Personal Data Processing Policy

This personal data processing policy (the “Policy”) has been drafted in accordance with the requirements of Federal Law No. 152-FZ of the Russian Federation “On Personal Data” dated July 27, 2006, and defines the procedure for processing personal data and security measures taken by Strive-Task LLC (INN 9701284389, OGRN 1247700309340, KPP 770101001, registered address: 129164, Moscow, intracity territory of Alekseevsky Municipal District, Mira Ave., 120, premises 11P) (the “Operator”).

1.1. The Operator’s most important goal and condition for carrying out its activities is compliance with human and civil rights and freedoms in the processing of personal data, including protection of privacy and personal and family confidentiality.

1.2. This Policy applies to all websites, applications, and services administered by Strive-Task LLC, including but not limited to:

• https://kanbano.ru
• https://app.kanbano.ru
• https://api.kanbano.ru

2.1. Automated processing of personal data means processing personal data using computing equipment.

2.2. Blocking of personal data means temporary suspension of personal data processing (except where processing is required to clarify personal data).

2.3. Website (Service) means a set of graphical and informational materials, as well as computer programs and databases, ensuring their availability on the internet at https://kanbano.ru.

2.4. Personal data information system means a set of personal data contained in databases and the information technologies and technical means that ensure their processing.

2.5. Depersonalization of personal data means actions that make it impossible, without additional information, to determine that personal data belongs to a specific User or other data subject.

2.6. Processing of personal data means any action (operation) or set of actions (operations), performed with or without automation tools, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, and destruction of personal data.

2.7. Operator means a legal entity that independently organizes and/or carries out personal data processing and determines the purposes of processing personal data, the composition of personal data to be processed, and actions performed with personal data.

2.8. Personal data means any information directly or indirectly related to an identified or identifiable User of the kanbano.ru Service.

2.9. User means any individual visiting the website https://kanbano.ru and/or using the Kanbano Service, including those registered in the Service.

2.10. Provision of personal data means actions aimed at disclosing personal data to a specific person or group of persons.

2.11. Distribution of personal data means any actions aimed at disclosing personal data to an indefinite group of persons.

2.12. Cookie files are small text files stored on the User’s device by a browser and used to ensure Service operation, analytics, and saving User settings.

3.1. The Operator has the right to:

• obtain reliable information and/or documents containing personal data from the personal data subject;
• continue processing personal data without the subject’s consent if consent is withdrawn and there are grounds specified in the Personal Data Law;
• independently determine the composition and list of measures necessary and sufficient to ensure fulfillment of obligations under the Personal Data Law, unless otherwise provided by Russian law.

3.2. The Operator is obliged to:

• provide the personal data subject, upon request, with information related to processing of their personal data;
• organize personal data processing in accordance with current Russian legislation;
• respond to appeals and requests of personal data subjects and their legal representatives in accordance with the Personal Data Law;
• provide necessary information to the authorized authority for protection of personal data subjects’ rights within 10 days from receipt of its request;
• publish this Policy and ensure unrestricted access to it;
• take legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, distribution, and other unlawful actions;
• stop processing and destroy personal data in the manner and in cases provided by the Personal Data Law.

4.1. Personal data subjects have the right to:

• receive information related to processing of their personal data;
• require the Operator to clarify, block, or destroy their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the declared processing purpose;
• withdraw consent to personal data processing;
• appeal actions or inaction of the Operator to the authorized authority for protection of personal data subjects’ rights or in court;
• exercise other rights provided by Russian law.

4.2. Personal data subjects are obliged to:

• provide reliable personal information to the Operator;
• notify the Operator about clarification (update, modification) of their personal data.

5.1. Personal data processing is carried out on a lawful and fair basis.

5.2. Personal data processing is limited to achieving specific, pre-defined, and lawful purposes. Processing personal data incompatible with collection purposes is not allowed.

5.3. Combining databases containing personal data processed for incompatible purposes is not allowed.

5.4. Only personal data relevant to processing purposes is processed.

5.5. The content and volume of processed personal data correspond to stated processing purposes. Excessive personal data processing is not allowed.

5.6. Personal data processing ensures personal data accuracy, sufficiency, and, where necessary, relevance to processing purposes.

5.7. Personal data is stored no longer than required by processing purposes, unless another period is set by federal law or agreement.

6.1. User registration and granting access to Service functionality.

Within this purpose, the Operator processes the following personal data:

• name;
• email address;
• password (in hashed form).

