Privacy Policy
This policy is for people whose personal data KITSIS CRM processes for its own purposes: the people who use the Service, people who write to us, and visitors of kitsiscrm.com. It is the information required by Articles 13 and 14 of the GDPR (Regulation (EU) 2016/679).
Data that companies keep in their CRM is different. Contacts, deals, messages and files in a workspace belong to the company that uses KITSIS. For that data the company is the controller and we only process it on its behalf, under the Data Processing Agreement. If you are a client or contact of such a company, ask that company about your data. We will pass on any request we receive about it.
1. Controller
KITSIS CRM, a sole proprietorship registered in the Polish register of business activity (CEIDG) under tax number NIP 5223380752. Its full business name and registered address are public in CEIDG under this number.
Write to privacy@kitsiscrm.com about anything in this policy. We have not appointed a data protection officer: the law does not require one for our kind of processing.
2. What we process, why, and on what legal basis
| Whose data | What | Why | Legal basis (GDPR) |
|---|---|---|---|
| Users of the Service | name, email address, login, password (stored only as an Argon2id hash), role, language, photo and work phone if added | to create the account, let the person sign in and work in the Service | Art. 6(1)(b) for the person who signs the company up; Art. 6(1)(f) for invited Users: our and the company’s legitimate interest in running the Service the company ordered |
| Users of the Service | IP address, browser and device, time of sign-in, sessions, sign-in codes, passkeys, failed sign-in attempts | to protect accounts: sessions, sign-in codes, lockout after wrong passwords, the device list, the company’s access log | Art. 6(1)(f): security of the Service |
| Users of the Service | email address and the text of the email | to send service emails: sign-in codes, password reset, security notices, billing and deletion notices | Art. 6(1)(b) and 6(1)(f) |
| Users of the Service | technical error reports: page, browser, error text, with personal data masked | to find and fix errors | Art. 6(1)(f) |
| Company billing contacts | company name, email, VAT number, address, payment status. Card data goes to Stripe and never reaches us | to charge for the Service and keep accounting records | Art. 6(1)(b) and Art. 6(1)(c): tax and accounting law |
| People who write to us | email address, name, the message | to answer and to keep a record of the case | Art. 6(1)(f) |
| Visitors of kitsiscrm.com | IP address and request data in server logs of our hosting | to deliver the website and protect it | Art. 6(1)(f) |
The website kitsiscrm.com uses no cookies, no analytics and no advertising trackers. The app at app.kitsiscrm.com uses only the cookies it needs to work: the session cookie, the protection token against forged requests (CSRF), and the cookie that remembers a trusted device for 30 days. The interface language is kept in your browser’s storage. So that screens open at once, the app also keeps a copy of recently opened screens in the browser’s storage for up to 72 hours. It is erased when you sign out.
We do not sell personal data, do not use it for advertising and make no decisions about people by automated means, including profiling.
3. Do you have to give us the data?
The name of the company, an email address and a password are needed to create a workspace, and an email address is needed to invite a User. Without them we cannot provide the Service. Everything else is optional.
4. Who receives the data
We use service providers who process data for us under data processing agreements:
| Provider | What for | Where |
|---|---|---|
| DigitalOcean, LLC | servers and database | Frankfurt, Germany |
| OVH SAS | file storage and encrypted backups | France |
| Backblaze, Inc. | second encrypted copy of database backups | Amsterdam, Netherlands |
| Vercel Inc. | delivery of the website and the web app | global network, including the USA |
| Functional Software, Inc. (Sentry) | error reports with personal data masked | EU data region, Frankfurt |
| Google (Google Workspace) | sending service emails and our email | EU and USA |
The current list with details is on the subprocessors page.
Other recipients:
- Stripe (Stripe Payments Europe, Limited, Ireland) processes payments. For fraud prevention and legal obligations Stripe acts as a separate controller, see stripe.com/privacy.
- Telegram delivers internal alerts to our team: names of new companies, subscription changes and warnings about attacks on accounts. Logins and IP addresses are never sent there, only short coded fingerprints of them. Telegram stores data of users in the EEA in the Netherlands.
- Push services of browser makers (Apple, Google, Mozilla) deliver notifications to devices where a User turned them on. The text of the notification is encrypted for the device (RFC 8291), so the push service cannot read it. It sees the device address, time and size.
- Public authorities, when the law requires it.
5. Transfers outside the EEA
Some providers are US companies: DigitalOcean, Backblaze, Vercel, Sentry and Google. They are certified under the EU-US Data Privacy Framework, which the European Commission found adequate (decision of 10 July 2023), and their agreements with us also include the Standard Contractual Clauses (Commission Decision 2021/914). You can ask for a copy of these safeguards at privacy@kitsiscrm.com.
6. How long we keep data
| Data | How long |
|---|---|
| Account data of a User | while the person is in a workspace. When a workspace is deleted, Users who belong to no other workspace are deleted with it |
| Whole workspace after the subscription ends | 30 days, then deleted. Backups expire no later than 35 days after deletion |
| Failed sign-in attempts | 1 day; the sign-in journal for lockouts 180 days |
| Journal of service emails | 90 days |
| The company’s access log | 24 months; it is part of the Service and belongs to the company |
| Error reports | for the retention period of our Sentry plan, then deleted automatically |
| Billing and accounting records | 5 years from the end of the year in which tax became due (Polish tax law) |
| Correspondence with us | up to 3 years after the matter is closed, the limitation period for claims |
7. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict its processing, to data portability, and to object to processing based on our legitimate interest (Articles 15 to 21 GDPR). Write to privacy@kitsiscrm.com. We reply within 7 days, and fulfil the request within one month at the latest, as the law requires. Many things you can do yourself: change your name and email in the profile, download data, sign out other devices.
You can also complain to the supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland, uodo.gov.pl.
8. Security
How we protect data is described in the Data Processing Agreement, Annex 2. To report a vulnerability, see the security page.
9. Changes
We update this policy when our processing changes. The date of the current version is at the top. We email Users about important changes.