Privacy Policy

Effective date: 30 August 2026

1. WHO WE ARE

This Privacy and Personal Data Processing Policy (“Policy”) explains how personal data is processed in connection with the SendyBees website, SaaS service and amoCRM integration, including communication through supported messaging channels such as WhatsApp, Telegram and other channels that may be made available by SendyBees.

Service provider and operator:

Individual Entrepreneur Shuanat Kadyrova

Identification Number: 302251391

Registered Address: Georgia, Tbilisi, Chugureti District, Chitaia Street, No. 38, No. 1

Trade name: SendyBees

Website: https://sendybees.space/

Privacy and support email: [email protected]

In this Policy, the above person is referred to as “SendyBees”, “we”, “us”, “our” or the “Provider”.

This Policy is prepared under the laws of Georgia, including the Law of Georgia on Personal Data Protection. Where another mandatory data-protection law applies to a particular Customer or processing activity, that law may also apply.

2. BUSINESS-TO-BUSINESS SERVICE

SendyBees is intended for business and professional use. The amoCRM integration is provided to companies, individual entrepreneurs and other persons acting for business or professional purposes (“Customers” or “Business Users”).

Individuals with whom a Customer communicates through amoCRM, WhatsApp, Telegram or another messaging channel are not customers of SendyBees merely because their messages or contact data pass through the Service. They are normally customers, leads, contacts, employees or other communication partners of the Customer.

The SendyBees amoCRM integration is provided free of charge.

3. OUR DATA-PROTECTION ROLES

Depending on the processing activity, SendyBees may act in different roles.

3.1. SendyBees as controller

SendyBees acts as a controller when it determines the purposes and means of processing, for example in relation to:

• administration of Business User accounts and access;
• communications with Business Users and support requests;
• security, abuse prevention and service integrity;
• operation of the SendyBees website;
• technical and operational logs used for our own security and administration;
• compliance with legal, accounting and regulatory obligations;
• our own service notices and, where legally permitted, marketing communications.

3.2. SendyBees as processor

When a Customer uses SendyBees to exchange or synchronise communications with the Customer’s own contacts through amoCRM and connected messaging channels, the Customer normally determines why and how those contacts are communicated with.

For such Customer-controlled data, the Customer is normally the controller and SendyBees acts as a processor on behalf of the Customer and on the Customer’s documented instructions, subject to the Terms of Use and Public Offer.

Nothing in this Policy changes the allocation of responsibilities required by applicable law.

4. CATEGORIES OF PERSONAL DATA

Depending on the features used, we may process the following categories of data.

4.1. Business User data

• name and surname;
• business email address and telephone number;
• company or business name;
• job title, role or permissions;
• SendyBees account identifiers;
• amoCRM account and user identifiers;
• support correspondence;
• account settings and integration configuration;
• authentication and security information;
• information about use of the Service.

Because the amoCRM integration is provided free of charge, SendyBees does not require payment-card details for use of the Integration.

4.2. Customer-controlled contact and messaging data

Where necessary to provide the Service, this may include:

• names of the Customer’s contacts;
• telephone numbers;
• usernames, messenger IDs and channel identifiers;
• CRM contact, lead, deal, conversation or other relevant identifiers;
• message text;
• message attachments where the relevant feature supports them;
• date and time of messages;
• message identifiers;
• delivery, read or other messaging status;
• routing and synchronisation information;
• information technically required to display, transmit or associate a message with the correct CRM record or communication channel.

4.3. Technical data

We may process technical information such as:

• IP address;
• browser, device and operating-system information;
• timestamps;
• server and application logs;
• error and diagnostic data;
• authentication events;
• security events;
• API request and response metadata to the extent reasonably necessary for operation, troubleshooting and security.

5. SOURCES OF DATA

Personal data may be obtained:

• directly from a Business User;
• from the Customer organisation that authorises a user;
• from amoCRM after the Customer authorises the integration;
• from WhatsApp, Telegram or another connected communication channel;
• from APIs and technical providers used to deliver the Service;
• automatically from browsers, applications, servers or security systems when the Service is used.

