Privacy Policy

1. General provisions

1.1. This Privacy Policy sets out how personal data is collected, processed, stored and protected when the Ağıllı Mühasib service is used.

1.2. The Policy applies to:

• visitors to the agillimuhasib.com website;
• business customers subscribed to the service and their employees who have an account in the panel;
• third parties named in the data a business customer enters into the panel, including that business’s own customers.

1.3. The service is intended for business use. No separate service is offered to individual consumers.

1.4. This document is read together with the Terms of Use. This Policy applies to matters relating to personal data, and the Terms of Use apply to matters relating to subscription, payment and liability. If a conflict arises between the two documents, the provisions of this Policy prevail with regard to personal data.

1.5. The version and effective date of the Policy are shown at the beginning of the document and in section 15. The system records the number and date of the version in force at the moment the user gives consent.

2. Who the operator is

2.1. The person who provides the service and is responsible under this Policy:

2.2. All requests relating to personal data are sent to the email address above.

2.3. Within the meaning of articles 2.1.9 and 2.1.10 of the Law of the Republic of Azerbaijan “On Personal Data”, and in line with the division set out in section 6 of this Policy, the Operator acts as the owner for part of the data and as the operator for the other part.

2.4. A data subject who considers that their rights have been violated has the right to apply to the competent state authority or to a court, and to claim compensation for the material and moral damage suffered.

3. Key terms

3.1. In this Policy, the terms “owner” and “operator” are used in the meaning given in articles 2.1.9 and 2.1.10 of the Law “On Personal Data”.

4. What data we collect

The table below covers all personal data stored in the system. Types of data not on this list are not collected.

4.1. Passwords are not stored in plain form. The system holds only a one-way hash of the password.

4.2. Card details are not collected. Payment is made by bank transfer, in cash or by card terminal; the card number and security code do not enter our systems.

4.3. Data of a sensitive category, including data about health, beliefs, racial and ethnic origin, is not collected and must not be entered into the panel.

4.4. When the Customer sends a file to the support chat or WhatsApp, the Customer decides what data it contains. We recommend not sending personal data that is not necessary.

5. Why and on what basis we process data

Each piece of data is processed only for the purpose shown below. If the purpose changes, the data subject is informed in advance.

5.1. Data is not sold, rented out or transferred to third parties for advertising or marketing purposes.

5.2. The sales, expense and revenue amounts that a business customer enters into the panel are not shown in our team’s user interface.

5.3. Where statistics are kept to improve the quality of the service, only aggregated figures that do not make it possible to identify a person are used.

5.4. No decision producing legal effects for a data subject is taken by automated means. Automatic calculations are made on the basis of the data entered into the panel, but these calculations are an accounting tool, not a decision about the Customer.

6. The business customer’s own customers and employees

6.1. The roles are divided as follows:

6.2. The Customer itself is the owner of the personal data relating to its own customers, employees and other third parties that it enters into the panel. The Customer determines the purpose, scope, legal basis and retention period for collecting this data.

6.3. For that data, the Operator acts only as an operator, on the Customer’s instructions and on the basis of the Terms of Use. The Operator does not interfere with the content of this data, does not use it for its own purposes and does not give it to third parties.

6.4. The Customer confirms and warrants that it:

• has collected the data relating to third parties that it enters into the panel in accordance with the law and on the necessary legal basis;
• has informed those persons of the processing of the data, the purpose of the processing and their rights;
• has all the legal grounds needed for this data to be stored in the Operator’s information system;
• takes on the obligations of an owner with regard to that data.

6.5. Remarks, demands and claims of third parties relating to this data are addressed first of all to the Customer.

6.6. Where a third party sends the Operator a written request concerning their personal data, the Operator accepts the request, replies within the period set by law and immediately forwards the request to the relevant Customer. The Customer, as owner, decides on correcting, deleting or stopping the processing of the data. The Operator technically ensures that the decision is carried out.

6.7. The Customer must state its written position to the Operator within 5 working days of receiving the notice. If the Customer does not respond within this period, or if the request is clearly lawful, the Operator reserves the right to restrict access to that data or to move it to the archive. This action is not considered a breach of contract by the Operator.

6.8. The records kept in the credit section are accounting records: name, phone and unpaid amount. These records are not information about credit history, credit rating or family status and may not be used for such purposes.

6.9. If the Customer chooses to send a debt reminder or another message to its own customers from the panel, it is sent in the Customer’s name and on its instructions. The Customer is responsible for the content of the message, the choice of recipient and obtaining the necessary consent from the recipient.

7. Who data is shared with

Data is shared only with parties that are necessary for the service to work, and only to the extent necessary.

7.1. The panel and the database are stored on a Contabo GmbH server located in the European Union. If any of the providers changes, this table is updated with the new provider’s name and country.