Legal basis for processing is Federal Law No. 152-FZ “On Personal Data” and the consent of the personal data subject.

6.2. Informing the User via email (notifications, service messages, and mailings).

To achieve this purpose, the following data is processed:

• name;
• email address.

Legal basis is Federal Law No. 149-FZ “On Information, Information Technologies and Information Protection” and the consent of the personal data subject.

6.3. Analysis of Service usage and Service improvement.

For these purposes, the Operator processes:

• cookie files;
• IP address;
• user device information;
• browser information;
• history of actions in the Service interface;
• access time and visited page information.

Legal basis is Federal Law No. 152-FZ “On Personal Data” and the Operator’s legitimate interest.

6.4. Ensuring technical operability and security of the Service.

To achieve this purpose, the Operator processes:

• IP address;
• technical information about the user’s device;
• event logs;
• browser information;
• data automatically transmitted while using the Service, including cookie data, access time, and requested page addresses.

Legal basis for processing is Federal Law No. 152-FZ “On Personal Data” and the Operator’s legitimate interest.

7.1. Personal data is processed with consent of the personal data subject, including consent provided during Service registration by accepting this Policy.

7.2. Personal data processing is necessary to perform an agreement (user agreement) to which the personal data subject is a party, and to conclude such agreement at the initiative of the personal data subject.

7.3. Personal data processing is necessary to exercise rights and legitimate interests of the Operator, provided rights and freedoms of the personal data subject are not violated, including for analytics and Service quality improvement.

7.4. Personal data processing is necessary to achieve purposes provided by Russian legislation.

Security of personal data processed by the Operator is ensured through implementation of legal, organizational, and technical measures necessary to comply with current legislation in personal data protection.

8.1. The Operator ensures preservation of personal data and takes all possible measures to exclude access to personal data by unauthorized persons.

8.2. User personal data is not transferred to third parties, except where required by law, to ensure operation of technical contractors and services necessary for Service functioning (hosting, analytics, payment systems, communication tools), or with consent of the personal data subject.

8.3. If inaccuracies in personal data are found, the User may update them independently in the Service personal account or by sending notice to the Operator at support@kanbano.ru marked “Personal Data Update”.

8.4. The period of personal data processing is determined by achievement of purposes for which the data was collected, or by the storage period established by legislation or contract. The User may withdraw consent to personal data processing at any time by sending notice to support@kanbano.ru marked “Withdrawal of Consent to Personal Data Processing”.

8.5. Information collected by third-party services (payment systems, analytics and communication services, communication tools) is stored and processed by corresponding operators in accordance with their own user agreements and privacy policies. The Operator is not responsible for actions of such third parties.

8.6. The Operator ensures confidentiality of personal data during processing.

8.7. Processing of personal data is terminated when processing purposes are achieved, consent expires, consent is withdrawn by the subject, or unlawful personal data processing is identified.

9.1. The Service uses cookie files to ensure Service operation, save User settings, and collect Service usage statistics through web analytics systems.

9.2. The User may configure their browser to reject all cookie files or notify when they are sent. In this case, some Service features may become unavailable or function incorrectly.

9.3. The Operator may use anonymized data obtained through cookie files to analyze user behavior and improve Service quality.

10.1. The Operator collects, records, systematizes, accumulates, stores, clarifies (updates, modifies), extracts, uses, transfers (provides, grants access), depersonalizes, blocks, deletes, and destroys personal data.

10.2. The Operator performs automated processing of personal data with receipt and/or transmission of the received information via information and telecommunication networks or without such transmission.

11.1. Before carrying out cross-border transfer of personal data, the Operator must notify the authorized authority for protection of personal data subjects’ rights of its intent to carry out such transfer.

11.2. Before submitting said notification, the Operator must obtain relevant information from state authorities of a foreign country, foreign individuals, or legal entities to which personal data transfer is planned.

The Operator and other persons with access to personal data must not disclose personal data to third parties or distribute personal data without consent of the personal data subject, unless otherwise provided by federal law.

13.1. The User may receive any clarifications on issues related to processing of personal data by contacting the Operator via email at support@kanbano.ru.

13.2. Any changes to the Operator’s personal data processing policy will be reflected in this document. The Policy is valid indefinitely until replaced by a new version.

13.3. The current version of the Policy is publicly available online at https://kanbano.ru/privacy-policy.