6. PURPOSES AND LEGAL GROUNDS

Where SendyBees acts as controller, we may process personal data for the following purposes:

• entering into and performing our agreement with a Business User;
• creating and administering access to the Service;
• providing support and responding to requests;
• maintaining security and preventing fraud, abuse or unauthorised access;
• troubleshooting, maintaining and improving reliability of the Service;
• protecting our legal rights and legitimate interests;
• complying with legal obligations;
• sending operational service communications;
• sending marketing communications only where a lawful basis, including consent where required, exists.

Where SendyBees acts as processor, the Customer determines the lawful basis and purposes of processing. SendyBees processes such data only to provide the Service and follow the Customer’s documented instructions, unless processing is required by applicable law.

SendyBees does not sell personal data.

7. DATA MINIMISATION AND CUSTOMER RESPONSIBILITIES

SendyBees aims to process only data reasonably necessary for the relevant Service functionality.

The Customer is responsible for:

• having a lawful basis to collect, use and communicate with its contacts;
• providing privacy notices required by applicable law;
• obtaining consents where required, including for direct marketing or messaging;
• responding to data-subject requests relating to Customer-controlled data;
• ensuring that the content of communications is lawful;
• complying with applicable rules of amoCRM, WhatsApp, Telegram and other connected platforms;
• avoiding unlawful spam, phishing, fraud, harassment or other prohibited communications.

Customers should not intentionally transmit special-category or highly sensitive personal data through SendyBees unless they have a lawful basis and have determined that use of the Service is appropriate for such processing.

8. RECIPIENTS, PLATFORMS AND SERVICE PROVIDERS

To provide the Service, personal data may be transmitted to or made available to:

• amoCRM;
• the messaging platform selected by the Customer, including WhatsApp/Meta or Telegram where applicable;
• hosting, infrastructure and cloud-service providers;
• communications and API providers;
• security, monitoring, error-diagnostics and support providers;
• professional advisers where reasonably necessary;
• competent authorities where disclosure is required by law.

Third-party platforms process data under their own terms and privacy practices where they act independently.

SendyBees is an independent third-party service. Unless expressly stated and duly authorised, SendyBees is not amoCRM, Meta, WhatsApp or Telegram and does not claim to be an official representative or affiliate of those companies.

9. INTERNATIONAL DATA TRANSFERS

SendyBees is operated by an individual entrepreneur registered in Georgia. Customers, CRM systems, messaging platforms and technical providers may be located in other countries.

Use of the Service may therefore involve international transfers of personal data.

Where Georgian law applies, SendyBees will use a lawful basis and applicable safeguards for international transfers as required by the Law of Georgia on Personal Data Protection.

Where Customer Data is subject to the GDPR and its transfer to SendyBees in Georgia requires a transfer mechanism under Chapter V of the GDPR, SendyBees will reasonably cooperate without undue delay in putting the required mechanism in place. If required for a transfer from the EEA, the parties will enter into the applicable Standard Contractual Clauses adopted by the European Commission, including the controller-to-processor module where appropriate, and complete the required annexes. Where UK data-protection law applies, the parties will use the applicable UK international-transfer mechanism, including the UK International Data Transfer Addendum or another mechanism recognised by applicable law. Equivalent safeguards will be used where another applicable law requires them.

10. DATA RETENTION

We retain personal data only for as long as reasonably necessary for the purpose for which it is processed, to provide the Service, comply with legal obligations, maintain security, resolve disputes and establish or defend legal claims.

Business User account and support information may be retained for the duration of the business relationship and for a reasonable period afterwards where necessary for legal, security or operational purposes.

Customer-controlled data is processed for the period necessary to provide the requested messaging or synchronisation functionality and in accordance with the Customer’s instructions and the Terms of Use.

Unless expressly agreed otherwise, SendyBees is not intended to serve as a permanent independent archive of the Customer’s correspondence. Customers should maintain any records they are legally or operationally required to retain in their own CRM or other authorised systems.

