Skip to content
Poland · Agentic software engineering

Software Development for Product Teams in Poland

A common assumption when a company in Poland brings in engineers from outside the EU is that keeping the database in Europe keeps the data in Europe. EDPB Guidelines 05/2021 disagree: remote access from a third country is a transfer under GDPR Chapter V when the transfer criteria are met, even if it only displays personal data on a screen. Türkiye has no EU adequacy decision, so a transfer tool belongs in the contract before anyone opens a production console.

Curiosive is a studio in Ankara, Türkiye, building with AI coding agents under senior engineer review. We build products end to end or work as embedded engineering capacity month by month. Agents do the volume: scaffolding, migrations, test coverage and refactors that touch hundreds of files. Engineers own data models, auth, permissions, payment paths and anything touching personal data, and nothing merges until a person has read it.

24
published portfolio projects
5+
years building for production
12
countries the work runs in
100%
of code read by a senior engineer
1 day
to hear back, from the engineer

Working hours between Poland and Ankara, summer and winter

Ankara is on UTC+3 all year, because Türkiye does not use daylight saving time. Poland moves between UTC+1 in winter and UTC+2 in summer, so the gap changes twice a year. In winter Ankara is two hours ahead: our 09:00 is 07:00 in Poland, our 18:00 is 16:00, and a Polish 09:00 start is 11:00 in Ankara. That leaves seven shared hours in a standard 09:00 to 18:00 day. In summer the gap is one hour: our day runs from 08:00 to 17:00 Polish time, a Polish 09:00 is 10:00 here, and eight hours are shared. Because our day starts and ends earlier than yours, the last one or two hours of a Polish afternoon fall after we have stopped, and anything raised then is picked up the next morning. Work runs on Türkiye business hours; we do not offer evening cover.

GDPR transfers when engineers in Türkiye work on Polish data

As of 2 October 2026, Türkiye is not on the European Commission's list of adequacy decisions, so personal data from a Polish system made available to a studio in Ankara needs another Chapter V transfer tool. The usual one is the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914, with four modules: controller to controller, controller to processor, processor to processor and processor to controller. Under Clause 14, both parties warrant that they have no reason to believe the destination country's laws and practices prevent the importer from complying. Example 11 in the EDPB guidelines covers this exact pattern: a third-country processor remotely accessing EU-stored data for EU controllers results in transfers to that processor. For a controller in Poland, the GDPR supervisory authority is the Urząd Ochrony Danych Osobowych (UODO). The clauses belong in place before anyone is granted access to production data.

Poland's AI systems act and AI features in your software

Poland's Ustawa z dnia 3 lipca 2026 r. o systemach sztucznej inteligencji (Dz.U. 2026 poz. 1003) was published on 27 July 2026 and entered into force 14 days after publication. Its articles 8 to 18 and its chapters on inspections, proceedings, settlements, administrative fines and criminal provisions, and amendments to other laws take effect three months after publication, on 28 October 2026 per the Sejm ELI register. It names the Komisja Rozwoju i Bezpieczeństwa Sztucznej Inteligencji as market surveillance authority and single point of contact under the EU AI Act. At EU level, the Article 50 transparency duties have applied since 2 August 2026: an AI system that interacts with people must be designed so they are told, unless it is obvious. A chat assistant in your product needs that disclosure built in.

NIS2 supplier security for software companies in Poland

The NIS2 Directive reached Polish law through the act of 23 January 2026 amending the national cybersecurity system act (Dz.U. 2026 poz. 252), in force since 3 April 2026. NIS2 covers medium-sized and larger entities in its Annex I and II sectors, which include cloud computing, data centre and managed service providers. Its Article 21 requires in-scope entities to address supply chain security, including the security aspects of their relationships with direct suppliers and service providers. If your company is in scope, an outside engineering studio is the kind of service provider that review covers. What we can show is how work is gated: every change is read before it merges for secrets handling, input validation, access control and dependency risk, continuous integration re-runs the checks on every change, and repository, database and hosting accounts sit in your name from the first commit.

How AI agents change the cost of software for teams in Poland

An engineer writes a scoped task with acceptance criteria and the limits the agent must not cross. Claude Code or Cursor then reads the code, implements the change, updates tests and runs the type checker, linter and test suite before proposing it. A senior engineer reviews every diff; agents never merge their own work. That makes volume cheaper. It does not make judgement cheaper, which is why anything touching personal data from a Polish system stays with engineers. Our work at scale includes the Zing Coach (zing.coach) rebuild from Webflow to Next.js, the revival of RateItAll (rateitall.com) with more than 12 million reviews, and the Detailed SEO Extension, used by 600,000 SEOs and maintained through its acquisition by Ahrefs. Work runs as AI-accelerated development, starting from $2,000 per month, with scope agreed in writing.

Questions

The things people ask before starting.

Is it GDPR compliant to outsource software development from Poland to Türkiye?

It can be, with a transfer tool in place. Türkiye has no EU adequacy decision as of 2 October 2026, so the usual route is the Standard Contractual Clauses from Decision (EU) 2021/914, signed before any engineer can see personal data, including through remote access to systems hosted in the EU.

How many working hours overlap between Poland and Türkiye?

Seven in winter and eight in summer, counted over a standard 09:00 to 18:00 day. Ankara stays on UTC+3 all year while Polish time switches between UTC+1 and UTC+2, so Ankara is two hours ahead in winter and one in summer. The one short weekly call fits easily inside that window.

How does a company in Poland contract with a software studio in Ankara?

As a cross-border agreement. Scope and budget are set down in writing after a discovery call, there is no long contract to begin and no lock-in. The code is yours from the first commit, with repository, database and hosting accounts opened in your name or connected to accounts you already hold.

Does Poland's NIS2 law apply to our outsourced development partner?

The duty sits with your company, if it is in scope. The amended Polish cybersecurity act, in force since 3 April 2026, implements NIS2, whose Article 21 asks in-scope entities to address supply chain security, including relationships with direct suppliers and service providers such as an outside engineering studio.

How it starts

What happens after you write to us.

  1. 01

    You describe the product

    One paragraph on what you are building, roughly when you need it, and who it is for. No brief, no form with fifteen fields.

  2. 02

    You get a reply within a day

    From the engineer who would do the work, not a sales team. If we are not the right fit we say so, and where possible we point you somewhere better.

  3. 03

    You get a scoped plan

    Scope, price and timeline in writing before anything is committed. You decide with the numbers in front of you.

No long contract to begin, no lock-in to our tooling, and the code is yours from the first commit.

Start a conversation
Contact

Looking for an engineering partner for the long haul?

A short note about the product, the timeline and who it is for is enough to start. You will hear back from the engineer who would do the work, not a sales team.

Ankara / Türkiye · Working across European and US time zones