BeeQueen is a work application. It is used by staff of marketing agencies that run their operations on the MACS platform, to see the field marketing actions their company has planned and to talk to the crews carrying them out. This policy explains what personal data the app processes, why, who it is shared with and what rights you have.
1. Who we are
BeeQueen is published by Columbus Holdco ("we", "us"), as part of The Hive network of applications.
You can reach us about anything in this policy at support@beequeen.app.
2. Who is responsible for your data
BeeQueen has no public sign-up. Your account is created by the agency that employs or engages you, and the actions, projects, crews and clients you see in the app are that agency's operational data.
Your employing agency is the data controller for the account and operational data you see in BeeQueen. It decides who gets an account, what each person may see, and how long the records are kept.
Columbus Holdco acts as a processor on that agency's behalf, operating the MACS platform and the BeeQueen app under a written agreement with it.
We act as a controller in our own right for the limited data we need in order to run and support the app itself — for example the correspondence you send to our support address, and the technical logs described in section 3.
If you want to exercise a right over your account or operational data, the fastest route is your agency's administrator. You can also write to us and we will pass the request on.
3. What data we process
The app processes the following categories of personal data.
| Data | Where it comes from | What it is used for |
|---|---|---|
| Name | Your account with the agency, delivered to the app in your sign-in token | Shown on your profile and beside the messages you send, so colleagues know who they are talking to |
| E-mail address | Your account with the agency, delivered in your sign-in token | Identifies your account and is shown on your profile |
| Company membership and role | Your account with the agency | Determines which companies' actions and which colleagues you can see |
| Messages you write | You, when you send a message in the app | Delivered to the other participants in the conversation and kept as part of the record of an action |
| Device notification token | Apple or Google, when you allow notifications | Lets a message notification reach this particular device |
| Sign-in session tokens | Our identity provider, when you sign in | Keeps you signed in. Held in the device's secure storage (Keychain on iOS, Keystore on Android) and never sent anywhere but our own servers |
| App preferences | You, for example the company you selected | Stored on the device so the app opens the way you left it |
| Technical logs | Our servers, when the app talks to them | Security, abuse prevention and diagnosing faults. Contain the account making the request, the time and the request made |
The app also shows you data about other people — the crew booked on an action, the action leader, the contact at the venue. That data belongs to your agency, and you are expected to treat it as confidential work information.
4. What we do not collect
We think it is as important to be clear about what the app does not do.
- No location data. BeeQueen has no map and never asks for the location permission. The addresses in the app are the ones planned for an action, not where anybody is
- No tracking. We do not track you across apps or websites, and we do not use an advertising identifier
- No advertising. The app contains no ads and no ad network
- No third-party analytics or crash-reporting SDK is embedded in the app
- No access to your photos, camera, contacts, calendar, microphone or health data
- No selling of personal data, ever, to anyone
5. Why we process it, and on what basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Giving you access to your agency's actions and letting you work on them | The legitimate interests of your agency in running its operations, and the performance of its contract with you (Art. 6(1)(f) and 6(1)(b)) |
| Delivering the messages you send to the colleagues you send them to | The same legitimate interests, and your own action in sending them |
| Sending a notification when a message arrives | Your consent, given through the device's notification permission, which you can withdraw at any time (Art. 6(1)(a)) |
| Keeping the service secure, preventing abuse and diagnosing faults | Our legitimate interests in operating a secure service (Art. 6(1)(f)) |
| Answering a support request you send us | Our legitimate interests in supporting our users (Art. 6(1)(f)) |
| Meeting legal or regulatory obligations | Compliance with a legal obligation (Art. 6(1)(c)) |
We do not use your data for automated decision-making that produces legal or similarly significant effects on you, and we do not profile you.
6. Push notifications
If you allow notifications, your device gives the app a token from Apple's or Google's notification service. We register that token against your account so a message notification can reach that device, and nothing else.
- A notification tells you a message arrived and shows a preview, so the content of the message passes through Apple's or Google's notification service as transport
- The token is removed when you sign out, so nothing reaches a device nobody is signed in on
- You can withdraw the permission at any time in your device settings. The rest of the app keeps working
- We never send marketing notifications
7. Who we share data with
We do not sell personal data and we do not share it for anyone else's marketing. Data is shared only with:
- Your agency and your colleagues in it. Your name is visible to the people in the conversations and actions you are part of — that is the point of the app
- Apple (APNs) and Google (FCM), purely as transport for a notification to your device, and only if you allowed notifications
- Our hosting and infrastructure providers, who run the servers on which the platform operates, under contracts that bind them to process data only on our instructions
- Public authorities, where we are legally required to disclose data, and only to the extent required
Every processor we use is bound by a written data processing agreement.
8. International transfers
The platform's servers and databases are hosted in the European Union.
Sending a push notification necessarily involves Apple and Google, which may process the notification outside the European Economic Area. Where a transfer outside the EEA takes place, it is covered by an adequacy decision or by the European Commission's Standard Contractual Clauses.
9. How long we keep it
Retention of your account and operational data is set by your agency as the controller. As a guide:
| Data | Kept |
|---|---|
| Account data (name, e-mail, company membership) | For as long as your agency keeps your account open |
| Messages and the conversations they belong to | As part of the record of the action they relate to, for as long as your agency retains that record |
| Device notification token | Until you sign out, remove the app, or turn notifications off |
| Session tokens and preferences on your device | Until you sign out or remove the app, which deletes them |
| Technical logs | A limited period for security and diagnostics |
| Support correspondence | As long as needed to resolve the matter, and to evidence that we did |
10. How we protect it
- All traffic between the app and our servers is encrypted with HTTPS and secure WebSockets
- Sign-in is handled by our identity provider in a secure system browser window — the app never sees or stores your password
- Session tokens are held in the device's own secure storage, protected by the operating system
- Access to data is limited by your account's company membership and role: you see your companies' actions and colleagues, and no one else's
- Access to production systems by our staff is restricted, authenticated and logged
Keep your device locked with a passcode or biometric, and sign out from Profile › Sign out on a device you are handing to someone else.
11. Your rights
Under the GDPR you have the right to:
- Access the personal data held about you, and receive a copy
- Rectify data that is inaccurate or incomplete
- Erase your data, where there is no overriding reason to keep it
- Restrict or object to processing carried out on the basis of legitimate interests
- Data portability for data you provided, in a structured, machine-readable format
- Withdraw consent where processing rests on it — notifications, in practice
- Lodge a complaint with a supervisory authority. In Belgium that is the Data Protection Authority, gegevensbeschermingsautoriteit.be
How to exercise them. Because your employing agency is the controller for your account, start with its administrator — they can act immediately. You can also write to support@beequeen.app and we will forward your request to the right agency and support it. We will respond within one month, as the GDPR requires.
Note that some data cannot simply be erased on request: a message you sent to colleagues is part of a shared conversation and of the operational record of an action, in the same way as a work e-mail.
12. Children
BeeQueen is a professional tool. It is not directed at children, it has no public sign-up, and accounts are issued only to adults working for or with an agency. We do not knowingly process the personal data of children.
13. Changes to this policy
We may update this policy as the app changes. The effective date at the top always tells you which version you are reading. If a change materially affects how your personal data is handled, we will make it known through the app or through your agency before it takes effect.
14. Contact us
For a question about your own account or the data your agency holds, contact your agency's administrator first — they can resolve most requests immediately.