Personal data processing policy

Version dated 28 October 2026.

1. Operator and scope

The personal data operator is Паламарчук Юлия Сергеевна (Yuliya Sergeevna Palamarchuk), a self-employed individual applying the Russian Professional Income Tax regime, Moscow. Contact email: julia.innovator@yandex.ru. The Cyrillic name identifies the operator; the Latin spelling is a translation for readability.

This policy covers users of the operator’s Telegram and MAX bots that link to this policy, and the associated system used to manage conversations. The Telegram bot supports Russian and English; the MAX bot uses Russian. The operator processes personal data under Russian Federal Law No. 152-FZ of 27 July 2006 on Personal Data.

2. Purposes and data

Materials requested by the user

The bot provides links to the operator’s accounts and sends guides, PDFs and other materials only following the relevant command or button press. The data processed are the platform; user and chat identifiers; profile first and last names and username, where available; technical bot-account and Telegram Premium flags; interface and selected conversation language; command or button press; requested material; request time; message identifiers; and information about delivery, retries and chat unavailability.

Free materials are a subscription bonus. The form has two separate, initially unchecked consents: personal data processing and updates and advertising. After selecting both, the user presses “Subscribe and continue”. Requesting a material alone is not consent. Users may unsubscribe at any time without returning materials already received; further access to bot materials requires a subscription. Unsubscribing and data-protection enquiries remain available regardless of subscription.

Conversations with the operator

To receive enquiries, prepare replies and preserve the context of a conversation, the operator processes the platform, user and chat identifiers, available name and username, enquiry and reply content, message times, and reading and delivery information. The operator may reply personally through the conversation management system.

Interaction and material usage statistics

To assess where users come from and which materials and links are useful, the operator processes the platform, user identifier, source tags, material requests, button presses, tracked link visits and the times of these actions. Consent for bot services does not permit this information to be used for advertising profiling.

Advertising

To advertise the operator’s own products, services and events, the operator processes the platform, user and chat identifiers, subscription status and sending records. The personal data processing consent includes a conditional mailing-list purpose: data are used for it only after separate consent to receive updates and advertising. Before that choice, or after withdrawal, promotional processing and advertising are not permitted. A subscription in one messenger does not create a subscription in another.

Consent records and protection of rights

The operator records the platform, user identifier, consent type, choice time, user action, document language and version, and withdrawal information. These records establish the lawfulness of processing, support compliance with opt-outs, and enable the handling of enquiries and disputes.

3. Data that are not requested

A telephone number may be provided voluntarily for a callback requested by the user; email may be used for requested materials and separately consented advertising; gender may be provided in a skippable voluntary survey. These optional features require appropriate notices and choices before use. Passport, payment, health and other sensitive-category data are not requested. Data are not used for biometric identification.

Do not send documents, sensitive information or other people’s data unless necessary for your enquiry. Where a message contains excessive data, the operator restricts their use and deletes them when there is no lawful reason to retain them. Voluntarily sending a message does not authorise unrestricted use of its contents.

4. Grounds and processing operations

Materials, conversations and interaction statistics are processed on the basis of consent for bot services. The same data processing consent covers the mailing list only if the user separately and voluntarily agrees to receive updates and advertising. Where processing is necessary to fulfil a statutory obligation or protect the operator’s legitimate rights without infringing the user’s rights, the relevant grounds in Article 6 of Law No. 152-FZ apply. They do not replace required advertising consent.

Processing includes collection, recording, organisation, accumulation, storage, updating, retrieval, use, disclosure to the extent needed for the services, restriction, deletion and destruction. Processing is automated and may also be performed directly by the operator when handling enquiries.

When a user initiates contact, minimal identifiers and technical information are used to answer the request to start the service, select a language, show documents and record the choice. This is limited to necessary steps initiated by the user to provide the requested service under Article 6(1)(5) of Law No. 152-FZ. A full profile, conversation history and individual analytics are not created before consent. A substantive message sent before consent needs to be sent again after consent.

5. Retention

Conversation history and profile data are kept while needed for an ongoing conversation, for no more than 12 months after the user’s last enquiry or material request. Automated advertising does not extend this period. Processing ends earlier if its purpose has been achieved and retention is no longer necessary.

User-level source, click and material usage records are kept for no more than 90 days after the action, then deleted or converted into statistics that do not identify the user.

Technical events and delivery records are retained until delivery and related error resolution are complete, for no more than 30 days after the job has finished. Excessive content in technical records is removed once the failure is resolved.

