Pay24 Privacy Policy
This Privacy Policy explains how personal data is processed when you use Pay24, a cloud application for Bitrix24 that records partial payments for CRM deals and invoices, shows what is paid and what is still due, imports bank statements and matches incoming payments with invoices and deals, and creates a Statement of account for a client (the "Application"). The Application is available at https://pay-eu.ai-automation-agency.biz and distributed through the Bitrix24 Marketplace.
This Policy is drafted in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and the Polish Act of 10 May 2018 on the Protection of Personal Data.
1. Who we are
ARTISMEDIA Sp. z o.o., Nowogrodzka 64/43, 02-014 Warsaw, Poland; KRS 0000868723; NIP (VAT ID) PL7011004442; REGON 387549826 ("we", "us"). Contact for privacy matters: artismediaeu@gmail.com, +48 693 124 346.
2. Our role: processor and controller
2.1. CRM data, payments and bank statements. Your organization (the "Customer") keeps data about its deals, invoices, clients and payments in its Bitrix24 account and uploads bank statements into the Application. For this data the Customer is the controller and we act as a processor under Article 28 GDPR, processing it only to provide the Application's features on the Customer's documented instructions. The Data Processing Terms in Section 11 form part of the Pay24 License Agreement.
2.2. Account, contact-form, billing and technical data. For data about the installation (Bitrix24 account address, installation identifier), messages you send us through the contact form, billing data for the Pro plan (Section 3.7) and technical data (IP address, logs) we act as an independent controller.
2.3. What the Application writes to Bitrix24. The Application creates, changes and deletes payments of deals and invoices (the standard payments of Bitrix24) when a user records, confirms, edits or deletes a payment, or when a bank statement line is recorded; writes the derived fields "Paid", "Balance due", "Last payment date", "Days overdue" and "Payment status" to deals; runs the automation triggers "invoice fully paid", "partial payment received" and "overpayment"; adds a Statement of account PDF to the timeline when a user asks for it; and adds a tab, a workflow robot and the deal fields listed above. It does not change any other data of CRM records and does not delete CRM records.
3. What data the Application processes
3.1. Read from your Bitrix24 account when the Application is used:
- deals and invoices: ID, title, invoice number, amount, currency, dates (created, start, due/close date), stage, linked company, contact and parent deal; for deals also the derived fields listed in Section 2.3;
- payments of these deals and invoices: amount, currency, whether the payment is confirmed, payment date, payment method, payment reference and comment;
- the list of payment methods of the Bitrix24 account (ID and name);
- clients of deals and invoices: company name or first and last name of the contact; from their requisites — company name, VAT ID / tax number; from their bank details — IBAN or account number (used only to recognise the payer in a bank statement);
- the Customer's own company (for the Statement of account): name and VAT ID;
- numbers of documents created by the Bitrix24 document generator (for example by DocMaster24) for deals and invoices — document ID, number, title and record — to recognise these numbers in payment details;
- for the "Open latest deal" button: the ID of the latest deal the user can see;
- whether the user who opens the Application is a Bitrix24 administrator;
- installation data: Bitrix24 account address, installation ID (
member_id), access tokens issued by Bitrix24.
3.2. Bank statements uploaded by users (CAMT.053, MT940 or CSV files). A statement contains the Customer's account number and, for each transaction, the date, amount, currency, the name and IBAN or account number of the payer or payee, payment details (remittance information) and bank references. Such a file may contain personal data of the Customer's clients (for example sole traders or private persons who paid an invoice). The Application reads the file in server memory during the upload request only: outgoing payments are discarded, incoming payments are compared with the data listed in Section 3.1 and returned to the user's browser for review. The file and its contents are not written to disk, are not kept after the request and are not written to logs. Transactions waiting for review stay only in the user's open browser page. When a transaction is recorded, the Application writes to the Bitrix24 payment the amount, the date, the bank reference (up to 40 characters) and a comment "From <payer name>. <payment details>" (up to 250 characters) — this data then lives in the Customer's Bitrix24 account.
3.3. Statement fingerprints. For every statement line that has been recorded or skipped by a user, the Application keeps a fingerprint: a truncated SHA-256 hash calculated from the bank reference, date, amount and currency (or, without a reference, from the line contents), together with the record it was recorded to (for example "invoice 12"), the Bitrix24 payment ID and the date. The fingerprint does not contain and cannot be turned back into the payer's name, IBAN or payment details. It is used only so that the same payment is never recorded twice when a statement is uploaded again.
3.4. Settings entered in the Application by an administrator: whether confident matches are recorded automatically and the required confidence level.
3.5. Not requested: client e-mail addresses and phone numbers, products, activities, correspondence, calls and files, employees' data other than the administrator flag of the current user. The Application requests the "CRM", "Online store / payments" (sale), "Payment systems" (pay_system), "Embedding in the interface" (placement) and "Business processes" (bizproc) access scopes.
