Privacy Policy

This is an English translation provided for convenience. In case of any discrepancy, the Macedonian version prevails.

This Privacy Policy explains how Друштво за менаџмент и бизнис консалтинг ПРОБИС-КОНСАЛТ ДООЕЛ Скопје (PROBIS-KONSALT DOOEL Skopje), ЕМБС 7513615, ЕДБ 4057021555700, with its registered seat at ул. Драгутин Аврамовски Гуте бр. 32, Општина Карпош, Скопје (“popolni.mk”, “we”, “us”), collects, uses, stores and protects personal data when you use the service at popolni.mk. “popolni.mk” is the trade name of the service offered by this company.

popolni.mk is a software service that helps notary, law and accounting offices fill in the documents they already use in their work more quickly. You upload a document, and popolni.mk fills it in with new data and returns a finished Word file.

This Policy applies to the web portal at popolni.mk and to the Popolni add-in for Microsoft Word, which connects to the same service.

We process personal data on the legal bases set out in section 4 of this Policy, mainly for the performance of the contract and for our legitimate interests. We ask for consent only where the law requires it for a specific processing operation.

The processing complies with the Law on Personal Data Protection of the Republic of North Macedonia and with the General Data Protection Regulation of the EU, the GDPR.

1. In short

• We do not sell personal data.
• We do not use the data for advertising or for any other purpose unrelated to the service.
• The connection to popolni.mk is encrypted.
• The data is stored on protected servers in the European Union.
• For your parties’ documents, popolni.mk is the processor and your office remains the controller. This is governed by the Data Processing Addendum, which forms an integral part of the Terms of Use.
• You have the right of access, rectification, erasure, restriction and objection, in accordance with the law.

2. Two roles: controller and processor

It is important to distinguish two kinds of data, because our role is not the same for each of them.

a) Data about your account (popolni.mk is the controller)

For the data created when opening and using the account, popolni.mk decides why and how it is processed. For that data, popolni.mk is the controller.

b) Content you enter to fill in documents (popolni.mk is the processor)

The documents, images, scans, audio recordings and text you enter to produce a document often contain personal data of your parties, such as names, EMBG numbers, addresses, signatures and other numbers.

For that content, your office decides why and how the data is processed. Your office is therefore the controller, and popolni.mk is the processor that processes the data on your instructions.

The obligations of both parties are governed by the Data Processing Addendum, which forms an integral part of the Terms of Use and is accepted electronically when the account is opened or activated.

3. What data we collect

a) Account and office data

We may process:

• the user’s first name and surname;
• email address;
• the name of the office;
• contact details you provide to us;
• the password, stored only as a cryptographic hash, never as plain text;
• language settings and basic account parameters.

b) Content you enter

We may process:

• documents you upload for repeated filling, including Word files;
• images, scans, documents, audio recordings and text you enter for each production;
• text extracted from those documents, images and audio recordings, needed to fill in the document;
• finished documents created by popolni.mk and their versions;
• messages in the conversation with the assistant in the application.

c) Technical data for operation and billing

We may process:

• login and usage records, needed for security and support;
• the number of downloaded documents, to track the subscription and volume;
• basic technical data needed for the stable operation of the service.

We do not use tracking cookies, we do not perform profiling and we do not collect data from third-party sources for marketing.

4. Why we process the data and on what basis

We process the data for the following purposes and on the following legal bases:

Performance of the contract

We process the data to provide you with the service, to manage your account and to produce the documents you request.

Legal obligation

We process the data where necessary for issuing invoices, keeping records and fulfilling tax, accounting or other legal obligations.

Legitimate interest

We process the data for the security and integrity of the system, preventing fraud and abuse, securing evidence in the event of incidents and basic technical maintenance of the service.

We balance these interests against your rights and freedoms. You have the right at any time to object to processing based on legitimate interest.

Consent

Where consent is required for a specific processing operation, we will ask for it separately. You can withdraw your consent at any time.

For the content of the documents, the legal basis is determined by your office as the controller. Where the content contains special categories of personal data or a national identification number, such as the EMBG, popolni.mk processes that data exclusively on the documented instructions of the office and on a basis provided by the office.

We process that content only to perform the service, never for our own purposes.

5. How we protect the data

We apply technical and organisational measures to protect the data.

Encryption in transit

Every connection to popolni.mk is protected with TLS, that is, HTTPS. Data is not transmitted over an open connection.

Encryption at rest

The database and the backups are stored on encrypted disks with our server provider in the EU.

Access control

Each office has access only to its own projects and documents. Access is restricted and separated per office.

Protected passwords

Passwords are stored only as a cryptographic hash, using Argon2. We do not store them as plain text and cannot read them back.

Backups

We make daily backups to reduce the risk of data loss. The backups are stored encrypted and for a limited time.

6. Where the data is stored and transfers to third parties

The main data is stored on servers in the European Union, in Frankfurt, Germany.

For the service to work, part of the content may be transferred to carefully selected providers acting as sub-processors. They process data only on our instructions and under contractual protection obligations.

For the content of the documents, these providers are engaged by popolni.mk within our role as a processor. Your office remains the controller and, by accepting the Terms of Use and the Data Processing Addendum, grants popolni.mk a general authorisation to engage sub-processors. For every planned change of sub-processors, popolni.mk notifies the office in advance and gives it the opportunity to raise a reasonable objection.

