01Definitions
This Personal Data Processing Policy has been prepared in accordance with the Law of the Kyrgyz Republic «On Personal Information» No. 58 of April 14, 2008 and other regulatory legal acts of the Kyrgyz Republic, and sets out how personal data is processed by Marketing Business Support LLC (MSB).
- Personal data — information relating to an identified individual
- Processing — actions performed with personal data: collection, systematization, accumulation, storage, use, transfer, blocking, destruction
- Operator — Marketing Business Support LLC (MSB), which processes personal data
- Data subject — an individual whose personal data is processed
02Categories of data processed
- Last name, first name, patronymic
- Phone number
- Email address
- Messenger data (WhatsApp, Telegram)
- IP address
- Browser and device data
- Date and time of requests
- History of actions in the system
- Information about deals and sales
- History of interactions with customers
- Analytics data and KPIs
- Data from integrations with external systems (1C)
03Purposes and legal grounds of processing
- Providing the services of the BigBee CRM platform
- Managing the customer's sales and team
- Operating integrations (WhatsApp, Telegram, 1C)
- Producing analytics and reports
- Technical support and maintenance
- Ensuring the security of the system
- Consent of the data subject
- Necessity for the performance of a contract
- Legitimate interests of the operator
- Requirements of the legislation of the Kyrgyz Republic
04Methods of processing
Automated processing
- Data collection through web forms
- Automatic deal synchronization
- Generation of reports and analytics
- Integration with messengers
Non-automated processing
- Manual data entry by employees
- Phone consultations
- Work with paper documents
- Customer technical support
05Processing and retention periods
Data of active users is processed for the entire period of use of the BigBee CRM service.
- Personal data is kept for 3 years
- Commercial information — 5 years
- Logs and technical data — 1 year
- Data for tax accounting — as required by law
Data that the legislation of the Kyrgyz Republic requires us to keep (accounting, tax and contractual records, and evidence of the authorization a business gave to connect its account) is not kept in the working CRM. It is moved to a restricted, encrypted legal archive that is accessible only to authorized Operator personnel (every access is logged), is used only to comply with the law, and is retained for the period required by the applicable law of the Kyrgyz Republic, after which it is permanently deleted.
06Personal data protection measures
Technical measures
- SSL/TLS data encryption
- Multi-factor authentication
- Regular backups
- 24/7 security monitoring
- Anti-virus protection
- Firewalls and intrusion detection systems
Organizational measures
- Separation of access to data
- Staff training
- Audit of employee actions
- Information security policies
- Non-disclosure agreements
- Control over external contractors
07Transfer of data to third parties
Personal data may be transferred to the following categories of recipients:
- Meta (WhatsApp Business API)
- Telegram (Bot API)
- Hosting providers
- Payment systems
- Analytics services
Upon official requests within the framework of the current legislation of the Kyrgyz Republic.
08Rights of data subjects
The data subject has the right to:
- Receive information about the processing of their data
- Demand correction of inaccurate data
- Demand deletion or blocking of data
- Withdraw consent to processing
- Receive a copy of their data
- Restrict processing of data
- Object to processing
- Apply to the authorized state body for personal data protection
09How to submit requests
10Data deletion instructions (Facebook and Instagram data)
If you connected your Facebook or Instagram account to BeeCRM (BigBee CRM), or you communicated with a business that uses BeeCRM, you can ask us to delete the data we received about you from Meta platforms. Use any of the following options:
Option 1 — through Facebook or Instagram (automatic)
- Facebook: open Settings & privacy → Settings → Apps and websites, find «BigBee», click Remove, then open the removed app and choose Send request to delete your data.
- Instagram: open Settings → Website permissions → Apps and websites (or Business integrations), remove «BigBee» and request data deletion.
- Meta sends the request to us automatically. You will receive a confirmation code and a link to a status page, where you can see whether the request has been received, is being processed or has been completed.
Option 2 — by email
Write to [email protected] with the subject «Data deletion request» and include your Facebook / Instagram profile name or username (or the email of your BeeCRM account). We may ask you to confirm that the account is yours. We process email requests within 30 calendar days.
Option 3 — disconnect in the CRM (businesses)
A business can disconnect its Instagram account, Facebook Page or ad account at any time in Integrations in the CRM. This stops all further data collection immediately; to delete the stored data as well, use option 1 or 2.
What we delete
- access tokens and the Facebook / Instagram account identifiers of the connection;
- your name, username and profile picture received from Meta;
- the text and attachments of messages and comments you sent, and raw copies of the notifications Meta sent us about them;
- notes and summaries generated from your messages by the CRM's AI assistant.
What we keep, and for how long
Business records of the company you dealt with (for example, that a deal existed and its amount) remain in its CRM without your Facebook / Instagram identity. Records that the legislation of the Kyrgyz Republic requires us to keep are moved to a restricted, encrypted legal archive, accessible only to authorized personnel with every access logged, and are retained for the period required by the applicable law of the Kyrgyz Republic, after which they are permanently deleted. The status page shows what was deleted and what was retained by law.
11Final provisions
This Policy may be amended due to changes in legislation or in internal personal data processing procedures.
The current version of the Policy is published on the official BigBee CRM website and takes effect from the moment of publication.
Continued use of the service after changes are made constitutes acceptance of the new version of the Policy.