Livespace Card Scanner (“Card Scanner” or the “App”) is a mobile application for Android and iOS devices that lets you photograph business cards, automatically read the information on them using artificial intelligence, and add the contacts to Livespace CRM. The App works only in connection with an active Livespace CRM account; it does not allow you to create a separate account.
This policy describes the processing of personal data in connection with the use of Card Scanner. For matters concerning other Livespace services, the general Livespace privacy policy also applies.
Business card data and CRM contacts. The controller of the personal data of a person whose business card is scanned is the entity using Livespace CRM (e.g. the company employing the App user). That entity determines the purposes and legal basis for obtaining and using the contact data. Livespace S.A. processes this data on behalf of that entity as a processor under a data processing agreement. This also applies to user data processed on the customer’s instructions in order to link a scan to its CRM instance and save the contact.
Data processed by Livespace for its own purposes. To the extent that Livespace itself determines the purposes and means of processing data related to infrastructure security, diagnostics and maintenance of the service, the controller of that data is Livespace S.A., ul. Tadeusza Rejtana 17/38, 02-516 Warsaw, Poland, KRS 0001146367, NIP (Tax ID) 5213568709. Data protection contact: ochronadanych@livespace.io. Livespace has not appointed a data protection officer; the address above is a general contact channel for privacy matters.
When a business card is scanned, the App may process its photo, a cropped image and the following information read from the card: first name, last name, job title, company name, email address, phone number, postal address and website address. If a photo includes more than one business card, it may contain data of several people.
In connection with the use of the App, the Livespace CRM user data necessary for logging in and handling scans is also processed, in particular the instance name, email address, the password used for authentication and session renewal, user ID, session ID, security token and the selected interface language.
Technical information about the use of the service is also generated, including the IP address, the date and time of the request, user and instance identifiers, URLs, request identifiers, response codes and device or application data. Some short-lived diagnostic records may contain a fragment of the image submitted for analysis.
The App requires access to the camera in order to take a photo. It does not use the device’s location, address book, photo gallery or advertising identifier, and it contains no analytics or advertising tools of its own. On older versions of Android, additional device storage permissions may appear as a result of the libraries used.
The user photographs a business card in Card Scanner. The photo is processed locally in the App, and the image to be recognised is then sent via the Livespace CRM instance to an image processing service operated by Livespace. To read the text, this service uses models provided by Amazon Web Services (AWS) through the Amazon Bedrock service.
Once the data has been read, a contact is created in the customer’s CRM. By default, the App allows quick, automatic saving of the contact. The user can turn this option off and review and correct the data before saving. For certain validation errors, the App requires the user to check the information that was read.
The cropped photo of the business card is attached to a note linked to the contact in the CRM. It is visible in the CRM interface to users who have access to that contact. If a single photo contains several business cards, the same photo may be attached to several contacts and contain data of other people. We therefore recommend taking a separate photo of each business card.
The data is recognised by AI tools, which may misread the content. The user should verify its accuracy before further use. Reading data from a business card and saving the contact do not constitute automated decision-making concerning the person on the business card which produces legal effects concerning them or similarly significantly affects them within the meaning of Article 22 GDPR.
Processing on behalf of Livespace customers. Business card data and the related user information are processed by Livespace in order to provide the Card Scanner features, read and save contacts and ensure the operation of the CRM, on the instructions of the relevant controller. It is the Livespace customer, not the App itself, that is responsible for establishing the appropriate legal basis for processing the data of people on business cards and for fulfilling the information obligations under Article 13 or 14 GDPR. The mere fact that a business card has been handed over does not constitute consent to unrestricted use of the data, in particular for marketing.
