Consent to Personal Data Processing

Given by selecting a separate checkbox when creating an account in the DocRoost service.

1. The person creating an account in the DocRoost service (the Data Subject), acting freely, of their own will and in their own interest, gives specific, purpose-defined, informed, conscious and unambiguous consent to the owner of the DocRoost service (the Operator) to process their personal data on the terms below, in accordance with Article 9 of Federal Law No. 152-FZ of 27 July 2006 ‘On Personal Data’ (the Law).

2. Personal data covered: name, email address, password hash, profile photo if uploaded, role in the organization, second-factor authentication data, and the account identifier if a messenger is connected.

3. Processing purposes: creating an account and signing in to the service, working in the organization’s archive, and sending messages about the operation of the service.

4. Processing operations: collection, recording, systematization, accumulation, storage, updating, retrieval, use, transfer (provision or access) to administrators of the organization to which the Data Subject belongs and contractors listed in the Personal Data Processing Policy, blocking, deletion and destruction. Processing is carried out using automated means.

5. Databases containing personal data are located within the Russian Federation. If the organization has allowed messengers and the Data Subject has connected Telegram, the account identifier is transferred to a relay server in the Republic of Kazakhstan and to Telegram outside the Russian Federation.

6. This consent remains valid until the account ceases to exist or consent is withdrawn. IP addresses, browser information, and records of sign-ins and actions in the service are processed for security purposes under Article 6(1)(7) of the Law, rather than under this consent, for the periods stated in the Personal Data Processing Policy.

7. Consent may be withdrawn by emailing support@docroost.com. Within 30 days of withdrawal, the Operator stops processing and deletes the data unless another legal ground for processing exists under the Law. Use of the account ends after withdrawal. Withdrawal by an organization owner is implemented after ownership has been transferred or the organization has been deleted.

8. This consent does not cover documents, emails or messages stored in the organization’s archive: these are processed on the organization’s instructions.