Privacy Policy

This is a translation of the Russian version at https://nana800.io/privacy/; if they differ, the Russian version prevails.

Policy on the processing and protection of personal data when using the website and software

of Individual Entrepreneur Stepan Romanovich Turchenko

OGRNIP: 324390000049050; INN: 391101214447

Web address of the official publication

https://nana800.io/privacy/

Official email

tech@nana800.io

User's consent to the processing of personal data

Appendix No. 2

Sovetsk, Kaliningrad Region, 2024

Terms

For the uniform and unambiguous interpretation of the terms of this policy on the processing and protection of personal data, the following meanings and definitions of the terms and concepts used in the policy on the processing and protection of personal data are established:

Policy

this document, which sets out the policy of Individual Entrepreneur Stepan Romanovich Turchenko on the processing and protection of personal data when using the Products, published for review by an unlimited number of persons at the web address: https://nana800.io/privacy/. In the context of the Website, documents and public information, this Policy may also be called the "Privacy Policy"

Personal data

any information relating to a directly or indirectly identified or identifiable natural person (the personal data subject)

Biometric personal data

information that describes the individual physiological features of a personal data subject and on the basis of which the person can be identified, including photographs, fingerprints, the image of the retina, and features of the body structure

Data

any data, details and information that is not personal data and does not identify a natural person, but was provided and (or) received by that natural person (the personal data subject)

Operator

Individual Entrepreneur Stepan Romanovich Turchenko (OGRNIP 324390000049050; INN 391101214447), who organizes and (or) carries out the collection and (or) processing of Personal data, and determines the purposes of processing personal data, the composition of the personal data to be processed, and the actions (operations) performed with personal data

Partner

a third party with whom the Operator is in a civil-law relationship and who collects and (or) processes, and (or) stores, and (or) transfers Personal data from Users within the limits set by such civil-law relationship and independently ensures the protection of the personal data received

Processing of personal data

any action (operation) or set of actions (operations) performed with Personal data, with or without the use of automation tools, including collection, recording, systematization, accumulation, storage, clarification (updating, changing), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion and destruction of personal data

Automated processing of personal data

processing of personal data by means of computer equipment

Use of personal data

actions (operations) with personal data performed by the Operator for the purpose of making decisions or taking actions that give rise to legal consequences for the personal data subject or other persons, or otherwise affect the rights and freedoms of the personal data subject or other persons

Distribution of personal data

actions aimed at transferring personal data to a certain group of persons (transfer of personal data) or at making an unlimited number of persons familiar with personal data, including publication of personal data in the mass media, placement in information and telecommunication networks, or providing access to personal data in any other way

Blocking of personal data

temporary suspension of the collection, systematization, accumulation, use and distribution of personal data, including their transfer

Destruction of personal data

actions as a result of which it is impossible to restore the content of personal data in the personal data information system, or as a result of which the physical media of personal data are destroyed

Depersonalization of personal data

actions as a result of which it is impossible, without the use of additional information, to determine whether personal data belong to a specific natural person

Publicly available personal data

personal data to which access of an unlimited number of persons is granted with the consent of the subject, or which, in accordance with federal laws, are not subject to the confidentiality requirement

Personal data information system

a set of personal data contained in databases and the information technologies and technical means that ensure their processing, including the use of software

Personal data subject

a natural person who is directly or indirectly identified or identifiable by means of personal data

Confidentiality of information

a regime established and mandatory for a person who has gained access to certain information, the requirement not to pass such information to third parties without the consent of the owner of the Data and information

Localization

the use, when processing personal data, of databases located on the territory of the Russian Federation

Database

an objective form of presenting and organizing a set of data located on a server (computer), systematized in such a way that this data can be found and processed with the help of information technologies and computer equipment, including the use of software

Cross-border transfer of personal data

transfer of personal data to the territory of a foreign state to an authority of a foreign state, a foreign natural person or a foreign legal entity

Agreement

a civil-law agreement between the Operator and the personal data subject under which the parties assume rights and obligations (for example, a user agreement and a license agreement)

Device

a computer that is a mobile device or a personal computer, running an operating system and able to process and transmit information

Products

the Website and the Software developed (created) by the Operator

Website

a set of web pages and the data on them located on the Internet at the web address: https://nana800.io/ and other subdomain addresses that are managed and (or) controlled by the Operator

Software

computer programs that are SaaS (web) or desktop solutions developed by the Operator. In the context of this Policy, Software also means the computer program "Bekender", available at the web address: https://cloud.nana800.io/

User

a natural person who visits, uses or studies the Products

Identification

assigning an identifier to a User and an access object and (or) comparing the identifier presented by the User with the list of assigned identifiers in the Database

Authentication

verifying that the identifiers presented by a User belong to that User, confirming the authenticity of the identification data entered

Cookie files

text files sent by the server of the Website and stored on the User's Device that the User uses to access the Website

1. General provisions of the Policy

1.1.The purpose of this document is to declare and define the conditions, procedure, purposes and scope of the processing and protection by the Operator of personal data received through the visits and use of the Products by Users and Partners.

