Privacy and Personal Data Processing Policy

1. General provisions

1.1. This Privacy and Personal Data Processing Policy (the “Policy”) establishes the procedure for processing and protecting the personal data of individuals using wesetup.ru and its related services.

1.2. The Policy has been developed in accordance with the Constitution of the Russian Federation, Federal Law No. 152-ФЗ of 27.07.2006 “On Personal Data” (“152-ФЗ”), Federal Law No. 149-ФЗ of 27.07.2006 “On Information, Information Technologies and Information Protection”, and other regulatory legal acts of the Russian Federation concerning personal data protection.

1.3. The personal data operator is Общество с ограниченной ответственностью «БФС» (the “Operator”, “Company”, “we”), INN 5018215599, OGRN 1235000105306, address: 141065, Московская область, г. Королёв, ул. Ленина, д. 10/6.

1.4. The Policy applies to all personal data the Operator receives from users when they use wesetup.ru, the WeSetup web application and Telegram Mini App through @wesetupbot.

1.5. This Policy is a publicly available document published openly on wesetup.ru.

1.6. Use of the Services constitutes the User's agreement with this Policy and the personal data processing conditions stated in it. If the User disagrees with the Policy, they must stop using the Services.

2. Terms and definitions

2.1. Personal data means any information relating to an identified or identifiable individual, directly or indirectly (a personal data subject).

2.2. Personal data processing means any action or set of actions performed on personal data, including collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), anonymisation, blocking, deletion and destruction.

2.3. Operator means ООО «БФС», which independently or jointly with others organises and/or carries out personal data processing and determines its purposes, the personal data to be processed and the actions performed on it.

2.4. User means an individual using the Operator's Services: a website visitor, a registered web application user or a Telegram Mini App user.

2.5. Client means a legal entity or individual entrepreneur that has entered into an agreement with the Operator to use the Services and created an organisation (account) in WeSetup.

2.6. Services means wesetup.ru, the WeSetup web application (electronic SanPiN/HACCP logs for catering establishments and food production facilities), and Telegram Mini App available through @wesetupbot.

2.7. Cookies are small text files placed by a website in the User's browser to store session and settings data.

2.8. Electronic logs are accounting documents (records) created by the Client and its employees in the Services to comply with sanitary legislation and HACCP principles.

3. Legal grounds for personal data processing

3.1. The Operator processes personal data on the following legal grounds:

• the personal data subject's consent to processing their personal data (clause 1, part 1, article 6 of 152-ФЗ), expressed during registration, subscription or other use of the Services;
• performance of an agreement to which the personal data subject is a party, beneficiary or guarantor (clause 5, part 1, article 6 of 152-ФЗ);
• the Client's instruction to the Operator to process personal data, with the Client acting as the personal data operator for its employees (part 3, article 6 of 152-ФЗ);
• performance of obligations imposed on the Operator by Russian Federation legislation, including tax and accounting legislation (clause 2, part 1, article 6 of 152-ФЗ);
• exercise of the Operator's rights and legitimate interests, provided that the personal data subject's rights and freedoms are not infringed (clause 7, part 1, article 6 of 152-ФЗ).

3.2. The Operator does not process personal data authorised by the subject for dissemination.

4. Purposes of personal data processing

4.1. The Operator processes personal data solely for the following purposes:

4.1.1. Registering and identifying the User in the Services and providing access to the personal workspace and web application features.

4.1.2. Entering into, performing and terminating an agreement for access to the Services, including subscribing and extending the subscription period.

4.1.3. Maintaining electronic SanPiN/HACCP logs on the Client's instructions, including creating, storing, displaying and exporting log records.

4.1.4. Enabling Telegram Mini App to operate: authorising the User and sending task notifications and reminders.

4.1.5. Processing payments for the Services, including recording the fact, amount and period of payment and preparing closing documents.

4.1.6. Providing technical support to Users and Clients and responding to enquiries sent to support@wesetup.ru.

4.1.7. Improving the Services, analysing user behaviour in anonymised or aggregated form, correcting technical errors and ensuring information security.

4.1.8. Informing Users about changes to the Services, prices, service terms and this Policy.

4.1.9. Complying with Russian Federation legislation, including maintaining accounting and tax records.

4.2. The Operator does not use personal data for purposes incompatible with those listed above and does not make decisions producing legal consequences for the subject solely on the basis of automated personal data processing.

