Personal Data Processing Policy

Table of Contents

1. What is this document about?
2. Who will process the personal data?
3. What do we do with personal data?
4. Why do we need personal data?
5. On what basis do we process personal data?
6. What personal data do we process?
7. What rights do I have regarding my personal data?
8. How do we protect personal data?

1. What is this document about?

1.1. Personal data is any information relating to a directly or indirectly identified or identifiable individual (data subject).

Thus, personal data includes not only a person's full name, date of birth, or residential address but also less obvious data—for example, an IP address, cookie files, etc.

1.2. The document you are reading is the Privacy Policy (hereinafter referred to as the "Policy"). The Policy is necessary to ensure the confidentiality and protection of personal data from unauthorized access and dissemination.

1.3. The Policy is posted on the website https://botto.ai/ (hereinafter referred to as the "Site") and applies to the personal data of individuals using the Site (hereinafter referred to as "Users").

1.4. By using the Site, the User confirms that they have read and agree to this Policy. A separate mandatory condition for the processing of personal data is the User's provision of independent and informed Consent to the processing of personal data in the manner provided for by a separate document located at: https://botto.ai/. If the User does not agree with the Policy or does not provide separate Consent to the processing of personal data, they must stop using the Site.

1.5. Relations related to the processing of Users' personal data are regulated in accordance with this Policy, Federal Law No. 152-FZ of July 27, 2006, "On Personal Data" (hereinafter referred to as the "Personal Data Law"), and other regulatory legal acts of the Russian Federation in the field of personal data.

1.6. In addition to the Policy, the User and the Operator also enter into a User Agreement containing all necessary and essential terms for accessing and using the service (hereinafter referred to as the "User Agreement"). The User Agreement is posted at: https://botto.ai/agreement.

2. Who processes the personal data?

2.1. The personal data is processed by Botto Limited Liability Company (INN: 4632270489, OGRN: 1204600009184), address: 420500, Republic of Tatarstan, Verkhneusonsky Municipal District, Innopolis Urban Settlement, Innopolis, Universitetskaya Street, Building 5 (hereinafter referred to as the "Operator"). You can contact us using the following details:

● Phone: +7 (800) 301-97-87;

● Email address: support@botto.ai.

2.2. Regarding the personal data provided by the User during registration and use of the personal account (such as name, contact details), the Operator is an independent data controller, determining the purposes and composition of their processing.
Regarding the personal data uploaded by the User to the Service as part of their Customer Base (phone numbers, other subscriber data), the Operator processes such data as a processor on behalf of the User (the data controller) based on the User Agreement, which is an instruction for the processing of personal data. The User is solely responsible for the lawfulness of the collection and the availability of all necessary consents from the data subjects contained in the Customer Base.

2.3. The Operator reserves the right to change or supplement the Policy at any time. The Operator will notify the User of changes to the Policy 7 calendar days in advance on the Site. The new version of the Policy comes into force from the moment of its publication on the Site, unless otherwise provided by the new version. Continued use of the Service after changes are made means the User agrees to such changes.

2.4. The Operator has the right to entrust the processing of personal data to a third-party organization. In doing so, the Operator undertakes not to disclose personal data to third parties and not to distribute it without the User's consent, unless otherwise provided by the legislation of the Russian Federation. Persons processing data based on an agreement (operator's instruction) concluded with the Operator undertake to comply with the principles and rules of data processing and protection provided for by the Personal Data Law.

2.5. The Operator does not verify the accuracy of the personal data provided by the User and is not able to assess their legal capacity.

2.6. The Operator does not control and is not responsible for third-party websites that the User may access via links available on the Operator's Site.

3. What do we do with personal data?

3.1. As the Operator, we process personal data – we perform any action (operation) or a set of actions (operations) with personal data. Processing is carried out both with and without the use of automation tools. The processing of personal data includes:

● collection, recording, systematization, accumulation, storage;

● updating, modification;

● retrieval, use, transfer (disclosure);

● blocking, deletion, destruction.

3.2. The Operator processes personal data both using automation tools and without their use (mixed method).

3.3. The Operator collects personal data:

● during User registration (account creation);

● when using the Site and the service, automatically or when the User voluntarily enters additional personal data while using the Site.

3.4. The period of processing and storage of personal data is limited to:

(1) achieving the purposes of processing and storing personal data; or

(2) the term of the User's consent to the processing of personal data – including consent given for processing personal data for the purpose of informing about new products and services, special offers, and various events related to the Operator's activities.

Transfer of Personal Data

3.5. The User is informed about the transfer of their personal data to other persons. A complete list of persons to whom the Operator may transfer the User's personal data can be found at the link: [https://my.botto.ai/].

3.6. The Operator uses third-party services that may process Users' personal data. The services are used to improve the quality of the Operator's services and service, the Site, its usability, and to develop new functionality, including by analyzing usage results:

(1) Yandex.Metrica.

(2) Telecom operators, for sending voice and text messages on behalf of the User.
(3) Government authorities in cases and manner prescribed by the legislation of the Russian Federation.
(4) Multifunctional Information Exchange Service (MIES) – for the purpose of verifying and confirming User data, as well as in cases provided by law, to verify the lawfulness of processing data contained in the User's Customer Base. Interaction with MIES is carried out only with the separate consent of the data subject.