In accordance with this Policy, Individual Entrepreneur Stepan Romanovich Turchenko discloses the procedure for processing and protecting personal data, which is aimed at protecting the rights and interests of personal data subjects, including protecting personal data from unauthorized access, unlawful use or loss, ensuring the protection of human rights and freedoms when processing personal data, and protecting the rights to privacy, personal and family secrecy.

1.2.This Policy provides the following basic information about the processes of personal data processing:

• principles and conditions of personal data processing;
• purposes of personal data processing;
• grounds for personal data processing;
• procedure for personal data processing;
• conditions for transferring personal data to third parties;
• information on the organization of access to personal data;
• measures to comply with the legal rights of personal data subjects;
• measures to ensure the protection of storage and processing of personal data.

1.3.This Policy complies with the requirements that legislation places on the activities of the Operator, including, but not limited to, the requirements of the following regulations:

• Policy on the processing and protection of personal data of Individual Entrepreneur Stepan Romanovich Turchenko;
• Constitution of the Russian Federation;
• Civil Code of the Russian Federation;
• Federal Law of the Russian Federation of July 27, 2006 No. 152-FZ "On Personal Data";
• Convention of the Council of Europe for the Protection of Individuals with regard to Automatic Processing of Personal Data (Strasbourg, January 28, 1981);
• Federal Law of the Russian Federation of July 27, 2006 No. 149-FZ "On Information, Information Technologies and Information Protection";
• Federal Law of the Russian Federation of March 13, 2006 No. 38-FZ "On Advertising";
• Resolution of the Government of the Russian Federation of November 1, 2012 No. 1119 "On Approval of the Requirements for the Protection of Personal Data When Processed in Personal Data Information Systems";
• Order of the Federal Service for Technical and Export Control of the Russian Federation of February 18, 2013 No. 21 "On Approval of the Composition and Content of Organizational and Technical Measures to Ensure the Security of Personal Data When Processed in Personal Data Information Systems".

1.4.This Policy must be read and followed by all persons authorized by Individual Entrepreneur Stepan Romanovich Turchenko to process personal data in a personal data information system or to handle personal data in any other form.

1.5.The current version of the Policy is kept at the registration address of Individual Entrepreneur Stepan Romanovich Turchenko and is published on the Website on the Internet at the web address: https://nana800.io/privacy/ - in public access, and takes effect from the moment it is approved by order of Individual Entrepreneur Stepan Romanovich Turchenko.

If personal data is collected in other Products, the Operator publishes in them the text of the Policy or a link to the web address where the Policy is located on the Internet.

2. Principles of personal data processing

2.1.The Operator hereby declares that the main principle of personal data processing is to ensure the legitimate interests of the Operator without affecting the legitimate interests, rights and freedoms of the personal data subject.

2.2.When processing personal data, the Operator is guided by the following established principles:

(1) the existence of a legal basis for processing personal data;

(2) ensuring the lawfulness of the purposes and methods of processing personal data;

(3) processing of personal data for purposes determined in advance and declared in the consent of the personal data subject to provide personal data, or in the Agreement, in this Policy, or evident from the actions of the Parties;

(4) compliance of the scope and nature of the personal data processed, and of the methods of processing, with the purposes of processing personal data;

(5) absence of personal data that is excessive in relation to the purposes declared when the personal data was collected;

(6) ensuring the security of access to personal data by the personal data subject and the subject's authorized persons;

(7) ensuring the accuracy, sufficiency and relevance of personal data in relation to the purposes of storing personal data, in a form that allows the personal data subject to be identified;

(8) personal data is processed no longer than the relevant purpose of processing requires, unless the storage period of personal data is established by legislation or by an Agreement to which the personal data subject is a party and (or) a beneficiary;

(9) the personal data processed is subject to destruction or depersonalization when the purposes of processing are achieved or when there is no longer a need to achieve these purposes, unless otherwise provided by the legislation of the Russian Federation;

(10) transfer of personal data to Partners exclusively with the explicit consent of the personal data subject to such transfer and with the subject's expression of will;

(11) localization of databases containing personal data.

