KSeF CRM Privacy Policy
This Privacy Policy explains how personal data is processed when you use KSeF CRM, a cloud application for Bitrix24 that sends invoices from Bitrix24 to the Polish National e-Invoicing System (KSeF), receives their status, KSeF number and official confirmation of receipt (UPO), downloads purchase invoices from KSeF, checks suppliers on the VAT white list and imports purchase invoices into the CRM (the "Application"). The Application is available at https://ksef.ai-automation-agency.biz and distributed through the Bitrix24 Marketplace.
This Policy is drafted in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and the Polish Act of 10 May 2018 on the Protection of Personal Data.
1. Who we are
ARTISMEDIA Sp. z o.o., Nowogrodzka 64/43, 02-014 Warsaw, Poland; KRS 0000868723; NIP (VAT ID) PL7011004442; REGON 387549826 ("we", "us"). Contact for privacy matters: artismediaeu@gmail.com, +48 693 124 346.
2. Our role: processor and controller
2.1. Invoice and CRM data. Your organization (the "Customer") keeps invoices, clients and suppliers in its Bitrix24 account and in KSeF. For this data the Customer is the controller and we act as a processor under Article 28 GDPR, processing it only to provide the Application's features on the Customer's documented instructions. The Data Processing Terms in Section 11 form part of the KSeF CRM License Agreement.
2.2. Account, billing and technical data. For data about the installation (Bitrix24 account address, installation identifier), billing data for the Pro plan and technical data (IP address, logs) we act as an independent controller.
3. What data the Application processes
3.1. Read from your Bitrix24 account when a user works with the Application:
- the invoice opened by the user: number, title, dates, amount, currency, tax amount, linked company or contact and "my company";
- its product rows: name, quantity, unit, price, discount, VAT rate;
- requisites of the buyer and of "my company": company name, NIP / VAT ID, REGON, KRS, legal address; bank details of "my company" (account number, bank name, SWIFT); for a buyer without a company — the first and last name of the contact (an invoice to a consumer);
- for importing a purchase invoice: companies whose requisites contain the supplier's NIP (ID only); pipelines and smart processes (IDs and names) for the settings;
- whether the user is a Bitrix24 administrator, and the user's ID (to record who sent an invoice);
- installation data: Bitrix24 account address, installation ID (
member_id), access tokens issued by Bitrix24.
3.2. Exchanged with KSeF: the structured invoice (FA(3) XML) built from the data in Section 3.1 — it contains the data of the seller and the buyer, which may include a natural person (a sole trader or a consumer); the status, the KSeF number and the UPO; for purchase invoices — invoice metadata and the full XML of invoices issued to the Customer's NIP, which contain the data of suppliers (which may be sole traders) and of their bank accounts.
3.3. KSeF credentials: the Customer's NIP and the KSeF token entered by a Bitrix24 administrator, and the short-lived access tokens issued by KSeF.
3.4. VAT white list and NBP: for the white list check we send the supplier's NIP and bank account number to the Ministry of Finance service and keep the answer (VAT status, whether the account is on the list, request identifier, date). For invoices in foreign currency we request the NBP exchange rate (no personal data is sent).
3.5. Settings entered by an administrator: KSeF environment, NIP, rates used for 0% and untaxed items, exemption basis, invoice footer, who may send invoices, how purchase invoices are imported (pipeline, smart process, responsible user, task), interface language.
3.6. Billing data (Pro plan). Payments are made on the Stripe Checkout page. We never receive or store payment card data. We store the installation ID and account address, the Stripe customer and subscription IDs, the plan, its status and dates, the history of billing events and the monthly counters of sent and received invoices.
3.7. Technical data: IP address, timestamps, request paths, Bitrix24 account address.
3.8. Not requested: contacts' e-mail addresses and phone numbers, deals, activities, correspondence, calls, employees' data other than the user ID and administrator flag. The Application requests the "CRM", "Embedding in the interface" (placement), "User fields" (userfieldconfig), "Tasks" and "Users" access scopes.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Building structured invoices, sending them to KSeF, receiving statuses, KSeF numbers and UPOs, writing them to Bitrix24 | Art. 28 GDPR: processing on behalf of the Customer, who relies on its own legal basis (in particular Art. 6(1)(c): the obligation to issue invoices in KSeF) |
| Downloading purchase invoices, white list checks, importing into the CRM, approval tasks | Art. 28 GDPR, as above |
| Installing the Application, authenticating users and KSeF sessions, keeping the service secure, the activity log | Art. 6(1)(b): performance of the License Agreement; Art. 6(1)(f): legitimate interest in security and accountability |
| Managing the Pro subscription, trial and monthly Free limit; refunds | Art. 6(1)(b); Art. 6(1)(f) |
| Keeping billing records | Art. 6(1)(c): Polish tax and accounting law |
We do not use the data for marketing, profiling, sale to third parties, or training machine learning models.
5. How the data is processed and stored
5.1. Invoices live in KSeF and in Bitrix24. The legal copy of every invoice is kept by KSeF. KSeF numbers, statuses, verification links and UPO files are written to the Customer's Bitrix24 account and remain there after uninstalling.
