Pametne Tehnologije d.o.o. (“we”, “our”, “us”) provides Costs & expenses (the “Application”), an application for Bitrix24 that helps users record, calculate, store, and analyze the costs and expenses of tasks, projects, and CRM items.
This Privacy Policy explains how we handle personal data when you install and use the Application, purchase a subscription, or contact our support. Processing of personal data on behalf of your organization is additionally governed by our Data Processing Agreement (“DPA”).

1. Who is responsible for your data

Your organization (the company or individual that uses the Application for business purposes) determines how personal data contained in its Bitrix24 portal is processed through the Application. For this data, your organization acts as the Data Controller, and we process personal data on its behalf as a Data Processor under the GDPR.
We act as the Data Controller for the license and technical data required to provide and bill the Application and for the data contained in support requests.
Payments are processed by Paddle, which acts as our authorized reseller and Merchant of Record. Paddle processes payment data as an independent controller in accordance with its own privacy policy. We do not receive or store payment card data.
Your organization is responsible for ensuring that it has a lawful basis and all necessary permissions to process the personal data contained in its Bitrix24 portal through the Application.

2. What data we process

Depending on how the Application is used, we may process:

• Bitrix24 users: user IDs and names, hourly rates assigned to employees in the cost catalog, and time-tracking records (user, task, and hours);
• Cost objects: names of tasks, projects, CRM items (deals, leads, quotes, invoices, smart process items), and products, as well as amounts of CRM items and purchasing prices of products;
• Cost records and catalog: cost items, cost rows and their values, and the user who created or last changed them and when;
• Access settings: the users who are granted read or write access to cost data;
• Technical data: the Bitrix24 portal domain and identifier and the authorization tokens issued by Bitrix24 for the Application;
• License data: the subscription plan and its period, Paddle transaction and subscription identifiers, and records of refunds;
• Support data: the name, email address, and content of messages sent to our support by email or through the messenger integrated in the Application.

We process data acting as a Data Processor solely to provide the functionality of the Application on behalf of your organization, including:

• displaying the Costs tab and calculating hourly, fixed, and product costs;
• writing the calculated total to the Cost field in Bitrix24;
• exporting cost data to XLS and providing it to Bitrix24 BI Builder;
• running the CRM robots of the Application and creating documents with costs;
• applying the access settings defined by your organization.

• managing the license, trial period, subscriptions, and refunds — performance of the contract (Article 6(1)(b) GDPR);
• preventing abuse, such as repeated trial periods or repeated refund requests, and ensuring the security of the Application — our legitimate interests (Article 6(1)(f) GDPR);
• answering support requests — performance of the contract or our legitimate interests (Article 6(1)(b) or (f) GDPR);
• complying with legal obligations, including accounting and tax obligations — Article 6(1)(c) GDPR.

All data processed by the Application is stored in the Application’s own database, separately for each Bitrix24 portal, on servers operated for Pametne Tehnologije d.o.o. within the European Union (Bratislava, Slovakia).
Data that the Application writes to your Bitrix24 portal, such as the values of the Cost field, documents created with costs, and data provided to BI Builder, is stored in Bitrix24 and is subject to Bitrix24’s terms and privacy policy.

5. How long we keep the data and when it is deleted

• When the trial period or a paid subscription expires and no valid paid license has been purchased, access to the Application is blocked. The data is retained for one (1) month and is then permanently deleted. If a license is purchased within this period, the data is restored.
• When the Application is uninstalled, the data is retained for one (1) month and is then permanently deleted. If the Application is reinstalled within this period, the data is restored.
• When the Application is uninstalled with the “Delete application data” option selected, the data is deleted immediately.

• the portal identifier and license history, to ensure that the trial period is granted only once per portal and to process refunds;
• transaction records, for as long as required by applicable accounting and tax law;
• support correspondence, for as long as necessary to handle the request and any follow-up.

6. Who we share data with

We may share or transmit personal data with the following parties where necessary to provide the Application:

• Bitrix24: data is obtained from your Bitrix24 portal, and calculated costs are written back to it (the Cost field, BI Builder, documents, and CRM robots). Bitrix24 processes personal data under the responsibility of your organization and according to its own privacy and data-processing terms.
• Our hosting providers: data required to operate the Application is stored on infrastructure provided by our hosting providers in the European Union.
• Paddle: when a subscription is purchased, an encrypted identifier of your Bitrix24 portal is passed to Paddle so that the payment can be linked to the license. Paddle processes payment data as Merchant of Record and an independent controller.

7. Your rights

Under the GDPR and other applicable data-protection laws, individuals may have rights including:

• access to their personal data;
• correction of inaccurate data;
• deletion of personal data (“right to be forgotten”);
• restriction of processing;
• data portability;
• objection to processing; and
• the right to lodge a complaint with a competent data-protection supervisory authority, in Slovenia the Information Commissioner (Informacijski pooblaščenec).

8. Security

We apply appropriate technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction.
These measures include separate storage of data for each Bitrix24 portal, encrypted connections, verification of requests from Bitrix24, appropriate access controls, and confidentiality obligations for personnel who may have access to personal data. Within the Application, your organization can restrict access to cost data through the Access settings.
We take measures appropriate to the risks associated with processing personal data, in accordance with Article 32 GDPR where applicable.

9. Data breaches

If we become aware of a personal data breach affecting data processed on behalf of an organization, we will notify the relevant organization without undue delay and provide reasonable information and assistance necessary for the organization to assess and, where required, notify the competent supervisory authority and affected individuals.

10. Contact us

If you have questions about how personal data is processed by the Application, please contact us:
gdpr@pamteh.si
Pametne Tehnologije d.o.o.
Dunajska cesta 113
1000 Ljubljana
Slovenia
gdpr@pamteh.si