Personal Data Processing Policy

1. General

This Personal Data Processing Policy (the Policy) is the document required by part 2 of article 18.1 of Federal Law No. 152-FZ dated July 27, 2006 On Personal Data (the Law). It defines how the personal data of users of the taktom.ru website (the Site) and the TAktom cloud service (the Service) is processed, both with and without the use of automation, and states the data protection requirements the Operator implements.

This English text is a translation provided for convenience only. In case of any discrepancy between the English and the Russian versions of the Policy, the Russian version shall prevail.

The Policy is published on the Site with unrestricted public access.

2. Operator details

The personal data operator is Abdulov V, taxpayer ID (INN) 631610850704 (the Operator). The duties of the person responsible for organizing personal data processing (article 22.1 of the Law) are performed by the Operator personally. The Operator has no employees and does not process employee personal data.

3. Whose data and what data is processed

The Operator processes the data of users of the Service, of representatives of customers (organizations and sole traders), of persons who contact the Operator via feedback forms and e-mail, and of visitors of the Site with respect to technical data:

• the e-mail address provided when registering an account and when contacting support;
• a name, nickname or other designation, if specified in the profile;
• company name, taxpayer identification number and contact phone number — if provided when subscribing or paying against an invoice;
• payment metadata received from the payment service: amount, date, identifier and status of the payment, the type and masked details of the payment method;
• technical data: IP address, browser and device information, date and time of access, cookies;
• the content of requests submitted to support.

Bank card details and other payment credentials are neither transferred to nor processed by the Operator: the payment is completed on the side of the payment service.

4. Data placed in the Service by users

A user may place in the Service the personal data of their employees, clients and other individuals. With respect to such data the user acts as the operator: they determine the purposes, the scope and the legal grounds of the processing, the categories of data subjects, and ensure that the necessary consents are in place.

The Operator processes such data solely on behalf of the user (part 3 of article 6 of the Law) to the extent necessary to provide the functionality of the Service, does not determine the purposes of the processing and does not use the data for its own purposes, including advertising and profiling. The terms of the instruction are set out in the User Agreement and Public Offer. The fact that such data is stored on the infrastructure of the Operator does not by itself mean that the Operator determines the purposes of its processing.

5. Purposes and legal grounds of processing

Purposes of processing: registration, identification and authentication of the user and provision of access to the Service; performance of the agreement with the user or customer; settlements for the Service, acceptance of payments and issuance of documents confirming payment; technical support and communication regarding the Service; notifications about changes to the Service, plans and legal documents; maintaining the availability and security of the Service; compliance with obligations imposed by law. Processing incompatible with these purposes is not permitted.

Legal grounds: the agreement to which the data subject is a party — the User Agreement and Public Offer (clause 5 of part 1 of article 6 of the Law); the consent of the data subject confirmed at registration (clause 1 of part 1 of article 6); compliance with obligations imposed on the Operator by law, including tax legislation and Federal Law No. 422-FZ dated November 27, 2018 (clause 2 of part 1 of article 6); the legitimate interests of the Operator in securing the Service, subject to the rights of the data subject (clause 7 of part 1 of article 6).

6. Data the Operator does not process

The Operator does not process special categories of personal data (article 10 of the Law) or biometric personal data (article 11 of the Law), does not disseminate personal data in a way that would require the separate consent under article 10.1 of the Law, and does not use personal data to promote third-party goods or services. The Service is not intended for persons under 18.

7. Actions with data, methods and location of processing

The Operator performs collection, recording, systematization, accumulation, storage, updating, retrieval, use, transfer (provision, access), depersonalization, blocking, deletion and destruction of personal data by mixed means. Decisions producing legal effects concerning the data subject are not taken solely on the basis of automated processing (article 16 of the Law).

The databases in which the personal data of citizens of the Russian Federation is processed are located on servers within the territory of the Russian Federation (part 5 of article 18 of the Law). No cross-border transfer is carried out; should this change, the notification required by article 12 of the Law will be submitted before any such transfer begins.

8. Transfer to third parties

To pay, the user is redirected to the page of a payment service connected by the Operator. The Operator passes to that service the amount, the payment description and the internal identifiers of the invoice and receives the result of the payment and payment metadata in return; the details of the payment method are provided by the user to the payment service directly, and with respect to the data it collects that service acts as an independent operator.

The infrastructure of the Service is maintained by a Russian hosting provider that processes data on behalf of the Operator subject to confidentiality and security obligations.

Personal data is not sold and is not transferred to any other third parties, except in cases expressly required by law, including reasoned requests of authorized state bodies.

9. Retention periods and destruction

Personal data is processed for the lifetime of the account and of the agreement. After the account is deleted, the purposes of processing are achieved or consent is withdrawn, the data is destroyed within 30 days, except for records whose retention period is established by law, in particular settlement documents. The destruction is recorded in the manner prescribed by the requirements of Roskomnadzor.

10. Security measures and incident handling

Pursuant to articles 18.1 and 19 of the Law, the Operator:

• applies this Policy and internal documents on personal data processing, performing the duties of the responsible person personally;
• identifies current security threats and applies the measures required for the necessary level of protection;
• restricts and separates access to personal data, keeps records of authorized persons and logs actions in information systems;
• encrypts communication channels (HTTPS/TLS), performs backups and verifies restore procedures;
• detects unauthorized access, remediates its consequences and controls compliance of the processing with the Law.

If an unlawful or accidental transfer of personal data resulting in a violation of the rights of data subjects is detected, the Operator notifies Roskomnadzor within 24 hours of the incident, its presumed cause and the measures taken, and within 72 hours of the results of the internal investigation (part 3.1 of article 21 of the Law), and also notifies the affected users where this is necessary to protect their rights.

11. Consent, its withdrawal and the rights of the data subject

Consent to the processing of personal data is given when registering an account by ticking the corresponding box in the registration form; registration does not proceed without confirmed consent, and the fact of consent is recorded by the Operator. Consent may be withdrawn at any time by contacting the Operator: processing ceases and the data is destroyed within 30 days, unless it must be retained on other grounds provided by law. Withdrawal of consent makes further provision of the Service impossible.

The data subject has the right to obtain information about the processing of their personal data (part 7 of article 14 of the Law), to demand its correction, blocking or destruction, to withdraw consent, to object to the processing and to appeal against the actions of the Operator to Roskomnadzor or in court. Requests are sent using the contact details of the Operator and must contain information allowing the subject to be identified; a response is provided within 30 days, and this period may be extended by no more than 5 business days with notice to the applicant.

12. Cookies

The Site and the Service use cookies necessary for their operation: keeping the user session, language and interface settings, and ensuring security. No third-party web analytics or advertising trackers are used. The user may disable cookies in the browser settings; some features of the Service may then become unavailable.

13. Changes to the Policy

The Operator may amend this Policy. A new version takes effect upon its publication on the Site, unless the version itself states otherwise.

User Agreement and Public Offer

14. Operator details and contacts

Requests regarding personal data processing, including access requests, withdrawal of consent and demands to correct or destroy data, are to be sent using the contact details below.

Abdulov V
Self-employed (professional income tax payer, Russia)
INN 631610850704
support@taktom.ru · +7 939 975-00-85