5.2. Stored on our servers (in files readable only by the Application's service account, permissions 0600):
- the KSeF token, encrypted with AES-256-GCM using a key that is not stored with the data; it is never shown in the interface again, never sent to the browser and never written to logs; KSeF access tokens are kept only in memory;
- copies of Sent invoices (XML), their UPOs and purchase invoices (XML), encrypted with AES-256-GCM, so that users can download them and so that corrections can refer to the original invoice;
- the list of Sent invoices (Bitrix24 invoice ID, invoice number, KSeF number, status, dates, amounts, items needed for corrections) and the list of purchase invoices (metadata, parsed summary, white list result, import result);
- the activity log: who sent, corrected or imported which invoice and when (user ID, invoice number, KSeF number) — without invoice contents;
- settings (Section 3.5) and the synchronisation cursor;
- OAuth tokens of the Bitrix24 account and the application token used to verify uninstall notifications — encrypted;
- user sessions: a random session ID with the account address and the user's Bitrix24 access token, for up to one hour.
5.3. Location. The Application runs on servers of Hetzner Online GmbH in Germany (EU).
5.4. Retention:
- KSeF token, settings, lists of sent and purchase invoices, copies of XML and UPO files, activity log and OAuth tokens — for as long as the Application is installed, copies of invoice files not longer than 24 months; all deleted immediately upon the uninstall notification from Bitrix24;
- sessions — up to one hour; KSeF access tokens — in memory only, up to their expiry (at most 7 days for the refresh token);
- technical logs — up to 12 months;
- billing data and invoices — 5 years from the end of the calendar year in which the related tax payment deadline fell; not deleted on uninstall;
- the record that the free trial has been used and the monthly counters — for as long as the Application is offered, so that the trial and the free limit are granted once per account.
5.5. Security measures: TLS for all traffic, including to KSeF; KSeF requires and the Application applies AES-256 encryption of invoices with a session key encrypted by the Ministry's public RSA key; encryption at rest of the KSeF token, OAuth tokens and invoice files; tokens are never sent to the browser; every request from the Application's pages must carry a valid session created from a Bitrix24 request; KSeF settings and the subscription can be changed only by a Bitrix24 administrator confirmed by Bitrix24; the Customer can restrict sending invoices to administrators; uninstall notifications are accepted only with the account's application token; access and activity logging.
5.6. What logs contain: Bitrix24 account address, type of operation, Bitrix24 invoice ID, KSeF environment, status codes and error texts returned by KSeF or Bitrix24, duration. Invoice contents, NIPs of buyers, bank account numbers and token values are not written to technical logs.
6. Recipients and sub-processors
6.1. Ministry of Finance (KSeF, VAT white list). Invoices are sent to KSeF and purchase invoices are downloaded from it on the Customer's instruction; the white list check is sent to the Ministry's service. The Minister of Finance processes this data as a separate controller under Polish tax law; the Ministry is not our sub-processor.
6.2. Narodowy Bank Polski — only the currency code and date are sent to obtain an exchange rate.
6.3. Sub-processors: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — server hosting (EU).
6.4. Stripe (Pro plan payments). Stripe Payments Europe, Limited (Ireland) receives billing data and acts as an independent controller for payment processing and as our processor for billing services. Stripe receives no invoice or CRM data.
6.5. Support e-mail. Messages to artismediaeu@gmail.com are handled by Google Ireland Limited. We never ask for KSeF tokens or invoice files by e-mail.
6.6. We will inform Customers of any intended change of sub-processors at least 30 days in advance; Customers may object by uninstalling the Application.
7. International transfers
We do not ourselves transfer personal data processed by the Application outside the European Economic Area. KSeF, the white list and NBP are operated in Poland. Stripe and Google may transfer data outside the EEA under the safeguards described in their own policies (EU-U.S. Data Privacy Framework or Standard Contractual Clauses).
8. Your rights
Data subjects have the rights of access, rectification, erasure, restriction, portability and objection (Articles 15–21 GDPR) and the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl. Requests concerning invoice and CRM data should be addressed to the Customer as controller; we assist the Customer. Note that invoices accepted by KSeF cannot be deleted from KSeF. Requests to us: artismediaeu@gmail.com; we respond within one month.
9. Cookies
The Application does not set cookies and uses no analytics or advertising trackers.
10. Changes
The current version is published at https://ksef.ai-automation-agency.biz/legal/privacy. Material changes will be communicated to Customers in advance.
11. Data Processing Terms (Article 28 GDPR)
11.1. Subject matter and duration: provision of the Application for as long as it is installed on the Customer's Bitrix24 account.
11.2. Nature and purpose: building structured invoices from Bitrix24 data and sending them to KSeF on a user's instruction; receiving and storing statuses, KSeF numbers and UPOs; downloading, storing and showing purchase invoices; checking suppliers on the VAT white list; importing purchase invoices into the CRM.
11.3. Data subjects: the Customer's clients and suppliers and their representatives (including sole traders and consumers named on invoices), and the Customer's users. Categories of data: as listed in Sections 3.1–3.5. No special categories of data.
11.4. We process personal data only on the Customer's documented instructions, which consist of installing and using the Application, its settings, sending invoices and importing purchase invoices.
11.5. Persons authorised to process the data are bound by confidentiality.
11.6. We implement the technical and organisational measures described in Section 5 (Art. 32 GDPR).
11.7. We engage the sub-processors listed in Section 6.3 under written terms providing equivalent protection; the Customer gives general authorisation for them.
11.8. We assist the Customer with data subject requests and with its obligations under Articles 32–36 GDPR.
11.9. We notify the Customer of a personal data breach without undue delay and in any case within 48 hours of becoming aware of it. If we suspect that a KSeF token has been compromised, we will tell the Customer to revoke it in KSeF.
11.10. On uninstall, all data processed on behalf of the Customer and stored on our servers is deleted as described in Section 5.4. Invoices remain in KSeF; data written to Bitrix24 remains there.
11.11. We make available information necessary to demonstrate compliance and allow for audits on reasonable prior notice, at the Customer's expense, no more than once a year.