2.3.The principles specified in this section of the Policy apply to all activities of the Operator in relation to personal data, regardless of the category of the personal data subject and the method of obtaining and using personal data.

2.4.In connection with the provision of services on the territory of the Russian Federation, the collection, processing and storage of personal data is carried out by the Operator on the territory of the Russian Federation, based on the principle of localization of personal data of citizens of the Russian Federation.

3. Conditions of personal data processing

3.1.The Operator does not deliberately collect personal data belonging to special categories of personal data (concerning race, nationality, political views, religious or philosophical beliefs, health, intimate life) or biometric personal data.

However, such data may be provided by the User (placed in the Product) while services are provided to the User under Agreements.

Given that such data may be placed without the knowledge of the Operator, the Operator cannot request consent to such processing, because the Operator is not aware in advance of the potentially sensitive nature of the personal information that the User may provide.

3.2.The Operator does not collect personal data for the purpose of compiling a "profile" of the personal data subject or other persons to the extent that this could affect the rights and freedoms of personal data subjects and third parties.

3.3.The Operator hereby guarantees that organizations external to the Operator have no access to data that may be used by the Operator, except in cases expressly provided for by the current legislation of the Russian Federation, the Agreement, this Policy and the consent to the processing of personal data. If personal data not specified in this Policy is received, or data that does not correspond to the declared purposes of personal data processing is received, such data is subject to immediate destruction.

3.4.The Operator is not responsible for personal data subjects providing their own personal data directly to third parties (including Partners). Third parties (including Partners) assume the rights and obligations for processing such data.

3.5.Employment contracts with the Operator's employees, civil-law contracts with other persons, or confidentiality agreements signed by the parties, where these persons have access to personal data, must include conditions on the non-disclosure by employees and other persons of information that contains personal data.

3.6.Personal data is processed in a mixed mode, both with and without the use of automation tools - by mechanical and manual means.

4. Categories of personal data subjects

4.1.This section of the Policy defines the categories of natural persons whose personal data is processed by the Operator, and the scope of personal data that the Operator may process with or without the use of automation tools. The Operator processes the personal data of the following categories of natural persons, according to their legal status in relations with the Operator:

4.1.1.Users.

4.1.2.Partners:

• natural persons, including individual entrepreneurs, managers, representatives and employees of legal entities and individual entrepreneurs, who have contractual relations with the Operator;
• natural persons, including individual entrepreneurs, managers, representatives and employees of legal entities and individual entrepreneurs, who are potential Partners (negotiating the conclusion of an Agreement).

4.2.By Appendix No. 1 "Composition of personal data to be processed" to this Policy, the Operator has established the list of personal data to be processed by the Operator depending on the category of personal data subjects.

5. Data to be processed

5.1.The Operator processes data of the following categories:

5.1.1.Personal data provided by the personal data subject independently:

I. Personal data:

• Last name, first name;

II. Contact details:

• Username in messengers;
• Phone number;
• Email address.

III. Other categories:

• Information about the personal data subject received from Partners under civil-law agreements between the Operator and the Partner for the purpose of performing the Agreement or a civil-law agreement between the personal data subject and the person who provided the personal data of the subject;
• Other data necessary for processing personal data in accordance with the legislation of the Russian Federation in respect of legal relations between the Operator and the personal data subject.

5.1.2.Publicly available personal data that was published by the personal data subject independently or with the subject's approval on the Internet or in the mass media and may be obtained by the Operator from publicly available Internet resources.

5.2.Financial data (payment details (bank account details)) is processed by the Partner that provides acquiring services to the Operator.

5.3.Data that is transmitted automatically while the User uses the Website and the Software:

• Electronic data (HTTP headers, IP address, Cookie files, web beacons, pixel tags, browser identifier data, information about hardware and software);
• Date and time of the start and end of the session of using the Products;
• Information about the activity of the personal data subject while using the Products;
• Location information;
• Cookie file data;
• Information about the Device, including the Device name and identifiers, hardware model, operating system and version, as well as information about the mobile network and the unique Device identifier generated from the Device MAC / IMEI / MEID;
• Other Data to be collected automatically that is not personal data.

5.4.The Products use Cookie files, which consist of alphanumeric strings and provide unique identification of the User's Device.

