What you need to do
If you use ETOCHATBOT to receive enquiries, keep conversations or send messages to your customers, you determine the purposes of processing their personal data. For an ordinary business using automation, a Roskomnadzor notification is generally required even when the database is hosted by a SaaS provider.
- Roskomnadzor notification: describe your organisation's processing and the databases it uses.
- Your privacy policy: explain to people what you collect, why, how long you retain it and who processes it on your instructions.
- Processing agreement (DPA): establish ETOCHATBOT's instructions and obligations.
- Consents: obtain and record them where your processing or its delegation requires them.
These documents serve different purposes. The service's entry in the Roskomnadzor register does not replace your business's notification. See Article 22 of 152-FZ.
1. Who is responsible for conversations?
- You, the service customer: the personal data operator for people communicating with your connected bots and accounts.
- IE Dmitry Yuryevich Kiselev, ETOCHATBOT: processes those people's data on your instructions under the DPA.
- Your own service account and billing: ETOCHATBOT processes these data for its own purposes described in the service privacy policy.
Processing includes receiving, storing and displaying conversations, handling attachments and sending replies. Technical access to conversations by the service provider also constitutes processing and must be limited to the agreed purposes, including service delivery, support and security. Your documents should disclose this processing on instructions.
You remain responsible to data subjects; the processor has its own statutory and contractual duties. See Parts 3–5, Article 6 of 152-FZ.
2. Do you need a new Roskomnadzor notification?
- If you have not notified: the general rule is to notify before processing starts. Exceptions are listed in Part 2 of Article 22; SaaS hosting itself is not an exception.
- If you are already registered: compare your notification with your planned processing. New purposes, data categories, operations or database locations may require an amendment.
- If notified information changes: submit the changes by the 15th day of the following month. A new subscription alone does not require a duplicate initial notification if no notified information changes.
Use the official Roskomnadzor portal. The rules and deadline are in Article 22 of 152-FZ.
3. What to include in the notification
Describe your actual processing for each purpose. The following examples are for ordinary customer enquiries and conversations; adapt them to your business.
| Field | What to include |
|---|---|
| Purpose | Preparing, concluding and performing a civil contract — for orders and customer service. Promotion of goods, works and services — separately, if you process data for marketing. If neither describes your activity, use an accurate custom purpose. |
| Data subjects | Select “Customers” for your customers. For prospective customers, subscribers and other people contacting you, use “Other categories of personal data subjects” and describe them. Select customer representatives and website visitors only if your processing covers them. |
| Personal data | Names, phone numbers and email addresses only if collected. Under other personal data: messaging platform user and chat IDs, usernames, profile links, conversation contents, submitted attachments and message metadata relating to individuals. Include other applicable categories according to the actual contents. |
| Legal grounds | The person's consent or another applicable ground under Article 6. Contract performance applies to necessary processing under a contract with that person. Your subscription agreement with ETOCHATBOT alone does not authorise processing all your contacts' data. |
| Operations | Actual operations: collection, recording, organisation, accumulation, storage, updating, retrieval, use, transfer (provision, access), deletion and destruction. Processing by the service on instructions involves provision of data and access. |
| Methods | Automated processing; mixed processing if you also use non-automated records. Indicate processing over the Internet when applicable. |
| Database location | The actual country and physical data centre address for the databases used. Obtain current deployment details as described below. |
Complete the remaining fields for your business, including contact details, security measures, processing start date and termination conditions. Report categories and processing arrangements; the ordinary notification does not require uploading customer conversation histories.
Is there a field for ETOCHATBOT as a contractor? Point 10.2, Part 3 of Article 22 specifically concerns persons processing data in state or municipal information systems. An ordinary commercial bot does not make that field applicable. Record the service provider in your processing agreement and inform data subjects in your documents.
Notification requirements: Parts 3 and 3.1, Article 22. Select data according to your purposes: Article 5. Identifiers and linked conversations can be personal data: Article 3.
4. What to put in your privacy policy
Publish your own policy and make it accessible where you collect data: on your website, in the bot description and menu, in its first message, and next to forms. Include your operator details, purposes, data categories, grounds, retention periods, deletion procedure and contact for data subject requests. Describe ETOCHATBOT's processing on your instructions. Access requirements are set out in Part 2, Article 18.1 of 152-FZ.
