1. Personal Data Operator
1.1. The personal data operator is individual entrepreneur Erkhov Andrey Viktorovich (hereinafter — the Operator, Amicon), OGRNIP 326620000043721, INN 622709706110. 1.2. Email address for enquiries concerning the processing of personal data: hello@amicon.ai. The postal address for sending written enquiries is provided by the Operator upon a request sent to that email address. 1.3. The Operator is an individual entrepreneur. The obligation to appoint a person responsible for organising the processing of personal data, established by Article 22.1 of Law No. 152-FZ for operators that are legal entities, does not apply to the Operator; the Operator organises the processing of personal data personally.
2. Terms and Definitions
Personal data — any information relating to a directly or indirectly identified or identifiable individual (personal data subject). Subject — an individual to whom personal data relates. Processing of personal data — any action (operation) or set of actions performed with or without the use of automation means, including the collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), anonymisation, blocking, deletion and destruction of personal data. Operator — a person that, independently or jointly with other persons, organises and (or) carries out the processing of personal data and determines the purposes of processing, the composition of the personal data to be processed and the actions performed with personal data. Platform — the amicon.ai / amicon.su website, the Amicon / Amicon Studio mobile application and related services. User — an individual using the Platform, whether registered on it or not. Profile — a User's account on the Platform. Project — a workspace on the Platform for organising interaction between Project participants (correspondence, files, statuses). Interactive chat — a service available on the Platform enabling a User to contact the Operator, including without registration; it does not constitute correspondence within a Project. Cookie — a small piece of data stored on the User's device and transmitted by the browser upon subsequent requests to the Platform. Other terms are used in the meanings established by Law No. 152-FZ and by the offer governing the use of the Platform (hereinafter — the Offer).
3. Categories of Subjects and Composition of the Personal Data Processed
3.1. Registered Users. The following are processed, in particular: information provided by the User upon registration and in the Profile (name or other designation, email address and the record of its confirmation, telephone number, profile image, text description); authentication data stored in the form of irreversible hash values; account information (role on the Platform, preferred interface language, records of acceptance of the Offer, of this Policy and of the cookie decision, information on the blocking of the Profile, the dates of creation and modification of the Profile). 3.2. Technical session and security data. The following are processed, in particular: IP address; browser and device information (User-Agent); session identifier; the date and time of the beginning and the end of the session; service information necessary to detect abuse. 3.3. Data arising in the course of work within a Project. The following are processed, in particular: content posted by Project participants; information on Project participants and their roles; Project service events and the content of notifications thereof. 3.4. Data for the delivery of push notifications. Where the mobile application is used, the following are processed, in particular: the push notification token, the platform type, the language, and other technical information on the device and the application version that is necessary for the delivery of notifications. 3.5. Data of enquiries submitted through the interactive chat. Where the interactive chat is used, the texts of the User's messages are processed and, for unregistered visitors, an anonymous identifier stored in a cookie. The procedure for the automated processing of such messages is described in Section 7 of the Policy. 3.6. Candidate data. Where a response to a job vacancy is submitted, the following are processed: surname, first name and patronymic; email address; the desired position; the text of the enquiry; the information contained in the CV. 3.7. Data of persons submitting enquiries and complaints. The information specified in the enquiry and the content of the message in respect of which the complaint is filed are processed. 3.8. Data related to the monitoring function. The following are processed, in particular: the identifier of the owner of the monitored resource; email address; the addresses of the resources checked; the results of checks and information on the technical errors detected. The Operator does not collect the personal data of visitors to the monitored resources. 3.9. The Operator does not purposefully process special categories of personal data (concerning racial and ethnic origin, political opinions, religious and philosophical beliefs, state of health or intimate life) or biometric personal data. The profile image is not used by the Operator to establish identity and is not processed as biometric personal data. Where such information is contained in materials submitted by the Subject on the Subject's own initiative, in particular in a CV or an enquiry, the Operator does not use it for independent purposes and deletes it in the absence of legal grounds for its processing. 3.10. The Platform is not intended for persons under eighteen years of age. The Operator does not purposefully collect the personal data of such persons; upon receiving information that the personal data of a minor has been provided without the consent of a legal representative, the Operator deletes it. 3.11. The Operator does not request information that is not required for the purposes specified in Section 4. The User independently determines what information to post in the Profile and in a Project. The lists set out in this Section reflect the composition of the personal data processed as at the date of this version of the Policy; the specific composition depends on which functions of the Platform the User uses. The Operator gives notice of changes in the composition of the personal data processed in the manner provided for by clause 16.3 of the Policy.
