Who is given consent, and to what#
I, the data subject, freely, of my own will and in my own interest, give my consent to the processing of my personal data on the terms set out below.
Operator: Akeda LLC — Limited Liability Company «AKEDA» (Акеда, ООО), TIN (ИНН) 5003175505, KPP 500301001, PSRN (ОГРН) 1265000059213. Registered address: 142721, Moscow Region, Vidnoye, Prigorod Lesnoye (Misaylovo), Sovremennikov St. 2, unit 25N, Russia. Chief Executive Officer — Evgenia Sergeevna Oganesyan. Email: hello@akeda.ru.
The consent is given in respect of the erp.akeda.ru website and its subdomains, the Akeda mobile applications and the Akeda ERP service.
It is a person who gives this consent: a site visitor who submitted a request or started a conversation with the voice assistant, and an employee of a client who has been given access to a workspace. The consent does not cover the records a client uploads into its own workspace: for those the client is the operator and it is the client who obtains the consents of their subjects. See the Personal data processing policy for details.
The personal data covered#
Consent is given to the processing of the following personal data:
- first and last name;
- email address;
- phone number;
- job title and company name, if given;
- the workspace, the legal entities access has been opened to, and the role in the workspace;
- sign-in records: date and time, IP address, browser and device details;
- an activity log: date and time, the section and the operation performed;
- the name, TIN, KPP, PSRN or PSRNSP and address of the subscription payer;
- records of invoices, payments and refunds: numbers, amounts, dates and status;
- details of a saved payment method: the masked card number, expiry date, card scheme, issuing bank and the identifier held by the payment service. The full card number and the verification code are neither passed to nor processed by the operator;
- cookies, the anonymous visitor identifier, the addresses of pages viewed, the referrer, clicks, scrolling, form filling and the session recording made by Webvisor — the data collected by the Yandex.Metrica web analytics service (counter No. 112347336);
- a device identifier for delivering notifications;
- the text of a request left in a form on the site;
- the sound of speech, the transcript of what was said and the text of the turns — in a conversation with the voice assistant on the site.
The operator does not process special categories of personal data or biometric personal data.
Purposes of processing#
The operator processes personal data for the following purposes:
- answering a request left on the site;
- registering a workspace, granting access to the service and identifying the user at sign-in;
- providing the subscription services and technical support;
- issuing invoices, taking payments, making refunds and sending fiscal receipts;
- sending notifications about the service, payment due dates and changes to the terms;
- answers from the voice assistant on the site and the assistant in the workspace;
- keeping the service secure and investigating incidents;
- counting site visits anonymously;
- complying with the requirements of the law of the Russian Federation.
Marketing and information mailings are sent only on the basis of a separate consent; they can be stopped from any letter.
Actions performed on data and methods of processing#
The following actions are performed on personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), depersonalisation, blocking, deletion and destruction. Personal data is never disseminated, that is, disclosed to an indefinite group of persons.
Processing is carried out in the following ways:
- automated — by means of computing equipment; this is the main way, because the service is a program;
- without automation — when a request that arrived by email is dealt with, and when the operator keeps its own paperwork;
- mixed, with transfer over the Internet — over a secure channel and only to the recipients named below.
No decision producing legal consequences for the data subject is taken solely on the basis of automated processing. No profiling is carried out. The assistant's answers are not legally significant decisions.
Storage and retention#
Recording, systematisation, accumulation, storage, updating and retrieval of the personal data of Russian citizens are performed using databases located in the Russian Federation (article 18 part 5 of 152-FZ). Every workspace has its own database. Files uploaded by members are kept in object storage located in the Russian Federation.
Retention periods:
- a service user's data — while the workspace subscription is in force and while the person remains a member of it;
- the data of a disabled workspace — 180 days from the day the workspace stopped working, after which it is destroyed irreversibly; another period may be agreed with the client;
- a request left on the site — one year from the date it was submitted;
- records of invoices, payments and fiscal receipts — for the periods set by accounting and tax law, at least five years;
- a conversation with the voice assistant on the site is not stored: it lives in the server's memory only for the length of the conversation and disappears with it; the sound of speech is not recorded after it has been recognised;
- data processed on the basis of this Consent — until it is withdrawn, unless the law sets another period.
