 August 2026 mean every mandate in an agency is unlawful?
- No. PIP described complaints, inspections, 121 written orders and 201 voluntary conversions — it did not pass judgment on every mandate in Poland. The test is the facts: subordination, hours, instructions, tools. A “mandate” label does not defend you when the facts are those of employment. Source: https://www.pip.gov.pl/aktualnosci/pierwsze-efekty-kontroli-zasadnosci-wyboru-umowy-cywilnoprawnej
- From when does an inspector have the new tools to examine civil-law contracts?
- From 8 July 2026. That day PIP announced the new order and cooperation with ZUS and the revenue service on targeting. The new tools do not reach back into periods that already ended — the Chief Inspector himself noted that many complaints concern those periods and the new measures then do not apply. You still need order today.
- How many complaints and inspections did PIP give in the first tally?
- From 8 July to 13 August 2026 — 690 complaints and requests. From 1 January 2026 — 1,794 against 619 a year earlier. More than 100 inspections since 8 July, 35 closed. 121 orders to confirm an employment contract. 201 voluntary conversions to 6 August. 7 GIP interpretations (2 civil, 5 employment). We do not add our own percentages.
- Does GESOFT replace PIP, ZUS, KRAZ or the payroll programme?
- No. We do not replace authorities or working finance and payroll. We build a contract register, subordination facts, hours, a client portal and — when needed — Android for the coordinator. KRAZ stays in STOR. An individual interpretation stays with the GIP. Agency-card detail is also in the staffing-agency programme.
- When must an agency have e-Deliveries?
- KRS companies registered before 2025 — from 1 April 2025. CEIDG sole traders registered before 2025 — from 1 October 2026. New firms from 1 January 2025 open an ADE at registration. From 1 January 2026 e-Deliveries are the primary official channel. Schedule: https://www.biznes.gov.pl/pl/portal/004495
- How does KSeF relate to an invoice for person-hours?
- Issuing duty: 1 February 2026 if 2024 sales exceeded PLN 200 million gross, 1 April 2026 for the rest, small taxpayers up to PLN 10,000 of invoices a month — 1 January 2027. Receiving invoices in KSeF from 1 February 2026. The ministry did not announce 2026 sanctions for errors. Invoice totals should descend from the same hours register you will show PIP. More: KSeF in a company application.
- Must we throw out Traffit, eRecruiter or payroll to have a PIP-ready register?
- Not as a rule. If those systems are one source of truth, we glue on a facts layer and a dossier export. If the truth lives in four subscriptions and Telegram, the core has to be assembled again. We do not burn a working ATS. The criteria are in boxed software or software to order.
- Will the application tell us a mandate must become an employment contract?
- No. That is a legal assessment. The panel shows flags: a roster, instructions, tools, replacing an employee, one payer on B2B. Payroll plus counsel take the threshold and the decision. Code that “classifies the relationship by itself” would pretend to be an adviser. We do not sell that.
- How is candidate and contractor data protected in such a panel?
- Roles, retention, an access log, a person pack on request, a ban on an intern wiping a file in a dispute. Design detail: GDPR in web applications and 2FA in Laravel. The DPO stays with you.
- How do we ask for a quote and what should the message contain?
- Write to contact: KRAZ and scope, civil and employment headcount, plant count, hours source, untouchable finance and payroll, ADE, KSeF, one concrete pain from recent weeks. GESOFT (Paweł Matusiak, Laravel, Vue, Android) comes back with an offer in 24 hours. If a boxed product is enough — we will say so.
Describe your project