The Operator's Products may use the following Cookie files, including web beacons (including pixel tags), to collect data and link it to the User's Device and web browser:

• strictly necessary functional Cookie files required for the functioning of the Products and for the Operator to provide services to the User;
• statistical and analytical Cookie files that make it possible to recognize the User and to collect anonymous (aggregated) data on the actions performed by the personal data subject using the Products;
• (third-party) tracking / advertising cookies: these cookies collect information about Users, traffic sources, pages visited and advertising displayed to the User, as well as the advertising through which the User came to the advertised page. They make it possible to display advertising that may interest the User. They are also used for statistical and research purposes

5.5.If the Products allow the User to upload personal data of third parties, the User undertakes to obtain the consent of the personal data subjects to their transfer (disclosure) to the Operator.

6. Purposes of personal data processing

6.1.In this section of the Policy, the Operator defines the purposes for which the personal data of personal data subjects is collected and processed.

6.2.The Operator processes the personal data of personal data subjects for the purposes of:

6.2.1.Ensuring the functioning of the Operator's Products:

• providing the User with access to the Products;
• ensuring the functioning of the Products;
• processing requests of the personal data subject by the Operator and sending them to the Partners specified by the personal data subject;
• communicating with the personal data subject to send notifications, requests and information related to the activities of the User, the Operator, the Partner;
• carrying out analytics of the Operator's activities;
• carrying out analytics of the functioning of the Products;
• solving the User's technical problems;
• developing new products and expanding the range of the Operator's services;
• providing effective customer and technical support on matters of the Operator's business activities.

6.2.2.Performance by the Operator of obligations under Agreements concluded with personal data subjects, or under agreements in which such a personal data subject is a beneficiary:

• concluding, servicing, performing, amending and terminating an agreement;
• preparing and providing payment documents;
• settlements under the agreement;
• pre-trial work aimed at resolving disputes under the agreement and at collecting debt.

6.2.3.Concluding civil-law agreements with the personal data subject or with a person authorized by the personal data subject to represent their interests;

6.2.4.Providing the personal data subject with informational materials (including advertising materials) from the Operator and (or) Partners for the purpose of promoting goods, works and services by direct contact with that personal data subject.

6.2.5.Ensuring and protecting the legitimate rights and interests of the personal data subject:

• achieving the legitimate purposes of the Operator, provided that the rights and freedoms of the personal data subject are not violated;
• ensuring security, protecting the rights and legitimate interests of the personal data subject and preventing unlawful acts against the subject;
• performing the functions assigned to the Operator and Partners by the legislation of the Russian Federation in accordance with the Tax Code of the Russian Federation, the Federal Laws of the Russian Federation (in particular: "On Banks and Banking Activity", "On Credit Histories", "On Countering the Legalization (Laundering) of Proceeds from Crime and the Financing of Terrorism", "On Currency Regulation and Currency Control", "On Personal Data", the Law "On Protection of Consumer Rights"), the regulations of the Central Bank of Russia, the Federal Service for Technical and Export Control, other state and municipal bodies, as well as the Charter of the Operator;
• complying with the requirements of law enforcement, control and supervisory bodies (the Ministry of Internal Affairs of Russia, the FSB of Russia, the CVM of the Ministry of Internal Affairs of Russia, the Federal Tax Service of Russia and others) in relation to the personal data subject.

6.3.Cookie files are used by the Operator for the purposes of:

• Identifying the User and recognizing the User's Device;
• Statistics and collecting data on the viewing of particular pages.

7. Grounds for personal data processing

7.1.The Operator processes personal data on the basis of:

• the requirements of the legislation of the Russian Federation that establish the purpose of personal data processing, the conditions for obtaining personal data and the range of personal data subjects;
• Agreements that define the purposes of personal data processing and to which the personal data subject is a party or a beneficiary;
• other civil-law agreements that define the purposes of personal data processing and in which the personal data subject is an actual participant and (or) a beneficiary, but not a party;
• the subject's consent to the processing of their personal data;
• receiving personal data from Partners or third parties, provided that the consent of the personal data subject to this transfer of personal data has been given to that Partner or third party;
• receiving publicly available data of the personal data subject.

7.2.Personal data subjects give consent to the processing of personal data (in the form of Appendix No. 2 to the Policy) in the following ways:

(1) ticking a box ("checkbox") in a field of the Product intended for indicating consent to the provision of personal data and (or) the use of Cookie files, or performing an action that is designated in the Product as a condition of agreeing to the processing of personal data;

(2) written consent of the personal data subject;

(3) an Agreement with the personal data subject.

7.2.1.The consent of the personal data subject to the processing of their personal data is valid until the personal data subject withdraws it, but for no more than 20 (Twenty) years from the date the consent to the processing of personal data was given, unless otherwise stated in the written consent.

