Privacy Policy

This Privacy Policy explains how PRIONEX LTD ("PRIONEX", "we", "us or "our") processes personal data in connection with its software products, websites and services, including PRIONEX CRM, PRIONEX Loan Management System and Prionex Hub.

This Privacy Policy is intended to provide information about the categories of personal data processed, the purposes and legal bases of processing, retention, disclosures, international transfers, security measures and the rights of individuals.

PRIONEX processes personal data in accordance with applicable data protection legislation, including Regulation (EU) 2016/679 ("GDPR") where applicable.

We apply the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.

PRIONEX develops, licenses, implements and supports software solutions for businesses.

Our software products may be used for:

• customer relationship management;
• loan and portfolio management;
• employee and workplace management;
• internal communications;
• tasks and workflow management;
• customer and debtor management;
• reporting and operational activities;
• technical support, maintenance and system administration.

The precise categories of personal data processed depend on the particular product, configuration and instructions of the relevant customer.

PRIONEX may act as a Controller, a Processor, or, depending on the processing activity, in both capacities.

A Controller determines the purposes and means of processing personal data. A Processor processes personal data on behalf of a Controller and on documented instructions.

3.1 PRIONEX as Controller

PRIONEX acts as Controller for personal data processed for its own purposes, including:

• information relating to PRIONEX employees and job applicants;
• business contacts;
• website and service administration;
• account and access management;
• security and fraud prevention;
• legal and regulatory compliance;
• contractual and corporate administration.

3.2 PRIONEX as Processor

Where a PRIONEX software product is used by a customer to process the customer's own personal data, the customer generally acts as Controller and PRIONEX acts as Processor.

In such circumstances, PRIONEX processes Customer Data only on the customer's documented instructions and in accordance with the applicable data processing agreement.

Customer Data may include information relating to the customer's customers, employees, applicants, debtors, contractors or other individuals, depending on the customer's use of the software.

The customer's responsibilities include determining the purposes and legal basis of processing, providing appropriate privacy information to individuals, responding to data subject requests where applicable, and ensuring that its processing activities comply with applicable law.

PRIONEX CRM is a business software platform used by customers for customer relationship management and related operational activities.

Depending on the customer's configuration, CRM records may contain:

• names and contact details;
• customer and account identifiers;
• employment or organisational information;
• contractual information;
• customer and debtor information;
• payment or account information;
• communications and notes;
• documents and attachments;
• operational records;
• information entered by authorised users.

The exact categories of data depend on the relevant customer's use of the CRM.

Where such information belongs to a customer, PRIONEX processes it as Processor on behalf of that customer.

PRIONEX Loan Management System ("LMS") supports loan and portfolio management activities.

Depending on the customer's configuration, the LMS may process information relating to borrowers, applicants, loans, payments, accounts, communications and related operational records.

The relevant customer remains responsible for determining the purposes and legal basis for processing borrower and applicant data.

Certain PRIONEX LMS configurations may support automated processing in connection with loan applications or portfolio operations.

The technical system is capable of issuing a final refusal automatically without human intervention. The system does not issue an automatic final approval.

Where automated decision-making is used by a customer and a decision may produce legal effects or similarly significantly affect an individual, the relevant customer, as Controller, is responsible for assessing and complying with applicable requirements concerning automated decision-making, including Article 22 GDPR where applicable.

Where Article 22 GDPR applies, appropriate safeguards must be provided in accordance with applicable law. These may include appropriate information, the possibility of requesting human intervention, expressing one's point of view and contesting the decision, where required.

PRIONEX does not independently determine the legal basis or substantive lending policy of a customer.

Prionex Hub is an internal workplace application available through:

• iOS;
• Android;
• web browsers.

Application identifier: com.prionex.hub

Web domains:

• hub.crm-prionex.com
• hub.crm-prionex.online

Prionex Hub is an internal workplace system used by employees of PRIONEX and participating customer companies.

The application is unlisted and is distributed through controlled access. It does not provide public self-registration.

User accounts are created and managed by the relevant employer through its corporate CRM.

Prionex Hub does not use advertising or cross-application tracking.

For PRIONEX employees, PRIONEX acts as Controller for the relevant employment and workplace processing.

For employees of customer companies, the relevant employer generally acts as Controller and PRIONEX acts as Processor.

The employer determines which employees receive access, their roles and permissions, and how workplace information is used.

PRIONEX provides the technical infrastructure and processes personal data on behalf of the customer in accordance with documented instructions.

Depending on the account and configuration, Prionex Hub may process:

• full name;
• work email address;
• login identifier;
• employee ID and internal Hub ID;
• role, department, group, manager and project information;
• internal workplace telephone extension;
• language and time-zone settings;
• profile avatar;
• account status;
• notification settings.

