Privacy policy

1. General provisions

UAB “Ateities IT” (hereinafter – the “Company”, “we”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use and safeguard your data when you use our website, the Hanna mobile app, or contact us.

This Policy applies to individuals who:

• visit our website;
• use the Hanna mobile app;
• contact us;
• use our services prior to entering into a contract (e.g., submit an inquiry or request a demo).

By using our website or the Hanna mobile app, or by providing your data, you confirm that you have read this Privacy Policy.

2. Data controller

3. What data we collect

We may collect the following personal data:

3.1. Data you provide:

• name and surname;
• email address;
• phone number;
• company name and related details;
• any other information you provide when contacting us.

3.2. Automatically collected data:

• IP address;
• browser type and device information;
• date and time of visit;
• pages viewed;
• cookie data.

3.3. Data used for advertising conversion measurement:

To evaluate the effectiveness of our advertising campaigns, in certain cases we may transmit information about actions performed on the website to advertising platform providers on the server side, using, for example, the “Meta Conversions API”.

• information about the action performed (e.g., a successful demo or trial account registration);
• the date and time of the action;
• the address of the page where the action was performed;
• a technical unique conversion identifier;
• the email address, hashed using the SHA-256 hashing function before transmission;
• where the relevant consent has been obtained, additional advertising cookie identifiers or technical identifiers of the advertising platform, if used for conversion attribution.

3.4. Google API Services User Data:

Hanna CRM allows users to connect supported Google services, including Gmail, Google Drive, Google Calendar and Google Contacts, in order to provide CRM functionality.

Gmail. When a user connects Gmail, Hanna CRM uses read-only access to retrieve email correspondence associated with CRM contacts. Email sender and recipient information, subject, date, message content and related message data may be processed and stored in Hanna CRM in order to display customer communication history. Hanna CRM does not use Gmail access to send, modify or delete email messages.

Google Drive. When a user connects Google Drive, Hanna CRM may create, read, update and delete only files that the user has created or selected for use with Hanna CRM. These files remain stored in the user's Google Drive and are accessed only to provide file-management functionality requested by the user.

Google Calendar. When enabled by the user, Hanna CRM accesses Google Calendar data to provide calendar and CRM activity integration functionality.

Google Contacts. When enabled by the user, Hanna CRM accesses Google Contacts data to provide contact synchronization and CRM contact management functionality.

Google user data is used solely to provide and improve the user-facing functionality requested by the user. Hanna CRM does not use Google user data for advertising purposes and does not sell Google user data.

Access to Google services can be revoked by the user at any time through their Google Account permissions or by disconnecting the integration in Hanna CRM.

Hanna CRM's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3.5. Hanna mobile app:

This section applies to the Hanna mobile app for Android devices, distributed through Google Play (app package identifier: app.hannacrm.dev.hannamobile).

Data controller and data processor. The app is intended for Hanna CRM users who work for companies that have entered into an agreement with us. CRM data processed through the app (customers, contact persons, tasks, opportunities, notes, files and call information) is generally controlled by your company, as the Hanna CRM customer. UAB “Ateities IT” processes this data as a data processor under its agreement with your company. For questions about CRM data processing or to exercise your rights regarding that data, contact your company first. App accounts are created by your company's Hanna CRM administrator; you cannot create a new account in the app itself.

Data processed by the app:

• Account data: first name, last name, email address, company and user permissions. Sign-in takes place via the Hanna sign-in page in a browser. Sign-in tokens stored on the device are encrypted using Android Keystore.
• CRM data: records that you view, create or edit in the app. These records are processed within your company's Hanna CRM system.
• Call information (only if you enable this feature): when you allow access to your phone's call log, the app may send call phone numbers, direction (incoming, outgoing or missed), date and time, and duration to your company's Hanna CRM. This allows callers to be identified and calls to appear in the CRM communication history. The app does not record the content of conversations. Phone numbers you mark as personal are not sent to the CRM. You can disable call data transmission in the app settings or revoke the permission on your phone.
• Phone contacts (only with your permission): used only on the device to show the caller's name from your address book on the caller card. Your phone's address book is not transmitted to our servers.
• Notifications: the app uses Google Firebase Cloud Messaging (FCM) to deliver push notifications. This requires a device notification identifier (token); notifications may contain work-related CRM information.
• Other device features and permissions: display over other apps (for the caller card), calling functionality (to initiate calls from the app), and biometrics (to unlock the app). Biometric verification takes place on the device; Hanna CRM does not receive your biometric data.