Once the purpose of processing is achieved, or the need to achieve it is lost, the data is destroyed or anonymised within thirty days, unless the law provides otherwise.
Who receives what, exactly#
The operator may share personal data with the recipients named below — only for the purposes of this Consent and only to the extent stated.
- Beget, Russia — object storage for files (a bucket in the ru1 region) and storage for backups. What is shared: the files members upload into a workspace, attachments of letters and documents, the cache of printed forms, and database backups — encrypted before they are sent. The storage operator does not open the content and has no purposes of its own for it.
- The data centre operator hosting the service's servers — for hosting and storage only. It has no purposes of its own for the data and no access to the contents of the databases.
- REG.RU, Russia — delivery of system email through the mail node mail.hosting.reg.ru. What is shared: the recipient's email address and name, the workspace name, and the subject and body of the letter — a sign-in or recovery link, or the number, amount and due date of an invoice.
- Tochka, Russia — acceptance of card and Faster Payments System payments, refunds, and the fiscal receipt required by Federal Law No. 54-FZ of 22 May 2003. What is shared: the invoice number and date, the amount and currency, the payment purpose, the address the payer returns to in the workspace, and the email address the receipt is sent to. The card number, its expiry date and the verification code are entered on the bank's own page; Akeda neither receives nor passes them on.
- Yandex LLC (TIN 7736207543, 16 Lva Tolstogo St., Moscow, 119021), Russia — the Yandex.Metrica service, counter No. 112347336 — counting site visits and judging which pages are useful. What is shared: IP address, browser and device details (User-Agent), the anonymous visitor identifier, the addresses of pages viewed, the referrer and campaign tags, clicks, scrolling, form filling and the session recording made by Webvisor. The visitor's name, phone number and email address are not passed to the counter. Processing terms: yandex.ru/legal/metrica_termsofuse.
- Telegram — notifying an Akeda manager about a request left on the site so that it can be answered the same day. What is shared: the name, phone number, message text and the page the request was sent from. Nothing else is shared.
- Yandex Cloud, Russia — speech recognition and synthesis during a conversation with the voice assistant on the site. What is shared: the sound of the visitor's speech for as long as they hold the talk button down, and the text of the assistant's replies to be voiced. The visitor's name, phone number and email address are not shared.
- The provider of the language model that answers in the assistant — preparing an answer to a question put to the voice assistant on the site or to the assistant inside a workspace. What is shared: the text of the question and of the previous turns of the same conversation and, for the assistant inside a workspace, the workspace records needed to answer that particular question. Sign-in credentials and payment details are not shared. The provider's servers are located outside the Russian Federation.
- The provider of the assistant's video likeness — showing the assistant's speaking face on the site. What is shared: the sound of the assistant's already synthesised speech, so that the image moves its lips in time with it. The visitor's speech, their questions and any information about them are not shared.
- DaData, Russia — filling in the details of a company or sole trader while a counterparty record is being created. What is shared: the string the member typed into the search field — a TIN, a PSRN or a name. No other workspace data is shared.
- Apple Inc., USA — delivering a notification to the Akeda mobile app on iPhone, iPad and Mac. What is shared: the device identifier and the notification's title and text — for example, the sender's name and the beginning of a message. Showing the text inside a notification can be turned off in the app's settings, and notifications themselves in the device's settings.
- Browser notification delivery services (Google, Mozilla or Apple, depending on the browser) — delivering a notification to the desktop. What is shared: the device's subscription address and an encrypted message whose content the delivery service cannot read. The user turns these notifications on themselves and can turn them off at any time.
- Google LLC, USA — loading the typefaces the workspace interface is set in (Google Fonts). What is shared: the IP address and browser details of whoever opened the application. Workspace data, credentials and payment details are not shared.
- Government authorities — in the cases, to the extent and in the manner expressly required by law.