Account information may be received from the employer's CRM and copied or synchronised to the Hub environment.

A personal mobile telephone number is not collected by Prionex Hub.

The application does not store the user's password. During authentication, credentials are transmitted to the relevant CRM authentication service and an access token is returned.

Prionex Hub provides workplace communication and collaboration functions.

Users may create or receive:

• messages;
• threads and replies;
• forwarded messages;
• mentions;
• reactions;
• pinned content;
• tasks;
• events;
• notes;
• drafts;
• photographs;
• avatars;
• group photographs;
• document and other file attachments;
• voice messages through the web version;
• other content submitted by authorised users.

Message and other workplace content is stored on the Hub server so that the relevant functionality can operate.

Search functionality may operate on message text.

Message editing and deletion

The system maintains a separate history of message changes and deletions.

Where a message is deleted for all participants, the active message content may be cleared while a corresponding historical record may remain.

Customer and debtor information

Workplace communications may contain personal data relating to customers, borrowers or debtors of the relevant employer.

Such information may be included in messages, documents, screenshots or other user-generated content at the initiative of authorised users.

Where such information is processed on behalf of a customer, the customer remains the Controller and PRIONEX acts as Processor.

PRIONEX Hub does not create a separate independent customer/debtor database for this purpose. Customer and debtor information displayed through the CRM workspace may be retrieved from the relevant CRM system when requested by an authorised user.

Users may upload photographs from the device gallery.

Images may be used as:

• message attachments;
• profile avatars;
• group photographs.

The maximum supported image size is 25 MB.

On every image upload, EXIF metadata, including GPS coordinates contained in EXIF metadata, is removed on the server.

Previously uploaded photographs have also been processed to remove such metadata.

The mobile application permits image attachments. PDF, Office and similar files may be uploaded through the web version.

Prionex Hub includes a location-sharing function.

Location data is processed only when the user actively selects the location function in a chat and confirms the action.

The application requests location permission only while the application is being used.

Prionex Hub does not:

• continuously track the user's location;
• access location in the background;
• request "always" location access;
• use location for advertising or cross-application tracking.

The location point is visible to participants in the relevant chat and is stored as part of the relevant message.

Location data is not included in push notifications and is not stored in server logs for advertising or analytics purposes.

The map image associated with the location is generated by PRIONEX's own server. The device does not directly contact a third-party mapping service for this function.

Depending on the platform and use of the application, Prionex Hub may process:

• push notification token;
• installation identifier;
• device model;
• browser name for the web version;
• operating system and platform information;
• operating system version;
• application version;
• session information;
• IP address in relevant server or authentication logs;
• crash information;
• search strings;
• User-Agent information.

The installation identifier is a randomly generated application identifier and is not an advertising identifier.

The actual IP address is not stored in the main Hub application database. It may be present in relevant web-server and CRM authentication logs.

Web-server logs containing search strings and User-Agent information are retained for 30 days and are then automatically deleted.

Crash information may be transmitted to Expo and may include the text of the latest fatal error. Such crash information is not intentionally linked to the user's identity.

Prionex Hub does not intentionally collect:

• the personal address book/contacts stored on the device;
• personal mobile telephone numbers;
• audio recorded through the mobile device microphone;
• advertising identifiers such as IDFA or AAID;
• cross-application tracking data;
• payment card or payment account information;
• health information as a dedicated application function;
• biometric information.

The "Contacts" section of Prionex Hub is an employee directory provided from the server and is not the device's personal address book.

Face ID and fingerprint authentication, where available, is handled by the operating system. Biometric information is not transmitted to PRIONEX.

The camera is used only for QR-code scanning for device/account linking. The application does not use the camera to take photographs or videos for upload to PRIONEX servers.

Prionex Hub uses push notification infrastructure to deliver notifications.

Depending on the platform, this may involve:

• Expo;
• Apple Push Notification service (APNs);
• Google Firebase Cloud Messaging (FCM).

When registering for push notifications, Expo may receive a native APNs or FCM token, an installation identifier, the application bundle identifier and IP address.

When a push notification is sent, relevant service providers may receive the push token, notification title and notification content, together with necessary service identifiers.

By default, the content of a workplace message is not included in the push notification sent to the external push service. A neutral notification text is used instead.

Full notification content may be transmitted where the user has enabled notification previews.

Apple APNs may receive the device token and notification content.

Google FCM may receive the FCM token, Firebase Installation ID and notification content.

The user's name and email address are not transmitted to these push services for this purpose. The association between a push token and an individual user is maintained in PRIONEX's own database.