3.6. Contact form on https://pay-eu.ai-automation-agency.biz/about: your name, the e-mail address or phone number you leave for our reply, your message, and the time it was sent. Your IP address is used in server memory only to limit the number of messages and is not saved with the message.
3.7. Billing data (Pro plan). Payments for the Pro plan are made on the Stripe Checkout page and processed by Stripe (Section 6.3). We never receive or store payment card data. On our servers we store only: the installation ID (member_id) and the Bitrix24 account address; the Stripe customer ID and subscription ID; the plan and subscription status; the dates of the trial and of the current billing period; the history of billing events; and, for the Free plan limit, the fingerprints (Section 3.3) of statement transactions processed in the current and the two previous months. The name, e-mail address, billing address and VAT ID entered at checkout are held by Stripe; we can view them in our Stripe account to issue invoices, handle refunds and answer billing questions, but we do not copy them to the Application's servers.
3.8. Technical data: IP address, browser type, timestamps, request paths, Bitrix24 account address.
3.9. The Application is not intended for special categories of personal data (Article 9 GDPR). The Customer undertakes not to put such data into payment comments or deals used by the Application.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Showing and recording payments, calculating the balance due and days overdue, writing derived fields to deals, running triggers and the workflow robot | Art. 28 GDPR: processing on behalf of the Customer, who relies on its own legal basis (usually Art. 6(1)(b), (c) or (f)) |
| Reading bank statements, matching incoming payments with invoices and deals, recording matched payments, preventing double recording | Art. 28 GDPR, as above |
| Creating a Statement of account for a client | Art. 28 GDPR, as above |
| Installing the Application, authenticating users, keeping the service secure | Art. 6(1)(b): performance of the License Agreement; Art. 6(1)(f): legitimate interest in security |
| Answering messages sent through the contact form; technical support and fixing errors | Art. 6(1)(b) and 6(1)(f) |
| Managing the Pro subscription, trial, monthly Free limit and payments; refunds; preventing repeated trials | Art. 6(1)(b); Art. 6(1)(f): legitimate interest in granting the trial and the free limit once per account |
| Keeping billing records and invoices | Art. 6(1)(c): obligations under Polish tax and accounting law |
We do not use the data for marketing, profiling, sale to third parties, or training machine learning models.
5. How the data is processed and stored
5.1. Payments are stored in Bitrix24, not by us. Payments, derived deal fields and Statement of account PDFs are written to the Customer's Bitrix24 account and remain there after the Application is uninstalled. CRM data read for a request is held in server memory only for that request.
5.2. Bank statements are not stored (Section 3.2). When a Statement of account PDF is produced, it is converted by LibreOffice in a temporary folder that is deleted immediately after the conversion.
5.3. Stored on our servers:
- statement fingerprints (Section 3.3) — up to 400 days from the date the line was recorded or skipped; deleted when the Application is uninstalled;
- settings (Section 3.4) and the cached list of payment methods (IDs and names) — for as long as the Application is installed; deleted on uninstall;
- OAuth tokens (access/refresh) and the application token used to verify uninstall notifications and robot calls — in files readable only by the Application's service account (file permissions 0600), used solely to call the REST API of the corresponding Bitrix24 account; deleted on uninstall;
- user sessions of the Application's pages: a random session ID with the Bitrix24 account address and the user's Bitrix24 access token, for up to one hour, so that the token is never sent to the browser.
In most operations the Application uses the access token of the user who is working with it, so it can see only what that user can see in Bitrix24. The application token is used only to run automation triggers when the user's own permissions do not allow it.
5.4. In the browser. The Application does not store anything in the browser beyond the page itself.
5.5. Location. The Application runs on servers of Hetzner Online GmbH in Germany (EU).
5.6. Retention:
- bank statement files and their contents — not retained (Section 3.2);
- CRM data — not retained (Section 5.1);
- statement fingerprints — up to 400 days; deleted on uninstall;
- settings, payment method list and tokens — for as long as the Application is installed; deleted immediately upon the uninstall notification from Bitrix24;
- sessions — up to one hour;
- contact-form messages — as long as needed to answer you and handle follow-up questions; you can ask us to delete them at any time;
- technical logs — up to 12 months;
- billing data (Section 3.7) and invoices — 5 years from the end of the calendar year in which the related tax payment deadline fell; not deleted on uninstall, and uninstalling does not cancel a Pro subscription;
- the record that the free trial has been used (installation ID, account address, trial dates) — for as long as the Application is offered; the fingerprints counted against the Free plan limit — up to 3 months; neither is deleted on uninstall, so that the trial and the free limit are granted only once per account and month.
