Pulse24 Privacy Policy
This Privacy Policy explains how personal data is processed when you use Pulse24, a cloud application for Bitrix24 that builds sales analytics from your CRM deals: sales funnel by stage, conversion, time at each stage, figures by responsible person and period, with currency conversion (the "Application"). The Application is available at https://pulse-eu.ai-automation-agency.biz and distributed through the Bitrix24 Marketplace.
This Policy is drafted in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and the Polish Act of 10 May 2018 on the Protection of Personal Data.
1. Who we are
ARTISMEDIA Sp. z o.o., Nowogrodzka 64/43, 02-014 Warsaw, Poland; KRS 0000868723; NIP (VAT ID) PL7011004442; REGON 387549826 ("we", "us"). Contact for privacy matters: artismediaeu@gmail.com, +48 693 124 346.
2. Our role: processor and controller
2.1. CRM and employee data on your Bitrix24 account. Your organization (the "Customer") enters data about its deals and employees into its own Bitrix24 account. For this data the Customer is the controller and we act as a processor under Article 28 GDPR, processing it only to provide the Application's features on the Customer's documented instructions. The Data Processing Terms in Section 11 form part of the Pulse24 License Agreement.
2.2. Account, contact-form and technical data. For data about the installation (Bitrix24 account address, installation and user identifiers), messages you send us through the contact form, and technical data (IP address, logs) we act as an independent controller.
2.3. Read-only access. The Application only reads data from Bitrix24. It never creates, changes or deletes deals, contacts, employees or any other records in your Bitrix24 account.
3. What data the Application processes
3.1. Read from your Bitrix24 account to calculate the figures:
- deals: ID, title, stage, pipeline, amount and currency, start date, close date, "closed" flag, creation and last modification time, ID of the responsible person;
- reference data: deal stages (ID, name, order, whether the stage means won or lost) and currencies with their exchange rates as set in your Bitrix24;
- deal stage history: record ID, deal ID, pipeline, stage and the time of each stage change;
- active employees: ID, first name, last name, department membership (
UF_DEPARTMENT); - departments: ID, parent department, head of department;
- the user who opens the Application: ID, first name, last name, administrator flag (and departments, if Bitrix24 returns them);
- installation data: Bitrix24 account address, installation ID (
member_id), access tokens issued by Bitrix24.
3.2. Read only on a user's request and not stored: when a user clicks a stage, the Application requests from Bitrix24 a list of up to 60 deals of that stage (ID, title, stage, amount, currency, responsible person, start date), shows it to that user and does not keep it — not in memory between requests, not on disk and not in logs.
3.3. Not requested at all: contacts, companies, leads, invoices, client phone numbers and e-mail addresses, postal addresses, deal comments, activities, files, correspondence, calls, bank details, and employees' contact details. The Application requests only the "CRM", "Users (basic)" and "Company structure" access scopes. It has no access to telephony, mail, Drive, chats or Open Channels.
3.4. Of the fields Bitrix24 returns about employees, the Application uses only ID, NAME, LAST_NAME, the administrator flag and UF_DEPARTMENT. All other fields are discarded immediately and never stored or transferred. The "Users (basic)" scope is needed because department membership is only available with it, and without it figures cannot be limited to a department.
3.5. The Application is not intended for special categories of personal data (Article 9 GDPR). The Customer undertakes not to enter such data into the fields used for the calculation.
3.6. Contact form on https://pulse-eu.ai-automation-agency.biz/about: your name, the e-mail address or phone number you leave for our reply, your message, and the time it was sent. Your IP address is used in server memory only to limit the number of messages (no more than five per hour) and is not saved with the message.