Prionex Hub does not use cookies for its application functionality.

Prionex Hub does not operate its own analytics system.

Firebase is used for push notification functionality and not as a separate Hub analytics service.

PRIONEX's CRM environment may use OpenReplay for session recording and technical monitoring. OpenReplay is deployed on PRIONEX infrastructure in the Netherlands.

Access by authorised PRIONEX personnel to customer data is subject to access logging.

Access rights are restricted according to applicable roles and permissions.

PRIONEX uses access controls and logging as part of its technical and organisational security measures.

PRIONEX may use service providers to provide infrastructure and technical functionality.

For Prionex Hub, relevant providers include:

Worldstream B.V.

Location: Netherlands, European Union

Worldstream provides hosting infrastructure for PRIONEX servers, databases, files and logs.

Expo / 650 Industries, Inc.

Location: United States

Expo is used for push notification delivery and application update functionality.

Depending on the relevant operation, information may include device or installation identifiers, push tokens, IP address and technical crash information.

Apple Push Notification service

Provider: Apple

APNs provides push notification delivery for Apple devices.

Google Firebase Cloud Messaging

Provider: Google

FCM provides push notification delivery for Android devices and supported web browsers.

These providers may process personal data as service providers/subprocessors where applicable.

PRIONEX does not sell personal data.

PRIONEX primarily hosts its application infrastructure with Worldstream in the Netherlands.

Certain technical service providers used by PRIONEX, including providers involved in push notifications and application infrastructure, may process personal data outside the European Economic Area, including in the United States.

Where personal data is transferred outside the EEA, PRIONEX will apply an appropriate transfer mechanism and safeguards as required by applicable data protection law.

Depending on the circumstances, such mechanisms may include:

• an adequacy decision;
• the European Commission's Standard Contractual Clauses;
• another lawful transfer mechanism available under applicable law.

Where required, PRIONEX will also consider appropriate supplementary measures.

At the date of this Privacy Policy, the contractual and transfer arrangements applicable to individual providers may differ. The relevant arrangements are maintained as part of PRIONEX's data protection and vendor-management processes.

International transfers under the GDPR are subject to specific safeguards.

PRIONEX retains personal data only for as long as necessary for the relevant purpose, contractual obligations, legitimate business needs or legal requirements, subject to applicable law.

For Prionex Hub, the current retention practices include:

Workplace messages and files are not automatically deleted solely because an employee leaves the relevant employer.

When an employee leaves, the employer may block the employee's access to the application. Workplace content may remain available to the employer as business records and workplace information, subject to the employer's own retention policies and applicable law.

Prionex Hub does not provide public self-registration.

An account is created by the relevant employer through its CRM.

Users cannot independently create an account through Prionex Hub.

Access may be blocked or deactivated by the relevant employer through its CRM.

Blocking an account prevents further access to the application but does not, by itself, constitute deletion of workplace content or other records that the employer is entitled or required to retain.

Where personal data is processed on behalf of a customer, requests concerning Customer Data should generally be directed to the relevant customer/employer as Controller.

Nothing in this section limits any statutory rights available to an individual under applicable data protection law.

Depending on the applicable law and the role of PRIONEX in the relevant processing, individuals may have rights including:

• the right to obtain confirmation as to whether personal data concerning them is being processed;
• the right of access;
• the right to rectification;
• the right to erasure;
• the right to restriction of processing;
• the right to object to certain processing;
• the right to data portability where applicable;
• the right to withdraw consent where processing is based on consent;
• rights relating to automated decision-making where applicable.

These rights are subject to applicable legal conditions and exemptions.

The GDPR requires organisations to provide transparent information about processing purposes, categories of data, legal bases, recipients, retention, international transfers and data subject rights.

Where PRIONEX processes personal data on behalf of a customer, the customer generally acts as Controller.

If your personal data is processed through a PRIONEX system on behalf of your employer or another PRIONEX customer, you should normally contact that organisation first regarding access, correction, deletion or other rights concerning your data.

PRIONEX will assist its customers with data subject requests as required by the applicable data processing agreement and applicable law.

This does not prevent an individual from contacting PRIONEX directly where permitted or required by applicable law.

Depending on the circumstances, PRIONEX may rely on one or more of the following legal bases:

• performance of a contract;
• taking steps at the request of an individual prior to entering into a contract;
• compliance with a legal obligation;
• legitimate interests of PRIONEX or another party, where such interests are not overridden by the individual's rights and freedoms;
• consent, where consent is the appropriate legal basis.

For PRIONEX employees, certain workplace processing may be based on the employment relationship, applicable legal obligations and legitimate interests rather than consent.

