Policy on the Processing of Personal Data

1. General provisions

Personal data operator: ООО «ГК «Первый ИТ Альянс» (the “Operator”).

ИНН 7725842448, КПП 770901001, ОГРН 5147746111013.

Legal address: 109147, г. Москва, ул. Таганская, д. 34А, эт. 3, оф. 312.

Contact address for personal data processing matters: privacy@postify.work.

The Policy applies to all personal data that the Operator receives from users of the postify.work website and the app.postify.work service (the “Service”).

By using the Service and providing their data, the user confirms their agreement with the terms of this Policy.

2. Legal grounds for processing

The Operator processes personal data on the basis of:

• Federal Law No. 152-FZ “On Personal Data” and other regulatory legal acts of the Russian Federation;

• the data subject’s consent to the processing of personal data;

• the contract (public offer) to which the data subject is a party;

• the Operator’s constituent documents.

3. Purposes of personal data processing

The Operator processes personal data for the following purposes:

• registration, identification of the user and provision of access to the Service;

• performance of the services agreement, invoicing and acceptance of payment;

• generation and publication of content at the user’s request;

• technical support and feedback;

• sending service messages and (subject to separate consent) advertising messages;

• improving the quality of the Service and analytics of its use;

• compliance with the requirements of the legislation of the Russian Federation.

4. Categories of subjects and composition of personal data

The Operator processes the personal data of Service users.

Composition of the data processed: surname, first name; email address; password (in encrypted form); brand and company profile data; content uploaded by the user; information about the social network accounts connected by the user; IP address, device and browser data, cookies; payment information required for payment.

The Operator does not process special categories of personal data or biometric personal data.

5. List of actions and methods of processing

The processing of personal data includes collection, recording, systematization, accumulation, storage, refinement (updating, modification), extraction, use, transfer (provision, access), depersonalization, blocking, deletion and destruction.

Processing is carried out with and without the use of automation tools.

Recording, systematization, accumulation, storage, refinement and extraction of the personal data of citizens of the Russian Federation are carried out using databases located on the territory of the Russian Federation (part 5, art. 18 of 152-FZ).

6. Cookies and metric data

The Service uses cookies that are necessary for login, saving the language and interface theme, as well as for analytics of the use of the Service.

On the first visit, the user is offered to accept or decline optional cookies.

The user can disable cookies in the browser settings; in that case certain functions of the Service may become unavailable.

7. Transfer of data to third parties and assignment of processing

The Operator may entrust the processing of personal data to third parties (cloud infrastructure providers, mailing services, payment providers, AI service providers) on the basis of a contract, provided that they comply with the requirements of 152-FZ and confidentiality.

The Operator does not sell personal data and does not transfer it to third parties for purposes not provided for by this Policy, except in cases established by the legislation of the Russian Federation.

8. Cross-border data transfer

For certain functions (in particular, the generation of content by means of artificial intelligence), the Operator may transfer the necessary data to processors located outside the Russian Federation, in compliance with the requirements of art. 12 of 152-FZ.

Cross-border transfer is carried out after notifying the authorized body and while ensuring adequate protection of the rights of data subjects.

9. Processing periods and destruction of data

Personal data is processed for the term of the contract and the subject’s consent, as well as for the periods established by the legislation of the Russian Federation.

Upon withdrawal of consent or achievement of the purposes of processing, personal data is subject to destruction or depersonalization within a period not exceeding 30 days, unless otherwise provided by law.

10. Rights of the personal data subject

The personal data subject has the right to:

• receive information about the processing of their personal data;

• demand clarification, blocking or destruction of the data if it is incomplete, outdated, inaccurate or processed in violation of the law;

• withdraw consent to the processing of personal data;

• appeal the actions of the Operator to the authorized body (Roskomnadzor) or in court.

Requests are sent to privacy@postify.work.

11. Procedure for withdrawing consent

Consent to the processing of personal data may be withdrawn by sending an application to the email address privacy@postify.work or to the Operator’s legal address.

After the withdrawal of consent, the Operator ceases the processing of personal data and destroys it, except for data whose processing continues on other lawful grounds.

12. Measures to protect personal data

The Operator takes legal, organizational and technical measures to protect personal data from unlawful access, destruction, modification, blocking, copying and distribution: encryption of data transmission (HTTPS), access restriction, backup, appointment of a person responsible for organizing the processing of personal data.

13. Changes to the Policy and contacts

The Operator may make changes to this Policy. The current revision is posted on the website.

For all questions regarding the processing of personal data, please contact: privacy@postify.work.