Temporary queues, technical logs, backups or diagnostic records may exist for limited periods where necessary for security, resilience, troubleshooting or recovery. Where exact retention periods cannot reasonably be stated, they are determined by the purpose of processing, legal obligations, security requirements and technical necessity.

11. SECURITY

SendyBees applies organisational and technical measures appropriate to the nature, scope and risks of processing, which may include, as appropriate:

• access controls and role restrictions;
• protection of authentication credentials and tokens;
• secure transmission mechanisms;
• logging and monitoring of material security events;
• measures designed to preserve confidentiality, integrity and availability;
• backup and recovery measures where appropriate;
• restriction of personnel access on a need-to-know basis.

No internet-based service can guarantee absolute security.

12. PERSONAL-DATA INCIDENTS

Where SendyBees acts as processor and becomes aware of a personal-data incident affecting Customer-controlled data, SendyBees will notify the relevant Customer without undue delay and provide reasonably available information needed for the Customer to meet applicable obligations.

Where SendyBees acts as controller, it will register, assess and notify qualifying incidents in accordance with applicable Georgian law, including the statutory notification requirements applicable to the State Audit Office of Georgia.

13. DATA-SUBJECT RIGHTS

Subject to applicable law, a data subject may have the right to:

• receive information about processing;
• access personal data and obtain a copy;
• request correction, updating or completion;
• request blocking, restriction, termination of processing, deletion or destruction where legally available;
• withdraw consent where processing is based on consent;
• object to direct marketing;
• exercise applicable data-portability rights;
• exercise rights relating to automated decision-making where relevant;
• lodge a complaint with a competent supervisory authority or court.

Requests concerning data for which SendyBees acts as controller may be sent to [email protected].

If the request concerns data that SendyBees processes solely on behalf of a Customer, SendyBees may refer the requester to the relevant Customer and will reasonably assist the Customer as required by applicable law.

14. DIRECT MARKETING

SendyBees does not use Customer-controlled message content or contact lists for SendyBees’ own direct marketing.

If SendyBees sends its own marketing communications to Business Users, such communications will be sent only where permitted by applicable law, and an appropriate opt-out mechanism will be provided.

Customers are solely responsible for the legality of marketing or promotional communications that they send to their own contacts through the Service.

15. COOKIES AND WEBSITE TECHNOLOGIES

The SendyBees website may use cookies or similar technologies that are necessary for authentication, security, session management and user preferences.

If non-essential analytics, advertising or similar technologies are introduced, SendyBees will provide notices and consent mechanisms where required by applicable law.

16. CHILDREN

SendyBees is a business service and is not directed to children for independent use.

A Customer that processes information relating to minors remains responsible for establishing the lawful basis and meeting any additional requirements applicable to that processing.

17. THIRD-PARTY LINKS AND SERVICES

The Service may contain links or connections to third-party services. SendyBees does not control the independent privacy practices of such third parties. Customers and users should review the relevant third-party privacy terms where appropriate.

18. CHANGES TO THIS POLICY

We may update this Policy to reflect changes in law, the Service, integrations, security practices or processing activities.

The current version of this Policy will be published at https://sendybees.space/privacy with an updated effective date. Material changes may also be communicated through the Service or by email where reasonably appropriate.

19. CONTACT AND SUPERVISORY AUTHORITY

Privacy contact:

Individual Entrepreneur Shuanat Kadyrova

Identification Number: 302251391

Registered Address: Georgia, Tbilisi, Chugureti District, Chitaia Street, No. 38, No. 1

Website: https://sendybees.space/

Email: [email protected]

Under Georgian law, data subjects may also have the right to contact the State Audit Office of Georgia in relation to personal-data protection matters.

20. LANGUAGES

This Policy is published in Georgian, English and Russian.

The three versions are intended to express the same legal meaning. In case of inconsistency, the Georgian-language version shall prevail to the extent permitted by applicable mandatory law.