Privacy Policy
1. Who is responsible for your data (the controller)
ALIEN AFFAIRS sp. z o.o.
Powstańców Wielkopolskich 16/1711, 61-895 Poznań, Poland
NIP 781-196-66-16
E-mail for privacy matters: client@accomat.com · Phone: +48 61 224 88 19
We are an accounting and HR services office. The portal and the app are the tools through which our clients (companies) exchange documents and information with us. We have not appointed a Data Protection Officer; please write to the e-mail address above for any question about your data.
2. Who this policy applies to
- Client users — the persons who sign in to the portal or the app on behalf of a client company (owners, board members, authorised staff).
- People whose data our clients enter — mainly the client's employees and contractors (e.g. for payroll, contracts, leave letters, work permits). For that data the client company is the controller and we act as its processor under the accounting services agreement (Art. 28 GDPR). This policy explains how we handle that data on the client's behalf.
- Visitors of the public pages of qarmas.com.
3. What data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Company tax ID (NIP), the company's contact e-mail address, one-time login codes and links, session identifiers, date and time of sign-in, IP address, device/browser type | Signing you in without a password, keeping your session, preventing abuse (rate limits, blocking attacks) | Art. 6(1)(b) — performance of the services agreement; Art. 6(1)(f) — our legitimate interest in the security of the service |
| Push-notification device token (Firebase Cloud Messaging), linked to your company | Sending you notifications from the app (e.g. a document is ready, a deadline is near). You can switch notifications off in the phone settings; the token is deleted when you sign out or uninstall | Art. 6(1)(b); Art. 6(1)(f) |
| Biometric lock setting (on/off) | Locking the app with your fingerprint or face. The biometric check itself happens only on your phone (Android / iOS system); we never receive biometric data — only whether the lock is enabled | Art. 6(1)(b) |
| Documents you upload: bank statements (PDF, MT940, photos), invoices, contracts, employee documents, other files you share with us | Doing the bookkeeping, payroll and HR work you ordered. Bank statements and some documents are read automatically (see section 5, "AI-assisted reading") to detect the month and account and to speed up filing | Art. 6(1)(b); Art. 6(1)(c) — accounting, tax and social-insurance law obligations |
| Employee and contractor data entered by the client: names, PESEL / passport data, addresses, contact details, contract terms, pay, working hours, leave, work-permit and residence data | Payroll, employment contracts, ZUS and tax filings, leave letters, work-permit and immigration letters — on the client's instruction | Processed on behalf of the client (Art. 28 GDPR). The client's own basis is typically Art. 6(1)(b), (c) and, for special data, Art. 9(2)(b) |
| Messages and notes you send us through the portal, e-mails we exchange | Answering you, handling your requests, keeping a record of instructions | Art. 6(1)(b); Art. 6(1)(f) |
| Technical logs (requests to sensitive pages, errors, security events) | Keeping the service running and safe, investigating incidents | Art. 6(1)(f) |
Providing the data marked as needed for sign-in and for the services is a condition of using the portal and the app; without it we cannot sign you in or perform the services. Providing a device token is voluntary (deny the notification permission on your phone).
4. Permissions the app asks for
- Notifications — to deliver push messages (optional).
- Files / photos / camera — only when you choose a file or take a photo of a document to upload it. The app does not scan your gallery.
- Biometrics — only to unlock the app locally (optional).
The app does not use your location, contacts, microphone or call logs, contains no advertising and no third-party analytics or tracking SDK.
5. Who receives your data (recipients and processors)
We share data only with providers that help us run the service, under data-processing agreements, and only as far as needed:
- Hosting provider — the servers on which qarmas.com and its database run, and our e-mail servers.
- Cloudflare, Inc. — DNS/CDN, bot protection on the web login page ("Turnstile"), and encrypted off-site backup storage (Cloudflare R2). Backups are encrypted copies of the whole system kept for disaster recovery.
- Google LLC — Firebase Cloud Messaging for push notifications to the app and Google Workspace for sending our e-mails.