The contracting parties for these providers are their legal entities with which popolni.mk enters into an agreement, for example Google Ireland Limited, OpenAI Ireland Limited or Anthropic PBC. The stated location refers to the possible place of processing. A transfer outside the EU takes place only when the processing actually occurs outside the EU.

We carry out transfers outside the EU and North Macedonia only with appropriate safeguards in accordance with Article 46 of the GDPR and the corresponding provisions of the Law on Personal Data Protection, including standard contractual clauses and a transfer impact assessment.

We use these providers only so that popolni.mk can produce the requested document. It is contractually agreed with them that your content will not be used to train their models and will not be stored longer than necessary to perform the service.

We do not share data with third parties for marketing, advertising or resale.

A copy of the safeguards, including the standard contractual clauses for the transfers to these providers, is available on request.

7. How long we keep the data

We keep the account data and the content for the duration of the cooperation, so that you can access your documents and use the service.

After the cooperation ends, we delete or anonymise the account data, as well as the login and security records, within 12 months.

We delete the content of the documents in accordance with your office’s instructions and the data processing agreement. In any case, we delete the content no later than 90 days after the end of the cooperation, unless the office requests earlier deletion.

We keep the billing data for as long as the tax and accounting regulations require, as a rule up to 10 years.

We keep the messages in the conversation with the assistant for the duration of the cooperation and delete or anonymise them at the latest together with the account data. If those messages contain personal data of parties, the retention periods for document content apply to them.

The backups are stored encrypted and are overwritten in a regular cycle of up to 14 days. This means that deleted content also disappears from the backups within that cycle.

You can request the deletion of your data at any time, in accordance with section 8.

8. Your rights

In accordance with the law, you have the right to:

• access the data we hold about you;
• rectification of inaccurate or incomplete data;
• erasure of your data, the “right to be forgotten”;
• restriction of processing;
• object to processing;
• data portability in a readable format;
• withdraw consent at any time;
• not be subject to a decision based solely on automated processing;
• lodge a complaint with the supervisory authority.

popolni.mk does not make decisions based solely on automated processing and does not perform profiling.

The right to erasure is not absolute. It does not apply where the processing is necessary to fulfil a legal obligation, for example tax regulations, or for the establishment, exercise or defence of legal claims. In such cases, we restrict the data instead of deleting it.

Withdrawing consent does not affect the lawfulness of the processing carried out before the withdrawal.

To exercise these rights, write to us at kontakt@popolni.mk.

Where personal data of parties has been entered by an office, you should address your request to that office as the controller. We will assist the office in fulfilling the request.

9. Data Processing Addendum

Where popolni.mk processes personal data contained in the documents, images, scans, audio recordings, text and other materials entered by your office, popolni.mk acts as the processor and your office as the controller.

This processing is governed by the Data Processing Addendum, which forms an integral part of the Terms of Use. The Addendum is accepted electronically together with the Terms, when the account is opened, activated or used.

The Addendum governs the subject matter and duration of the processing, the nature and purpose of the processing, the types of personal data, the categories of data subjects, the documented instructions, confidentiality, the security measures, the sub-processors, the handling of security incidents and the deletion or return of the data.

10. Cookies

The public website does not use tracking cookies or third-party analytics.

In the application we use only essential technical cookies, needed to keep you logged in and to protect the session. Without these cookies, the service cannot work properly.

11. Security incidents

If a breach of the security of personal data for which popolni.mk is the controller occurs, that is, the account data, and if it poses a risk to the rights and freedoms of the affected persons, we will report the incident to the supervisory authority within 72 hours, in accordance with the law.

For the content of the documents, where popolni.mk is the processor, we notify the affected office as the controller without undue delay. The office then decides on reporting to the supervisory authority and on notifying the affected persons, where necessary.

In both cases we act in accordance with the applicable regulations.

12. Children

popolni.mk is intended for professional use by offices and is not intended for persons under 18 years of age.

We do not knowingly collect personal data from children.

13. Changes to this Policy

We may update this Privacy Policy.

In the case of significant changes, we will notify you by email or through a notice in the application.

The date of the last change is stated at the top of this page.

14. Contact and supervisory authority

For questions or requests related to privacy, you can contact us at:

• Email: kontakt@popolni.mk
• Phone: 071 237 331

Controller: Друштво за менаџмент и бизнис консалтинг ПРОБИС-КОНСАЛТ ДООЕЛ Скопје (PROBIS-KONSALT DOOEL Skopje), ЕМБС 7513615, ЕДБ 4057021555700, ул. Драгутин Аврамовски Гуте бр. 32, Општина Карпош, Скопје, North Macedonia.

Contact person for personal data protection matters: kontakt@popolni.mk.

This person is not a formally designated data protection officer within the meaning of Article 37 of the GDPR.

If you believe that your rights have been violated, you have the right to lodge a complaint with the Personal Data Protection Agency of the Republic of North Macedonia (Агенција за заштита на личните податоци) (бул. „Гоце Делчев“ бр. 18, 1000 Скопје, Северна Македонија), azlp.mk.