4. Purposes of Processing and Legal Grounds
Personal data is processed solely for the purposes listed below. The legal ground under Article 6 of Law No. 152-FZ is specified for each purpose. 4.1. Registration and maintenance of the Profile, provision of access to the Platform, identification of the User upon login, confirmation of the email address, recovery of access. Ground: performance of a contract to which the Subject is a party (clause 5 of Part 1 of Article 6); consent of the Subject (clause 1 of Part 1 of Article 6). 4.2. Organisation of interaction within a Project: exchange of messages and files, maintenance of statuses and stages, sending notifications of Project events. Ground: performance of a contract (clause 5 of Part 1 of Article 6). 4.3. Sending service notifications by email and as push notifications. Ground: performance of a contract (clause 5 of Part 1 of Article 6). Advertising and informational mailings that are not connected with the performance of a contract are sent only where the Subject has given separate prior consent in accordance with Article 18 of the Federal Law On Advertising. 4.4. Ensuring the security of the Platform: preventing unauthorised access, detecting and suppressing abuse, investigating incidents. Ground: the exercise of the rights and legitimate interests of the Operator, provided that the rights and freedoms of the Subject are not violated (clause 7 of Part 1 of Article 6). 4.5. Consideration of enquiries, complaints and claims, protection of the rights and legitimate interests of the Operator, including in court. Ground: clause 7 of Part 1 of Article 6. 4.6. Fulfilment of the obligations imposed on the Operator by law, including the maintenance of accounting and tax records and the retention of primary documents. Ground: clause 2 of Part 1 of Article 6. 4.7. Consideration of enquiries received through the interactive chat, the selection of a solution and the preliminary calculation of the cost of work, including the automated analysis of messages. Ground: taking steps to conclude a contract at the initiative of the Subject (clause 5 of Part 1 of Article 6). Where the Subject has given consent to the processing of personal data in the manner provided for by Section 6 of the Policy, the processing is also carried out on the basis of such consent (clause 1 of Part 1 of Article 6). 4.8. Consideration of responses to job vacancies and correspondence with candidates. Ground: consent of the Subject (clause 1 of Part 1 of Article 6). 4.9. Provision of the function of monitoring the operability of software and the sending of alerts to the owner of the monitored resource. Ground: performance of a contract (clause 5 of Part 1 of Article 6); consent of the Subject (clause 1 of Part 1 of Article 6). 4.10. Personal data is not processed for purposes not specified in this Section unless the corresponding amendments are made to this Policy and notice is given to Users in the manner provided for by clause 16.3 of the Policy. The Operator does not sell personal data, does not transfer it for the purposes of advertising targeting, and does not take decisions based solely on automated processing that give rise to legal consequences in respect of the Subject or otherwise affect the Subject's rights and legitimate interests.
5. Methods of Processing and Location of the Databases
5.1. Processing is carried out with and without the use of automation means and includes the collection, recording, systematisation, accumulation, storage, clarification, extraction, use, transfer (provision, access), blocking, deletion and destruction of personal data. 5.2. The databases containing the personal data of citizens of the Russian Federation are located on servers situated within the territory of the Russian Federation. The collection, recording, systematisation, accumulation, storage, clarification and extraction of the personal data of citizens of the Russian Federation are carried out using such databases in accordance with Part 5 of Article 18 of Law No. 152-FZ. 5.3. Files posted by Users (attachments, profile images, correspondence exports) are stored on servers within the territory of the Russian Federation.