Transfer outside the Russian Federation. Workspace databases, member files and records of invoices and payments are processed and stored in Russia and never cross the border. Only the flows named above leave the Russian Federation, and each of them is narrow and can be switched off: the turns of a conversation with the assistant go to the language model provider; a notification's title and text go to the push delivery service; an IP address and browser details go to the provider of the interface typefaces. Akeda carries out no other cross-border transfer of personal data.
Personal data is shared with any other third party only with the subject's separate consent, except in the cases provided for by the law of the Russian Federation.
Rights of the data subject#
Under article 14 of 152-FZ a data subject has the right to:
- obtain information about the processing of their data: confirmation that processing takes place, its legal grounds and purposes, the data being processed, its source, the periods of processing and storage, the persons the data is shared with, and the methods of processing used;
- require their data to be corrected if it is incomplete, out of date or inaccurate;
- require blocking or destruction of the data if it was obtained unlawfully or is not necessary for the stated purpose;
- withdraw consent to processing at any time — the procedure is set out in the next section;
- object to processing and require that marketing messages stop;
- appeal against the operator's acts or omissions to the authority responsible for protecting the rights of data subjects — the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor), 7 bldg 2, Kitaygorodsky Proyezd, Moscow, 109074, Russia — or to a court.
A request is sent to hello@akeda.ru or by post to the operator's registered address. It should state the person's full name, information confirming their relationship with the operator (for example, the email address used to sign in, or an invoice number) and what exactly is being asked for. An answer is sent within ten business days of receipt; that period may be extended by no more than five business days, with notice of the reasons. Exercising these rights is free of charge.
Term of the consent#
This Consent takes effect on the day it is accepted and runs until the subject withdraws it.
Withdrawal does not affect the lawfulness of processing carried out on the basis of the consent before it was withdrawn.
After withdrawal, processing continues only where the operator retains another lawful ground under article 9 part 2 and article 6 of 152-FZ — in particular the duty to keep payment records.
How to withdraw consent#
Consent to the processing of personal data may be withdrawn at any time, without giving reasons and free of charge (part 2 of article 9 of 152-FZ). Consent can be withdrawn in either of two ways:
- send a free-form application to hello@akeda.ru with the subject «Withdrawal of consent to the processing of personal data», from the address held in the account, or by post to the operator's registered address;
- delete the account yourself: in the workspace, under Settings → Members, or by asking the workspace administrator to do it.
Timing. Receipt of a withdrawal application is confirmed within 10 business days. Processing stops and the data is destroyed or depersonalised within 30 days of the application being received.
Withdrawal does not affect the lawfulness of processing carried out before it was received. Processing continues only where the operator retains another lawful ground: performance of the contract for as long as the subscription runs, and compliance with a duty imposed by law — records of invoices, payments and fiscal receipts are kept for at least five years regardless of withdrawal.
Withdrawal by a user of the service ends that person's access to the workspace. The contents of the workspace itself are not deleted: the client is its operator and it is the client who disposes of them.
Acceptance and operator details#
Acceptance of this Consent — that is, giving it — is any of the following: submitting a request through a form on the site, registering a workspace, accepting an invitation to a workspace, signing in to the service for the first time, or starting a conversation with the voice assistant. The date and time of acceptance are recorded automatically.
By accepting, the subject confirms that they have read the Personal data processing policy and the Terms of service, and gives consent to the processing of personal data on the terms set out above.
Akeda LLC (Limited Liability Company «AKEDA»)
TIN (ИНН) 5003175505
KPP 500301001
PSRN (ОГРН) 1265000059213
Registered address: 142721, Moscow Region, Vidnoye, Prigorod Lesnoye (Misaylovo), Sovremennikov St. 2, unit 25N, Russia
Chief Executive Officer — Evgenia Sergeevna Oganesyan
Tax regime — simplified, «Income» at 6 %; Akeda is not a VAT payer
Bank details — stated on the invoice
Email: hello@akeda.ru
Telegram: @akeda_erp