3.7. Technical data: IP address, browser and OS type, timestamps, request headers, session identifier.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Calculating and displaying sales analytics to the Customer's users; keeping the figures up to date by background recalculation | Art. 28 GDPR: processing on behalf of the Customer, who relies on its own legal basis (usually Art. 6(1)(b) or 6(1)(f)) |
| Limiting what each user sees according to the company structure in Bitrix24 | Art. 28 GDPR, as above |
| Installing the Application, authenticating users, keeping the service secure | Art. 6(1)(b): performance of the License Agreement; Art. 6(1)(f): legitimate interest in security |
| Answering messages sent through the contact form; technical support and fixing errors | Art. 6(1)(b) and 6(1)(f) |
| Compliance with legal obligations | Art. 6(1)(c) |
We do not use the data for marketing, profiling, evaluating employees beyond the figures requested by the Customer itself, sale to third parties, or training machine learning models.
5. How the data is processed and stored
5.1. Calculated on the fly, only figures are kept. CRM data is fetched from your Bitrix24 account, processed in server memory, and discarded once the calculation is finished. Deal titles are part of what Bitrix24 returns during the calculation, but they are not kept after it. What the Application keeps in server memory between calculations:
- aggregated figures — counts and amounts of deals by stage, month and responsible person ID, in the base currency of your Bitrix24;
- a deal index — a numeric table with, for each deal, only its ID, stage, responsible person ID, date and amount in the base currency, so that later updates request only the deals that changed instead of the whole CRM;
- stage history as listed in Section 3.1 (IDs, stages and dates only);
- stage names and exchange rates of your Bitrix24.
These are kept until the service restarts or the Application is uninstalled. Deal titles, client data, contact details and any other CRM content are never stored, neither in memory between requests nor on disk nor in logs.
5.2. Employee names and the department structure are kept in server memory for up to 30 minutes, to show names instead of numeric IDs and to apply access rules. The confirmed identity of the user who opened the Application is kept in memory for up to 5 minutes.
5.3. Nothing from the CRM is written to disk. The figures, the index and the history live only in memory and are recalculated after a restart.
5.4. Background updates. To make the dashboard open instantly, the Application recalculates the figures in the background every few minutes (less often on large accounts, to stay within Bitrix24 REST API limits) and loads the stage history separately, even when nobody has the Application open. This applies to cloud Bitrix24 accounts and to on-premise accounts where the Customer has connected an inbound webhook.
5.5. OAuth tokens (access/refresh), the application token used to verify uninstall notifications, the installation ID and the account address are stored on the server in files readable only by the Application's service account (permissions 0600). They are used solely to call the REST API of the corresponding Bitrix24 account, give no access to user passwords, and are deleted when the Application is uninstalled.
5.6. Inbound webhooks. If the Customer connects an inbound webhook on an on-premise Bitrix24, its address (which contains a secret key), the ID of the employee who created it, whether that employee is an administrator, and the scopes it grants are stored on the same terms as tokens and deleted together with them. The Application only accepts a webhook that points to the same Bitrix24 account from which it was opened.
5.7. Sessions. To keep the Bitrix24 access token out of the browser address bar, server logs, browser history and the Referer header, the Application creates a server-side session and passes only its identifier to the browser. The session (account address, the user's Bitrix24 access token and timestamps) lives 1 hour and is stored in a file with permissions 0600 so that a service restart does not log users out. All sessions of an account are closed immediately on uninstall.
5.8. In the browser. The dashboard remembers in the browser's local storage that a user has closed the welcome tips (one flag per Bitrix24 account and user ID). Nothing else is stored in the browser, and nothing is written to your Bitrix24.
5.9. Location. The Application runs on servers of Hetzner Online GmbH in Germany (EU).
5.10. Retention:
- figures, the deal index and stage history — in memory until the service restarts or the Application is uninstalled;
- employee names and department structure — up to 30 minutes in memory;
- deal lists opened by a user — not retained;
- tokens, webhooks, sessions and settings — for as long as the Application is installed, deleted immediately upon the uninstall notification from Bitrix24; sessions also expire after 1 hour;
- contact-form messages — as long as needed to answer you and handle follow-up questions; you can ask us to delete them at any time;
- technical logs — up to 12 months.