5. Personal data processed

5.1. User account data: surname, first name and patronymic; email address; mobile telephone number; position and role in the organisation; password (stored solely as an irreversible cryptographic hash; the Operator cannot access the plain-text password).

5.2. Client organisation data: legal entity or individual entrepreneur name, tax ID, registered and actual addresses, bank and other details, and responsible persons' contact details.

5.3. Electronic log records, which may contain: surnames, first names and patronymics of the Client's employees; health and hygiene marks (including examination results, fitness-for-work marks and signs of illness); temperature readings for premises, equipment and products; other production and monitoring indicators required by sanitary legislation and the Client's HACCP plan; the date and time of an entry and information about the person who made it.

5.4. Photo attachments to electronic log records, uploaded by Users as documentary evidence of measures carried out (the condition of premises, equipment and products, and instrument readings).

5.5. Telegram data when Telegram Mini App is used: Telegram ID, username, first name and surname in the Telegram profile, interface language, and the chat identifier for sending notifications.

5.6. Technical data: IP address; cookies; browser and operating system information; device type and parameters; screen resolution; the date, time and duration of access to the Services; referring pages; data from the Яндекс.Метрика web analytics system, including “Вебвизор” technology (recording user actions in the interface: cursor movements, clicks, scrolling and form completion, without storing the content of password or payment-data input fields).

5.7. Payment data: the fact of payment, payment amount, date and time, paid plan and subscription period, and transaction status.

5.8. The Operator does not receive, process or store Users' bank card data. Bank card details are entered and processed directly on the secure page of the payment service “Робокасса” (ООО «Бизнес-Процессинг»), certified to the PCI DSS security standard. The Operator receives only payment-result information from the payment service.

5.9. The Operator does not process biometric personal data or special categories of personal data concerning racial or ethnic origin, political views, religious or philosophical beliefs, or intimate life. Health information is processed solely as fitness-for-work marks required by sanitary legislation and only on the Client's instructions. An employee's sign-in on the Client's shared device is photographed (a camera frame when identity is confirmed by PIN) only if the Client enables this feature and the employee consents; the frame is stored as evidence that a record was signed, and no automatic facial recognition or other biometric technologies are applied to it.

5.10. The Operator does not deliberately collect minors' personal data. The Services are intended for people who have reached an age permitting them to enter into employment and contractual relationships.

6. Methods and periods of personal data processing

6.1. Personal data is processed using automated means and without such means, including collection, recording, systematisation, accumulation, storage, clarification, retrieval, use, transfer, anonymisation, blocking, deletion and destruction.

6.2. Personal data is collected through: the User's own data entry during registration and use of the Services; receipt of data from the Client when employee accounts are created; receipt of data from Telegram during authorisation through Telegram Mini App; and automatic collection of technical data when the Services are accessed.

6.3. Personal data processing periods:

• User account data and Client data are stored for the term of the agreement and 3 (three) years after its termination, or until consent is withdrawn, unless otherwise required by law;
• electronic log records and photo attachments are stored for the period set by the Client and by sanitary legislation governing retention of accounting documentation, but for no less than 12 months;
• payment data and accounting documents are stored for no less than 5 (five) years in accordance with tax legislation and the Federal Law “On Accounting”;
• technical data and web analytics data are stored in anonymised form for no more than 25 months.

6.4. When processing purposes have been achieved or are no longer necessary, personal data must be destroyed or anonymised within no more than 30 days, unless otherwise provided by law or the agreement.

6.5. When the personal data subject withdraws consent to processing, the Operator stops processing and destroys the personal data within no more than 30 days of receiving the withdrawal, except where processing may continue on other lawful grounds (part 2, article 9 and part 4, article 21 of 152-ФЗ).

7. Storage of personal data in the Russian Federation

7.1. Under part 5, article 18 of 152-ФЗ, the Operator ensures that the personal data of Russian Federation citizens is recorded, systematised, accumulated, stored, clarified and retrieved using databases located in the Russian Federation.

7.2. The Operator's server equipment and databases are hosted by Russian hosting providers in data centres physically located in the Russian Federation.

7.3. Database backups are also stored in the Russian Federation.

8. Transfer of personal data to third parties

8.1. The Operator does not sell, rent out or transfer personal data to third parties, except as expressly stated in this Policy or required by Russian Federation legislation.

8.2. Personal data may be transferred to the following categories of third parties to the extent necessary to achieve the processing purposes:

8.2.1. The payment service “Робокасса” (ООО «Бизнес-Процессинг») — to settle payments for the Services. The following is transferred: order identifier, payment amount, and the payer's email address and/or telephone number. Bank card details are entered by the User directly with the payment service and are not transferred to the Operator.

