Consent24 Privacy Policy
This Privacy Policy explains how personal data is processed when you use Consent24, a cloud application for Bitrix24 that records and documents consent of natural persons to the processing of their personal data for purposes defined by its users — for CRM contacts, leads and companies — including consent pages, double opt-in e-mails, consent forms, withdrawal pages and an append-only consent journal (the "Application"). The Application is available at https://consent-eu.ai-automation-agency.biz and distributed through the Bitrix24 Marketplace.
This Policy is drafted in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and the Polish Act of 10 May 2018 on the Protection of Personal Data.
If you are a person who received a consent link or e-mail from a company that uses Consent24: that company is the controller of your data and decides why your consent is requested. Consent24 is its tool. Please address questions about your data to that company; you can withdraw your consent at any time on your personal consent page (the link is in every message and on the consent page). Section 8 explains your rights.
1. Who we are
ARTISMEDIA Sp. z o.o., Nowogrodzka 64/43, 02-014 Warsaw, Poland; KRS 0000868723; NIP (VAT ID) PL7011004442; REGON 387549826 ("we", "us"). Contact for privacy matters: artismediaeu@gmail.com, +48 693 124 346.
2. Our role: processor and controller
2.1. Consent data and CRM data. Your organization (the "Customer") uses the Application to ask its clients and other persons ("data subjects") for consent and to keep evidence of it. For this data — the consent journal, the purposes and consent texts, and the CRM data read from the Customer's Bitrix24 account — the Customer is the controller and we act as a processor under Article 28 GDPR, processing it only to provide the Application's features on the Customer's documented instructions. The Data Processing Terms in Section 11 form part of the Consent24 License Agreement.
2.2. Account, contact-form, billing and technical data. For data about the installation (Bitrix24 account address, installation identifier), messages you send us through the contact form, billing data for the Pro plan (Section 3.8) and technical data of our servers (Section 3.9) we act as an independent controller.
2.3. What the Application writes to Bitrix24. For each purpose based on consent it creates text fields "Consent: <purpose>" in contacts, leads and companies and writes to them granted, withdrawn or expired (or clears them); it writes the date of an erasure request to the field "GDPR: erasure requested"; it adds comments with a copy of each consent event to the timeline of the CRM card, together with uploaded scans of signed forms; it sends confirmation e-mails through the Customer's CRM e-mail (an outgoing e-mail activity) when a user or a workflow robot requests it; it runs the automation triggers "consent granted", "consent withdrawn" and "re-consent needed"; and it adds a "Consents" tab and two workflow robots. It does not change other data of CRM records and does not delete or anonymise CRM records.
3. What data the Application processes
3.1. Read from the Customer's Bitrix24 account when the Application is used: for a contact, lead or company — first, middle and last name or company title, e-mail addresses and phone numbers (to show who the record is about, to send a confirmation e-mail to the address chosen and to fill in a consent form and a Record of consent); the values of the Application's own fields; the name of the Customer's own company ("My company") shown to data subjects as the controller; for the "Open latest contact" button — the ID of the latest contact the user can see; the name, ID and administrator flag of the user who works with the Application; for a workflow robot started on a deal — the contact or company of that deal; installation data — Bitrix24 account address, installation ID (member_id), access tokens issued by Bitrix24.
3.2. Purposes created by the Customer: code, title and consent text in English, Polish and/or German, legal basis, re-consent period, all versions with their dates and the name of the user who saved them.
3.3. Consent journal. For every event — consent requested (link created or e-mail sent), consent granted, consent withdrawn, re-consent due, erasure requested, record of consent exported, purpose version saved or archived — the Application stores: record number, date and time (UTC), event type, the type and CRM ID of the contact, lead or company, the purpose code and version of the consent text, the method (consent link, e-mail double opt-in, signed paper form, recorded by a user, preferences page, erasure request), the language of the page, and depending on the method:
- for confirmations and withdrawals made by the data subject on the Application's pages: the IP address and the browser identification (user agent) of the data subject, and an identifier of the link used (a hash, not the link itself);
- for e-mail double opt-in: the e-mail address to which the confirmation e-mail was sent;
- for events recorded by a user of the Customer: the name and Bitrix24 ID of that user, the channel (phone, in person, e-mail reply, other) and the note entered by the user;
- for signed paper forms: the file name, size and SHA-256 hash of the uploaded scan and the form ID; the scan itself is not stored by us — it is passed to the Customer's Bitrix24 account as a timeline attachment;
- the hash of the previous record and of this record (integrity chain).
The names, e-mail addresses and phone numbers of data subjects are not stored in the journal, except the e-mail address of a double opt-in confirmation; they are read from the Bitrix24 account when needed.
3.4. Links. For a consent link: a random token, the Bitrix24 account, the type and CRM ID of the record, the purposes, the language, the method, for double opt-in the e-mail address, the user who created it, creation and use time. For a personal withdrawal ("my consents") page: a random token, the Bitrix24 account and the type and CRM ID of the record.
3.5. Settings entered by an administrator: default language of consent pages and the controller name shown to data subjects. Technical setup data: names of the fields created in Bitrix24, results of the last setup.