5.7. Security measures: TLS/HTTPS for all traffic; OS-level access restriction to data files; tokens are never sent to the browser (server-side sessions); every request from the Application's pages must carry a valid session created from a Bitrix24 request; uninstall notifications and robot calls are accepted only with the account's application token, compared in constant time; changes of settings and of the subscription only by a Bitrix24 administrator confirmed by Bitrix24; access logging.
5.8. What logs contain: Bitrix24 account address, type of operation, deal, invoice and payment IDs, payment amounts, the format of an uploaded statement and the number of lines and matches, status and duration, error texts returned by Bitrix24. When a contact-form message arrives, the log records its ID, your name, the contact you left and the first 120 characters of the message. Bank statement contents, payer names, IBANs, payment details and token values are never written to logs.
6. Recipients and sub-processors
6.1. We do not sell, rent or disclose data to third parties except as described here or required by law.
6.2. Sub-processors:
- Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — server hosting (EU).
6.3. Stripe (Pro plan payments). Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland, receives the billing data described in Section 3.7 and the details entered at checkout. For processing payments, including fraud prevention and compliance with its legal obligations as a payment service provider, Stripe acts as an independent controller under its own privacy policy (https://stripe.com/privacy). For billing services provided to us (subscription management, invoices and receipts, tax calculation, the Customer Portal), Stripe acts as our processor. Stripe receives no CRM data or bank statements and is not a sub-processor for the Customer's data.
6.4. Support e-mail. Messages sent through the contact form may be forwarded by e-mail to our support mailbox artismediaeu@gmail.com, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. CRM data and bank statements are never sent by e-mail.
6.5. Bitrix24 is the Customer's own service provider; the Application only calls the Customer's Bitrix24 REST API. The Bitrix24 JavaScript library used inside the Application is loaded by the user's browser from Bitrix24.
6.6. Data of one Customer is never used for another Customer.
6.7. We will inform Customers of any intended change of sub-processors at least 30 days in advance by updating this Policy; Customers may object by uninstalling the Application.
7. International transfers
We do not ourselves transfer personal data processed by the Application outside the European Economic Area. If a contact-form message is forwarded by e-mail (Section 6.4), Google may process it in other countries under the safeguards described in its data processing terms, including the European Commission's Standard Contractual Clauses. Stripe may transfer billing and payment data to Stripe, Inc. in the United States and other group companies under the EU-U.S. Data Privacy Framework or Standard Contractual Clauses, as described in its privacy policy.
8. Your rights
Under the GDPR, data subjects have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), and to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl.
Because CRM data, payments and bank statements are controlled by the Customer, requests concerning that data should be addressed to the Customer as controller; we assist the Customer in fulfilling them. Payments and comments written by the Application can be changed or deleted by the Customer in Bitrix24.
Requests to us: artismediaeu@gmail.com. We respond within one month (Art. 12(3) GDPR).
9. Cookies
The Application does not set cookies and uses no analytics or advertising trackers. Bitrix24, inside which the Application is opened, uses its own cookies under its own policy.
10. Changes to this Policy
The current version is published at https://pay-eu.ai-automation-agency.biz/legal/privacy. Material changes will be communicated to Customers in advance. Continued use after the effective date means acceptance of the updated Policy.
11. Data Processing Terms (Article 28 GDPR)
11.1. Subject matter and duration: provision of the Application for as long as it is installed on the Customer's Bitrix24 account.
11.2. Nature and purpose: reading CRM records, payments and client requisites on request; recording payments in the Customer's Bitrix24 account; reading bank statements uploaded by the Customer's users in memory and matching incoming payments with invoices and deals; keeping statement fingerprints to prevent double recording; creating Statements of account.
11.3. Data subjects: the Customer's clients and their representatives (including payers named in bank statements), the Customer's own representatives, and any natural persons whose data the Customer puts into deals, invoices or payment comments. Categories of data: as listed in Sections 3.1–3.4.
11.4. We process personal data only on the Customer's documented instructions, which consist of installing and using the Application, uploading statements, its settings (including automatic recording of confident matches) and the robots and triggers configured by the Customer.
11.5. Persons authorised to process the data are bound by confidentiality.
11.6. We implement the technical and organisational measures described in Section 5 (Art. 32 GDPR).
11.7. We engage sub-processors listed in Section 6 under written terms providing equivalent protection; the Customer gives general authorisation for them.
11.8. We assist the Customer with data subject requests and with its obligations under Articles 32–36 GDPR, taking into account the nature of processing.
11.9. We notify the Customer of a personal data breach without undue delay and in any case within 48 hours of becoming aware of it.
11.10. On uninstall, all data processed on behalf of the Customer and stored on our servers is deleted as described in Section 5.6; no copies are retained except logs as stated. Billing data and the Free limit counter are our own data as controller and are kept as stated in Section 5.6. Payments recorded in the Customer's Bitrix24 account remain there.
11.11. We make available information necessary to demonstrate compliance and allow for audits on reasonable prior notice, at the Customer's expense, no more than once a year.