8.2.2. Hosting provider — to the extent required to host infrastructure and store data on servers in the Russian Federation. The provider does not process data independently and acts under an agreement containing confidentiality obligations.

8.2.3. ООО «ЯНДЕКС» (the Яндекс.Метрика service) — to collect and analyse anonymised statistics about visits and user behaviour, including “Вебвизор” technology. Processing terms are established by Yandex documents published at yandex.ru/legal.

8.2.4. Telegram Messenger — when Telegram Mini App is used and notifications are received through @wesetupbot. Telegram's own data processing is governed by the Telegram privacy policy.

8.2.5. Persons engaged by the Operator to support users (consultants and support staff) — on the Operator's instructions and only within the access granted by the user's organisation under “Settings → Consultant”; the organisation can restrict or disable access at any time. Engaged persons must maintain confidentiality and comply with 152-ФЗ.

8.2.6. Authorised government authorities — upon a reasoned request, in the manner and to the extent established by Russian Federation legislation.

8.3. All third parties receiving personal data must maintain confidentiality and ensure the security of the personal data during processing.

8.4. Cross-border transfer of personal data to foreign states that do not provide adequate protection of personal data subjects' rights is not carried out by the Operator. If a cross-border transfer becomes necessary, the Operator will comply with article 12 of 152-ФЗ, including notifying Роскомнадзор and obtaining the subject's separate consent.

9. Processing personal data of the Client's employees

9.1. When the Client (a legal entity or individual entrepreneur) uses the Services, the Client acts as the personal data operator for the personal data of its employees and other persons whose data is entered in electronic logs, while the Operator (ООО «БФС») acts as the person processing personal data on the Client's instructions under part 3, article 6 of 152-ФЗ.

9.2. The Client independently determines the purposes and scope of processing its employees' personal data, ensures lawful grounds for processing, including obtaining data subjects' consent, and is responsible for the lawfulness of obtaining that data.

9.3. The Operator processes such personal data solely to the extent and for the purposes specified in the Client's instructions (the agreement to use the Services), does not independently determine processing purposes and does not use this data for its own interests.

9.4. The Operator undertakes to maintain the confidentiality of personal data processed on the Client's instructions and ensure its security during processing in accordance with article 19 of 152-ФЗ.

9.5. The Client is liable to personal data subjects for the Operator's actions. The Operator is liable to the Client under their agreement and Russian Federation legislation.

9.6. Enquiries from the Client's employees concerning the exercise of their rights as personal data subjects are addressed to the Client. If the Operator receives such an enquiry, it is forwarded to the Client or handled in agreement with the Client.

10. Use of cookies and similar technologies

10.1. The Services use cookies and similar technologies (browser local storage: localStorage and sessionStorage) to operate and improve the user experience.

10.2. The Operator uses the following categories of cookies:

10.2.1. Strictly necessary (technical) cookies provide the basic functionality of the Services: User authorisation, session maintenance, keeping the User signed in to the workspace, cross-site request forgery (CSRF) protection and load balancing. These cookies cannot be disabled without losing the functionality of the Services. The legal grounds are performance of the agreement and the Operator's legitimate interest in operating the Services.

10.2.2. Functional cookies save user settings: the selected organisation, interface display options and acknowledgements of notifications and information messages. They remove the need to configure the interface again at every sign-in.

10.2.3. Analytical cookies are set by Яндекс.Метрика to collect anonymised statistics: visit counts, referral sources, viewing depth, time on pages and interface behaviour (“Вебвизор” technology). Aggregated data is used to improve the Services.

10.3. The Operator does not use advertising cookies or cookies for targeted advertising and does not transfer cookie data to advertising networks or data brokers.

10.4. How to manage cookies. The User may disable or restrict cookies in their browser settings and delete previously saved cookies at any time. The relevant settings are in the following sections:

• Google Chrome: Settings → Privacy and security → Cookies and other site data;
• Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data;
• Microsoft Edge: Settings → Cookies and site permissions;
• Safari: Settings → Privacy → Manage Website Data;
• Яндекс Браузер: Settings → Websites → Advanced site settings → Cookies.

10.5. The User may also opt out of data collection by Яндекс.Метрика by installing the official browser add-on “Блокировщик Яндекс.Метрики”, available on the Yandex support website.