6. Consent to the Processing of Personal Data and Its Withdrawal
6.1. Consent to the processing of personal data is given by the User upon registration on the Platform by marking the acceptance of the Offer and of this Policy. The date and time at which consent is given are recorded by the Operator. 6.1.1. A person who submits to the Operator a response to a vacancy, a CV or any other enquiry concerning employment expresses consent to the processing of personal data by the very fact of submitting such materials to the Operator — using the response form on the Platform or by writing to the Operator's email address. Consent is deemed to have been given at the moment when the Operator receives the relevant materials; the Operator records the fact and the date of their receipt. The response form on the Platform contains a notice on the processing of personal data with a link to this Policy; where materials are sent by email, this Policy is available at the address specified in clause 16.4 of the Policy. The consent covers the personal data specified in clause 3.6 of the Policy, is given for the purposes specified in clause 4.8 of the Policy and is valid for the period specified in clause 13.2 of the Policy. A person who does not wish their personal data to be processed for those purposes may refrain from submitting such materials to the Operator or withdraw consent in the manner provided for by clause 6.4 of the Policy; such a refusal does not affect access to the other functions of the Platform. 6.2. Consent to the use of the cookies for which it is required in accordance with clause 12.2.2 of the Policy is given separately — by way of confirmation in the information notice on the Platform. 6.3. The provision of personal data is voluntary. A refusal to provide the information necessary for registration makes it impossible to create a Profile and to use the functions of the Platform that require authorisation. 6.4. The Subject may withdraw consent at any time by sending a notice to hello@amicon.ai from the email address specified in the Profile or by any other means that makes it possible to establish the identity of the applicant. 6.4.1. The User may independently delete the Profile and the personal data associated with it using the functionality of the Platform, where such functionality is available in the version of the Platform being used, or by submitting an enquiry to the Operator in the manner provided for by clause 6.4 of the Policy. Deletion of the Profile at the User's initiative entails the cessation of processing and the destruction of personal data, subject to clause 6.5 of the Policy. 6.4.2. Independent deletion of the Profile is unavailable for as long as circumstances preventing the cessation of processing persist, in particular where the User is the owner of an active Project or a party to an active development contract. In such a case the User must first complete or terminate the relevant relations, transfer ownership of the Project to another participant or submit an enquiry to the Operator; the Operator informs the User of the reason why deletion is not possible and of the conditions for carrying it out. 6.5. Upon the withdrawal of consent, the Operator ceases the processing and destroys the personal data within a period not exceeding thirty days from the date of receipt of the withdrawal, in the manner provided for by clause 13.3 of the Policy. In accordance with Part 2 of Article 9 of Law No. 152-FZ, the Operator may continue the processing without the Subject's consent where the grounds provided for by clauses 2–11 of Part 1 of Article 6 of Law No. 152-FZ are present, in particular where the processing is necessary for the performance of a contract, for the fulfilment of the obligations imposed on the Operator by law, or for the protection of the rights and legitimate interests of the Operator. In such a case the Operator informs the Subject of the ground for and the scope of the processing that is continued.
7. Automated Analysis of Enquiries
7.1. The texts of the messages sent by the User to the interactive chat are processed and analysed using generative artificial intelligence technologies. The results of such processing are used by the Operator for the purposes specified in clause 4.7 of the Policy. 7.2. The results of the automated processing are available to the Operator and are not transferred to third parties, except in the cases specified in Sections 8 and 9 of the Policy. 7.3. Decisions giving rise to legal consequences in respect of the Subject or otherwise affecting the Subject's rights and legitimate interests are not taken solely on the basis of automated processing. The Subject may object to the processing described in this Section by sending an enquiry to hello@amicon.ai. 7.4. The use of the interactive chat is voluntary. The Operator recommends that no information which is not required for the consideration of the enquiry be provided in the chat, including information about third parties and other confidential information.
