Privacy Policy for Personal Data

2.1. We process the following categories of personal data:

• data you provide yourself (name, email address, phone number, business information);
• data collected automatically when you use the Service (IP address, browser and operating system information, cookies);
• billing data (payment status, transaction ID, billing email; full card data are processed by our payment service provider and are not stored by us; payments are processed by PayPro Global).

3.1. We process personal data solely for the following purposes:

• identification of the user when using the Service;
• provision of the Service;
• performance of obligations under the contract with the user;
• sending informational messages, news and notifications (with your consent);
• statistical and analytical research based on anonymised data.

3.3. We retain personal data as follows:

• account data — while the account is active and not more than 3 years after its termination;
• billing data — not more than 5 years from the date of payment processing, as required by tax law;
• CRM data — deleted not more than 3 years after deletion by the user or termination of the account;
• backups — not more than 3 years;
• logs — not more than 3 years.

4.1. Personal data may be disclosed to third parties only in the following cases:

• you have given your consent to such disclosure, including consent to cross-border transfer;
• disclosure is necessary to perform the contract to which you are a party;
• disclosure is necessary to protect our rights and legitimate interests;
• disclosure is required by law, including court orders and requests of competent state authorities.

5.1. You have the right to:

• access your personal data;
• rectify inaccurate or incomplete data;
• erase your data ("right to be forgotten");
• restrict processing;
• receive your data in a portable format;
• object to processing;
• withdraw your consent at any time.

6.1. Organisational measures:

• access rights restricted by the least-privilege principle;
• system of recording and logging actions with personal data;
• integrity assurance;
• regular security analysis;
• control of physical access to data media;
• internal data protection policies;
• designated persons responsible for data processing;
• internal control of data protection measures.

6.2. Technical measures:

• TLS 1.3 encryption of all connections;
• two-step authentication (password and one-time code);
• automatic and semi-automatic incident response;
• proactive filter (WAF — Web Application Firewall);
• regular security audits of code and infrastructure, internally and by independent companies;
• firewall-restricted access to all infrastructure;
• continuous activity monitoring;
• timely updates of system software;
• password rotation every 90 days;
• antivirus software.