OrgChart24 Privacy Policy
This Privacy Policy explains how personal data is processed when you use OrgChart24, a cloud application for Bitrix24 that displays and prints your company's organizational structure (the "Application"). The Application is available at https://orgchart.ai-automation-agency.biz and distributed through the Bitrix24 Marketplace.
This Policy is drafted in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and the Polish Act of 10 May 2018 on the Protection of Personal Data.
1. Who we are
ARTISMEDIA Sp. z o.o., Nowogrodzka 64/43, 02-014 Warsaw, Poland; KRS 0000868723; NIP (VAT ID) PL7011004442; REGON 387549826 ("we", "us"). Contact for privacy matters: artismediaeu@gmail.com, +48 693 124 346.
2. Our role: processor and controller
2.1. Employee data on your Bitrix24 account. Your organization (the "Customer") enters data about its departments and employees into its own Bitrix24 account. For this data the Customer is the controller and we act as a processor under Article 28 GDPR, processing it only to provide the Application's features on the Customer's documented instructions. The Data Processing Terms in Section 10 form part of the OrgChart24 License Agreement.
2.2. Account and technical data. For data about the installation (Bitrix24 account address, installation and user identifiers) and technical data (IP address, logs) we act as an independent controller.
3. What data the Application processes
3.1. Read from your Bitrix24 account:
- departments: ID, name, parent department, head of department;
- employees: ID, first name, last name, middle name, job title, profile photo, active flag, department membership (
UF_DEPARTMENT); - installation data: Bitrix24 account address, installation ID, ID of the user who opened the Application.
3.2. Not requested at all: employee e-mail addresses and phone numbers, messengers, dates of birth, home addresses, salaries, HR documents, and any CRM data (deals, leads, contacts, companies, invoices). The Application requests only the "Users (minimum)", "Company structure" and "Business processes" access scopes (the latter only to register its automation rules for workflows). It has no access to CRM, telephony, mail, Drive or chats.
3.3. Of the fields returned by the user.get method, the Application uses only ID, NAME, LAST_NAME, SECOND_NAME, WORK_POSITION, PERSONAL_PHOTO, ACTIVE and UF_DEPARTMENT. All other fields are discarded immediately and never stored or transferred.
3.4. The Application is not intended for special categories of personal data (Article 9 GDPR). Profile photos are displayed as images only; no facial recognition, comparison or biometric processing is performed.
3.5. Technical data: IP address, browser and OS type, timestamps, request headers, session identifier.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Displaying the org chart to the Customer's users; printable and PDF versions | Art. 28 GDPR: processing on behalf of the Customer, who relies on its own legal basis (usually Art. 6(1)(b) or 6(1)(f)) |
| Installing the Application, authenticating users, keeping the service secure | Art. 6(1)(b): performance of the License Agreement; Art. 6(1)(f): legitimate interest in security |
| Technical support and fixing errors | Art. 6(1)(b) and 6(1)(f) |
| Compliance with legal obligations | Art. 6(1)(c) |
We do not use the data for marketing, profiling, employee evaluation, sale to third parties, or training machine learning models.
5. How the data is processed and stored
5.1. Read on open, never written to disk. Org structure data is fetched from your Bitrix24 account when a user opens the Application, processed in server memory and kept there for no longer than one hour to avoid re-querying Bitrix24 on every view. After that, or when the service restarts, it is discarded.
5.2. Org structure data is never written to disk in any form: not to a database, not to files and not to logs.
5.3. OAuth tokens (access/refresh) and the account address are stored in files readable only by the Application's service account (permissions 0600), are used solely to call the REST API of the corresponding Bitrix24 account, give no access to user passwords, and are deleted when the Application is uninstalled.
5.4. Sessions. To keep the Bitrix24 access token out of the browser address bar, server logs, browser history and the Referer header, the Application creates a server-side session and passes only its identifier to the browser. A session lives 1 hour. All sessions of an account are closed immediately on uninstall.
5.5. Printing and PDF are generated in the user's browser. The printable document is not sent to or stored on our servers.
5.6. Location. The Application runs on servers of Hetzner Online GmbH in Germany (EU). Personal data is not transferred outside the European Economic Area.
5.7. Retention: org structure data — up to 1 hour in memory; tokens and settings — for as long as the Application is installed, deleted immediately upon uninstall notification; technical logs — up to 12 months.
5.8. Security measures: TLS/HTTPS for all traffic; OS-level access restriction to token files; no anonymous access (the user's identity is confirmed by Bitrix24); API requests accepted only from our own origin; access logging.
5.9. What logs contain: Bitrix24 account address, number of departments and employees read, operation duration. Names, job titles, photos and token values are never written to logs.
6. Recipients and sub-processors
6.1. We do not sell, rent or disclose data to third parties except as described here or required by law.
6.2. Sub-processors:
- Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — server hosting (EU).
6.3. Bitrix24 is the Customer's own service provider; the Application only calls the Customer's Bitrix24 REST API.
6.4. Data of one Customer is never used to provide the Application to another Customer.
6.5. We will inform Customers of any intended change of sub-processors at least 30 days in advance by updating this Policy; Customers may object by uninstalling the Application.
7. Your rights
Under the GDPR, data subjects have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), and to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl.
Because employee data is entered into Bitrix24 by the employer, requests concerning that data should be addressed to the Customer as controller; we assist the Customer in fulfilling them. Changes made in Bitrix24 appear in the Application automatically on the next read.
Requests to us: artismediaeu@gmail.com. We respond within one month (Art. 12(3) GDPR).
8. Cookies
The Application uses only strictly necessary cookies/session identifiers required for login and session security. No analytics or advertising cookies are used inside the Application.
9. Changes to this Policy
The current version is published at https://orgchart.ai-automation-agency.biz/legal/privacy. Material changes will be communicated to Customers in advance. Continued use after the effective date means acceptance of the updated Policy.
10. Data Processing Terms (Article 28 GDPR)
10.1. Subject matter and duration: provision of the Application for as long as it is installed on the Customer's Bitrix24 account. 10.2. Nature and purpose: reading and displaying the Customer's organizational structure. 10.3. Data subjects: the Customer's employees and users of its Bitrix24 account. Categories of data: as listed in Section 3.1. 10.4. We process personal data only on the Customer's documented instructions, which consist of installing and using the Application and its settings. 10.5. Persons authorised to process the data are bound by confidentiality. 10.6. We implement the technical and organisational measures described in Section 5 (Art. 32 GDPR). 10.7. We engage sub-processors listed in Section 6 under written terms providing equivalent protection; the Customer gives general authorisation for them. 10.8. We assist the Customer with data subject requests and with its obligations under Articles 32–36 GDPR, taking into account the nature of processing. 10.9. We notify the Customer of a personal data breach without undue delay and in any case within 48 hours of becoming aware of it. 10.10. On uninstall, all personal data is deleted as described in Section 5.7; no copies are retained except logs as stated. 10.11. We make available information necessary to demonstrate compliance and allow for audits on reasonable prior notice, at the Customer's expense, no more than once a year.