DocMaster24 Privacy Policy
This Privacy Policy explains how personal data is processed when you use DocMaster24, a cloud application for Bitrix24 that creates quotes, proforma invoices, invoices, agreements, acceptance protocols, order confirmations and documents from your own templates using the data of CRM deals and invoices (the "Application"). The Application is available at https://docmaster-eu.ai-automation-agency.biz and distributed through the Bitrix24 Marketplace.
This Policy is drafted in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and the Polish Act of 10 May 2018 on the Protection of Personal Data.
1. Who we are
ARTISMEDIA Sp. z o.o., Nowogrodzka 64/43, 02-014 Warsaw, Poland; KRS 0000868723; NIP (VAT ID) PL7011004442; REGON 387549826 ("we", "us"). Contact for privacy matters: artismediaeu@gmail.com, +48 693 124 346.
2. Our role: processor and controller
2.1. CRM data and documents. Your organization (the "Customer") keeps data about its deals, clients and its own company in its Bitrix24 account and enters its company details into the Application. For this data and for the documents created from it the Customer is the controller and we act as a processor under Article 28 GDPR, processing it only to provide the Application's features on the Customer's documented instructions. The Data Processing Terms in Section 11 form part of the DocMaster24 License Agreement.
2.2. Account, contact-form, billing and technical data. For data about the installation (Bitrix24 account address, installation identifier), messages you send us through the contact form, billing data for the Pro plan (Section 3.7) and technical data (IP address, logs) we act as an independent controller.
2.3. What the Application writes to Bitrix24. The Application only adds the documents it creates (to the Documents section of a deal or invoice, or as a timeline comment), a copy on the shared Drive if the Customer enables it, a tab, a button and a workflow robot. It never changes or deletes CRM records.
3. What data the Application processes
3.1. Read from your Bitrix24 account when a document or preview is requested:
- the deal or invoice: ID, title, amount, currency, linked company, contact and own company;
- its products: name, quantity, unit, price, discount, VAT rate and whether VAT is included;
- requisites of the client and of the Customer's own company: company or person name, VAT ID / NIP / tax number, registration numbers (e.g. REGON, KRS), name of the director, legal address; bank details of the Customer's own company: bank name, IBAN or account number, BIC/SWIFT;
- if the deal has no linked requisites: the name and address of the linked company, or the first and last name of the linked contact;
- for the list of deals in the Application: ID, title, amount and currency of the latest deals or of deals whose title matches the text typed by the user;
- whether the user who opens the Application is a Bitrix24 administrator;
- installation data: Bitrix24 account address, installation ID (
member_id), language of the account at installation, access tokens issued by Bitrix24.
3.2. Entered in the Application by the Customer ("Company details"): company name, address, country, VAT ID, registration number, IBANs, BIC, bank, e-mail and phone for documents, name of the signatory, document rules (payment term, VAT and QR settings, number format, note on documents).
3.3. Own templates uploaded by the Customer (Word files) and the Customer's settings of which templates are shown. Templates may contain whatever the Customer puts into them.
3.4. Not requested: client e-mail addresses and phone numbers, activities, correspondence, calls, files other than templates, employees' data other than the administrator flag of the current user. The Application requests the "CRM", "Embedding in the interface" (placement), "Business processes" and, for the optional copy of documents, "Drive" access scopes.
3.5. The Application is not intended for special categories of personal data (Article 9 GDPR). The Customer undertakes not to put such data into deals, products or templates used to create documents.
3.6. Contact form on https://docmaster-eu.ai-automation-agency.biz/about: your name, the e-mail address or phone number you leave for our reply, your message, and the time it was sent. Your IP address is used in server memory only to limit the number of messages and is not saved with the message.
3.7. Billing data (Pro plan). Payments for the Pro plan are made on the Stripe Checkout page and processed by Stripe (Section 6.3). We never receive or store payment card data. On our servers we store only: the installation ID (member_id) and the Bitrix24 account address; the Stripe customer ID and subscription ID; the plan and subscription status; the dates of the trial and of the current billing period; the history of billing events; and the number of documents created per month (to apply the Free plan limit). The name, e-mail address, billing address and VAT ID entered at checkout are held by Stripe; we can view them in our Stripe account to issue invoices, handle refunds and answer billing questions, but we do not copy them to the Application's servers.