5.11. Security measures: TLS/HTTPS for all traffic; OS-level access restriction to token, session and webhook files; no anonymous access to the figures (the user's identity is confirmed by Bitrix24); the same access rules applied to aggregated figures and to deal lists; API requests accepted only from our own origin; uninstall notifications accepted only with the account's application token; access logging.
5.12. What logs contain: Bitrix24 account address, type of operation, number of records processed, duration, error codes returned by Bitrix24, and the steps of first-time use of the dashboard (for example, "example report opened") together with the account address but without the user's identity. When a contact-form message arrives, the log records its ID, your name, the contact you left and the first 120 characters of the message. Deal titles, client data, employee names and token values are never written to logs.
6. Recipients and sub-processors
6.1. We do not sell, rent or disclose data to third parties except as described here or required by law.
6.2. Sub-processors:
- Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — server hosting (EU).
6.3. Support e-mail. Messages sent through the contact form may be forwarded by e-mail to our support mailbox artismediaeu@gmail.com, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. CRM and employee data from Bitrix24 is never sent by e-mail.
6.4. Bitrix24 is the Customer's own service provider; the Application only calls the Customer's Bitrix24 REST API. The Bitrix24 JavaScript library used inside the Application is loaded by the user's browser from Bitrix24 (with a copy on our server as a fallback).
6.5. Data of one Customer is never used to calculate figures for another Customer and is not included in cross-customer benchmarks.
6.6. We will inform Customers of any intended change of sub-processors at least 30 days in advance by updating this Policy; Customers may object by uninstalling the Application.
7. International transfers
We do not transfer personal data processed by the Application outside the European Economic Area. If a contact-form message is forwarded by e-mail (Section 6.3), Google may process it in other countries under the safeguards described in its data processing terms, including the European Commission's Standard Contractual Clauses.
8. Your rights
Under the GDPR, data subjects have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), and to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl.
Because deal and employee data is entered into Bitrix24 by the Customer, requests concerning that data should be addressed to the Customer as controller; we assist the Customer in fulfilling them. Changes made in Bitrix24 appear in the Application automatically on the next recalculation.
Requests to us: artismediaeu@gmail.com. We respond within one month (Art. 12(3) GDPR).
9. Cookies
The Application itself does not set cookies. It uses a session identifier passed with each request and the local-storage flag described in Section 5.8, both strictly necessary for its operation. No analytics or advertising cookies or trackers are used. Bitrix24, inside which the Application is opened, uses its own cookies under its own policy.
10. Changes to this Policy
The current version is published at https://pulse-eu.ai-automation-agency.biz/legal/privacy. Material changes will be communicated to Customers in advance. Continued use after the effective date means acceptance of the updated Policy.
11. Data Processing Terms (Article 28 GDPR)
11.1. Subject matter and duration: provision of the Application for as long as it is installed on the Customer's Bitrix24 account.
11.2. Nature and purpose: reading the Customer's CRM deals, deal stage history, employees and company structure, calculating sales analytics, and displaying them to the Customer's users within their access rights.
11.3. Data subjects: the Customer's employees and users of its Bitrix24 account, and any natural persons whose data the Customer puts into deal titles. Categories of data: as listed in Section 3.1.
11.4. We process personal data only on the Customer's documented instructions, which consist of installing and using the Application, connecting a webhook where applicable, and the Application's settings.
11.5. Persons authorised to process the data are bound by confidentiality.
11.6. We implement the technical and organisational measures described in Section 5 (Art. 32 GDPR).
11.7. We engage sub-processors listed in Section 6 under written terms providing equivalent protection; the Customer gives general authorisation for them.
11.8. We assist the Customer with data subject requests and with its obligations under Articles 32–36 GDPR, taking into account the nature of processing.
11.9. We notify the Customer of a personal data breach without undue delay and in any case within 48 hours of becoming aware of it.
11.10. On uninstall, all personal data is deleted as described in Section 5.10; no copies are retained except logs as stated.
11.11. We make available information necessary to demonstrate compliance and allow for audits on reasonable prior notice, at the Customer's expense, no more than once a year.