7.2. The relationship with each of the parties above is set up by a contract, or by the terms of use of that service, which provides for the data to be used only for the stated purpose.

7.3. Where required by law, data is provided at the reasoned written request of a competent state authority. When such a request is received, its legal basis is checked and data is provided only to the extent stated in the request. Unless the law prohibits it, the business customer is informed.

7.4. Where the service or the activity passes to another person, including where the sole proprietorship is converted into a legal entity, the data passes to the new person on the terms set out in this Policy. Business customers are informed in advance.

8. Transfer of data abroad

8.1. For the technical provision of the service, some data is processed on the servers of service providers located outside the Republic of Azerbaijan.

8.2. The transfer is carried out on the basis of the data subject’s consent under article 14.3 of the Law “On Personal Data”. By accepting this Policy, the Customer and its users, and by ticking the consent box, a person who sends the website request form, consent to the transfer of data to the countries listed above.

8.3. In accordance with article 14.4 of that Law, the Operator retains its obligation for the security of the data during transfer.

8.4. Before data is transferred to a new foreign country, separate consent is obtained under clause 15.5.

9. Retention periods

9.1. Data is kept only until the purpose is achieved or for the period required by law.

9.2. Documents that must be kept under tax, accounting and other legal requirements, including invoices, electronic tax invoices, payment documents and bank statements, are kept for not less than 5 years under article 71.4 of the Tax Code. Where there is a tax audit, a dispute or another legal obligation, this period is extended.

9.3. A request to delete data does not apply to the documents listed in clause 9.2 until that period ends. During this period, the Customer’s other data, for example the contact person’s name, email, phone and marketing consent, is deleted on request.

9.4. Data remaining in backups created before the moment of deletion leaves the system completely within up to 90 days, in line with the rotation of the backups. During this period, the data in backups is accessed only for technical recovery.

9.5. After the period ends, the data is deleted irreversibly or converted into a form that does not make it possible to identify a person.

9.6. When the subscription is stopped, the data is not deleted immediately. The panel switches to view-only mode, data export remains available, and the panel is restored when payment is made. 12 months after the subscription ends, the data may be deleted after the Customer is warned by email 30 calendar days in advance. The Customer may at any time request in writing that its data be deleted sooner (11.5).

10. Security measures

10.1. The Operator takes the organisational and technical measures required by law to prevent the accidental loss, destruction, change, unauthorised access to and disclosure of personal data. The measures currently applied are:

• using an encrypted connection (HTTPS) when data is transferred;
• storing user passwords only as a hash, never as plain text;
• separating each Customer’s data from other Customers’ data at the software level;
• two-factor authentication, mandatory for the Operator’s administrator accounts and optional for Customer accounts;
• restricting team members’ access by role;
• keeping a record of sign-ins to the system and of operations, that is, an audit log;
• making daily backups of the data.

10.2. The Operator continuously reviews and updates these measures in line with the nature of the service, the level of risk and the technical means available.

10.3. The Operator has not currently undergone an independent security audit, including a penetration test, and does not declare that it holds any international management certificate, for example ISO/IEC 27001.

10.4. No technological solution can guarantee the absolute security of data transferred over the internet and stored in electronic form. The Operator does not give such a guarantee either, and this Policy does not create any security guarantee.

Technical access to the database

10.5. The person who carries out the technical management of the database, that is, the server administrator, has technical access to the data stored in the database by the nature of their duties. We state this openly, because the system cannot be kept running without such access.

10.6. This access is used only for the following purposes: keeping the system in working order, fixing malfunctions and errors, making and restoring backups, investigating security incidents, and complying with the requirements of the law or a court decision.

10.7. To manage this access, the Operator accepts the following obligations:

• that person signs a written confidentiality undertaking in accordance with the law, which remains in force during the employment relationship and after it ends;
• the right of technical access is given only to a limited number of people who perform this function, and the Operator keeps a list of these people;
• administrative operations are recorded in the audit log;
• a breach of the confidentiality undertaking leads to disciplinary liability under the employment contract and, in cases provided for by law, to other types of liability.

10.8. Other members of the Operator’s team, that is, support and management staff, have no access to the Customer’s sales, expense and revenue figures. Their access is limited to the identification details of the Customer’s account, subscription and payment records, support correspondence and internal notes about the Customer.

10.9. In the future, the Operator may introduce a feature that lets the support team view the Customer’s panel on the basis of the permission the Customer gives in each specific case. When this feature is introduced: viewing is possible only after the Customer’s explicit permission in the panel; permission is given for a set period and can be withdrawn by the Customer at any time; each viewing is recorded with its date, duration and the user who gave permission, and the Customer can see these records.