10.6. Disabling strictly necessary (technical) cookies will prevent authorisation and the correct operation of the personal workspace and electronic logs. Disabling functional and analytical cookies does not prevent use of the Services.

10.7. By continuing to use the Services without changing browser settings, the User consents to cookies being used to the extent stated in this section.

11. Confidentiality and measures to protect personal data

11.1. The Operator takes the necessary legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination and other unlawful actions (article 19 of 152-ФЗ).

11.2. Measures to protect personal data include:

• appointing a person responsible for organising personal data processing;
• approving internal regulations governing personal data processing and protection;
• identifying threats to personal data security and applying protection measures appropriate to the established security level;
• encrypting data in transit using HTTPS (TLS);
• storing passwords solely as irreversible cryptographic hashes;
• separating access rights: only authorised employees receive access to data to the extent necessary for their duties; within the Services, access is based on roles and access settings determined by the Client;
• isolating client organisations' data from each other (multi-tenancy);
• maintaining user action and security event logs;
• regular data backups;
• ensuring the physical security of server equipment in data centres;
• confidentiality obligations for employees with access to personal data;
• monitoring the measures taken and the level of information system security.

11.3. Personal data is confidential information. The Operator's employees who have obtained access to personal data must not disclose it to third parties or disseminate it without the subject's consent, unless otherwise provided by law.

11.4. If unlawful personal data processing is identified, the Operator remedies the breach or blocks the relevant data within no more than 3 (three) working days and notifies the personal data subject and the authorised authority in the manner established by 152-ФЗ.

11.5. The User must not disclose their credentials (login and password) to third parties and must immediately notify the Operator of any unauthorised access to their account.

12. Rights of the personal data subject

12.1. The personal data subject has the right to:

12.1.1. Obtain information about the processing of their personal data to the extent specified in part 7, article 14 of 152-ФЗ, including: confirmation that processing takes place; the legal grounds and purposes of processing; the processing methods used; information about persons with access to personal data; the personal data processed and its sources; processing and retention periods; and the name and address of a person processing data on the Operator's instructions.

12.1.2. Request clarification, blocking or destruction of their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated processing purpose.

12.1.3. Withdraw consent to personal data processing.

12.1.4. Object to the processing of their personal data in cases provided for by law.

12.1.5. Challenge the Operator's actions or omissions before the authorised body protecting personal data subjects' rights (Роскомнадзор) or in court.

12.1.6. Protect their rights and legitimate interests, including compensation for losses and non-pecuniary damage, through the courts.

12.2. How to make an enquiry. To exercise their rights, the personal data subject sends a request by email to support@wesetup.ru or in writing to the Operator's postal address: 141065, Московская область, г. Королёв, ул. Ленина, д. 10/6.

12.3. A request must contain: information confirming the subject's relationship with the Operator (agreement number, account email address, registration date), or otherwise confirming that the subject's data is processed; the subject's surname, first name and patronymic; the number of their main identity document, its issue date and issuing authority; and the signature of the subject or their representative. The request may be sent as an electronic document.

12.4. The Operator reviews the request and sends a reasoned response within no more than 30 (thirty) days of receiving it. This period may be extended by no more than 5 (five) working days, with notification to the subject of the reasons for the extension.

12.5. The Operator may refuse to provide information or fulfil a request in cases expressly provided for by part 8, article 14 and part 2, article 20 of 152-ФЗ, giving a reasoned response.

12.6. The User can exercise many rights independently: change account data in the workspace, disable notifications, delete uploaded photo attachments or request account deletion through support.

12.7. Withdrawal of consent to personal data processing necessary to provide the Services makes continued use of the Services impossible and results in termination of the agreement.

13. Changes to the Policy

13.1. The Operator may amend this Policy unilaterally, including following changes in Russian Federation legislation, the range of Services or personal data processing procedures.

13.2. A new revision of the Policy takes effect when it is published on wesetup.ru, unless the revision provides otherwise.

13.3. The latest revision date appears at the beginning of the document. Users are advised to review the current revision of the Policy periodically.

13.4. If personal data processing conditions change materially, the Operator additionally notifies Users by email or through the Services interface.

13.5. Continuing to use the Services after a new revision takes effect constitutes the User's acceptance of the revised Policy.

13.6. This Policy and the relationship between the User and the Operator arising from its application are governed by Russian Federation law. Disputes are resolved in the manner established by Russian Federation legislation.

14. Operator details

Telegram bot: @wesetupbot. Enquiries concerning personal data processing should be sent to support@wesetup.ru.