Personal Data Processing & Protection Policy

01 General provisions

This Policy defines the procedure for processing personal data ("PD") and the measures ensuring its security, and is developed in accordance with Federal Law No. 152-FZ of 27.07.2006 "On Personal Data".

02 Terms & definitions

• Personal data — any information relating to a directly or indirectly identified individual.
• Processing — any operation with PD: collection, recording, storage, use, deletion, etc.
• Operator — the party organizing and carrying out PD processing.

03 Legal basis

Processing is carried out on the basis of the subject's consent, concluded contracts, and in cases provided for by the legislation of the Russian Federation.

04 Processing purposes

PD is processed to provide access to the Platform, perform contracts, deliver technical support, and inform about updates.

05 Data subjects & data composition

Subjects are users and tenant representatives. Composition: full name, contact details, account data. The exact list is determined by the Operator.

06 Principles & conditions

Processing is lawful and fair, limited to the stated purposes, not excessive in scope, and ceases once the purposes are achieved or consent is withdrawn.

07 Self-hosted processing model

The Platform is deployed on the User's infrastructure. PD processed within an Instance is stored on the User's side; the Platform Operator has no access to it and is not a processor unless separately agreed.

08 Protection measures

Organizational and technical measures are applied: an encrypted credentials vault, role-based access control (RBAC), row-level security, audit, IP allowlist, approval gates on risky operations, and an air-gapped mode.

09 Data subject rights

The subject may obtain information about processing, request rectification, blocking or deletion of PD, and withdraw consent by sending a request to info@aihummer.ru.

10 Cross-border transfer

In the self-host model the Platform Operator performs no cross-border transfer. When transferring data independently, the User ensures compliance with 152-FZ.

11 Retention & deletion

PD is retained no longer than the processing purposes require and is destroyed upon their achievement or consent withdrawal, unless a different period is set by law.

12 Final provisions

The Operator may amend this Policy. The current version is published on the website. Related documents: Privacy Policy, Consent to data processing.