8. Transfer of Personal Data to Third Parties
8.1. The Operator does not disseminate personal data, that is, does not disclose it to an indefinite range of persons. Consent to the dissemination of personal data under Article 10.1 of Law No. 152-FZ is neither requested nor used by the Operator. 8.2. The Operator may entrust the processing of personal data to third parties with the Subject's consent and on the basis of a contract providing for the obligation to observe confidentiality and the requirements for the protection of personal data (Part 3 of Article 6 of Law No. 152-FZ). The Operator is liable to the Subject for the actions of such persons. 8.3. As at the date of this version of the Policy, personal data is transferred to the following persons: — to the provider of generative artificial intelligence services (the DeepSeek service, api.deepseek.com, People's Republic of China) — the texts of the messages sent by the User to the interactive chat; — to the provider of push notification delivery services (the Expo service, exp.host, United States of America) — the device push notification token, the title and text of the notification, and service information on the relevant event; — to the hosting provider and the telecommunications operators ensuring the functioning of the Operator's servers within the territory of the Russian Federation — to the extent necessary for hosting and operating the Platform. 8.4. Email is sent from the Operator's mail server located within the territory of the Russian Federation; the Operator does not transfer the content of messages to third-party mail services. Delivery of a message to the addressee is carried out by the addressee's mail provider. 8.5. Personal data may be provided to the state authorities of the Russian Federation on the grounds and in the manner established by law. 8.6. The Platform may contain links to third-party resources, including application stores. The processing of personal data on such resources is governed by their own policies; the Operator is not responsible for it. 8.7. Personal data is not transferred to web analytics services, advertising and tracking services, or visit counters.
9. Cross-Border Transfer of Personal Data
9.1. The transfer of personal data specified in clause 8.3 of the Policy constitutes a cross-border transfer to the territory of the People's Republic of China (the generative artificial intelligence service) and of the United States of America (the push notification delivery service). The current status of those transfers is set out in clause 9.5 of the Policy. 9.2. Only that volume of personal data which is necessary for the operation of the relevant function is transferred outside the Russian Federation. No other personal data is transferred outside the Russian Federation. 9.2.1. Cross-border transfer of personal data is carried out in compliance with the requirements of Article 12 of Law No. 152-FZ, including the submission to the Federal Service for Supervision of Communications, Information Technology and Mass Media (hereinafter — Roskomnadzor) of a notice of the intention to carry out a cross-border transfer of personal data. 9.3. The Subject may decline the functions that involve cross-border transfer: by not using the interactive chat and by disabling push notifications in the application settings. Declining these functions does not restrict access to the remaining functionality of the Platform. 9.4. The Operator does not carry out any other cross-border transfer of personal data.
10. Processing of Data Posted by the User in a Project
10.1. The User may post in a Project information about third parties, including the User's employees, representatives or clients. In respect of such information the User is the operator, while the Operator acts as a person carrying out the processing of personal data on behalf of the User in accordance with Part 3 of Article 6 of Law No. 152-FZ. 10.2. Processing on behalf of the User is carried out solely for the purpose of ensuring the operation of the Project and includes storage, systematisation, extraction, the provision of access to Project participants, the sending and delivery of notifications of Project events to Project participants, backup, blocking, deletion and destruction. The Operator performs no other actions with such information and does not use it for its own purposes. 10.3. The Operator ensures the confidentiality and security of such information and does not disclose it to third parties, except in the cases provided for by law and in the case of the engagement of notification delivery service providers in the manner provided for by clause 10.5 of the Policy. 10.4. The User independently ensures that legal grounds exist for the transfer of information about third parties to the Operator and fulfils the obligation to notify them where such an obligation is provided for by law. 10.5. For the delivery of notifications of Project events the Operator may engage the delivery service providers specified in clause 8.3 of the Policy, in compliance with Part 3 of Article 6 of Law No. 152-FZ. A notification includes only that volume of information which is necessary to give notice of the event. With regard to the engagement of such providers and the related cross-border transfer, the obligations of a personal data operator provided for by Article 12 of Law No. 152-FZ are fulfilled by the Operator; those obligations are not imposed on the User. The current status of cross-border transfer is set out in clauses 9.4 and 9.5 of the Policy.