- AI-assisted reading — to detect the month and bank account of an uploaded bank statement, or to read fields from an uploaded document, the file content may be sent to a large-language-model provider (currently via OpenRouter, Inc., using models operated by Google and other providers). The result is used only for filing that document. Data is not used by us to train any model; we choose providers that do not train on API data.
- Public authorities — tax offices, ZUS (social insurance), labour and immigration offices, courts — when the services you ordered require filings or when the law obliges us.
- Accountants, payroll and HR staff of ALIEN AFFAIRS sp. z o.o. and, where relevant, our professional advisers (auditors, lawyers) bound by confidentiality.
We do not sell personal data and do not share it for advertising.
6. Transfers outside the European Economic Area
Our own servers and the database are in the European Union. Cloudflare, Google and the AI providers may process data in the United States or other countries. Such transfers rely on the European Commission's adequacy decision (EU–US Data Privacy Framework) where the provider is certified, and otherwise on the Standard Contractual Clauses (Art. 46(2)(c) GDPR) with additional safeguards such as encryption in transit and at rest. You can ask us at client@accomat.com for a copy of the applicable safeguards.
7. How long we keep data
- Accounting and tax documents (bank statements, invoices, ledgers, filings) — 5 years counted from the end of the calendar year in which the tax obligation expired, as required by the Polish Accounting Act and the Tax Ordinance; longer if the law or an ongoing proceeding requires it.
- Payroll and employee records — the periods set by the Polish Labour Code and social-insurance law (10 years after the end of employment for records from 2019 onwards; up to 50 years for older records) — for as long as we keep them on the client's behalf.
- Account and session data — for the duration of the services agreement; login codes expire within minutes, sessions when you sign out or after inactivity.
- Push tokens — until you sign out, uninstall the app, or the token stops being valid.
- Security and access logs — up to 12 months, unless needed for an investigation.
- Backups — encrypted backups are rotated automatically and old copies are deleted after a few days.
- Correspondence — for the duration of the agreement and the limitation period for claims (generally up to 6 years).
8. Your rights
Under the GDPR you have the right to: access your data and get a copy; have it corrected; have it erased (where the law does not require us to keep it); restrict processing; data portability; object to processing based on our legitimate interests; and, where processing is based on consent, withdraw the consent at any time without affecting earlier processing.
To exercise a right, write to client@accomat.com or to the postal address above. We answer within one month. If your data was entered by a client company (for example you are its employee), we will forward your request to that company and help it respond.
You also have the right to lodge a complaint with the supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (PUODO), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl.
9. Deleting your account and app data
To close your access to the portal and the app, use the online form at https://qarmas.com/data-delete (no login needed; open to current and former clients), ask us at client@accomat.com (from the company's registered e-mail address) or end the services agreement. We then disable the login, delete push tokens and sessions, and remove the data we are not legally required to keep. Accounting and payroll records must be retained for the statutory periods in section 7 and are deleted when those periods end. Uninstalling the app removes all app data from your phone but does not, by itself, close your account.
10. Security
Connections are encrypted (HTTPS). Sign-in uses one-time codes sent to the company's registered e-mail address, with rate limits and lock-outs against guessing. Documents are stored outside the public web root and are reachable only by signed-in, authorised users and our staff. Access by our staff is role-based and logged. Backups are encrypted.
11. Cookies
The portal uses only strictly necessary cookies: the session cookie, the CSRF-protection token, and a cookie remembering your language and theme. The web login page loads Cloudflare Turnstile, which may set a cookie to tell people from bots. No advertising or analytics cookies are used, so no cookie consent banner is shown.
12. Children
The portal and the app are business tools for our client companies and are not intended for anyone under 18.
13. Changes to this policy
We may update this policy when the service or the law changes. The current version is always at https://qarmas.com/privacy-policy with the "last updated" date below. Material changes will be announced in the portal.
Terms and Conditions · Data deletion request · Client portal