7.2.2.If personal data is received by the Operator from Partners and (or) another third party, that Partner and (or) third party must have the consent of the personal data subject to the processing and transfer of personal data to the Operator. Responsibility for providing personal data without consent lies with the Partner and (or) third party that provided the personal data to the Operator, because the Operator has no control over the processes taking place at the Partner and (or) the third party that provided the personal data.

7.2.3.The Operator hereby establishes that, when personal data is received from Partners or third parties, a presumption of lawfulness applies, under which the Partner or third party is considered to have lawfully obtained the consent of the personal data subject to the relevant transfer of personal data. Taking this into account, the Operator does not monitor the proper compliance by the Partner or third party with the legislation on the processing of personal data.

7.3.The basis for processing Cookie files on the Website is the consent to the use of Cookie files, which the personal data subject gives while using the Website after the User is informed about the use of Cookie files by a banner on the Website. If the User refuses the use of Cookie files, access to a number of functions of the Website may be restricted for the User.

7.4.Personal data is processed without the consent of the personal data subject in the following cases:

(1) the personal data is publicly available;

(2) at the request of authorized state bodies in cases provided for by the legislation of the Russian Federation;

(3) personal data is processed on the basis of legislation of the Russian Federation that establishes its purpose, the conditions for obtaining personal data and the range of subjects whose personal data is subject to processing, and that defines the powers of the Operator;

(4) personal data is processed for the purpose of concluding and performing an agreement to which the personal data subject is a party or a beneficiary;

(5) personal data is processed for statistical purposes, provided that the personal data is mandatorily depersonalized;

(6) in other cases provided for by the legislation of the Russian Federation and this Policy.

7.5.The Operator hereby establishes that, for a potential personal data subject, studying the provisions of this Policy and giving consent to the processing of personal data is a mandatory requirement.

8. Transfer of personal data

8.1.The Operator has the right to entrust the collection and processing of personal data of personal data subjects to Partners on the basis of a civil-law agreement concluded between the Operator and the Partner. In this case, the Operator notifies the personal data subject of the upcoming collection or the upcoming transfer of that subject's personal data to the Partner, or identifies the Partners involved in the consent to the processing of personal data.

8.2.A Partner that processes personal data is obliged to comply with the principles and rules of personal data processing provided for by the current legislation of the Russian Federation in the field of personal data protection. At the same time, the Operator does not check that the Partner properly complies with the legislation of the Russian Federation on the processing and protection of personal data. For example, an engaged technology Partner that holds the relevant licenses receives payments under Agreements from Users of the Software and transfers them to the Operator - such a Partner independently receives the User's personal data and transfers the minimum information to the Operator, including the fact of payment.

8.3.In cases established by the legislation of the Russian Federation, including where there is an instruction from the personal data subject and (or) a civil-law agreement with the personal data subject, the Operator has the right to transfer the personal data of personal data subjects to third parties for the purposes defined by this Policy and the instruction and (or) the Agreement.

8.4.The Operator has the right to transfer the personal data of a personal data subject:

• to Partners at the request of the personal data subject for the performance of the Agreement concluded between the personal data subject and the Operator;
• to other persons at the request of the personal data subject.

8.5.The Operator hereby declares that it is not responsible for the consequences of transferring personal data to a Partner and (or) a third party specified in the request of the personal data subject.

8.6.The Operator has the right to transfer data and depersonalized data of the personal data subject to third parties without additional consent or notification of the personal data subject.

8.7.The Operator has the right to transfer personal data independently to any body of the Russian Federation or an international body, law enforcement bodies, central or local executive authorities, other official or state bodies or courts, to which the Operator is obliged to provide information under applicable law upon a relevant request.

8.8.The Operator hereby guarantees that no cross-border transfer of personal data is carried out in relation to personal data.

9. Storage and protection of personal data

9.1.Protection of personal data means a set of measures (the necessary legal, organizational and technical measures for protecting personal data) aimed at preventing unlawful or accidental access to personal data, and destruction, modification, blocking, copying and distribution of personal data of personal data subjects, as well as other unlawful actions. The protection of the personal data of personal data subjects from unlawful use or loss is ensured by the Operator at its own expense in the manner established by the current legislation of the Russian Federation in the field of personal data protection.

9.2.The Operator has studied the current threats to the security of personal data and determined that threats of the 3 (Third) type are relevant, which are not connected with the presence of undocumented (undeclared) capabilities in the system and application software. In order to properly inform personal data subjects in accordance with part 2 of Article 18.1 and Article 19 of the Federal Law of the Russian Federation of July 27, 2006 No. 152-FZ "On Personal Data", the Operator protects the personal data of personal data subjects in accordance with the adopted local acts that regulate internal organizational protection measures.