11. Rights of the Personal Data Subject and the Procedure for Exercising Them
11.1. The Subject has the right to obtain the information provided for by Part 7 of Article 14 of Law No. 152-FZ, including: confirmation of the fact of processing; the legal grounds for and the purposes of the processing; the methods of processing applied; information about the Operator; the composition of the personal data processed and the source from which it was obtained; the periods of processing and storage; the procedure for exercising the Subject's rights; information on the persons to whom the personal data has been or may be transferred; information on any cross-border transfer carried out or contemplated. 11.2. The Subject may require the clarification, blocking or destruction of personal data where it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing, and may also withdraw consent and object to the processing. 11.3. In order to exercise these rights the Subject sends a request to hello@amicon.ai or applies by means of the functionality available on the Platform. The request must contain information making it possible to identify the Subject (in particular, the email address specified in the Profile), information confirming the fact that the Operator processes the Subject's personal data, and the substance of the requirement. 11.3.1. A request on paper is signed by the Subject or the Subject's representative by hand. A request in the form of an electronic document is signed with an electronic signature in accordance with Federal Law No. 63-FZ of 6 April 2011 On Electronic Signature, as provided for by Part 3 of Article 14 of Law No. 152-FZ. 11.3.2. Where the Subject has a Profile, the Operator accepts a request without an electronic signature provided that the request is sent from the email address confirmed in the Profile or is made by means of the functionality of the Platform after logging in to the Profile: in that case the Subject is identified by the Profile. Where there are reasonable doubts as to the identity of the applicant, the Operator may request additional information confirming identity or propose that the request be submitted in the manner provided for by clause 11.3.1; personal data is not provided until identity has been confirmed. 11.3.3. Where the Subject does not have a Profile, the Operator accepts a request without an electronic signature provided that the request is sent from the email address that the Subject specified when submitting a response to a vacancy or another enquiry and contains information making it possible to match the request with the personal data previously obtained. Where there are reasonable doubts as to the identity of the applicant, clause 11.3.1 of the Policy applies. 11.4. The periods for the consideration of enquiries are as follows: — the provision of information on the processing of personal data or of a reasoned refusal — ten working days from the date of the enquiry; the period may be extended by no more than five working days, with notice to the Subject of the reasons for the extension; — the clarification of personal data where the fact of its inaccuracy is confirmed — seven working days; — the cessation of unlawful processing — three working days from the date on which it is detected; — the destruction of personal data upon the achievement of the purpose of processing or upon the withdrawal of consent — thirty days. 11.5. The Subject may appeal against the acts or omissions of the Operator to Roskomnadzor or in court. 11.6. The User may independently change the information in the Profile section and manage individual types of notifications in the settings, and may also delete the Profile in the manner provided for by clauses 6.4.1–6.4.2 of the Policy.
12. Cookies and Local Storage
12.1. The following cookies are used on the Platform: — the authorisation session cookie — necessary for logging in to the Profile and maintaining the session; the storage period corresponds to the duration of the session; — the cookie decision cookie — stores the record of the choice made; storage period — one year; — the interface language cookie — stores the language selected; storage period — one year; — the interactive chat anonymous identifier cookie — makes it possible to preserve the history of an unregistered visitor's enquiry; storage period — thirty days and, where the User registers and the correspondence is linked to the User's Profile, until such linking. 12.2. Strictly necessary cookies (the authorisation session, the interface language, the record of the cookie decision) are used on the basis of the Operator's legitimate interest in ensuring the operability of the Platform (clause 7 of Part 1 of Article 6 of Law No. 152-FZ). 12.2.1. Cookies that are necessary for the provision of a function the use of which is initiated by the User are set at the moment when the use of the relevant function begins. These include the interactive chat anonymous identifier cookie, which is set when the first message is sent to the chat. The legal ground for its use corresponds to the ground for processing specified in clause 4.7 of the Policy. Such a cookie is not used for analytics, profiling or advertising. 12.2.2. Other cookies, including third-party analytics and advertising cookies, are set only after the User's consent has been obtained. 12.3. The User may disable cookies in the browser settings. Disabling strictly necessary cookies makes it impossible to log in to the Profile and to use the functions that require authorisation. 12.4. The local storage of the browser is used to save interface settings and drafts entered by the User before they are sent. Such information is stored on the User's device and is not transferred to the Operator until the User sends it.
