Privacy policy

1. Who we are

This Policy is applied by the two companies that develop and provide UGLA under a shared integrated management system: MOI Tech LLC (ТОВ «МОІ ТЕК»), 5B Baseina Street, Kyiv, 01024, Ukraine, the developer of UGLA ERP, and MOVI TECH LLC (ТОВ «МОВІ ТЕК»), 26 Obolonskyi Avenue, office 402, Kyiv, 04205, Ukraine, which provides UGLA for HoReCa (together the “Company”, “we”). For commercial relationships with clients in the European Union, the Company may also act through an affiliated company in the Netherlands; the agreement then names which of us is responsible for your data.

Both companies are certified to ISO/IEC 27001:2022 (information security) and ISO 9001:2015 (quality), and the requirements of the GDPR and NIS2 are built into their processes.

2. Data protection officer

The Company has appointed a data protection officer (DPO). The DPO monitors compliance with data protection law, advises on lawful processing, keeps the records of processing activities, handles people's requests about their data and coordinates the response to a personal data breach.

Send every question and request about personal data to dpo@ugla.ua. Other questions: sales@ugla.ua, +38 067 337 18 50.

3. What this Policy covers

We process personal data in two roles.

• As a controller, when we decide the purpose and means of processing ourselves: the data of visitors to ugla.ua, of people who send a request or book a demo, and of the contact persons of clients, partners and suppliers. This Policy is about that.
• As a processor, when a client enters the data of its own staff, customers or counterparties into UGLA ERP. There we act only on the client's instructions and under the agreement and the data processing agreement, and the client, as the controller, is responsible for that data. If you are a customer or an employee of a company that works in UGLA, turn first to that company with questions about your data; we will help it answer.

4. What data we process

We collect only the data a specific purpose cannot do without: data minimisation, the principle our Privacy by Design policy is built on.

• A demo request on the website: name, e-mail, phone (optional), company name, number of locations; the page the request came from, the address of the page you came from, and the link's campaign tags (utm) and ad click identifiers (gclid, fbclid), if there were any.
• Booking a demo: the same name, e-mail and phone, the date and time you choose, your industry and any notes you add in the booking calendar.
• Correspondence and calls: your messages, contacts and position, and the history of your contact with sales and support.
• Clients and partners: contact persons' details, agreements, invoices, company payment details, support requests.
• Technical data of the website: IP address, browser type, the time and address of a request in server logs; the chosen pricing region (the ugla_region cookie) and your cookie choice (ugla_consent).
• Analytics and advertising, only with your consent: the pages you view and your actions on the website (a request, a booking, a calculator estimate, of which only a range is passed on, never the figures), Google's and Meta's cookie identifiers, the device type and an approximate location from the IP address. These services receive no name, e-mail or phone from us.

We do not collect special categories of data (about health, beliefs and the like) on the website and do not ask you to send them.

5. Why, and on what basis

The bases for processing are set by the Law of Ukraine “On Personal Data Protection” and, for people in the EU, by Article 6 of the GDPR.

• To answer a request, run the demo and prepare a proposal: steps taken at your request before entering into an agreement (Art. 6(1)(b) GDPR).
• To conclude and perform the agreement, provide support and invoice: performance of the agreement (Art. 6(1)(b)).
• To keep accounting and tax records and answer public authorities: a legal obligation (Art. 6(1)(c)).
• To understand where requests come from (campaign tags), protect the website and its forms from abuse and keep our systems secure: our legitimate interest (Art. 6(1)(f)), weighed against your rights.
• To send marketing mailings: only with your consent (Art. 6(1)(a)), which you may withdraw at any time.
• To measure visits to the website (Google Analytics), show UGLA's ads and count the requests ads bring (Google Ads, Meta): only with your consent (Art. 6(1)(a)), given in the cookie banner, which you may withdraw under "Cookie settings".

We make no decisions about you based solely on automated processing, and we do not sell personal data.

6. Who receives the data

Only the employees who need it for their work have access to the data (need to know and least privilege). We check the suppliers that process data on our behalf before working with them and sign data processing agreements with them. They are:

• DigitalOcean: the cloud infrastructure UGLA ERP and the website run on, and the backups (data centres in Frankfurt, Germany);
• Google Workspace: company e-mail and documents;
• Calendly (Calendly LLC, USA): demo booking; it loads only when you move on to booking;
• YouTube (Google): videos in the blog, only after you press play, and in its youtube-nocookie.com mode;
• Google (Google Ireland Limited, Google LLC): Google Tag Manager, Google Analytics 4 and Google Ads, only with your consent to analytics or advertising;
• Meta Platforms Ireland Limited: the Meta Pixel, only with your consent to advertising.