9.3.Taking the identified threats into account, the Operator uses the 3 (Third) level of personal data protection when processing personal data.

9.4.Personal data is stored in electronic form and on paper media in compliance with all requirements for its confidentiality (information security) - depending on the type of personal data and the method of its collection.

9.5.The Operator has implemented the measures provided for by Articles 18.1 and 19 of the Federal Law of July 27, 2006 No. 152-FZ "On Personal Data", as well as measures aimed at ensuring the security of personal data in accordance with the requirements for the protection of personal data established by the legislation of the Russian Federation:

(1) a person responsible for organizing the processing of personal data has been appointed;

(2) a person responsible for ensuring the security of personal data has been appointed;

(3) organizational and administrative documents on the processing and security of personal data have been developed and approved;

(4) a list of persons whose access to personal data is necessary for the performance of their job duties has been approved;

(5) employees who directly process personal data have been familiarized with the provisions of the legislation of the Russian Federation on personal data, including the requirements for the protection of personal data, the document that defines the Policy, and the organizational and administrative documents on the processing and security of personal data;

(6) internal control is carried out over the compliance of personal data processing with the requirements of the Federal Law of July 27, 2006 No. 152-FZ "On Personal Data" and the regulatory legal acts adopted in accordance with it;

(7) an assessment has been made of the harm that may be caused to personal data subjects;

(8) the current threats to the security of personal data have been identified;

(9) the type of threats to the security of personal data relevant for personal data information systems has been determined;

(10) the levels of personal data protection that must be ensured when processing it in personal data information systems have been determined;

(11) a personal data protection system has been developed that prevents the anticipated threats using the methods and means of personal data protection provided for the relevant level of personal data protection, including making it possible to detect cases of unauthorized access to personal data;

(12) the personal data protection system uses information protection tools that have passed the conformity assessment procedure;

(13) the effectiveness of the measures taken to ensure the security of personal data is assessed periodically;

(14) rules of access to personal data processed in personal data information systems have been established, and all actions performed with personal data in the information systems are registered and recorded;

(15) rules for ensuring the security of personal data processed using physical media have been defined;

(16) machine media of personal data are recorded and accounted for;

(17) a security regime has been organized for the premises where the information systems are located, preventing uncontrolled entry into or stay in these premises of persons who have no right of access to them;

(18) a document (agreement) on non-disclosure of confidential information and personal data must be concluded with the Operator's employees who work with personal data.

9.6.The protection of personal data is organized by the executive body of the Operator, unless another person is additionally appointed by order.

9.7.Access to personal data is granted to the Operator's employees who need personal data in connection with the performance of the obligations they have assumed.

9.7.1.An employee of the Operator who has access to personal data in connection with the performance of job duties:

• ensures the storage of information containing personal data in a way that excludes access to it by third parties;
• must not leave documents containing personal data at the workplace when the employee is absent;
• when an employee who has access to personal data is dismissed, the documents and other media containing personal data are transferred to another employee who has access to personal data.

9.8.Personal data on paper media is stored in safes that provide protection against unauthorized access; personal data in electronic form is stored in information systems and (or) electronic databases.

9.8.1.If the Operator processes biometric personal data, the biometric personal data is stored exclusively within automated processing.

9.9.The safekeeping of documents on paper and electronic media is ensured by the Operator for the period provided for by the Agreement with the personal data subject, by Order of Rosarkhiv of 20.12.2019 No. 236 "On Approval of the List of Standard Management Archival Documents Generated in the Course of the Activities of State Bodies, Local Self-Government Bodies and Organizations, with Indication of Their Storage Periods", by the statute of limitations, and by other requirements of the legislation of the Russian Federation.

10. Rights of the personal data subject

10.1.If personal data is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the declared purpose of processing, the personal data subject has the right to demand from the Operator, and to take, the following measures to protect their rights and legitimate interests:

• demand clarification of their personal data;
• demand deletion of personal data and withdraw consent to the processing of personal data;
• demand restrictions on the processing of personal data;
• request a copy of the accepted terms of the Policy and of the consent to the processing of personal data that permits the transfer of personal data;
• withdraw consent to the processing of personal data in full or in part;
• object to the processing of personal data, if this is provided for by the legislation of the Russian Federation.

10.2.To exercise the rights defined by clause 10.1 of this Policy and by the legislation of the Russian Federation on the processing and protection of personal data, the personal data subject may contact the Operator through the Operator's official email address: tech@nana800.io.

