Skip to content

Legal

Selleris Connect for Bitrix24 — Privacy Policy

Last updated:

1. Who we are and what this policy covers

This policy explains how the application Selleris Connect (the «App») for Bitrix24 processes data. The App is published in Bitrix24 Market by:

Selleris Warsaw sp. z o.o., UNIT, Rondo Ignacego Daszyńskiego 1, 00-843 Warsaw, Poland.

  • KRS: 0000690620
  • NIP (VAT ID): PL7010709991
  • REGON: 368051966

In this policy, Selleris Warsaw sp. z o.o. is called «Selleris» or «we».

The App connects an organization’s Bitrix24 account to the Selleris Connect service (the «Service»). This policy covers the data the App reads from and writes to that Bitrix24 account. Our website and sales contacts are covered by the Selleris Connect Privacy Policy (connect.selleris.com/privacy-policy).

Roles under the GDPR. The organization that installs the App (the «Customer») decides which Bitrix24 data is connected and who sees it. For that data:

  • the Customer is the controller;
  • Selleris is the processor, acting on the Customer’s instructions under Article 28 GDPR, the Selleris Connect for Bitrix24 End User License Agreement (connect.selleris.com/bitrix24/eula) and, where signed, a data processing agreement.

2. Data the App processes

When the App is installed

  • The Bitrix24 account’s identifier (member_id) and address.
  • The installation’s application token, which Bitrix24 uses to sign the App’s events. We do not keep the access token sent with the install event.

When an administrator connects the Bitrix24 account

  • The OAuth tokens of the administrator who authorizes the connection. The App acts with that administrator’s permissions.
  • That administrator’s Bitrix24 user ID and name.

From the projects (workgroups) the Customer switches on, and only from them

  • Project names, and their Kanban or Scrum stages.
  • Tasks: title, description, stage, tags, deadline, time estimates and time spent, story points, dates of creation and change, and the IDs and names of the people responsible, the creator and participants.
  • Comments in the task chats: the text, the author’s name and the time.
  • Files attached to those tasks and to their chats: name, size and content.
  • Users, through the minimal user_brief permission: ID and name only, never e-mail addresses.

What the App does not read

  • personal tasks outside projects;
  • projects the Customer has not switched on;
  • CRM data, other chats, other Drive files;
  • user e-mail addresses.

What the App writes to the Bitrix24 account. It writes only on the actions of the Customer’s clients in Selleris Connect:

  • a task for each new client request;
  • the client’s comments in the task chat, signed with the client’s name;
  • a stage move when a client approves an estimate or confirms completion;
  • the files the client attaches.

3. Why we process it

  • To show the Customer’s clients the progress, budget and history of their work in Selleris Connect.
  • To carry the clients’ requests, comments, files and approvals back to Bitrix24.
  • To provide the Service’s AI features, which draft estimates, summaries and benefit projections from the content of requests and tasks.
    • These features run on Microsoft Azure OpenAI deployed in the EU Data Zone.
    • The data is not used to train AI models.
  • To keep the Service secure and working, and to provide support.

We do not sell the data or use it for advertising. We share it only with the parties listed in Section 4, or with those the Customer chooses to share it with in the Service.

4. Where the data is stored, and who helps us

Hosting in the European Union. The App’s data is hosted on Microsoft Azure in the Sweden Central region (EU):

  • the database, the files and the Azure OpenAI models;
  • the authorization tokens, kept in Azure Key Vault.

Sub-processors

  • Microsoft Ireland Operations Limited (Microsoft Azure). Hosting, storage and AI models, in the EU.
  • WorkOS, Inc. (USA). Signs in the users of the Selleris Connect console. It receives the console user’s name and e-mail address, never Bitrix24 data. Transfers rely on the EU–U.S. Data Privacy Framework or Standard Contractual Clauses.

Bitrix24. The App exchanges data with the Customer’s Bitrix24 account, and with Bitrix24’s OAuth server (oauth.bitrix.info), which issues and refreshes the authorization tokens.

5. How long we keep it

  • Disconnecting the Bitrix24 account in the console stops synchronization and deletes the authorization tokens.
  • Removing the App from Bitrix24 stops synchronization and deletes the authorization tokens for every connection to that account. It also deletes the installation record.
  • Synchronized data stays in the Customer’s Selleris Connect workspace, so the Customer’s clients keep their history. It is deleted when the Customer deletes it, or within 30 days after the subscription ends.
  • Database backups expire after 14 days.

6. Security

  • Data is encrypted in transit (HTTPS) and at rest.
  • Each Customer’s data is isolated at the database level (row-level security).
  • The database is reachable only from the Service’s private network.
  • Authorization tokens are held in Azure Key Vault.
  • Files are scanned for malware before they are offered for download.

7. Your rights

People whose data is in the Customer’s Bitrix24 account, such as employees and clients, should first contact the Customer, which controls that data. Selleris helps the Customer answer requests for access, rectification, erasure, restriction, portability and objection.

You can also write to privacy@selleris.com. We may verify your identity. We respond within the time limits of the GDPR.

You have the right to lodge a complaint with a supervisory authority. In Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa.

8. Changes and contact

We may update this policy. The «Last updated» date shows the latest revision.

Contact: Selleris Warsaw sp. z o.o., UNIT, Rondo Ignacego Daszyńskiego 1, 00-843 Warsaw, Poland.