Privacy Policy

1. General

1.1. This Policy sets out how the “Deal Distribution” widget (the “Widget”) and its backend process and protect data, including personal data, when the Widget is installed and used in amoCRM accounts. It is drafted in line with Russian Federal Law No. 152-FZ “On Personal Data”.

1.2. The data operator is sole proprietor Elena V. Kononenko, trading as KO:AGENCY (the “Operator”). Contact details are listed at the top of this page and in section 11.

1.3. By installing the Widget and granting it access to an amoCRM account, the User confirms they have read and accept this Policy. Users who do not accept it should disable the Widget.

2. Data we process

• Account data: account id and domain, OAuth access tokens — to call the amoCRM API on behalf of the account.
• Employee data: user ids, names, groups and an “online / in distribution” flag — to distribute deals among managers.
• Deal data: deal id, pipeline and stage, responsible user, and the fields used in distribution rules (budget, tags, field values). The Widget does not copy customer cards or conversations.
• Widget settings: distribution rules, work schedules and the distribution log.
• Subscription payment data: an e-mail for the fiscal receipt and payment parameters. Payments are processed by YooKassa; the Operator never receives or stores card data.

The Widget does not process special categories or biometric data and never asks for amoCRM logins or passwords.

3. Purposes and legal grounds

• automatic distribution of deals among managers according to the User's rules;
• tracking employees' online status and work schedules;
• subscription billing and fiscal receipts;
• technical support and service operation.

Grounds: performance of the agreement with the User, the User's consent given by installing the Widget, and legal requirements (payment fiscalisation).

4. Processing principles

4.1. Data is processed lawfully and fairly and only to the extent needed for the stated purposes.

4.2. The Operator keeps data confidential and does not disclose it to third parties except as required by law or described in section 5.

4.3. Data is stored on servers in the Russian Federation (Moscow, Selectel data centre). No cross-border transfer of personal data takes place.

4.4. No decisions with legal effect are made solely by automated means: the Widget only assigns a responsible user according to rules set by the User.

5. Sharing with third parties

• amoCRM — the platform where the Widget is installed (via the official API);
• YooKassa — online subscription payments and fiscalisation, under YooKassa's own policy.

The Operator does not sell data or share it for advertising or any purpose unrelated to the Widget.

6. Your rights

Users and data subjects may request information about their data, its correction, blocking or deletion, withdraw consent by disabling the Widget and/or contacting the Operator, and lodge a complaint with the supervisory authority (Roskomnadzor) or a court. Requests: hello@koagency.me or Telegram @koagency_bot. We reply within 10 business days.

7. Security

• data is transferred over encrypted connections (HTTPS) only;
• server and database access is limited to authorised Operator staff;
• access tokens are stored server-side and never sent to the browser;
• activity logging and daily encrypted backups.

8. Retention and deletion

Data is processed while the Widget is in use. When the integration is disabled, API access stops and tokens are revoked. Account settings and logs are deleted within 30 days upon request. Payment records are kept for the periods required by law.

9. Cookies

The Widget runs inside the amoCRM interface and sets no advertising or analytics cookies of its own.

10. Final provisions

The Operator may update this Policy; a new version takes effect when published on this page. Russian law applies to matters not covered here.

11. Operator details and contacts