Processing by Livespace as a controller. Livespace uses its own logs and necessary diagnostic data to ensure the security of the service and infrastructure, detect abuse, diagnose errors and maintain the continuity of the system. The legal basis is Article 6(1)(f) GDPR — Livespace’s legitimate interest in protecting its systems and data and in ensuring reliable provision of its services. Where applicable, data may also be processed to establish, exercise or defend legal claims (Article 6(1)(f) GDPR) or to comply with a legal obligation (Article 6(1)(c) GDPR).
Providing the data necessary for logging in and performing a scan is required in order to use the App. Technical data is generated automatically during communication with the service. Card Scanner does not use business card data for Livespace’s own advertising or marketing activities.
In connection with providing the Card Scanner features, data may be processed by infrastructure and technical service providers acting on behalf of Livespace, in particular:
Authorised Livespace employees and contractors may also have access to the data to the extent necessary to perform their duties. Data may be disclosed to competent authorities where required by applicable law. A full list of sub-processors for the Livespace service is set out in an annex to the applicable data processing agreement.
In accordance with the arrangements for Card Scanner, the infrastructure that processes business card images and the Amazon Bedrock model calls are located in the European Union; the recognition service may use more than one EU region.
The mere use of services provided by an entity belonging to an international group of companies does not in itself mean that data is transferred outside the European Economic Area. If the provision of services involves transferring data to a third country, the conditions set out in Chapter V GDPR apply. Information about a specific transfer and the safeguards applied can be obtained at ochronadanych@livespace.io.
Retention periods depend on the type of data and where it is stored:
Deleting scans stored locally in the App does not delete data previously sent to Livespace CRM or records in the image recognition service. Retention periods for data in the CRM also depend on the actions and obligations of the controller — the company using Livespace.
Communication between the App and the Livespace CRM instance uses encrypted TLS connections. Data held in production databases and object storage is protected by encryption at rest. Livespace also uses tools for monitoring and logging security events and for access management. Specific safeguards are updated as the infrastructure evolves.
The user’s password stored on the device for session renewal is saved in secure system storage (Keychain on iOS or Keystore on Android). Logging out removes the stored session data and password from the App.
App data may be included in the device’s system backup, in services linked to the user’s Google or Apple account (as applicable), depending on the device and operating system settings. Such backups are managed in accordance with the rules of the relevant system or backup service provider.
If your business card has been scanned, requests concerning access, rectification, erasure, restriction of processing and your other rights under the GDPR should be directed primarily to the company whose representative scanned the business card and which is the controller of that data. That company assesses the grounds for processing and whether the request is justified. Livespace, as the processor, assists it within the limits of its obligations under the GDPR and the data processing agreement.
As regards data for which Livespace is the controller, you may — subject to the conditions set out in the GDPR — request access to your data, rectification, erasure or restriction of processing, and object to processing based on Article 6(1)(f) GDPR. The right to data portability applies in the cases specified in Article 20 GDPR. Not every request must result in a historical log entry being changed or deleted if the record accurately reflects an event and its continued retention has an appropriate legal basis.
Requests concerning the processing of data by Livespace can be sent to ochronadanych@livespace.io or by post to the company’s registered office address. For requests concerning data in a customer’s CRM, please indicate, if possible, the name of the relevant company or instance and the approximate date of the scan; this will help identify the appropriate controller. Submitting a request to Livespace does not replace submitting it to the relevant controller.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) (www.uodo.gov.pl) if you believe that the processing of your data infringes the GDPR.
The entity using Card Scanner is solely responsible for informing the people whose data it collects in the CRM about the controller, purposes, legal bases and other information required by the GDPR. Depending on how the data was obtained, Article 13 GDPR (data obtained directly from the data subject) or Article 14 GDPR (data obtained from another source) may apply. This policy does not replace the information obligation of the Livespace customer.
This policy may be updated in connection with changes to Card Scanner features, data processing rules or the law. The current version will be made available at the link provided in the App and on its page in the relevant app store. Questions about this policy can be sent to ochronadanych@livespace.io.
Get in touch — we'll explain how Card Scanner processes and protects personal data.
