This is an unofficial translation provided for convenience. The legally binding document is the Russian original, available at dashamail.ru/privacy. In case of any discrepancy, the Russian version prevails.
1. General provisions
- This Personal Data Processing Policy (hereinafter – the Policy) applies to the personal data of data subjects that the limited liability company «Pismo» (registered on 11 March 2016 by the Interdistrict Inspectorate of the Federal Tax Service No. 15 for St. Petersburg under PSRN 1167847127909, located at: 191024, St. Petersburg, Khersonskaya st., 8, lit. A, premises 9-N) may obtain when a user uses or visits the website, software products and services of Pismo LLC.
- The Policy is an official document that defines the main terms and definitions; the procedure and conditions for processing personal data; measures to ensure the security of personal data; the rights of users; the periods of personal data processing and transfer to third parties; the conditions for receiving advertising mailings; liability; and the legal grounds for processing personal data.
- This Policy applies solely to the website and the service owned by Pismo LLC.
- This Policy applies solely to users as defined in section 2 of this Policy, and does not extend to the personal data of individuals listed by the Operator's clients in a database that a client of the DashaMail email marketing service uploads to their personal account in that service. The processing of personal data of individuals contained in a database uploaded by a client of the DashaMail email marketing service to their personal account is carried out by Pismo LLC as a personal data processor on the basis of a separate written instruction.
- Pismo LLC does not control and is not responsible for third-party websites which the user may visit via links available on the website owned by Pismo LLC.
- The Operator's processing of personal data of other categories of data subjects is governed by other internal regulations of the Operator.
- This Policy takes effect from the moment it is published on the website and remains in force indefinitely, until replaced by a new Policy.
- If the user does not agree with the terms of this Policy, the use of the Website, the DashaMail Service and/or any services available through the Website or the DashaMail Service must cease immediately.
2. Main terms and definitions
- The following terms are used in this Policy and may be applied in both the singular and the plural:
- Personal data information system – the aggregate of personal data contained in the databases of Pismo LLC together with the information technologies and technical means that ensure their processing.
- Processing of personal data – any action (operation) or set of actions (operations) performed with or without the use of automation tools on users' personal data, including collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), anonymisation, blocking, deletion and destruction of personal data.
- Personal data operator (operator) – the limited liability company «Pismo» (registered on 11 March 2016 by the Interdistrict Inspectorate of the Federal Tax Service No. 15 for St. Petersburg under PSRN 1167847127909, located at: 191024, St. Petersburg, Khersonskaya st., 8, lit. A, premises 9-N), which independently or jointly with other persons organises and (or) carries out the processing of personal data, and also determines the purposes of processing personal data, the composition of the personal data to be processed, and the actions (operations) performed with personal data with the consent of the data subject.
- Personal data – any information relating to a directly or indirectly identified or identifiable individual (data subject), which was provided by the user when visiting the Website and registering with the DashaMail email marketing service.
- User – a registered user of the DashaMail email marketing service or an unregistered visitor to the Website; an individual who gives consent to the Operator to process their personal data. A User may be either an individual or a representative of a legal entity acting on the basis of a document confirming their authority.
- Website – a set of interlinked web pages published on the Internet under a unique address (URL), as well as its subdomains. Located on the Internet at dashamail.ru.
- DashaMail email marketing service (the DashaMail Service) – a hardware and software complex provided as SaaS (Software as a Service), intended for creating, sending and monitoring the results of email campaigns to subscribers, provided that the User has obtained the mandatory prior consent of the subscribers. Exclusive rights to the DashaMail Service belong to the Operator on the basis of the certificate of state registration with the Federal Service for Intellectual Property of the computer program «DashaMail email marketing service» No. 2020618882 dated 06.08.2020. The DashaMail Service is hosted on the Operator's server within the territory of the Russian Federation. The DashaMail Service can be used through the User's interaction with it over the Internet HTTP protocol using internet client programs (browsers).
- Personal Account – the account created by the User when registering with the DashaMail Service and associated with the User by login and password (authentication data), on the basis of which access to the DashaMail Service is provided.
- Cookies – a small piece of data sent by a web server and stored on the User's computer, which the web client or web browser sends back to the web server in an HTTP request each time it attempts to open a page of the corresponding website.
- IP address – the unique network address of a node in a computer network through which the User accesses the website.
- Advertising mailing – messages of an advertising nature originating from the Operator as sender, aimed at attracting attention to the object of advertising in order to create or maintain interest in it.
3. Procedure and conditions for processing personal data
- The ground for processing Users' personal data is consent to the processing of personal data. Users of the Website give their consent by using the Website and/or by ticking the dedicated checkbox after reading this Policy, consenting to the processing of their personal data in the following cases:
- when using the Website (with regard to the Operator's processing of Cookies and the IP address);
- when the User registers a Personal Account;
- when posting reviews on the Website;
- when interacting with the Operator's technical support specialist through the chatbot widget placed on the Website, or in any other way;
- when entering Personal data to receive a call back or an email reply from the Operator;
- when receiving funds as a refund from the Operator.
