Privacy Policy

This Privacy Policy (the Policy) sets out how personal information is processed and protected by Marketing Business Support Limited Liability Company (MSB) (the Operator), which provides access to the BigBee CRM platform, also called BeeCRM (the Service).

The Policy has been prepared in accordance with the Law of the Kyrgyz Republic «On Personal Information» No. 58 of April 14, 2008 and other regulatory legal acts of the Kyrgyz Republic.

• Personal information (personal data) — recorded information about a specific individual that identifies or can be used to identify that individual.
• Data subject — the individual to whom the personal data relates.
• Processing of personal data — collection, recording, storage, updating, use, transfer, anonymization, blocking and destruction of personal data.
• Holder of the data array — the Operator that processes the personal data.

The Operator processes the following categories of personal data:

• contact details (first name, last name, phone number, email address);
• details for communication via messengers (WhatsApp, Telegram, Instagram);
• information about deals, requests and communications within the Service;
• payment details to the extent necessary to process a payment;
• technical information (IP address, device type, Service usage data).

Personal data is processed on the basis of the data subject's consent and for the performance of a contract to which the data subject is a party. Purposes of processing:

• providing access to the features of the CRM platform;
• managing the user's sales, deals and team;
• integration with messengers and external systems;
• processing payments and issuing documents;
• analytics, reporting and technical support.

By registering in the Service and continuing to use it, the data subject consents to the processing of their personal data under the terms of this Policy. Consent may be withdrawn at any time by sending a request to [email protected]. Withdrawal of consent results in the termination of processing and the deletion of the data, unless there are other lawful grounds for retaining it.

Personal data is kept no longer than required by the purposes of processing, or for the period established by the legislation of the Kyrgyz Republic. Once the purposes of processing have been achieved, or consent has been withdrawn, the data is destroyed or anonymized.

Records we are required to keep by law. When we receive a deletion request, we remove the person's data from the working CRM. A limited set of records that the legislation of the Kyrgyz Republic obliges us to keep (for example, accounting, tax and contractual records, and evidence of the authorization a business gave to connect its account) is moved to a restricted legal archive. The archive is encrypted, is not visible in the CRM, can be accessed only by authorized Operator personnel (every access is logged), is used solely to meet legal obligations, and is retained for the period required by the applicable law of the Kyrgyz Republic, after which it is permanently deleted.

The Operator does not disclose personal data to third parties, except in cases provided for by law and transfers to service providers (payment organizations, messenger providers, hosting) that are necessary for the operation of the Service. Cross-border transfer of data is carried out only where an adequate level of protection is ensured.

• encryption of data in transit and at rest;
• separation and control of access to personal data;
• regular security audits and monitoring;
• training employees in data protection rules.

In accordance with the legislation of the Kyrgyz Republic, the data subject has the right to:

• receive information about the processing of their personal data;
• demand that the data be corrected, blocked or destroyed;
• withdraw consent to processing;
• appeal against the Operator's actions to the authorized state body for personal data protection or in court.

Businesses can connect their Facebook Page, Instagram professional account, WhatsApp Business account, Lead Ads forms and Meta ad account to the Service via Facebook Login / Instagram Login. Through these connections we receive only the data needed to provide the Service to that business:

• the connected account's identifiers, name/username and access tokens (stored encrypted);
• messages, comments and attachments that customers send to the connected business account, and the customer's public profile name, username and profile picture;
• lead form submissions and ad performance statistics of the business's own ad account.

This data is used only to display conversations and leads to the business in its CRM, to let its staff reply, and to report on its own advertising. We do not sell this data, do not use it for our own advertising, and do not share it with anyone other than the business that connected the account and the service providers we rely on to run the Service (hosting, and AI providers that draft automated replies if the business turns on an AI assistant). You can disconnect the account in the CRM at any time or remove the app in your Facebook / Instagram settings.

You can ask us to delete your data at any time — by removing the app in your Facebook or Instagram settings and choosing «Send request» (we receive the request automatically and give you a confirmation code and a status page), or by writing to [email protected]. Step-by-step instructions and what is deleted are described in the Data deletion instructions. You can check the progress of a request at crm.bigbee.su/data-deletion/status.