Advertising and data security. The Hanna mobile app does not display ads, use advertising or analytics tracking tools, sell data, or share data with third parties for advertising purposes. Data is transmitted over encrypted connections (HTTPS / TLS). These statements apply to the mobile app and do not change the separate description of cookies and advertising technologies used on the website in this Policy.

Retention and deletion. CRM and call data are stored in your company's Hanna CRM system according to your company's data retention rules and its agreement with us. Signing out of the app deletes sign-in data stored on the device; uninstalling the app removes its local data. To request deletion of an account or CRM data, contact your company's Hanna CRM administrator or email us at [email protected].

4. Purposes and legal bases for data processing

We process your personal data for the following purposes:

You have the right to withdraw your consent for marketing purposes at any time.

Where we rely on legitimate interest for server-side advertising conversion measurement, we apply the principle of data minimisation, assess the balance between the Company’s interests and your rights and freedoms, and provide you with the right to object to such processing.

When we process CRM data on behalf of a Hanna CRM customer as a data processor, that customer determines the purposes and legal basis for the relevant processing as the data controller. See Section 3.5 for more information about mobile app data.

5. Data disclosure

Your data may be shared with:

• our service providers (e.g., IT, hosting, analytics, email service providers);
• Meta Platforms Ireland Limited – when we use “Meta Pixel” and “Meta Conversions API” to measure advertising campaign effectiveness, attribute conversions and optimise advertising campaigns. When using “Meta Conversions API”, information about certain actions performed on the website may be transmitted directly from our servers to Meta;
• Google Firebase Cloud Messaging – to deliver push notifications to mobile app devices as described in Section 3.5;
• law enforcement authorities when required by law;
• other parties if necessary for service provision.

All data processors are required to comply with GDPR requirements.

6. Data transfers outside the EEA

Some of our service providers may be located outside the European Economic Area (EEA). In such cases, we ensure that:

• data is transferred in accordance with Standard Contractual Clauses (SCC) approved by the European Commission; or
• other appropriate safeguards under GDPR are applied.

7. Data retention periods

We retain your data only as long as necessary:

• inquiry data – up to 1 year from the last contact;
• marketing data – until consent is withdrawn;
• analytical data – according to cookie retention periods;
• data related to server-side advertising conversion measurement – only for as long as necessary to transmit the conversion, ensure technical reliability and achieve the stated purposes;
• other data – as required by applicable laws.

8. Data security

We implement appropriate technical and organizational security measures, including:

• data encryption during transmission (HTTPS / TLS);
• access control;
• system monitoring and protection;
• restricted employee access.

However, no system is completely secure, and we cannot guarantee absolute security.

9. Your rights

You have the following rights:

• to be informed about the processing of your data;
• to access your data;
• to request correction of inaccurate data;
• to request deletion of your data (“right to be forgotten”);
• to restrict processing;
• to data portability;
• to object to processing;
• to withdraw consent;
• to lodge a complaint with a supervisory authority.

Where we process your personal data on the basis of legitimate interest, you have the right to object to such processing on grounds relating to your particular situation. Upon receiving such an objection, we will assess it in accordance with applicable legal requirements.

To exercise your rights, including objecting to server-side advertising conversion measurement based on legitimate interest, contact us at: [email protected]

10. Cookies

We use cookies to ensure proper website functionality and improve user experience.

We use the following types of cookies:

• necessary (for website functionality);
• analytical (for usage statistics);
• functional (to remember user preferences);
• advertising (if applicable).

Analytical and advertising cookies, as well as browser-based tracking technologies, including “Meta Pixel”, are activated only after obtaining your relevant consent. If you choose only necessary cookies, “Meta Pixel” is not activated in your browser and advertising cookie identifiers are not used.

In addition to cookies, we may use server-side advertising conversion measurement technologies, such as “Meta Conversions API”. In such cases, information about certain actions performed on the website may be transmitted directly from our server to the advertising platform provider without using advertising cookies on your device. Such server-side conversion measurement may also be carried out when you choose only necessary cookies, where a separate legal basis specified in Section 4 of this Policy applies.

More information about cookies can be found in your browser settings or in our cookie notice.

11. Automated decision-making and AI

In certain cases, we may use automated tools or artificial intelligence (AI) solutions to:

• improve service quality;
• analyze data;
• automate processes.

Such solutions are not used to make legal or similarly significant decisions about you without human involvement.

12. Links to other websites

Our website may contain links to third-party websites. We are not responsible for their privacy practices.

13. Policy updates

We may periodically update this Privacy Policy. The updated version will be published on this website.

Last updated: 12 November 2026.

14. Contact

If you have any questions regarding this Privacy Policy or the processing of your data, please contact us:

Email: [email protected]