- Users' personal data are processed for the following purposes:
- promotion of the Operator's goods, works and services;
- provision of access to the DashaMail Service;
- provision of technical support services to Users;
- establishing feedback with the User, including sending notifications and requests and processing them, as well as processing requests and applications from the User with a view to further concluding and performing transactions between the Operator and the User;
- receiving and publishing User reviews;
- market research by the Operator;
- making refunds to the User;
- quality control of the services provided and of the availability level of the DashaMail Service;
- keeping statistics and analysing the operation of the Website and the DashaMail Service.
- The list of Users' personal data processed by the Operator using automation tools:
- surname, first name, patronymic;
- telephone number;
- email address;
- postal address for correspondence;
- bank account information, including bank account details;
- electronic wallet information;
- other information that the User has decided to provide on their own initiative.
- To keep statistics and analyse the operation of the Website, the Operator processes the following data using the Google Analytics and Yandex.Metrica analytics services:
- IP address;
- information about the User's browser;
- data from Cookie files;
- the time of the User's access to the Website;
- referrer (the address of the previous page).
- Google Analytics, a web analytics tool of Google Inc., registered at Amphitheatre Parkway, Mountain View, California 94043, USA (hereinafter – Google), is used for the continuous optimisation of the Website. Google Analytics works with Cookie files and creates pseudonymous usage profiles that make it possible to analyse Users' use of the Website. Information stored in such Cookies (for example, browser type/version, operating system used, referrer URL, host name of the accessing computer, time of the server request) is generally transmitted to and stored on Google's servers. To block Google Analytics, the User may download and install the add-on available at https://tools.google.com/dlpage/gaoptout. Further information should be obtained by the User from Google's privacy policy: https://www.google.com/policies/privacy.
- The Yandex.Metrica service, available at https://api.yandex.com/metrika, allows the User's various services and applications to interact with the Yandex.Metrica service of Yandex LLC, registered at 119021, Moscow, Lva Tolstogo st., 16 (hereinafter – Yandex). Yandex.Metrica works with cookies and creates pseudonymous usage profiles that make it possible to analyse Users' use of the Website. Information stored in such cookies (for example, browser type/version, operating system used, referrer URL, host name of the accessing computer, time of the server request) is generally transmitted to and stored on Yandex's servers. To block Yandex.Metrica, the User may download and install the add-on available at https://yandex.com/support/metrica/general/opt-out.html. Further information should be obtained by the User from Yandex's privacy policy: https://yandex.com/legal/confidential/.
- If Google Analytics and Yandex.Metrica are blocked, some functions of the Website may become unavailable to the User.
- The Operator does not process biometric personal data or special categories of personal data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, state of health or sex life.
- The Operator does not verify the accuracy of the information provided by the User and assumes that the User provides accurate and sufficient information and keeps it up to date. If the data previously provided to the Operator change, the User notifies the Operator of such changes so that the Operator can comply with this Policy and the applicable legislation of the Russian Federation, in the manner provided for in clause 5.6.4 of this Policy.
- The Operator performs the following actions with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer to third parties (distribution, provision, access) for the performance of transactions concluded with the User, for example to provide services and access to the DashaMail Service, blocking and destruction.
- Personal data are stored in a form that allows the data subject to be identified, for no longer than the periods set out in section 6 of this Policy.
4. Measures to ensure the security of personal data
- The security of Personal data processed by the Operator is ensured through legal, organisational, technical and software measures necessary and sufficient to meet the requirements of the legislation of the Russian Federation.
- The Operator takes the following measures to ensure the security of Personal data:
- appointment of persons responsible for organising the processing and ensuring the protection of Personal data;
- limitation of the number of the Operator's employees who have access to Personal data;
- determination of the protection level of Personal data processed in Personal data information systems;
- identification of current threats to the security of Personal data processed in Personal data information systems;
- establishment of access control rules for Personal data processed in personal data information systems and ensuring the logging and accounting of all actions performed with personal data;
- restriction of access to premises housing the main technical means and systems of Personal data information systems and where non-automated processing of Personal data is carried out;
- maintaining records of machine-readable media containing Personal data;
- organisation of backup and recovery of Personal data information systems and of Personal data modified or destroyed as a result of unauthorised access;
- establishment of password complexity requirements for access to Personal data information systems;
- use of information protection tools that have passed conformity assessment procedures in the established manner;
- anti-virus control and prevention of malicious software (viruses) and software bookmarks entering the corporate network;
- organisation of timely updates of the software used in personal data information systems and of information protection tools;
- regular assessment of the effectiveness of the measures taken to ensure the security of Personal data;
- detection of unauthorised access to personal data and adoption of measures to establish the causes and eliminate possible consequences;
- conducting certification tests of personal data information systems;
- monitoring of the measures taken to ensure the security of personal data and of the protection levels of personal data information systems.
