Documents and company details

1. Parties and scope

The Delayou customer, a legal entity or individual entrepreneur using the program for business, acts as the personal data operator for data placed in its workspace (the Operator). MOBILNYE RESHENIYA LLC (ООО «МОБИЛЬНЫЕ РЕШЕНИЯ»), Tax ID 6320055779, company registration number 1216300009969, processes that data on the Operator's instructions (the Processor).

This agreement is an annex and an integral part of the Delayou licence offer and sets out processing terms under Article 6(3) of Russian Federal Law No. 152-FZ on Personal Data. It applies when the offer is accepted and data is submitted for processing, including during the free trial, and remains effective until the instructed processing and deletion are completed.

This agreement governs instructed workspace data. Processing of website visitors' and customer representatives' data for contracting, billing and support is described in the privacy policy, under which the Processor acts as an independent operator. This agreement does not replace that policy or separate demo request consent.

2. Instructions and Operator responsibilities

The Operator determines processing purposes, data scope, users and access settings. Instructions are expressed through authorised users' program actions, workspace settings, integrations selected by the Operator and requests submitted by an authorised representative through support or email.

The Operator ensures lawful collection and processing, informs data subjects and obtains consent where required, including the grounds for instructing the Processor. Acceptance of the offer by a customer is not consent from every person whose data it uploads.

The Processor processes instructed data only for the purposes stated here and to carry out lawful instructions. If an instruction prevents compliance with law or requires clarification, the Processor informs the Operator so that further steps can be agreed.

3. Processing purposes

Processing is instructed to provide and configure the Delayou workspace, manage users and access, and support the customer's contacts, interactions, tasks, projects, documents and other workflows within selected modules.

These purposes include actions and integrations instructed by the Operator, support and diagnostics in response to its requests, backups and recovery, security, and temporary retention to resume work after licence expiry within the agreed period.

The Processor does not use instructed personal data for its own advertising or purposes outside these instructions.

4. Data subjects and data categories

Data subjects are the Operator's staff and authorised users, its customers, counterparties and their representatives, and candidates whose data it processes for recruitment. The actual scope depends on selected modules and the Operator's lawful purposes.

Instructed data comprises names; business contact details including telephone numbers, email and correspondence addresses; organisation and job title; candidates' professional information about education, qualifications and work experience; account identifiers, assigned permissions and workspace activity; and information relating to these people in business interactions, tasks and documents placed by the Operator for the stated purposes.

Data must be proportionate to the processing purpose. Other data categories, special categories and biometric data require separately agreed processing terms and appropriate lawful grounds; this agreement does not itself create such grounds.

5. Processing operations

Permitted automated operations and non-automated support operations comprise collection on instructions, recording, organisation, accumulation, storage, correction and updating, retrieval, use, access for authorised persons, transfers to integrations selected by the Operator, de-identification, blocking, deletion and destruction.

Accepting this agreement alone does not authorise public dissemination. Disclosure to an unrestricted audience requires separate instructions and lawful grounds. Access and integration settings do not relieve the Operator of checking the lawfulness of transfers.

6. Confidentiality and security

The Processor keeps instructed data confidential, grants access only to authorised persons to the extent needed and complies with applicable requirements of Articles 18.1 and 19 of Law No. 152-FZ. Organisational measures include a responsible person, internal policies, staff training and compliance controls.

Taking processing and identified threats into account, the Processor determines the required protection level and implements corresponding measures: access control and accounting, protected transmission, event logging, detection of unauthorised access, backups and recovery, evaluation of protection measures and ongoing controls.

When collecting Russian citizens' personal data, the Processor ensures recording, organisation, accumulation, storage, updating and retrieval using databases in Russia where Article 18(5) of Law No. 152-FZ applies. A worldwide licence does not authorise arbitrary relocation of databases abroad.

7. Other processors

Where processing must be delegated, the Processor gives at least 10 working days' prior notice identifying the other processor, contact details, purpose and scope. The Operator may raise reasoned objections before processing begins so that a solution can be agreed.

The other processor is bound by confidentiality and security obligations necessary to fulfil the instructions. The Processor remains responsible to the Operator for processing it delegates within applicable law and the agreement.

Transfers to integrations selected by the Operator follow its instructions. Foreign processors and cross-border transfers require separate agreement and compliance with statutory procedures; the programme's licence territory does not replace that agreement.

8. Incident notifications

If unlawful or accidental transfer, provision, dissemination or access to instructed personal data is identified and has infringed data subjects' rights, the Processor notifies the Operator within 12 hours of identifying the incident.

The initial notice includes information available at that time: circumstances, affected data and subject categories, suspected causes and possible harm, measures taken and a responsible contact. Information is supplemented as it is established.

Within 48 hours of identification, the Processor provides available internal investigation findings, including responsible persons where known. Further significant findings and measures are reported subsequently. These contractual deadlines do not replace the Operator's own statutory duties to notify the supervisory authority.

9. Requests and supporting documents

Throughout the instructions, including before processing begins, the Operator may request documents and information confirming compliance. The Processor supplies them within 10 working days unless a shorter statutory deadline applies, while protecting other customers' data and protected information.

Where the Processor collects data on instructions based on consent, the Operator supplies the applicable consent form. The Processor provides evidence of consents it obtained within 5 working days of a request and hands over relevant evidence on termination.

The Operator handles data subjects' requests and issues necessary instructions. The Processor assists with locating, correcting, blocking and deleting instructed data within its functions and applicable deadlines.

10. Retention, termination and deletion

Data is processed while workspace licences are active and retained for 6 months after all active workspace licences expire to allow work to resume, except where earlier deletion is lawfully requested by the Operator or required by law. Expiry of one licence while others remain active does not trigger deletion of the entire workspace. The Operator ensures a lawful retention ground. This agreement remains effective during retention; processing for other purposes is prohibited.

Renewing licences before that period expires restores access to retained data within the selected licence scope. If licences are not renewed, data is deleted after 6 months; the only exception is information that must be kept by law, with processing restricted to that purpose.

An authorised representative may request earlier termination and deletion of specified or all instructed data. The Processor fulfils the request within 15 calendar days of receipt unless a shorter statutory period applies. A lawful deletion request takes precedence over the six-month retention period.

Deletion covers live databases and backups containing instructed data. If destruction within the required period is objectively impossible, the Processor blocks the data and ensures destruction within the grounds and deadlines allowed by law, informing the Operator of reasons, measures and timeframes. If retention is legally required, the Processor explains the basis and limits processing to that purpose.

On request, the Processor provides evidence of destruction within 5 working days, prepared in accordance with applicable statutory requirements. Requests affecting the entire workspace are checked for the requester's authority.

11. Responsibility and effect

The Operator and Processor are responsible under Law No. 152-FZ and applicable law. The Processor is responsible to the Operator for breaches of instructed processing obligations; the licence offer does not override mandatory data protection requirements.

Where general licence offer provisions and this agreement differ on instructed personal data processing, this agreement's specific provisions and mandatory law prevail. A new version requires review and express consent from the Operator through a separate confirmation in the program or written agreement between the parties. Publication, continued use, automatic renewal or a charge do not, by themselves, constitute acceptance. Until agreement is reached, the previously accepted data processing agreement remains in effect for existing relations and automatic renewals.

12. Requests and company details

An authorised representative of the Operator submits processing enquiries, document requests and deletion instructions through support in the program or to info@delayou.biz. Include the organisation, workspace and request details.

Processor: MOBILNYE RESHENIYA LLC, Tax ID 6320055779, company registration number 1216300009969. Current company details and contacts.

The English version is provided for convenience; the Russian version prevails in the event of differences.