13. Periods of Processing and Storage of Personal Data
13.1. The processing of personal data ceases upon the achievement of the purposes of processing or upon the loss of the need to achieve them. Personal data is stored for no longer than the purposes of processing require. 13.2. The following maximum storage periods are established: — Profile data and the information associated with it — for the period of existence of the Profile and until thirty days have elapsed from the date of its deletion or of the withdrawal of consent (clause 13.3 of the Policy); — technical session data (IP address, User-Agent) — until the expiry of the session, but no longer than one year; — request rate counters — no longer than thirty days; — Project correspondence and files — for the term of the development contract and, following its termination, in the part comprising the information necessary to confirm the performance of obligations and to protect the rights of the Operator, until the expiry of the limitation period established by law; in the absence of such a contract — until the Project is deleted by the User or at the User's request; — push notification tokens — until the token is revoked, the mobile application is deleted or the Profile is deleted; — interactive chat correspondence and the results of its automated processing — no longer than one year from the date of the last enquiry (for unregistered Users), or for the period of existence of the Profile and until thirty days have elapsed from the date of its deletion or of the withdrawal of consent (clause 13.3 of the Policy); — candidate information — no longer than six months from the date on which the response was received, unless the Subject has consented to a longer storage period; — accounting and tax records containing personal data — for the periods established by law, but no less than five years. 13.3. Following the deletion of the Profile or the withdrawal of consent, personal data is destroyed in the Operator's live information systems immediately, but no later than within thirty days. From that moment the personal data contained in backup copies is blocked: such copies are used solely to restore the operability of the Platform after a failure and are not used for any other purposes of processing. Where data is restored from a backup copy, the destruction is applied again. Backup copies are stored for no longer than thirty days from the date of their creation, after which they are destroyed. 13.4. Personal data is not processed for an unlimited period.
14. Measures to Ensure the Security of Personal Data
14.1. The Operator takes legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination and other unlawful acts, and in particular: — identifies threats to the security of personal data and applies measures corresponding to the established level of protection; — restricts access to personal data to the range of persons who require it in order to perform their duties, and maintains a record of such persons; — applies secure methods of storing authentication data that preclude its restoration in the original form, and verification of the User's identity when access to the Profile is obtained; — ensures the encryption of data when it is transmitted between the User's device and the Platform; — limits the rate of requests and applies other measures to counter automated attacks; — performs backup and monitors the integrity of personal data; — ensures the possibility of restoring personal data that has been modified or destroyed as a result of unauthorised access. 14.2. In addition to Project participants, access to the content of a Project is available to the persons performing, on behalf of the Operator, the functions of Platform administration and technical support, to the extent necessary for the performance of their duties. Such persons are bound by a non-disclosure obligation. 14.3. Where a fact of unlawful or accidental transfer of personal data resulting in a violation of the rights of personal data subjects is established, the Operator notifies Roskomnadzor within twenty-four hours and reports the results of the internal investigation within seventy-two hours.
15. Cessation of Processing and Destruction of Personal Data
15.1. The processing of personal data ceases in the following cases: the achievement of the purposes of processing or the loss of the need to achieve them; the withdrawal of consent in the absence of other legal grounds for processing; the expiry of the storage period; the detection of unlawful processing where it is impossible to make it lawful; the deletion of the Profile; the termination of the Operator's activity. 15.2. Personal data processed with the use of automation means is destroyed by deleting it from the information systems in a manner that precludes its restoration. Physical media, including enquiries on paper, are destroyed in a manner that precludes the information contained in them from being read. 15.3. The fact of the destruction of personal data is confirmed by a record of destruction or by an export from the event log of the information system.
16. Final Provisions
16.1. The Operator may make amendments to this Policy. A new version enters into force from the moment it is posted on the Platform, unless the version itself provides otherwise. 16.2. Previous versions of the Policy are retained by the Operator. Relations that arose before a new version entered into force are governed by the version that was in effect at the time those relations arose. 16.3. The Operator gives notice to Users of the posting of a new version of the Policy on the Platform by means of a notice on the Platform. Amendments affecting the composition of the personal data processed, the purposes of processing or the list of persons to whom personal data is transferred are made by way of the adoption of a new version of the Policy. 16.4. The Russian-language version of the current version of the Policy is permanently available on the Platform at https://amicon.ai/privacy/, and its English-language version at https://amicon.ai/en/privacy/. In the event of any discrepancy between the versions, the Russian-language version prevails. 16.5. Questions, suggestions and enquiries concerning the processing of personal data are to be sent to hello@amicon.ai.