Personal data processing policy
This is a translation for convenience. The binding version of this document is the Russian one, published at the same address without the language prefix. If the English and Russian texts differ in any way, the Russian text prevails.
This Personal Data Processing Policy (the «Policy») sets out how personal data is processed and protected in the «Kontent zavod DobroKod» service (the site dobro-code.ru, the personal account automation.dobro-code.ru) and has been drawn up in accordance with Federal Law No. 152-FZ of 27 July 2006 «On Personal Data».
1. The personal data operator
The personal data operator is the sole proprietor Igor Naumovich Bolshim (OGRNIP 325508100387287, INN 500300383171) (the «Operator»).
Contact for enquiries about the processing of personal data: info@dobro-code.ru.
2. Legal grounds for processing
Personal data is processed on the basis of:
- Federal Law No. 152-FZ «On Personal Data»;
- the data subject's consent to the processing of their personal data;
- the contract (the Terms of Use and the Public Offer) to which the subject is a party;
- other regulations governing relations in the field of personal data.
3. Categories of subjects and the data processed
3.1. The Operator processes the data of the following subjects: visitors to the site and registered users of the Service.
3.2. The personal data processed:
- email address;
- name (where given by the user);
- password as an irreversible hash (never stored in the clear);
- the identifier and email address of the Yandex account when signing in through Yandex;
- IP address, device and browser information (User-Agent), action (audit) log data;
- cookies and web analytics data (see the Cookie Policy);
- payment identifiers from the payment operator (full card banking details are not stored by the Operator);
- access tokens for the external publishing platforms the User connects (stored encrypted);
- data the User voluntarily enters into projects and project briefs, and the material they upload (user content).
3.3. The Operator does not process special categories of personal data, except where the User uploads such data themselves as part of user content, having taken responsibility for having legal grounds to do so.
4. Purposes of processing
Personal data is processed in order to:
- register and identify the User and grant access to the Service;
- perform the contract and provide the Service;
- ensure security, prevent fraud and protect against unauthorised access;
- process payments and keep accounts;
- send service (transactional) notifications (email confirmation, access recovery);
- improve the quality of the Service and analyse its use in aggregate form;
- comply with the requirements of the legislation of the Russian Federation.
5. How processing is carried out
5.1. Processing is carried out both with and without the use of automation, and includes the collection, recording, systematisation, accumulation, storage, clarification, use, transfer (provision of, access to), blocking, deletion and destruction of personal data.
5.2. The Operator does not take decisions producing legal consequences for the subject solely on the basis of automated processing of their personal data.
6. Storage and localisation
6.1. Databases containing the personal data of citizens of the Russian Federation are hosted on servers located within the territory of the Russian Federation, in accordance with part 5 of Article 18 of 152-FZ.
6.2. Personal data is kept no longer than the purposes of processing require, or until consent is withdrawn, unless another period is established by law. Once the purposes are achieved, or if consent is withdrawn, the data is deleted or depersonalised, unless there are other lawful grounds for keeping it.
7. Transfer to third parties
7.1. The Operator engages the following categories of third parties (processors), to the extent necessary to provide the services:
- the payment operator YooKassa (YuMoney LLC) — to accept payments;
- suppliers of cloud infrastructure and data storage;
- third-party providers of content generation technology (AI providers);
- web analytics services and services protecting against automated requests;
- the publishing platforms the User connects to their projects themselves.
7.2. Some of those services are foreign. Data is transferred to them under the Consent to the cross-border transfer of personal data, in accordance with Article 12 of 152-FZ.
7.3. The Operator does not sell personal data and does not transfer it to third parties for purposes incompatible with those set out in this Policy.
8. Rights of the data subject
In accordance with Articles 14–22 of 152-FZ, the subject has the right to:
- receive information concerning the processing of their personal data;
- require the clarification, blocking or destruction of data where it is incomplete, out of date, inaccurate, obtained unlawfully or not necessary for the purposes of processing;
- withdraw consent to the processing of personal data;
- object to processing and appeal against the Operator's actions to the authority responsible for protecting the rights of data subjects (Roskomnadzor) or to a court.
To exercise these rights, the subject writes to info@dobro-code.ru. A response is provided within the periods established by 152-FZ. Withdrawal of consent is sent in the same way; after withdrawal the Operator ceases processing, save where processing is permitted without the subject's consent.
9. Protection measures
The Operator takes the necessary legal, organisational and technical measures to protect personal data against unlawful access, destruction, alteration, blocking, copying and distribution, including access rights separation, encryption of sensitive data, storing passwords as hashes and keeping action logs.
10. Registration in the register of operators
The Operator has sent Roskomnadzor a notification of personal data processing in the manner provided for by Article 22 of 152-FZ. Information about the Operator is entered into the register of operators processing personal data.
11. Changes to the Policy
The Operator may amend the Policy. The current version is published at https://dobro-code.ru/legal/privacy together with the date of the version. Continued use of the Service means agreement with the Policy in force.