3.7. The Operator does not plan and does not carry out cross-border transfer of Users' personal data.

Destruction of Personal Data

3.8. Upon achieving the Processing purposes, the Operator ceases Processing and ensures the destruction of Personal Data within the period established by:

(1) the Operator's local acts;

(2) the consents for the processing of personal data.

3.9. The Operator ceases the Processing of personal data in case of detection of their unlawful processing within 3 business days from the date of detection.

3.10. In case of withdrawal of consent to the Processing of personal data by the User and the absence of other legal grounds for the Operator, the Operator ceases processing and ensures the destruction of personal data.

3.11. In case of withdrawal of consent by the User for the processing of personal data for marketing purposes (promotion of goods, works, services on the market by establishing direct contacts with a potential consumer via communication means), the Operator ceases processing such personal data immediately.

3.12. The destruction of personal data implies the deletion of personal data from the Operator's servers in case of automated processing, and/or the destruction of tangible media in case of non-automated processing, as a result of which it becomes impossible to restore the content of the personal data.

4. Why do we need personal data?

The Operator processes Users' personal data for the following purposes:

4.1. concluding and executing contracts where the User is a party, beneficiary, or guarantor, as well as concluding contracts at the User's initiative;

4.2. using the Site in accordance with its functional purpose, creating an account, fulfilling User requests, sending notifications and information related to the use of the Site, providing the User with effective client and technical support in case of problems related to the use of the Site;

4.3. improving the quality of the Operator's services and service, the Site, its usability, developing new functionality, including by analyzing usage results, enriching the database;

4.4. operating the service for phone number scoring;

4.5. informing about new products and services, special offers, and various events related to the Operator's activities;

4.6. processing User requests for access to personal data, appeals for clarification or destruction of personal data, other requests and appeals, as well as fulfilling other obligations of the Operator;

4.7. for the purposes of exercising the rights and legitimate interests of the Operator or third parties, including determining the User's location for security purposes, preventing fraud, confirming the accuracy and completeness of personal data provided by the User.

4.8. Verifying the lawfulness of processing personal data contained in the User's Customer Base, including using the Multifunctional Information Exchange Service (MIES), in cases and manner prescribed by the legislation of the Russian Federation.

5. On what basis do we process personal data?

5.1. The processing of personal data is carried out in compliance with the principles:
(Art. 5 of the "Personal Data Law")

● lawfulness and fairness;

● limiting the processing of personal data to achieving specific, predetermined, and lawful purposes (as well as preventing the processing of personal data incompatible with the purposes of collecting personal data; preventing the merging of databases containing personal data processed for incompatible purposes; processing only those personal data that correspond to the purposes of their processing);

● correspondence of the content and volume of the processed personal data to the stated processing purposes (as well as preventing the processing of personal data excessive in relation to the stated purposes of their processing);

● ensuring the accuracy, sufficiency, and relevance of personal data in relation to the purposes of processing personal data;

● storing personal data no longer than required by the processing purposes (as well as destroying or anonymizing personal data upon achieving the processing purposes or in case of loss of the necessity to achieve these purposes, if the Operator cannot eliminate the violations of personal data, unless otherwise provided by federal law).

5.2. The Operator processes personal data on the following lawful grounds:
(1) Based on clause 5, part 1, article 6 of the "Personal Data Law" (performance of a contract) – for the purposes specified in clauses 4.1, 4.2, 4.4, 4.6, 4.7 of this Policy.
(2) Based on clause 1, part 1, article 6 of the "Personal Data Law" (data subject's consent) – for the purposes specified in clauses 4.3, 4.5, 4.8 of this Policy.

● using the Site according to its functional purpose, creating an account, fulfilling User requests, sending notifications and information related to the use of the Site, providing effective client and technical support;

● operating the phone number scoring service;

● improving the quality of services, the Site, its usability, developing new functionality, including by analyzing usage results;

(3) Based on clause 1, part 1, article 6, article 15 of the "Personal Data Law" (obtaining consent) – for the purpose of informing about new products, services, special offers, and events;

(4) Based on clause 2, part 1, article 6 of the "Personal Data Law" – for processing User requests for access to personal data, appeals for clarification or destruction, other requests, and fulfilling other obligations of the Operator.

(5) Based on clause 7, part 1, article 6 of the "Personal Data Law" – for the purposes of exercising the rights and legitimate interests of the Operator or third parties, including determining location for security, preventing fraud, confirming data accuracy.

6. What personal data do we process?

6.1. The Operator processes the following categories of personal data:

(1) First name, Last name, Patronymic, phone number, email address – for concluding and executing contracts where the User is a party, beneficiary, or guarantor.

(2) Cookie file data, including IP address, browser information, technical characteristics of equipment and software, date and time of access, addresses of requested pages – for using the Site, creating an account, fulfilling requests, providing support.

(3) Cookie file data (as above) – for improving the quality of services, the Site, its usability, developing new functionality, analyzing usage, enriching the database.

