In brief
When you use ETOCHATBOT to talk to your own customers on messaging platforms, we process those customers' data on your instructions. You remain the operator of their personal data, and we act as a processor (Part 3, Article 6 of 152-FZ; "processor" in the language of GDPR Art. 4(8)). This Agreement sets the terms for that processing.
1. Parties
- Data operator (Customer) — you, the service User, acting as the operator of your end customers' personal data.
- Data processor (Contractor) — sole proprietor Dmitry Yuryevich Kiselev, operator of ETOCHATBOT (full details on the Operator details page).
2. Subject matter
The Contractor processes the Customer's end customers' personal data solely for purposes required to deliver the service under the Public offer:
- receiving and routing messages from messaging platforms;
- showing conversations in the Customer's interface;
- storing message history and media;
- relaying the Customer's responses back to the messaging platform;
- providing APIs and webhooks for integration with the Customer's systems;
- ensuring data security and integrity.
Any processing beyond these purposes is only allowed under a separate, documented instruction from the Customer.
3. Categories of subjects and data
- Data subjects: individuals who contacted the Customer's connected messaging bot ("End customers").
- Categories of personal data: user identifier on the corresponding chat channel; username and profile name; profile photo (if provided by the channel); message contents and media sent to the bot; message metadata (time, delivery status).
- Special categories of personal data (Article 10 of 152-FZ; Art. 9 GDPR) are only processed when an End customer sends them to the bot themselves. The Customer must not use the service to deliberately collect such data.
4. Contractor's obligations
The Contractor undertakes to:
- Process personal data only on documented instructions from the Customer, except where processing is required by Russian law.
- Maintain the confidentiality of personal data and apply the security measures described in Security measures and required by Article 19 of 152-FZ.
- Allow only employees who have signed a non-disclosure obligation to process personal data.
- Engage sub-processors only with the Customer's general prior consent, provided they are subject to equivalent obligations. The Contractor will notify the Customer of a new sub-processor at least 14 calendar days in advance via email or inside the dashboard.
- Assist the Customer in upholding data subject rights (Article 14 of 152-FZ): provide data exports on request and ensure deletion at a subject's request.
- Assist the Customer in notifying Roskomnadzor and data subjects of incidents (Part 3.1, Article 21 of 152-FZ): notify the Customer of an incident within 24 hours of detection.
- Upon termination of the services, at the Customer's choice, return or delete all processed personal data, except data the Contractor is required to retain by law.
- Support audit of compliance with this Agreement on the Customer's reasonable request by providing documentation of the security measures implemented.
5. Customer's obligations
The Customer undertakes to:
- Have legal grounds to process their End customers' personal data (collecting consent on first contact, performance of a contract, or another basis under Article 6 of 152-FZ).
- Not use the service for unlawful data collection, spam, or any action prohibited by the Terms of service and the Anti-spam policy.
- Publish their own privacy policy and notify End customers about the collection of their personal data and the purposes of processing.
- Forward End customer requests requiring Contractor action to the Contractor within a reasonable timeframe.
6. Storage localization
The Contractor stores and initially collects End customers' personal data in data centers located in the Russian Federation (Part 5, Article 18 of 152-FZ).
7. Retention periods
Retention periods for data processed under this Agreement are defined in the Privacy policy ("Retention periods" section). There is no automatic deletion by time: End customers' data is kept for as long as the channel it belongs to exists.
In practice the retention period is set by the Customer. Deleting a channel in the dashboard immediately and irreversibly wipes that channel's conversations, contacts, CRM cards, comments and mentions, the rule trigger log, tickets, the knowledge base, and statistics. It does not cover files on disk (attachments, media, cached profile photos), which are deleted on request, nor the records of payments End customers made through the Customer's own payment provider: those keep the payer's identifier on the messaging platform and the name they wrote under, because without them the record stops being proof that the payment happened. The Customer may initiate deletion of a specific End customer's data at any time — some of it (the contact card, a deal) is deleted directly in the interface, the rest on request to info@etochat.bot.
Stated separately and plainly: if the Customer's channel is connected through a partner integration, the partner event delivery log contains the message text and the sender's name, and deleting the channel does not currently reach it — those records carry no channel reference in a field of their own. The shortcoming is acknowledged and will be fixed; until then such records are deleted on request.
8. Liability
The Parties are liable for breaches of this Agreement in accordance with Russian law. The Contractor's aggregate liability is limited as set out in the Public offer ("Liability of the parties" section).
9. Term and termination
This Agreement is in effect for the entire term of the service agreement between the Customer and the Contractor. Termination of the agreement also terminates this Agreement; however, confidentiality obligations survive.
10. Applicable law
This Agreement is governed by the laws of the Russian Federation. Disputes are resolved as set out in the "Miscellaneous" section of the Public offer.
11. Contacts
For questions about this Agreement and End customer data processing: info@etochat.bot with "DPA" in the subject line.