3.6. Not requested: deals' contents, products, activities other than the confirmation e-mails sent by the Application, correspondence, calls and files other than uploaded scans. The Application requests the "CRM" (crm), "Embedding in the interface" (placement) and "Business processes" (bizproc) access scopes.
3.7. Contact form on https://consent-eu.ai-automation-agency.biz/about: your name, the e-mail address or phone number you leave for our reply, your message, and the time it was sent. Your IP address is used in server memory only to limit the number of messages and is not saved with the message.
3.8. Billing data (Pro plan). Payments for the Pro plan are made on the Stripe Checkout page and processed by Stripe (Section 6.3). We never receive or store payment card data. On our servers we store only: the installation ID (member_id) and the Bitrix24 account address; the Stripe customer ID and subscription ID; the plan and subscription status; the dates of the trial and of the current billing period; and the history of billing events. The monthly Free plan counter is calculated from the consent journal. The name, e-mail address, billing address and VAT ID entered at checkout are held by Stripe; we can view them in our Stripe account to issue invoices, handle refunds and answer billing questions, but we do not copy them to the Application's servers.
3.9. Technical data: IP address, browser type, timestamps, request paths, Bitrix24 account address. Paths of consent and withdrawal pages are logged without their tokens.
3.10. The Application is not intended for special categories of personal data (Article 9 GDPR). The Customer undertakes not to put such data into consent texts, purposes or notes.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Showing consent pages, recording consents and withdrawals, keeping the consent journal as evidence, writing CRM fields and timeline comments, sending confirmation e-mails, running triggers and robots, producing Records of consent and exports | Art. 28 GDPR: processing on behalf of the Customer, who relies on its own legal basis (in particular Art. 7(1) and Art. 6(1)(c) and (f) GDPR — demonstrating consent) |
| Installing the Application, authenticating users, keeping the service secure, preventing abuse of public pages | Art. 6(1)(b): performance of the License Agreement; Art. 6(1)(f): legitimate interest in security |
| Answering messages sent through the contact form; technical support and fixing errors | Art. 6(1)(b) and 6(1)(f) |
| Managing the Pro subscription, trial and payments; refunds; preventing repeated trials | Art. 6(1)(b); Art. 6(1)(f) |
| Keeping billing records and invoices | Art. 6(1)(c): obligations under Polish tax and accounting law |
We do not use the data for marketing, profiling, sale to third parties, or training machine learning models. We do not contact data subjects on our own behalf.
5. How the data is processed and stored
5.1. What stays in Bitrix24. CRM records, the status fields, timeline comments with copies of the journal records and uploaded scans live in the Customer's Bitrix24 account and remain there after the Application is uninstalled.
5.2. Stored on our servers (as processor): the consent journal (Section 3.3), purposes with all versions (Section 3.2), links (Section 3.4) and settings (Section 3.5). The journal is append-only: records are never changed or deleted one by one; each record carries the hash of the previous one so that any later change can be detected. The journal of a Bitrix24 account is stored in a separate file whose name does not contain the account address.
5.3. Other data on our servers: OAuth tokens (access/refresh) and the application token used to verify uninstall notifications and robot calls — in files readable only by the Application's service account (file permissions 0600), used solely to call the REST API of the corresponding Bitrix24 account; user sessions of the Application's pages — a random session ID with the Bitrix24 account address and the user's Bitrix24 access token, for up to one hour, so that the token is never sent to the browser.
5.4. Location. The Application runs on servers of Hetzner Online GmbH in Germany (EU).
5.5. Retention:
- consent journal, purposes and settings — for as long as the Application is installed (the evidence is needed for as long as the Customer relies on the consents); after uninstallation — 30 days, then deleted; if the Application is reinstalled on the same Bitrix24 account within 30 days, they are restored. The Customer can export the journal at any time before (CSV; Record of consent per data subject);
- consent links — 30 days from creation (used links: until 30 days after use); withdrawal page links — for as long as the Application is installed; all links are deleted immediately upon the uninstall notification;
- tokens — for as long as the Application is installed; deleted immediately upon the uninstall notification from Bitrix24;
- sessions — up to one hour;
- contact-form messages — as long as needed to answer you and handle follow-up questions; you can ask us to delete them at any time;
- technical logs — up to 12 months;
- billing data (Section 3.8) and invoices — 5 years from the end of the calendar year in which the related tax payment deadline fell; not deleted on uninstall, and uninstalling does not cancel a Pro subscription;
- the record that the free trial has been used (installation ID, account address, trial dates) — for as long as the Application is offered.
5.6. Security measures: TLS/HTTPS for all traffic; OS-level access restriction to data files (0600); integrity chain of the journal with a verification function available to the Customer; tokens are never sent to the browser (server-side sessions); every request from the Application's pages must carry a valid session created from a request confirmed by Bitrix24; consent links are random 256-bit tokens, single-use and time-limited; rate limiting of public pages; uninstall notifications and robot calls are accepted only with the account's application token, compared in constant time; purposes, settings and the subscription can be changed only by a Bitrix24 administrator confirmed by Bitrix24; access logging.
