Data processing agreement

This document describes a separately agreed business processing arrangement. Visiting this page or accepting the offer does not conclude a DPA. Before processing, parties sign an annex identifying the instructing controller, subject and data categories, purposes, operations, recipients, territories, periods and deletion procedure.

The instructing controller confirms lawful bases and supplies documented instructions. The provider processes within those instructions, limits access, handles subject requests and provides agreed incident assistance. Notifications and regulatory duties follow mandatory legal deadlines and any agreed shorter deadlines.

Infrastructure outside Russia is used, including a server in Germany according to the owner. Requests may be processed by third-party API suppliers. The complete chain of legal entities, processing territories, each recipient’s retention practices and controller notification procedures require verification. This document does not certify Russian data localisation and does not replace cross-border transfer requirements.

Subprocessors, audit rights, chain changes, data return or deletion and retention of required records are specified in the annex. The special processing mode is not activated until these facts are verified. Consent does not replace localisation and cross-border transfer requirements.