- The Operator has passed the certification of its Personal data information system and operates on the basis of a certificate of conformity with information protection requirements approved by Order of the FSTEC of Russia No. 21 of 18 February 2013 «Composition and content of organisational and technical measures to ensure the security of personal data during their processing in personal data information systems», No. L024-00107-00/00125014.00300.2022, issued by Sertum-Pro LLC (620036, Sverdlovsk region, Yekaterinburg, Maloprudnaya st., bld. 1, apt. 342, bld. 5, office 715; TIN 6673240328) on 16.12.2022.
5. Rights and obligations of Users
- The User has the right to receive information concerning the processing of their personal data, including:
- confirmation of the fact that Personal data are processed by the Operator;
- the legal grounds and purposes of processing Personal data;
- the purposes and methods of processing personal data applied by the Operator;
- the name and location of the Operator, information about persons (other than the Operator's employees) who have access to personal data or to whom Personal data may be disclosed on the basis of a contract with the Operator or on the basis of the applicable legislation of the Russian Federation;
- the processed personal data relating to the relevant data subject and the source from which they were obtained, unless a different procedure for presenting such data is provided for by the applicable legislation of the Russian Federation;
- the periods of processing of Personal data, including their storage periods;
- the procedure for the data subject to exercise the rights provided for by Federal Law No. 152-FZ of 27 July 2006 «On Personal Data»;
- information about cross-border transfers of Personal data that have been made or are intended;
- the name or the surname, first name, patronymic and address of the person processing Personal data on behalf of the Operator, if processing has been or will be entrusted to such a person;
- other information provided for by Federal Law No. 152-FZ of 27 July 2006 «On Personal Data» or by other regulatory legal acts governing the processing of personal data.
- The User has the right to demand that the Operator clarify, block or destroy their personal data if the personal data are incomplete, outdated, inaccurate, unlawfully obtained or are not necessary for the stated purpose of processing, and also to take the measures provided for by law to protect their rights.
- The User has the right to use any lawful means to protect their rights and legitimate interests, including compensation for damages and for moral harm in court in accordance with the legislation of the Russian Federation. The User also has the right to appeal against the actions or omissions of the Operator to the authorised body for the protection of the rights of data subjects.
- The User has the right to request, in a structured, universal and machine-readable format, the list of their personal data provided to the Operator for processing, and to instruct the Operator to transfer their personal data to a third party if the Operator has the technical capability to do so. In this case, the Operator is not responsible for the actions subsequently performed by the third party with the Personal data.
- The User has the right to send messages to the Operator by submitting the relevant requests (applications), as well as any questions regarding the processing of Personal data, to the Operator's contact email address info@dashamail.ru (example subject line: «Restriction/withdrawal of consent to the processing of personal data») or to the Operator's current registered address. The User should check the current registered address in the Unified State Register of Legal Entities by entering the Operator's PSRN 1167847127909 on the website https://egrul.nalog.ru/index.html. The User's expression of will to exercise the rights and obligations specified in clause 5.5 of this Policy (an application for information, an application to withdraw consent to the processing of personal data and other requests of the User) must be specific – making it possible to identify whom it comes from and its substance. The application must be signed by the User or by their representative, whose authority must be documented. The period for considering the User's application is 10 (ten) business days from the date it is received by the Operator.
- In order for the Operator to comply with the measures ensuring the security of Personal data, the User is obliged to:
- Provide the Operator with up-to-date and accurate information about themselves.
- Not mislead the Operator as to their identity, and not provide false or inaccurate information about themselves.
- Not communicate to the Operator in any way, whether using the Website or the DashaMail Service or otherwise, any information relating in whole or in part to state, commercial and/or banking secrets, to facts and information about their private life or the private life of third parties, and not to communicate special categories of personal data or other information the provision of which is prohibited by this Policy.
- Update and amend their personal information in the event of its change within 5 (five) business days from the date of such change, during the term of the contractual relationship between the Operator and the User and during the period of processing of Personal data specified in clause 6.1 of this Policy, by submitting an application to update or amend Personal data in the manner provided for in clause 5.5 of the Policy.
- Immediately notify the Operator of any violation by the Operator, or by other persons through the fault of the Operator, of the rights and legitimate interests of the User in connection with the processing of personal data.
- Clarify their personal data and demand that they be blocked or destroyed if the Personal data are incomplete, outdated, inaccurate, unlawfully obtained or are not necessary for the stated purpose of processing.
- Take other measures provided for by the legislation of the Russian Federation to protect their rights.