10.3.On receiving a properly drawn up request from a personal data subject, the Operator must:

• identify the personal data subject (establish the subject's identity);
• establish the fact that the personal data of the personal data subject is being processed;
• give the personal data subject the opportunity to review the full information about the subject's personal data processed by the Operator;
• make changes, stop processing or block the personal data of the subject at the subject's written request, when the subject provides information confirming that the personal data processed is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the declared purpose of processing, as well as data processed in violation of the requirements of the legislation of the Russian Federation, unless there are grounds for processing the subject's personal data due to the requirements of the legislation of the Russian Federation or a valid agreement (contract) with the Operator;
• notify all persons to whom incorrect or incomplete personal data of the personal data subject was previously communicated of all exclusions, corrections or additions made to it;
• notify the personal data subject of the results of the actions requested by the subject in the manner and within the time limits provided for by the legislation of the Russian Federation.

10.4.It is hereby established that the termination of the collection and processing of personal data at the request of the personal data subject does not mean the termination of the processing of personal data by the Operator's Partners and other third parties, and the Operator is not responsible for the subsequent processing of personal data after it has been provided to a Partner at the request of the personal data subject. The personal data subject has the right to withdraw independently the consent to the processing of their personal data from the persons to whom this personal data was provided.

11. Google user data

This section explains how nana800 (https://nana800.io, cabinet https://cloud.nana800.io) accesses, uses, stores and shares Google user data.

Data we access

• Sign in with Google. When a user signs in with the "Sign in with Google" button, we receive the email address, first name, last name and the email-verified flag of the Google Account. We use them only to create the nana800 account or to find the existing one and sign the user in.
• Google Sheets block. When the user presses the connect button in the block settings, Google asks the user to allow access to their Google Sheets spreadsheets (scope https://www.googleapis.com/auth/spreadsheets). After the user agrees, we receive an access token for the spreadsheets of that Google Account.
• Google Calendar block. When the user presses the connect button in the block settings, Google asks the user to allow access to their calendar events (scope https://www.googleapis.com/auth/calendar.events). After the user agrees, we receive an access token for the calendar events of that Google Account.

How we use the data

• The Sheets token is used only for the actions the user configured in a block of their own scheme: read, add, update or find rows in the spreadsheet the user entered in that block. The spreadsheet is accessed only while the user's scheme runs.
• The Calendar token is used only to create an event in the calendar the user entered in the block and to read back the created event. The calendar is accessed only while the user's scheme runs.
• Spreadsheet and calendar data is passed on only to the blocks and services the user added to their own scheme.
• We do not use Google user data for advertising, we do not sell it, we do not transfer it to data brokers, and we do not use it to train artificial intelligence models.
• Our staff does not read data from the user's Google Sheets or Google Calendar, except when the user gave consent (for example, asked support to look at a scheme), when it is needed for security and abuse prevention, or when the law requires it.

How we store and protect the data

• Access tokens are stored in the block settings of the scheme on our servers. They are available only to the user and to the project members the user invited to their project.
• Data is transferred only over encrypted HTTPS connections. Only the operator has access to the servers and the database.
• Values that passed through the blocks during a scheme run are kept in the run history so the user can see the result. Run history is kept for at most 365 days, large records are cleared after 2-3 days. Deleting a scheme deletes its run history.

How to revoke access and delete data

• Delete the block or the scheme in the cabinet: the saved access token is deleted with it.
• Revoke nana800's access in your Google Account settings: https://myaccount.google.com/permissions.
• Delete the nana800 account and all its data: write to tech@nana800.io. We delete the data within 30 days.

Compliance with Google policies

nana800's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

12. Final provisions

12.1.Changes and additions may be made to this Policy. The Operator has the right to make changes at its own discretion, including, but not limited to, cases where the changes are connected with changes in the legislation of the Russian Federation and (or) in the activities of the Operator.

12.2.If changes are made to this Policy, the Operator notifies of the change by publication on the Internet at the web address: https://nana800.io/privacy/, and also notifies personal data subjects if it is possible to notify them and another method is not provided for by additional agreements of the Parties.

12.3.Other rights and obligations of Individual Entrepreneur Stepan Romanovich Turchenko as the Operator of personal data are determined by the legislation of the Russian Federation on personal data, by agreements between personal data subjects and the Operator, and by other documents that Individual Entrepreneur Stepan Romanovich Turchenko declares and uses in his activities.