11. Rights of the data subject

11.1. A person whose personal data is processed has the following rights:

• to know what data about them is stored, and the purpose and methods of processing;
• to find out from what source the data was obtained and to demand proof that it was obtained lawfully;
• to know to whom the data has been transferred;
• to demand that incorrect or incomplete data be corrected;
• to demand that the data be deleted, except in cases set by law;
• to object to the processing of the data without giving a reason;
• for data processed on the basis of consent, to withdraw consent at any time;
• to apply to the competent state authority or to a court, and to claim compensation for material and moral damage.

11.2. Requests are sent to contact@agillimuhasib.com. The Operator has the right to verify the identity of the person making the request.

11.3. Response periods:

11.4. Providing the information is free of charge.

11.5. A deletion request is carried out in the main system within 7 working days. In backups, data is deleted within the backup rotation, within 90 days at most. If a backup is restored, deletion requests are applied again.

11.6. Withdrawing consent stops processing for the request form and marketing notifications. It does not affect processing that is necessary for the performance of the contract and for meeting obligations set by law.

11.7. The right to object to a decision taken by automated means is retained. The Operator does not take such decisions, see clause 5.4.

11.8. Requests concerning data relating to the Customer’s own customers and employees are handled in accordance with clauses 6.6 and 6.7.

12. Cookies and the website’s technical data

12.1. The following types of cookies are used on the website and in the panel:

12.2. Analytics cookies are enabled only after the visitor gives consent. If consent is not given, the website remains fully functional. Analytics cookies are not currently used on the website.

12.3. Visitors can block or delete cookies in their browser settings. If necessary cookies are blocked, signing in to the panel may not be possible.

12.4. When the website is visited, the IP address, browser and device information and the time of the request are recorded technically. This data is used for security and to keep the website working.

12.5. The legislation of the Republic of Azerbaijan does not set a separate consent requirement for cookies. Consent for analytics cookies is the Operator’s own choice and is intended for entering foreign markets in the future.

13. Age limit

13.1. Only a person aged 18 or over may open a business customer account.

13.2. The Customer may invite to the panel only employees aged 16 or over, and ensures this.

13.3. We do not knowingly collect data of people under 16. If it becomes known that such data has entered the system, that data is deleted.

14. Data security incident

14.1. Where an incident occurs that is known to the Operator and has a real effect on the security of the Customer’s data, the Operator investigates the incident and informs the Customer by the account email no later than 72 hours.

14.2. The notice states the nature of the incident, its scope, its likely consequences and the measures taken and planned.

14.3. Each incident is investigated, a written report is prepared and remedial measures are taken. These documents are kept by the Operator.

14.4. Where the law requires state authorities to be informed, the Operator meets this requirement as well.

14.5. The 72-hour notice period is the Operator’s own obligation.

15. Changes to the Policy

15.1. The Operator may make changes to this Policy. Notice of a change is sent to the Customer by the account email and in the panel. The notice briefly explains the content of the change and states the effective date.

15.2. A change takes effect 15 calendar days after the date the notice is sent.

15.3. If the Customer continues to use the service without objecting during that period, the change is deemed accepted.

15.4. If the Customer does not agree with the change, it has the right to stop the subscription and export its data before the effective date. In this case, settlement for the subscription period paid for but not used is made in accordance with the Terms of Use.

15.5. A special rule applies to the following changes:

• transferring data to a new foreign country, using data for marketing purposes and changing the purpose of processing are carried out only with the data subject’s separate, explicit consent;
• when a new category of data recipient (for example, a new service provider) is added, the Customer is given at least 15 calendar days’ notice. During this period the Customer may object, stop the subscription and export its data;
• the retention period of data already collected is extended only where required by law or with the data subject’s consent.

15.6. The rights given to data subjects by law and the periods for responding to them cannot be limited by changes to this Policy.

15.7. All previous versions of the Policy are kept in an archive with the dates during which they were in force and are available on the agillimuhasib.com website. The Customer can see in the panel which version it accepted for its account and the date of acceptance.

16. Governing law, language and contact

16.1. This Policy and the relationships related to the Service are governed by the legislation of the Republic of Azerbaijan.

16.2. If disputes are not resolved by negotiation, they are heard by the competent court of the city of Baku.

16.3. The Azerbaijani text of the document is the official text. The Russian and English texts are translations, and in case of a discrepancy the Azerbaijani text applies.

16.4. Where the mandatory legal rules of the country in which the Customer is registered must be applied, those rules remain in force and this clause does not limit their application.

16.5. Where the service is provided to Customers registered in the European Union, the additional terms arising from European Union personal data protection legislation are set out in a separate Annex to this Policy. Until that Annex takes effect, the Operator does not provide the service to Customers located in the European Union.

16.6. The commercial terms of the service, the payment procedure, the limitation of liability and the Operator’s obligations relating to the content of the service are set out in the Terms of Use. This Policy does not create rights and obligations of a commercial nature.

16.7. Contact: contact@agillimuhasib.com