6. Periods of personal data processing, Cookies and transfer to third parties
- The Operator ceases processing Personal data in the following cases:
- upon expiry of 1 (one) year from the date of termination of the contractual relationship between the Operator and the User (for example, termination of access to, or blocking of, the DashaMail Service);
- at the User's demand, by sending a withdrawal of consent to the Operator;
- upon detection of unlawful processing of Personal data by the Operator or by other persons, at the demand of the User or an authorised person;
- in other cases provided for by the applicable legislation of the Russian Federation.
- As a result of the Operator's processing of the User's Personal data through anonymisation, anonymised statistical data may be obtained, which the Operator has the right to transfer to third parties for conducting research, performing work or providing services on the Operator's instructions.
- Personal data may be transferred to third parties in order to achieve the purposes defined by the Policy, subject to strict observance of the confidentiality measures that are applicable and sufficient in such cases. At the same time, the Operator does not transfer Personal data to third parties located in the territory of foreign states within the framework of this Policy.
- The Operator may request consent to the use of Cookies when the User first visits the Website. If the User changes their decision on consenting to the Operator's processing of Cookies, the User must delete the Cookie files stored on their device by clearing the browser history, unless a different procedure is provided by the developer of the browser the User uses to visit the Website. After performing these actions, on a repeat visit to the Website the User may refuse to give the Operator consent to process Cookies. At the same time, such a refusal to use Cookies may lead to incorrect operation of the Website and of the DashaMail Service.
- The period of processing Cookies is determined on the basis of achieving the purpose or completing the task, depends on the type of Cookie files, and they are deleted automatically.
7. Conditions for Users receiving advertising mailings
- In accordance with the provisions of Federal Law No. 126-FZ of 7 June 2003 «On Communications» and Federal Law No. 38-FZ of 13 March 2006 «On Advertising», the User acknowledges and agrees that the performance by the data subject of the actions specified in clause 3.1 of this Policy constitutes the User's consent to receive advertising mailings to the contact telephone numbers and email addresses specified by the User when registering on the Website and/or with the DashaMail Service.
- The User has the right at any time to withdraw their consent to receive advertising mailings by sending the Operator a corresponding application to the contact email address or by Russian Post in the manner specified in clause 5.5 of the Policy. The User's application must contain information about the User or their legal representative (surname, first name, patronymic (if any)) and/or about the User (representative of a legal entity) (name of the legal entity or sole proprietor, PSRN (or PSRNSP), registered address, or surname, first name, patronymic (if any)) and the contact numbers and email addresses to be excluded from the advertising mailing list. Such an application must be signed by the User's authorised representative.
- Contact numbers and email addresses are excluded from the advertising mailing list within 1 (one) business day from the moment the Operator receives the User's corresponding application. The application is subject to satisfaction provided that it meets the requirements specified in clause 7.4 of this policy and the requirements of the legislation of the Russian Federation.
8. Final provisions
- The Operator has the right to amend this Policy unilaterally in the event of changes in the regulatory legal acts of the Russian Federation, as well as at its own discretion.
- The new Policy takes effect from the moment of its publication on the Website, unless otherwise provided by the new version of the personal data processing policy.
- The law of the Russian Federation applies to this Policy and to the relations between the User and the Operator arising in connection with the application of the Policy.
- Compliance with the requirements of this Policy is monitored by the person responsible for organising the processing of personal data at the Operator.
- Persons guilty of violating the rules governing the processing and protection of Personal data bear material, disciplinary, administrative, civil or criminal liability in the manner established by the legislation of the Russian Federation.
9. Legal grounds for processing personal data
- the Civil Code of the Russian Federation;
- the Tax Code of the Russian Federation;
- Federal Law No. 152-FZ of 27.07.2006 «On Personal Data»;
- Federal Law No. 181-FZ of 24.11.1995 «On the Social Protection of Persons with Disabilities in the Russian Federation»;
- Federal Law No. 27-FZ of 01.04.1996 «On Individual (Personalised) Accounting in the Mandatory Pension Insurance System»;
- Federal Law No. 165-FZ of 16.07.1999 «On the Fundamentals of Mandatory Social Insurance»;
- Federal Law No. 166-FZ of 15.12.2001 «On State Pension Provision in the Russian Federation»;
- Federal Law No. 167-FZ of 15.12.2001 «On Mandatory Pension Insurance in the Russian Federation»;
- Federal Law No. 126-FZ of 07.07.2003 «On Communications»;
- Federal Law No. 38-FZ of 13 March 2006 «On Advertising»;
- Federal Law No. 323-FZ of 21.11.2011 «On the Fundamentals of Protecting the Health of Citizens in the Russian Federation»;
- Federal Law No. 402-FZ of 06.12.2011 «On Accounting».
Version dated 24 January 2023.