Where PRIONEX acts as Processor, the applicable customer/Controller determines the relevant legal basis for the processing.

PRIONEX does not intentionally request or routinely collect special categories of personal data through Prionex Hub as a dedicated feature.

However, Prionex Hub permits users to submit free-text messages, files, screenshots and other user-generated content. Consequently, users may include information that falls within special categories of personal data in workplace communications.

Examples may include information relating to health, biometric data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership or information concerning sex life or sexual orientation.

Where such information is processed on behalf of a customer, the customer is responsible for determining the lawful basis and applicable conditions for such processing.

PRIONEX does not perform automated content screening to identify or prevent users from entering such information into free-text fields or attachments.

Prionex Hub and CRM functionality may technically permit authorised users to enter free-text information or upload documents containing information relating to criminal convictions or offences.

PRIONEX does not intentionally request such information as a general Hub feature.

Where such information is processed on behalf of a customer, the customer remains responsible for ensuring that its processing complies with applicable legal requirements.

PRIONEX applies technical and organisational measures designed to protect personal data against unauthorised access, unlawful processing, accidental loss, destruction or damage.

For Prionex Hub, these measures include:

• encryption of data transmitted between the application and servers using TLS;
• prohibition of unencrypted application connections;
• protected storage of relevant device credentials/tokens on the device using operating-system security mechanisms;
• exclusion of relevant protected device credentials from ordinary cloud backup;
• role-based access controls;
• access logging;
• restricted employee access to Customer Data.

Prionex Hub does not use end-to-end encryption for workplace messages.

PRIONEX does not represent that application-level server-side encryption at rest is used for all stored Hub data.

PRIONEX also does not currently represent that the Hub environment is protected by a separate application-level backup system.

PRIONEX maintains procedures for identifying, assessing and responding to personal data security incidents.

Where PRIONEX acts as Processor, it will notify the relevant Controller of a personal data breach in accordance with the applicable data processing agreement and applicable law.

Where PRIONEX acts as Controller, it will assess and handle personal data breaches in accordance with applicable legal requirements.

Where PRIONEX processes personal data concerning its employees or job applicants, PRIONEX may process information necessary for:

• recruitment;
• employment administration;
• payroll and benefits;
• workplace management;
• access management;
• security;
• legal and regulatory compliance;
• performance and operational administration.

The relevant legal basis depends on the specific processing activity and applicable law.

PRIONEX's business software and Prionex Hub are intended for business and workplace use and are not directed to children.

PRIONEX does not knowingly provide public account registration for children through Prionex Hub.

PRIONEX may disclose personal data where required to do so by applicable law, court order, regulatory requirement or lawful request from a competent public authority.

Where legally permitted, PRIONEX will take reasonable steps to ensure that disclosures are limited to information that is relevant and necessary for the applicable purpose.

PRIONEX treats personal data and Customer Data as confidential and restricts access to authorised personnel and service providers according to applicable roles, contracts and instructions.

Where PRIONEX acts as Processor, Customer Data is processed only in accordance with the applicable customer agreement and documented instructions, subject to applicable law.

The Prionex Hub application itself does not use cookies.

PRIONEX websites may use strictly necessary technical technologies where required for website operation.

Where optional cookies or similar technologies are introduced, PRIONEX will provide the relevant information and obtain consent where required by applicable law.

PRIONEX websites or software products may contain links to third-party websites or services.

PRIONEX is not responsible for the privacy practices of third parties that operate independently from PRIONEX.

Users should review the privacy information of the relevant third party before providing personal data to that party.

PRIONEX may update this Privacy Policy from time to time to reflect changes in its products, processing activities, legal requirements or organisational practices.

The updated version will be published on this page with a revised "Last updated" date.

Where required by applicable law, PRIONEX will provide additional notice of material changes.

For privacy and personal data enquiries, please contact:

PRIONEX LTD Company Registration No. HE 483816 14 Georgiou A, Office/Flat 15 4047 Germasogeia, Limassol Cyprus

Email: dpo@crm-prionex.com

When contacting us, please provide sufficient information to allow us to identify the relevant service, customer relationship or processing activity.

If you believe that your personal data has been processed in violation of applicable data protection law, you may have the right to lodge a complaint with the competent data protection supervisory authority.

For PRIONEX LTD, the competent supervisory authority in Cyprus is the Office of the Commissioner for Personal Data Protection, subject to the applicable rules concerning supervisory authority competence.

You may also have the right to lodge a complaint with the supervisory authority in the EU/EEA Member State of your habitual residence, place of work or place of the alleged infringement, where applicable.