5.7. What logs contain: Bitrix24 account address, type of operation, type and CRM ID of the record, purpose codes, method, status and duration, error texts returned by Bitrix24. When a contact-form message arrives, the log records its ID, your name, the contact you left and the first 120 characters of the message. Tokens, links, IP addresses and e-mail addresses of data subjects are not written to logs.
6. Recipients and sub-processors
6.1. We do not sell, rent or disclose data to third parties except as described here or required by law.
6.2. Sub-processors:
- Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — server hosting (EU).
6.3. Stripe (Pro plan payments). Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland, receives the billing data described in Section 3.8 and the details entered at checkout. For processing payments Stripe acts as an independent controller under its own privacy policy (https://stripe.com/privacy); for billing services provided to us it acts as our processor. Stripe receives no consent or CRM data and is not a sub-processor for the Customer's data.
6.4. Support e-mail. Messages sent through the contact form may be forwarded by e-mail to our support mailbox artismediaeu@gmail.com, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Consent and CRM data are never sent by e-mail by us.
6.5. Bitrix24 is the Customer's own service provider; the Application only calls the Customer's Bitrix24 REST API. Confirmation e-mails are sent by the Customer's Bitrix24 from the Customer's mailbox. The Bitrix24 JavaScript library used inside the Application is loaded by the user's browser from Bitrix24. Consent and withdrawal pages for data subjects load nothing from third parties.
6.6. Data of one Customer is never used for another Customer.
6.7. We will inform Customers of any intended change of sub-processors at least 30 days in advance by updating this Policy; Customers may object by uninstalling the Application.
7. International transfers
We do not ourselves transfer personal data processed by the Application outside the European Economic Area. If a contact-form message is forwarded by e-mail (Section 6.4), Google may process it in other countries under the safeguards described in its data processing terms, including the European Commission's Standard Contractual Clauses. Stripe may transfer billing and payment data to Stripe, Inc. in the United States and other group companies under the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.
8. Your rights
Under the GDPR, data subjects have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal (Art. 7(3)), and to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl — or the authority of their country of residence.
Because consent data and CRM data are controlled by the Customer, requests concerning that data should be addressed to the Customer as controller; we assist the Customer in fulfilling them (the Application produces a Record of consent for access requests). A data subject can withdraw consent directly on their personal consent page. Note that the Customer may keep the record that consent was given and withdrawn as evidence where the law allows it (for example Art. 17(3)(e) GDPR).
Requests to us: artismediaeu@gmail.com. We respond within one month (Art. 12(3) GDPR). If we receive a request concerning data we process for a Customer, we forward it to that Customer without undue delay.
9. Cookies
The Application does not set cookies and uses no analytics or advertising trackers, neither in the Bitrix24 interface nor on consent and withdrawal pages. Bitrix24, inside which the Application is opened, uses its own cookies under its own policy.
10. Changes to this Policy
The current version is published at https://consent-eu.ai-automation-agency.biz/legal/privacy. Material changes will be communicated to Customers in advance. Continued use after the effective date means acceptance of the updated Policy.
11. Data Processing Terms (Article 28 GDPR)
11.1. Subject matter and duration: provision of the Application for as long as it is installed on the Customer's Bitrix24 account, plus 30 days after uninstallation (Section 5.5).
11.2. Nature and purpose: showing consent pages and withdrawal pages to data subjects; recording and storing the consent journal as evidence of consent and its withdrawal; reading CRM records on request; writing status fields and timeline comments; sending confirmation e-mails through the Customer's Bitrix24; producing Records of consent and exports.
11.3. Data subjects: the Customer's clients, prospects and their representatives recorded as contacts, leads and companies, and other natural persons whose consent the Customer requests; the Customer's users who record events. Categories of data: as listed in Sections 3.1–3.5 — identification and contact data read from the CRM, IP address and browser identification of confirmations, e-mail address of double opt-in confirmations, user names and notes, purposes and consent texts, technical identifiers.
11.4. We process personal data only on the Customer's documented instructions, which consist of installing and using the Application, its settings, the purposes created, the links and e-mails requested by users and the robots and triggers configured by the Customer.
11.5. Persons authorised to process the data are bound by confidentiality.
11.6. We implement the technical and organisational measures described in Section 5 (Art. 32 GDPR).
11.7. We engage sub-processors listed in Section 6 under written terms providing equivalent protection; the Customer gives general authorisation for them.
11.8. We assist the Customer with data subject requests (Record of consent, export, recording of erasure requests) and with its obligations under Articles 32–36 GDPR, taking into account the nature of processing.
11.9. We notify the Customer of a personal data breach without undue delay and in any case within 48 hours of becoming aware of it.
11.10. Return and deletion. The Customer can export the consent journal at any time from the Application. After uninstallation, all data processed on behalf of the Customer and stored on our servers is kept for 30 days to allow reinstallation or export on request and is then deleted (Section 5.5); no copies are retained except logs as stated. Billing data is our own data as controller and is kept as stated in Section 5.5. Fields, timeline comments and scans in the Customer's Bitrix24 account remain there.
11.11. We make available information necessary to demonstrate compliance and allow for audits on reasonable prior notice, at the Customer's expense, no more than once a year.