Appendices to this Policy:

1. Appendix No. 1 - Composition of personal data to be processed;

2. Appendix No. 2 - Form of Consent to the processing of personal data.

Appendix No. 1

to the Policy on the processing and protection of personal data when using the website and software

Composition of personal data to be processed

The Operator hereby establishes, in addition to the Policy, the following list of personal data to be processed by the Operator depending on the category of the personal data subject in accordance with section 4 of the Policy.

For each category of personal data subjects, the "+" sign next to the composition of personal data marks the personal data that may be processed by the Operator in respect of the relevant category of personal data subject.

Appendix No. 2

to the Policy on the processing and protection of personal data when using the website and software

Consent to the processing of personal data when using the Website and the Software

I, the User of the Software "Bekender", available at the web address https://cloud.nana800.io/, and of the Website, available at the web address https://nana800.io/, owned by Individual Entrepreneur Stepan Romanovich Turchenko (OGRNIP 324390000049050; INN 391101214447) (hereinafter the Operator), hereby give my consent to the collection and processing of my personal data through the Website and the Software on the terms below.

Assurances of the User:

• I confirm that I have studied and understand the terms of processing and protection of my personal data by the Operator set out on the Internet at the web address: https://nana800.io/privacy/
• I confirm that the decision to provide my personal data to the Operator was made by me reasonably, voluntarily and in my own interests, and I confirm that I am a natural person with legal capacity.
• I confirm that I am aware and understand that information, including account, technical, personal and other data that I use in the Software "Bekender", may be available to third parties (Partners) specified in this document.

The legal grounds for processing my personal data are:

• this consent, given by me by performing an active action - ticking a checkbox in a web form with a link to this consent and to the Policy on the processing and protection of personal data when using the website, applications and other software, or performing an action that is designated on the Website or in the Software "Bekender" as a condition of agreeing to the processing of personal data;
• Federal Law of July 27, 2006 No. 152-FZ "On Personal Data";
• the Policy on the processing and protection of personal data when using the website, applications and other software, located on the Internet at the web address: https://nana800.io/privacy/

I hereby give my consent to the processing of my personal data by the Operator through the Website and the Software for the following purposes:

• concluding, servicing, performing, amending and terminating civil-law agreements between me and the Operator for acquiring the rights to use computer programs;
• ensuring and providing access to the Website and the Software;
• receiving information and details from the Operator and (or) Partners;
• receiving informational and advertising materials from the Operator and (or) Partners;
• receiving and sending requests to the Operator;
• performance for my benefit, by the Operator, Partners and third parties through the Website and the Software, of the obligations they have assumed;
• performance of the obligations I have assumed to the Operator;
• receiving notification of changes to the Operator's Policy on the processing and protection of personal data and of events held by the Operator;
• carrying out analytics of the Operator's activities and of the functioning of the Website and the Software;
• tracking my activity and the effectiveness of the activities of the Operator and Partners;
• solving technical problems of the Website and the Software;
• providing me with technical support regarding the use of the functions of the Website and the Software;
• collecting statistical data.
• transfer of data (including personal data) to the following Partners:

List of personal data to the processing of which I give my consent:

• Last name, first name;
• Phone number;
• Email address;
• Payment details (bank account details);
• Electronic data (HTTP headers, IP address, Cookie files, web beacons, pixel tags, browser identifier data, information about hardware and software);
• Date and time of the start and end of the session of using the Website and the Software;
• Information about the activity of the personal data subject while using the Website and the Software;
• Location information;
• Cookie file data;
• Information about the Device, including the Device name and identifiers, hardware model, operating system and version, as well as information about the mobile network and the unique Device identifier generated from the Device MAC / IMEI / MEID;
• Other information processed through the Website and the Software: data on technical means (devices); information about the use of the Website and the Software; information obtained as a result of my interaction with the Website and the Software, including the following: about requests, reviews and questions sent.

List of permitted actions with my personal data: collection, recording, systematization, accumulation, storage, clarification (updating, changing), electronic copying, retrieval, use, transfer (distribution, provision, access) for the performance of contractual obligations to me, depersonalization, blocking, deletion and destruction.

I hereby permit the processing of my personal data both with and without the use of automation tools.

This consent to the processing of my personal data, given to the Operator, is valid for 20 (Twenty) years from the date it is given to the Operator.

I confirm that I have been notified of the right to withdraw this consent to the processing of personal data by sending an application to Individual Entrepreneur Stepan Romanovich Turchenko by email: tech@nana800.io.

The Operator undertakes to consider the application and send a reply within 14 (Fourteen) calendar days from the receipt of the request.