Alerts to the sales team about a request that did not reach our CRM contain none of your personal data.

For advertising, Google and Meta may also process the data they receive on their own account, as separate controllers, under their own privacy policies.

We may disclose data to public authorities where the law requires it, and to certification auditors within an audit, under confidentiality.

7. Transfers abroad

UGLA ERP and the website run in the EU, in DigitalOcean's data centres in Frankfurt, Germany. Our teams work in Ukraine, and some suppliers (for example, Calendly, and Google and Meta if you allowed analytics or advertising) are in the USA. Google LLC and Meta Platforms are certified under the EU–U.S. Data Privacy Framework. Where the personal data of people in the EU is transferred outside the European Economic Area, we apply the safeguards the GDPR requires (in particular the European Commission's standard contractual clauses) and address cross-border transfer requirements in our management system.

8. How long we keep data

Data is kept for as long as the purpose it was collected for requires, or as long as the law requires, and is then deleted, anonymised or archived under our Data Retention Policy.

• A request that did not lead to working together is kept while we are in conversation with you, and deleted at your request.
• Client data: for the term of the agreement and the periods set by accounting and tax law.
• Server logs: at least 12 months in active storage and up to 24 months in the archive, subject to data minimisation.
• Backups: a limited period needed to restore our systems.
• Analytics data: for the retention period set in Google Analytics, at most 14 months; advertising cookies: 90 days.

9. How we protect data

Data protection is built into development and processes (privacy by design and by default) and verified by an independent ISO/IEC 27001 audit. In particular:

• role-based access on need to know and least privilege, reviewed regularly and removed at once when duties change;
• multi-factor authentication, and access to systems through an encrypted VPN;
• encryption of data in transit (HTTPS/TLS, SSH) and at rest;
• monitoring of the infrastructure and event logs that are reviewed regularly;
• backups, and recovery and business continuity plans;
• a data protection impact assessment (DPIA) before a new application or process goes live, and data minimisation and pseudonymisation;
• staff training and confidentiality obligations.

10. Your rights

You have the right to:

• know whether we process your data and get a copy of it;
• have inaccurate data corrected and incomplete data completed;
• ask for your data to be erased or its processing restricted;
• object to processing based on legitimate interest, including for marketing;
• receive your data in a machine-readable format and pass it to another controller;
• withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.

Send your request to dpo@ugla.ua. We may ask you to confirm that the request is yours, and we will answer within one month; if a request is complex, this may be extended, and we will tell you. Requests are handled free of charge.

11. Cookies

On a first visit the website asks which cookies you allow. Until you choose, only the necessary ones work, and analytics and advertising do not load.

• Necessary, always: ugla_region remembers the chosen pricing region (a year), ugla_consent remembers your cookie choice (six months). Campaign tags and ad click identifiers are kept in the browser's memory until the end of the visit, to pass them on with a request.
• Analytics, with your consent: Google Analytics 4 (the _ga and _ga_… cookies, up to two years) counts visits and actions on the website.
• Advertising, with your consent: Google Tag Manager, Google Ads (_gcl_au, 90 days) and the Meta Pixel (_fbp, 90 days) show UGLA's ads to people who have visited and count the requests that ads bring.
• Calendly and YouTube set their own cookies only after your action: moving on to booking or pressing play on a video.

You can change your choice or withdraw consent at any time under "Cookie settings" at the bottom of every page. Withdrawing does not affect processing that took place before it.

12. Personal data breaches

If an incident affects personal data, we follow our breach management procedure: we assess the risk, contain the consequences, notify the supervisory authority within 72 hours where the GDPR requires it, and inform the people concerned without undue delay if the risk to them is high. Clients whose data we process are informed under the terms of the agreement.

13. Children

The website and UGLA are meant for companies. We do not knowingly collect children's data; if such data has reached us, write to dpo@ugla.ua and we will delete it.

14. Complaints

If you believe we have infringed your rights, write to the data protection officer at dpo@ugla.ua: we will look into it and reply. You may also complain to a supervisory authority: in Ukraine, the Ukrainian Parliament Commissioner for Human Rights; in the Netherlands, the Autoriteit Persoonsgegevens; in another EU country, the data protection authority of your country.

15. Changes to this Policy

The Policy is reviewed together with our management system at least once a year and whenever the processing changes materially. The current edition is on this page, dated at the top. The Policy is published in Ukrainian and English; where they differ, the Ukrainian text prevails.