(4) First name, Last name, Patronymic, phone number, email address – for informing about new products, services, special offers, and events.

(5) Phone number and cookie data containing information about website visits, date and time of access – for operating the phone number scoring service.

(6) First name, Last name, Patronymic, phone number, email address – for processing User requests regarding access, clarification, or destruction of personal data, other requests.

(7) Cookie file data (as above), First name, Last name, Patronymic, phone number, email address – for exercising the rights and legitimate interests of the Operator or third parties (security, fraud prevention, data verification).

(8) Data constituting the User's Customer Base: phone numbers, other personal data of individuals that the User uploads to the Service or transmits via API for the purpose of sending messages. The Operator processes this data as a processor on behalf of the User.

6.2. Cookie files allow for the subsequent identification of the User or device, remembering a session, or saving some settings and preferences specific to these sites. This information, after being saved in the browser and until the expiration of the set term or deletion from the device, will be sent with each subsequent request to the site on whose behalf they were saved for processing by the Operator.

6.3. If the User does not agree with the processing of cookies, they must accept the risk that the Site's functions and capabilities may not be available in full, and then follow one of these options:

(1) configure their browser themselves to limit the collection and sending of cookies for the Site;

(2) switch to the browser's special "incognito" mode to allow the site to use cookies until the browser window is closed or until switching back to normal mode;

(3) leave the Site to avoid further processing of cookies.

6.4. The User can at any time change the privacy settings of their device and disable the function that provides the Site with information about their location. However, disabling access to location information may affect certain functions of the Site. For all questions related to the privacy settings of the User's device, they should contact its manufacturer or mobile operator for help.

6.5. The User agrees that blocking the provision of certain information may affect the functionality of the Site. A demand to stop processing the categories of personal data specified in this section may lead to the termination of the Agreements at the User's initiative.

6.6. The Operator does not process:

(1) special categories of personal data;
(concerning race, nationality, political views, religious or philosophical beliefs, health status, intimate life of the data subject)

(2) biometric personal data.
(concerning physiological and biological characteristics of a person that can be used to establish their identity and which are used by the Operator for identification purposes)

7. What rights do I have regarding my personal data?

Withdraw consent to the processing of personal data

7.1. Consent to the processing of personal data for marketing purposes (for informing about new products, services, special offers, and events) can be withdrawn by the User at any time.

7.2. The User can send a withdrawal of consent to the Operator at the email address support@botto.ai, indicating "Personal Data" in the subject line. The User can also withdraw consent in another way.

7.3. When the Operator receives a withdrawal of consent to process personal data, it loses the right to continue processing the User's personal data. The Operator loses the right to process personal data to the extent specified in the User's consent.

Get access to personal data

7.4. The User has the right to receive information related to the processing of their personal data, including containing:

(1) confirmation of the fact of processing of personal data;

(2) the legal grounds and purposes of processing personal data;

(3) the purposes and methods of processing personal data used by the Operator.

7.5. To obtain information related to the Processing of personal data, the User needs to send the Operator a request for access to personal data.

7.6. The request must indicate:

(1) series and number of the identity document of the User;

(2) information about the date of issue and the issuing authority of the User's identity document;

(3) information confirming the fact of processing of personal data.

7.7. The request for access to Personal Data is sent to the email address support@botto.ai.

7.8. The Operator responds to the request at the email address from which the said request was received.

Clarify or destroy personal data

7.9. If the Personal Data is:

(1) incomplete, outdated, inaccurate;

(2) unlawfully obtained;

(3) not necessary for the stated processing purpose,

Users have the right to:

● change personal data about themselves independently via the personal account on the Site (where applicable);

● send the Operator an appeal to clarify or destroy personal data.

7.10. If unlawful processing of personal data is identified, the Operator is obliged to stop the unlawful processing and destroy the unlawfully processed personal data.

7.11. Appeals for clarification or destruction of personal data must be sent to the email address support@botto.ai.

7.12. The Operator responds to appeals regarding clarification or destruction of personal data at the email address from which the appeal was received.

7.13. The User, acting as the data controller in relation to the data in their Customer Base, bears full responsibility to the data subjects and authorized bodies for compliance with their rights, including the right to withdraw consent, access, clarify, and destroy data. The Operator (Botto LLC) provides the User with the necessary assistance in fulfilling their obligations as a controller within the functionality of the Service.

8. How do we protect personal data?

8.1. The Operator takes organizational and technical measures aimed at ensuring the security of Users' personal data, including:

● identifying threats to the security of personal data during their processing;

● adopting local regulations and other documents governing relations in the field of processing and protection of personal data;

● appointing persons responsible for ensuring the security of personal data in the structural divisions and information systems of the Operator;

● creating the necessary conditions for working with personal data;

● organizing the accounting of documents containing personal data;

● organizing work with information systems in which personal data is processed;

● storing personal data under conditions that ensure their safety and exclude unauthorized access to them;

● organizing training for the Operator's employees who process personal data.

8.2. The collected and processed personal data is located on servers within the territory of the Russian Federation. This ensures the Operator's compliance with the legal requirement to localize the personal data of citizens of the Russian Federation on the territory of the Russian Federation.