Example clause for your policy
Replace the bracketed text with your details and keep only purposes and data you actually use. This is a policy clause; any required consent must be obtained separately.
[Your organisation's name or sole proprietor's full name] engages individual entrepreneur Dmitry Yuryevich Kiselev (INN 165720128759, OGRNIP 323169000141965), provider of ETOCHATBOT (etochat.bot), to process personal data on its instructions under a processing agreement.
The purposes are [receiving and handling enquiries, processing orders and providing customer support]. The instructed processing covers messaging platform user and chat identifiers, usernames and profile links, conversation contents, attachments submitted by users and message metadata, as well as [list other data actually collected]. Operations include receiving, recording, organising, storing, retrieving, displaying, transmitting replies, updating, deleting and destroying data within the scope of the instructions.
The processor must maintain confidentiality and protect the data. The operator determines the purposes and lawful grounds of processing and handles requests from data subjects at [your contact address].
Set retention periods for each purpose and arrange deletion accordingly. The DPA describes the current retention of conversation history; it does not provide automatic deletion after a fixed period. Account for attachments and connected systems when arranging deletion.
A short notice in your bot
Your personal data operator is [your organisation or sole proprietor]. Our privacy policy: [link to your policy]. We use ETOCHATBOT to receive and handle messages; the service processes data on our instructions.
The policy must describe all your processing, including your own CRM and other integrations where used. ETOCHATBOT's policy describes the service's processing and does not replace your policy.
5. Consent and the processing agreement
Assess lawful grounds separately for your processing and for delegating it to the service. Part 3 of Article 6 requires the data subject's consent to delegation unless federal law provides otherwise. When relying on consent, identify the processor and the purposes, data and operations covered; keep evidence of the action taken and the accepted text.
Consent must be separate from other documents or information that the person accepts. A statement in your terms or the fact that someone sends a message does not by itself establish valid consent. See Parts 1 and 3, Article 9.
When the law requires written consent, identify the instructed processor by name and address, as required by Point 6, Part 4 of Article 9. Obtain the current complete details from us. Ordinary consent does not automatically require collecting passport data.
For direct marketing using personal data, obtain prior consent and stop that processing upon request. Starting a bot or agreeing to service messages does not automatically authorise advertising. See Article 15 of 152-FZ.
Use the DPA together with the terms of service; retain the agreed version and evidence of acceptance. Instructions must specify data, purposes and operations, confidentiality, security, applicable localisation requirements, evidence of protective measures and incident reporting. These requirements follow from Part 3, Article 6. For an individual agreement, contact us.
6. Service provider details for your documents
| Processor | Individual entrepreneur Dmitry Yuryevich Kiselev |
|---|---|
| INN | 165720128759 |
| OGRNIP | 323169000141965 |
| Service | ETOCHATBOT — etochat.bot |
| Contact | info@etochat.bot |
| Documents | Operator details, DPA |
The service's entry in the Roskomnadzor register, No. 16-25-027399, identifies its notification. It is not a certificate of compliance or a substitute for your obligations.
7. Where to obtain the data centre address
Ask for current database and data centre details at info@etochat.bot, using “Details for a Roskomnadzor notification” as the subject. Include your service account and the bots, accounts or channels you connect so that we can identify the relevant setup. Ask for the countries and physical addresses of the data centres used for storing and processing the data, and the parties involved.
The sole proprietor's registered address and the website domain are not the database location. Use confirmed details for the actual setup. Include your own CRM, exports and other databases if you use them, and reflect material changes in your notification.
Before you start
- Identify the people, data and purposes involved in your scenarios.
- Establish lawful grounds, required consents and agreed processing instructions.
- Publish your policy and make it accessible in the bot and collection forms.
- Obtain current database location details; submit or update your notification when required.
- Define retention, access permissions and a procedure for requests and deletion.
This guide explains ordinary commercial use of the service under Russian personal data law. It is informational; contractual processing terms are contained in the DPA and the agreement applicable to your account.