Privacy Policy

Holistic IT Solutions Ltd. ("the Company", "we", "us") operates the 12Pay (OneTwoPay) service and the onetwopay.co.il website. This policy explains what information we collect, why, who we share it with, and your rights. It is written in line with the Israeli Protection of Privacy Law, 5741-1981 (including Amendment 13), and the regulations made under it.

1. Who is responsible for your data

For information related to your account in the Service, the Company is the controller. For information about your customers that passes through the Service, you are the controller, and we hold and process it on your behalf and on your instructions.

2. What we collect

• Account details: name, email address, phone number and business details, such as the business name and registration or VAT number.
• Sign-in with another account: if you sign in with Zoho, Google, Microsoft or Facebook, we receive only your name, email address and account ID from them.
• Data from the systems you connect: CRM records such as contacts, accounts, deals and invoices, and payment and document status from your payment and invoicing providers. We collect only what is needed to provide the Service.
• Payment details: full card numbers never reach us and are never stored by us. They are entered with the payment processor, which is PCI DSS compliant. We may store a token issued by the processor, the last 4 digits, the expiry date, and the cardholder ID details when the processor requires them.
• Messages: the content of messages sent to your customers through the Service (SMS, WhatsApp, email), recipient numbers and delivery status.
• Technical data: IP address, browser and device type, and activity logs. We use them for security, troubleshooting and improving the Service.

3. How we use it

• To provide and operate the Service: connecting systems, issuing documents, collecting payments and sending messages on your instructions.
• To verify identity and secure your account, for example with a one-time SMS code.
• To bill your subscription and manage your account.
• To provide support and send service messages.
• To send marketing updates, only if you have agreed to receive them. You can withdraw your consent at any time.
• To comply with the law and protect the Company's rights.

We do not sell personal information, and we do not use your customers' data for any purpose of our own.

4. Who we share it with

• The systems you connect: Zoho, payment processors and invoicing software receive the data needed for each action you take.
• Infrastructure and service providers: cloud hosting (Amazon Web Services), security and content delivery (Cloudflare), email delivery and SMS delivery. They receive only what they need and are bound by confidentiality.
• Authorities: when the law requires it or under a court order.
• Business transfers: in a merger or sale of the business, the data passes to whoever continues the Service, subject to this policy.

5. Transfers outside Israel

Some of our providers store or process data outside Israel, for example on cloud servers in Europe or the United States. Such transfers follow the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001.

6. How long we keep it

We keep data while your account is active. After it is closed, we keep it only as long as needed to meet legal obligations, such as tax law, or to resolve disputes. After your account is closed, you can request an export of your data for 30 days. After that, the data is deleted or anonymized.

7. Security

We take reasonable measures to protect your data, in line with the Protection of Privacy (Data Security) Regulations, 5777-2017. These include encryption in transit, restricted access, two-step verification and backups. No system is completely immune. If a serious security incident occurs, we will notify you and the authorities as the law requires.

8. Your rights

• To review the information we hold about you (section 13 of the Protection of Privacy Law).
• To ask us to correct information that is wrong or out of date, or to delete it (section 14).
• To be removed from mailing lists (section 17F of the Protection of Privacy Law and section 30A of the Communications Law).

Send any such request to [email protected]. We will respond within 30 days. If you are a customer of one of our customers, please contact that business first, since it holds your information. We will help the business handle your request.

9. Cookies and third-party services on the website

The marketing website does not set cookies of its own and does not use tracking or advertising tools. To display the site, your browser loads fonts from Google Fonts and code libraries from cdnjs, and the site is served through Cloudflare. These services therefore receive your IP address and browser details. The application itself uses cookies that are needed for signing in and for security.

10. Children

The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect information about minors.

11. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email or in the Service before they take effect. The current version is always published on this page.

12. Contact

Holistic IT Solutions Ltd.
Email: [email protected]