English
Sign in

Legal

Privacy policy

Last updated:

This policy explains what personal data we process when you use Fumi — the fumi.rs website and the app at app.fumi.rs — why we process it, and what rights you have.

It is written to comply with the Serbian Law on Personal Data Protection and, where it applies, the EU General Data Protection Regulation (GDPR).

1. Who we are

Fumi is provided by Binary Code LLC, Dr Jovana Erdeljanovića 10, Pančevo, Serbia (in Serbian: Binary Code DOO; company registration number 22184997, tax ID 115626224) (“we”, “us”). For any privacy question, and for requests under this policy, write to contact@binnry.com.

2. Your organization and us

Fumi is used by organizations. For the documents and data an organization and its users keep in Fumi, the organization is the controller and we are its processor: we process that data only on its instructions and only to provide the service. That processing is governed by our Data processing agreement.

If you have a question about content your organization has put in Fumi, ask its administrator first. For account data, technical logs and correspondence with us, we are the controller.

3. What we process

  • Account data: name, e-mail address, language, role in the organization and group memberships. Passwords are stored only as a hash.
  • Google or Microsoft sign-in, if you use it: your account identifier with that service and your e-mail address. We never receive that account’s password.
  • Content: the files and folders you upload, their names, paths, sizes, types and tags, and who uploaded or changed what, and when.
  • Sign-in data: the tokens that keep you signed in, and the time of your last sign-in.
  • Technical logs: IP address, time, requested address and server response, recorded by our servers.
  • Correspondence: whatever you send us by e-mail.

We do not collect data for advertising and we do not build user profiles.

4. Why we process it

  • To provide the service — accounts and sign-in, storing and sharing documents, invitations and notifications. The basis is the contract with your organization.
  • For security — virus scanning, preventing abuse and fixing errors. The basis is our legitimate interest in keeping the service secure.
  • To answer your messages. The basis is legitimate interest, or steps taken before entering into a contract.
  • When the law requires it.

5. Who else sees the data

  • Your organization’s owner and administrators: they can see and change the content of the shared space and of their users’ personal folders, and manage accounts. Other members see only what access policies allow them to.
  • Our service providers: UpCloud (servers and file storage, in a data centre in Frankfurt, Germany) and Fastmail (sending e-mail, such as invitations and password resets). They process data only on our instructions.
  • Google and Microsoft, only if you choose to sign in with them. Their privacy policies then apply as well.
  • Public authorities, when we are legally required to disclose data.

Our staff do not access the content of your files, except when needed to fix a problem you report to us or when the law requires it. We do not sell data.

6. Where the data is kept

Files and the database are stored in the European Union (Frankfurt, Germany), which is considered to provide an adequate level of protection. Where a service provider processes data outside the EU — for example when sending e-mail — we rely on standard contractual clauses or other safeguards required by law.

7. How long we keep it

  • Account data — for as long as the account exists. When an account is deleted, we delete its data, except what we must keep by law.
  • Content — until the organization deletes it, or for as long as it uses the service. When it stops, the organization has a transition period to export its data, after which we delete it.
  • Sign-in tokens — until they expire or you sign out.
  • Technical logs — for a limited time, as long as needed for security and fixing errors.

8. Cookies and browser storage

The fumi.rs website uses no cookies, analytics or tracking tools, and serves its fonts and images from its own server.

The app uses one essential cookie, fumi_rt, which keeps you signed in; scripts can’t read it and it is used only for sign-in. The app also uses browser storage to remember your language and how you like files displayed. No consent is needed for this, because it is necessary for the service to work.

9. Security

Connections are always encrypted (HTTPS). Passwords are stored as hashes, files are scanned for viruses (unless the organization turns this off), each organization has separate storage, and download links are short-lived.

No measure is perfect. If a data breach affects you, we will notify your organization and, where the law requires it, the Commissioner.

10. Your rights

You have the right to request access to your data, its correction or deletion, restriction of processing and data portability, and to object to processing based on legitimate interest.

For content your organization has put in Fumi, send your request to its administrator — we will help them fulfil it. Send any other request to contact@binnry.com; we will reply within 30 days.

You also have the right to lodge a complaint with the Serbian Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs) and, if you are in the EU, with your local supervisory authority.

11. Children

Fumi is meant for organizations and is not intended for anyone under 15.

12. Changes to this policy

We may update this policy from time to time. The date of the latest change is shown at the top of the page, and we will tell organization administrators about significant changes before they take effect. The terms for using the service are in our Terms of service.