Consent to marketing data processing lasts 12 months unless withdrawn earlier. Advertising stops when this period expires unless fresh consent is obtained. An opt-out ends promotional processing and sending, including messages that are still queued.

Minimal evidence of consent and withdrawal is retained for no more than three years after the relevant processing ends where necessary to demonstrate compliance and protect rights. It is kept separately from the active advertising list and is not used to send advertisements. It is deleted earlier if no longer necessary. A specific dispute or statutory obligation may require the relevant records to be kept for the applicable period.

Once the purpose is achieved or consent is withdrawn, data without another lawful basis are destroyed within the time limits of Article 21 of Law No. 152-FZ, generally within 30 days. Requests to stop processing are subject to the separate period established by that Article; promotional processing stops immediately on request.

Deletion covers the working database, technical logs, queues and backups. Copies excluded from processing are not used for current operations. Restoring a backup must respect earlier opt-outs and deletion requests. If immediate destruction is technically impossible, restriction and the statutory destruction procedure apply.

6. Messengers, infrastructure and email

Messages pass through the messenger selected by the user, Telegram or MAX. Sending a reply or material involves providing the platform with the recipient identifier and outgoing content. These platforms also process data under their own terms and policies. This policy governs the operator’s actions and does not replace platform policies.

The main CRM database is hosted in Moscow, Russia, by RUWEB LLC (INN 7715488149). Telegram is provided by Telegram Messenger Inc. and MAX by MAX LLC. The system uses a server database and backups; its infrastructure includes backup storage on Yandex Disk. Enquiries sent to julia.innovator@yandex.ru pass through Yandex Mail. Personal Yandex services are used under their published terms. Yandex LLC’s registered address is 16 Leo Tolstoy Street, Moscow, Russia, 119021, OGRN 1027700229193; this is the company address, not a declaration of the physical backup location. Users may contact the bot they use instead of sending email.

In its letter dated 19 October 2026, No. 08-1001090, Roskomnadzor stated that the interaction with individuals who are Russian citizens via Telegram, as described by the operator in the notification, does not constitute cross-border personal data transfer activity. The notification for that scenario was left without consideration. This position concerns the activity described in the notification and does not automatically apply to other transfers to foreign recipients. The operator complies with Russian data localisation requirements. If another processing scenario involves a cross-border transfer, the operator must meet the requirements of Article 12 of Law No. 152-FZ before that transfer begins. User consent does not waive these duties. Disclosure to parties processing data on the operator’s instructions requires an appropriate legal basis and the necessary confidentiality and security obligations.

The operator does not sell the user database or give it to others for their independent advertising. Data may be provided to competent public authorities on a lawful request. Consent for bot services or advertising does not authorise publication of conversations or testimonials.

7. Security

The operator limits access to those who need it, uses individual authentication for the conversation management system, protected connections and database access controls. Backup creation is configured and its results are monitored; the existence of a backup does not by itself guarantee a successful restoration. The operator organises consent and opt-out records, scheduled deletion and security incident handling. Measures are reviewed when systems or risks change.

8. Rights and requests

Users may request information about processing and recipients, seek correction, restriction or destruction where provided by law, withdraw consent, request processing to stop, and complain to Roskomnadzor or a court.

Contact the bot you use or email julia.innovator@yandex.ru, identifying the messenger and providing enough information to find your account. The operator may request proportionate evidence of account ownership to avoid disclosing data to another person. A passport is not automatically required for every request.

To stop advertising, use the “Unsubscribe” button in “⚙️ Settings” (/privacy), /unsubscribe or send “Unsubscribe from advertising” to the bot. The Russian equivalent is “Отписаться от рекламы”. You may opt out in one bot or specify both messengers. If the operator cannot reliably link the accounts, confirmation of the second account will be needed.

Declining advertising does not prevent access to requested materials or conversations. Withdrawing consent for bot services may prevent further delivery and conversations through the bot where there is no other lawful basis for the necessary processing.

9. Changes

The current version is available using /privacy or the “Documents and privacy” link in the bots. Updating this policy does not automatically extend earlier consent. New purposes or processing scope require an appropriate legal basis and, where needed, fresh consent.

“⚙️ Settings” (/privacy) shows current consent status and allows withdrawal. Opening settings or repeating /start does not grant or extend consent. Resubscribing preserves the expiry of valid consent for bot services. If mailing-list data-processing consent has been withdrawn or expired, its terms appear in a separate document in the subscription form; confirmation restores only missing permissions. After withdrawing all consents, both must be confirmed again.