3.8. Technical data: IP address, browser type, timestamps, request paths, Bitrix24 account address.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating documents and previews from CRM data and showing them to the Customer's users; attaching them to CRM records or Drive; running the workflow robot | Art. 28 GDPR: processing on behalf of the Customer, who relies on its own legal basis (usually Art. 6(1)(b), (c) or (f)) |
| Storing the Customer's company details, own templates, document numbering | Art. 28 GDPR, as above |
| Installing the Application, authenticating users, keeping the service secure | Art. 6(1)(b): performance of the License Agreement; Art. 6(1)(f): legitimate interest in security |
| Answering messages sent through the contact form; technical support and fixing errors | Art. 6(1)(b) and 6(1)(f) |
| Managing the Pro subscription, trial, monthly document limit and payments; refunds; preventing repeated trials | Art. 6(1)(b); Art. 6(1)(f): legitimate interest in granting the trial and the free limit once per account |
| Keeping billing records and invoices | Art. 6(1)(c): obligations under Polish tax and accounting law |
We do not use the data for marketing, profiling, sale to third parties, or training machine learning models.
5. How the data is processed and stored
5.1. Documents are created in memory and not kept. CRM data is fetched from the Bitrix24 account at the moment a document or preview is requested, merged with the template in server memory and the result is sent to the Bitrix24 account or to the user's browser. When a PDF is produced, the document is converted by LibreOffice in a temporary folder that is deleted immediately after the conversion. Documents, CRM data and client details are not stored on our servers and are not written to logs.
5.2. Stored on our servers for as long as the Application is installed: Company details (Section 3.2), Own templates and template settings (Section 3.3), and document numbering (for each document type: the last number used and which deal or invoice ID received which number). These are deleted when the Application is uninstalled.
5.3. OAuth tokens (access/refresh) and the application token used to verify uninstall notifications are stored encrypted (AES-256-GCM) in files accessible only to the Application's service account, are used solely to call the REST API of the corresponding Bitrix24 account, and are deleted when the Application is uninstalled. In most operations the Application uses the access token of the user who is working with it, so it can see only what that user can see in Bitrix24.
5.4. In the browser. The Application does not store anything in the browser beyond the page itself. Documents downloaded on the Free plan are saved by the user's browser.
5.5. Location. The Application runs on servers of Hetzner Online GmbH in Germany (EU).
5.6. Retention:
- documents, CRM data and previews — not retained (Section 5.1);
- Company details, Own templates, settings and document numbering — for as long as the Application is installed; deleted immediately upon the uninstall notification from Bitrix24;
- tokens — for as long as the Application is installed; deleted on uninstall;
- contact-form messages — as long as needed to answer you and handle follow-up questions; you can ask us to delete them at any time;
- technical logs — up to 12 months;
- billing data (Section 3.7) and invoices — 5 years from the end of the calendar year in which the related tax payment deadline fell; not deleted on uninstall, and uninstalling does not cancel a Pro subscription;
- the record that the free trial has been used (installation ID, account address, trial dates) and the monthly document counter — for as long as the Application is offered, so that the trial and the free limit are granted only once per account; not deleted on uninstall.
5.7. Security measures: TLS/HTTPS for all traffic; encryption of tokens at rest; OS-level access restriction to data files; every request from the Application's pages must carry a Bitrix24 access token that is verified with the Bitrix24 account; changes of company details only by a Bitrix24 administrator confirmed by Bitrix24; uninstall notifications accepted only with the account's application token; access logging.
5.8. What logs contain: Bitrix24 account address, type of operation, template code, deal or invoice ID, status and duration, error codes returned by Bitrix24. When a contact-form message arrives, the log records its ID, your name, the contact you left and the first 120 characters of the message. Document contents, client data, bank details and token values are never written to logs.
