1. Who is responsible
The controller of your personal data is TopScale Kft. (TopScale Korlátolt Felelősségű Társaság), registered at Viola utca 2, 8200 Veszprém, Hungary, company registration number 19-09-523454 ("we", "us"). We operate Pumi and the website pumi.co. Privacy contact: info@pumi.co. We have not appointed a data protection officer, as the law doesn't require one for us.
2. Our role, and whom to contact
- We are the controller for the account data of everyone who uses Pumi (workspace owners, team members and invited clients), and for billing, support and technical data and visits to our website.
- Our customer is the controller for the content of their workspace: tasks, estimates, messages, files, and the data of the team members and clients they invite. We process it only on their behalf, under our Data Processing Agreement.
- If you were invited to a workspace, as a team member or a client: contact us about your login, profile and notification emails. Contact the workspace owner about project content. If you contact us about project content, we pass your request on and help them answer it.
3. What we collect and why
| Data | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account data | Name, email address, password (stored hashed), role, workspace membership, working hours | Create and run your account, sign you in | Contract (Art. 6(1)(b)) |
| Acceptance record | Date and version of the terms you accepted | Prove what was agreed and when | Legitimate interest (Art. 6(1)(f)): being able to prove the contract |
| Billing data | Plan, number of paid seats, subscription status, Paddle customer and subscription IDs | Manage your subscription and plan limits | Contract (Art. 6(1)(b)); legal obligation under accounting law (Art. 6(1)(c)) |
| Service emails | Invitations, approval requests, reminders, notifications, delivery status | Run the workflow you use the service for | Contract (Art. 6(1)(b)) |
| Support correspondence | Messages you send us and our replies | Answer your questions | Legitimate interest (Art. 6(1)(f)): handling and documenting support requests |
| Technical data | IP address, browser type, request logs, timestamps | Security, abuse prevention, troubleshooting | Legitimate interest (Art. 6(1)(f)): keeping the service secure, preventing abuse and fixing errors |
| Website analytics | Pages viewed, referrer, device and browser type, approximate location (country, region, city), buttons clicked, where on the page you click and how far you scroll | Understand how visitors use our website (not the app) | Legitimate interest (Art. 6(1)(f)): improving our website, measured without cookies and without following you to other sites |
We never see or store your card details: Paddle collects them at checkout. We don't sell personal data and don't show ads. Analytics runs only on our website, without cookies; the app has none.
4. Do you have to give us this data?
- Account data is needed to create an account and conclude the contract. Without it we can't provide the service.
- Billing data is needed only for the Pro plan.
- Technical data is created automatically when you use the service.
- Website analytics is collected automatically. You can object to it (section 9), or block it in your browser; neither affects how you can use the website.
We don't make decisions about you by automated means, and we don't profile you.
5. Cookies and local storage
Strictly necessary (no consent needed)
- Our website sets one cookie that remembers your language choice.
- The app keeps your login token in your browser's local storage, so you stay signed in.
- Paddle's checkout may set its own cookies for payment processing and fraud prevention.
Analytics (no cookies)
On our website we use Umami, an open-source analytics tool that we run on our own servers. It sets no cookies and stores nothing in your browser. Your IP address is used only to work out your approximate location and an anonymous visit identifier that changes every month; the IP address itself is not stored. No analytics data goes to third parties.
We use no advertising cookies. Our web fonts are served from our own servers.
6. Who receives the data
Our processors (they act only on our instructions, under a data processing agreement)
- Hetzner Online GmbH (Germany): servers, database and backups (including website analytics), in EU data centres.
- Shipmail (Germany): email delivery, hosted in the EU.
Independent controllers
- Paddle.com Market Ltd (United Kingdom), our Merchant of Record: checkout, payments, invoices, tax and subscription management, under its own privacy notice.
- Professional advisers (accountants, lawyers), bound by confidentiality, where needed.
- Authorities, where the law requires it.
- A buyer or successor, if our business is sold or merged, under the same protections.
7. International transfers
We keep data in the European Economic Area where we can. Paddle is in the United Kingdom, covered by an EU adequacy decision. Shipmail runs in Germany but uses some US-based subprocessors of its own; those transfers rely on the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework. Email info@pumi.co for a copy of these safeguards.
8. How long we keep it
- Account and workspace data: while your account is active. We delete it within 30 days after the account is closed or you ask us to delete it. Copies in backups are removed within a further 90 days.
- Acceptance record: while your account exists, and up to 5 years after it is closed (the general limitation period in Hungary).
- Billing records: as long as accounting and tax law requires, up to 8 years.
- Technical logs: no longer than 90 days.
- Website analytics: 14 months, then deleted automatically.
- Support correspondence: up to 2 years after your last message.
9. Your rights
Under the GDPR you have the right to:
- access your personal data and get a copy;
- have inaccurate data corrected;
- have your data erased;
- restrict how we process it;
- receive it in a portable format;
- object to processing based on legitimate interest;
- withdraw consent at any time, where processing is based on consent;
- lodge a complaint with a supervisory authority: in Hungary the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, Falk Miksa utca 9–11, 1055 Budapest, naih.hu), or the authority in your country.
Email info@pumi.co to use these rights. We reply within one month. For complex requests we may extend this by two months, and we tell you if we do. For workspace content, see section 2.
10. Security and breaches
We protect your data with encrypted connections (HTTPS), hashed passwords, role-based access inside the app, regular backups, and access to production systems limited to the people who need it.
- Data we control: if a breach is likely to put your rights at risk, we notify the NAIH within 72 hours, and you without undue delay if the risk is high.
- Workspace content: we notify the workspace owner without undue delay, as set out in the DPA. They decide on notifying the authority and the people affected.
11. Children
Pumi is a business tool and is not meant for anyone under 16.
12. Changes
We may update this notice. The date at the top shows the latest version. For a material change we notify you by email or in the app.
13. Contact
TopScale Kft., Viola utca 2, 8200 Veszprém, Hungary. Email: info@pumi.co.