Personal Data Processing Instructions

1. Parties and subject matter

1.1. This Instruction is Appendix No. 2 to Public offer and to User Agreement in their current editions. It is concluded between the user of the Layero service (hereinafter referred to as the “User”, who is also the operator of personal data) and the individual entrepreneur Murzak Mikhail Mikhailovich (TIN 772029626711; hereinafter referred to as “Layero”, who is also the person carrying out processing on behalf of the operator) in accordance with Part 3 of Article 6 of the Federal Law of July 27, 2006 No. 152-FZ “On Personal Data” (hereinafter referred to as “152-FZ”).

1.2. The order is considered accepted from the moment the User first places the data specified in section 2 in the service (creates a database, publishes a website with a form, enables Data API or integration), and is valid while such data is processed.

1.3. The order does not apply to the data of the User himself as a client of Layero (mail address, payments, etc.) - Layero processes them as an operator Privacy Policy.

2. What data and whose

2.1. Personal data of visitors, clients, users and other persons, at their discretion, posted by the User in the service or collected by him using the service:

• data in managed PostgreSQL databases, including application user tables (Data API, schema auth);
• data that visitors submit through forms on the User’s websites;
• data in the code, files, environment variables and logs of the User's projects;
• technical data of requests to the User’s sites and applications (page address, time, country and city determined by IP address);
• emails that User applications send to their users via the Data API.

2.2. The composition of the data and categories of subjects is determined by the User. Layero does not check the content and does not know its composition.

2.3. If the User places special categories of personal data or biometric personal data, he does so at his own risk: the service is not certified for their processing, and Layero does not provide the level of security required for such data (section 6).

3. Actions and goals

3.1. Layero, on behalf of the User, performs the following actions with the data: recording; storage; systematization in the structure specified by the User; extraction; use to the extent necessary for the operation of the service; transfer to sub-processors (section 7); backup; blocking; removal and destruction - using automation tools.

3.2. The purpose is solely to provide the User with service services: storing and issuing data to his applications and websites, fulfilling his requests, backup, transferring data to where the User indicated (for example, to a Google Sheets table connected by him or a Yandex Metrica counter in his account). Layero does not use this data for its own purposes.

4. User Responsibilities

• have legal grounds for processing and, if required, consent of subjects - including cookies and web analytics on their sites;
• publish on their websites their personal data processing policy and indicate in it Layero as the person processing data on behalf of;
• notify Roskomnadzor about the processing of personal data if required by law;
• independently respond to requests from subjects and fulfill their requirements using service tools (deleting rows, databases, projects);
• do not include integrations that transfer data outside of Russia (for example, Google Sheets), without legal grounds for cross-border transfer;
• do not output personal data to the build log: fragments of it are transferred to the support team (section 7).

5. Responsibilities of Layero

• process data only on behalf of and in the interests of the User, to the extent and for the purposes of section 3;
• maintain confidentiality: do not disclose or distribute data without the User’s consent, except as required by law;
• do not access the data content, except in cases where this is required by support at the request of the User, elimination of an incident or a legal requirement of an authorized body;
• provide the protection measures specified in section 6 and comply with the requirements of Articles 18.1 and 19 of the 152-FZ as applicable to the person processing data on behalf of;
• store data of citizens of the Russian Federation in databases on the territory of Russia (part 5 of Article 18 152-FZ);
• at the User’s request, within 10 working days, provide information about the protection measures taken and the processing of his data, including to confirm the fulfillment of this Order;
• notify the User about incidents under Section 8.

6. Protective measures

6.1. Layero applies the following measures:

• connection encryption (TLS) when connecting to databases and between internal nodes;
• access control between databases of different users, storage of role passwords in encrypted form;
• encrypting backup copies of shared databases with the Layero key in the Yandex Cloud key management service;
• logging connections to databases with a storage period of 90 days;
• placement of infrastructure in data processing centers in Russia;
• limiting the circle of persons who have administrative access to the infrastructure.

6.2. The level of security of personal data in the service was not established by Decree of the Government of the Russian Federation No. 1119, and certification was not carried out. The user independently assesses whether these measures are sufficient for his data.

7. Sub-processors

7.1. The user consents to the involvement of the following persons, to whom Layero entrusts part of the processing:

• Yandex.Cloud LLC (Russia) - servers, shared databases, backup storage, sending letters (Postbox);
• Timeweb LLC (Russia, Moscow) - dedicated databases and their backups;
• Telegram FZ-LLC (UAE) - prompt notifications for the support team about build failures: project name, error text and last lines of the build log. This is a cross-border transfer; The User agrees to it by accepting the Order.

7.2. Layero will notify you of the hiring of a new subprocessor at least 14 calendar days in advance - on this page and in the control panel. If the User does not agree, he has the right, before the change comes into force, to refuse services related to processing and receive a refund for the unused period.

7.3. Integrations that the User enables himself (Google Sheets, Yandex Metrica in his account, external databases) are not Layero subprocessors: the data is transferred there at the User’s direction.

8. Incidents

8.1. If Layero detects unauthorized or accidental access to the User's data, its transfer, modification or destruction, it notifies the User by email to the account owner immediately, no later than 12 hours from the moment of detection: what happened, what data is affected, what measures have been taken - so that the User has time to notify Roskomnadzor within its 24-hour period. No later than 72 hours from the moment of discovery, Layero reports the results of the investigation.

8.2. The user, as a data operator, is obliged to notify Roskomnadzor and the subjects of the incident. Layero provides him with the information he needs for this.

9. Data subject requests and audits

9.1. If the subject of personal data contacts Layero regarding the User’s data, Layero will forward the request to the User within 3 business days and inform the subject that the operator is the User.

9.2. If an authorized body requests Layero for information about the User's data, Layero will inform the User about this, unless prohibited by law.

10. Termination and removal

10.1. Databases deleted by the User are destroyed immediately after confirmation of deletion, along with backup copies. Project data, including its form data, is deleted when the project is deleted. When deleting an account, all User data is deleted within 30 calendar days.

10.2. Visitor form data is stored for no longer than 12 months from the date of submission, unless the User deletes it earlier. Logs of connections to databases - 90 days.

10.3. Before deletion, the User can download database data using the service (PostgreSQL dump).