6. Recipients and sub-processors
6.1. We do not sell, rent or disclose data to third parties except as described here or required by law.
6.2. Sub-processors:
- Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — server hosting (EU).
6.3. Stripe (Pro plan payments). Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland, receives the billing data described in Section 3.7 and the details entered at checkout. For processing payments, including fraud prevention and compliance with its legal obligations as a payment service provider, Stripe acts as an independent controller under its own privacy policy (https://stripe.com/privacy). For billing services provided to us (subscription management, invoices and receipts, tax calculation, the Customer Portal), Stripe acts as our processor. Stripe receives no CRM data or documents and is not a sub-processor for the Customer's data.
6.4. Support e-mail. Messages sent through the contact form may be forwarded by e-mail to our support mailbox artismediaeu@gmail.com, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. CRM data and documents are never sent by e-mail.
6.5. Bitrix24 is the Customer's own service provider; the Application only calls the Customer's Bitrix24 REST API. The Bitrix24 JavaScript library used inside the Application is loaded by the user's browser from Bitrix24.
6.6. Data of one Customer is never used for another Customer.
6.7. We will inform Customers of any intended change of sub-processors at least 30 days in advance by updating this Policy; Customers may object by uninstalling the Application.
7. International transfers
We do not ourselves transfer personal data processed by the Application outside the European Economic Area. If a contact-form message is forwarded by e-mail (Section 6.4), Google may process it in other countries under the safeguards described in its data processing terms, including the European Commission's Standard Contractual Clauses. Stripe may transfer billing and payment data to Stripe, Inc. in the United States and other group companies under the EU-U.S. Data Privacy Framework or Standard Contractual Clauses, as described in its privacy policy.
8. Your rights
Under the GDPR, data subjects have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), and to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl.
Because CRM data and documents are controlled by the Customer, requests concerning that data should be addressed to the Customer as controller; we assist the Customer in fulfilling them. Changes made in Bitrix24 apply to the next document automatically.
Requests to us: artismediaeu@gmail.com. We respond within one month (Art. 12(3) GDPR).
9. Cookies
The Application does not set cookies and uses no analytics or advertising trackers. Bitrix24, inside which the Application is opened, uses its own cookies under its own policy.
10. Changes to this Policy
The current version is published at https://docmaster-eu.ai-automation-agency.biz/legal/privacy. Material changes will be communicated to Customers in advance. Continued use after the effective date means acceptance of the updated Policy.
11. Data Processing Terms (Article 28 GDPR)
11.1. Subject matter and duration: provision of the Application for as long as it is installed on the Customer's Bitrix24 account.
11.2. Nature and purpose: reading CRM records, products and requisites on request, creating documents from templates, delivering them to the Customer's Bitrix24 account or users, and storing the Customer's company details, Own templates and document numbering.
11.3. Data subjects: the Customer's clients and their representatives, the Customer's own representatives and signatories, and any natural persons whose data the Customer puts into deals, products or templates. Categories of data: as listed in Sections 3.1–3.3.
11.4. We process personal data only on the Customer's documented instructions, which consist of installing and using the Application, its settings and the templates and robots configured by the Customer.
11.5. Persons authorised to process the data are bound by confidentiality.
11.6. We implement the technical and organisational measures described in Section 5 (Art. 32 GDPR).
11.7. We engage sub-processors listed in Section 6 under written terms providing equivalent protection; the Customer gives general authorisation for them.
11.8. We assist the Customer with data subject requests and with its obligations under Articles 32–36 GDPR, taking into account the nature of processing.
11.9. We notify the Customer of a personal data breach without undue delay and in any case within 48 hours of becoming aware of it.
11.10. On uninstall, all personal data processed on behalf of the Customer is deleted as described in Section 5.6; no copies are retained except logs as stated. Billing data is our own data as controller and is kept as stated in Section 5.6.
11.11. We make available information necessary to demonstrate compliance and allow for audits on reasonable prior notice, at the Customer's expense, no more than once a year.