1. General provisions
The personal data operator is Индивидуальный предприниматель Сташевская Арина Евгеньевна, TIN (INN) 650113327100, state registration number (OGRNIP) 323650000020211, postal address: 693000, г. Южно-Сахалинск, пер. Мебельный, д. 6 (the Operator).
The Policy covers all personal data the Operator receives through the website www.cloudybus.com (the Website), the client portal and the Cloudybus ERP software products (the Service).
The current version of the Policy is published openly at https://www.cloudybus.com/en/privacy and is available without signing in.
2. Key terms
Personal data means any information relating to a directly or indirectly identified or identifiable individual (the data subject). The terms operator, processing of personal data, automated processing, provision, blocking, erasure and anonymisation are used as defined in article 3 of Federal Law No. 152-FZ.
3. Whose data is processed and what exactly
Website visitors
The request form on the Website is disabled: names, phone numbers, e-mail addresses and other data are not collected through it and are not sent anywhere. Only technical data that any browser reports when requesting any website is processed: IP address, browser and device details, date and time of the request, addresses of the requested pages, cookie data (section 6). If a visitor contacts the Operator directly — by the phone number or e-mail address shown on the Website — the Operator processes the data provided in that message: name, contact details, company name and the content of the enquiry.
Representatives of the Operator’s clients
Employees and authorised representatives of the organisations the Operator contracts with: surname, given name and patronymic, job title, work e-mail address and phone number, and also the Service account identifier and records of sign-ins and actions in the Service required for access control and incident investigation.
Individuals whose data is supplied by a client
Employees of the client and of third parties whose data the client enters into the Service or supplies in documents: drivers (surname, given name and patronymic, personnel number, phone number, social insurance number, passport details, driving licence details), employees and passengers listed in transport requests, lists and access control cards, and contact persons of transport customers. The composition of such data is determined by the client; the Operator processes it on the client’s instructions — see section 7.
The Operator does not request and does not itself collect biometric personal data or special categories of personal data: information on racial or ethnic origin, political opinions, religious or philosophical beliefs, health or sex life.
4. Purposes of processing, legal grounds and retention
| Purpose | Legal ground | Retention period |
|---|---|---|
| Reviewing enquiries received by phone or e-mail and replying to them | Consent of the data subject expressed in the enquiry itself (article 9 of 152-FZ) | Until the purpose of the enquiry is achieved, but no longer than 3 years, or until consent is withdrawn |
| Concluding and performing the contract with a client, providing access to the Service and the client portal, technical support | Performance of a contract to which the data subject is a party or a beneficiary (article 6(1)(5) of 152-FZ) | The term of the contract and the subsequent retention periods set by accounting and archival legislation |
| Processing data contained in a client’s requests, lists and documents, including automated recognition of incoming requests | Instructions of the client, who is the operator of that data (article 6(3) of 152-FZ) | Determined by the client’s instructions; once they end, the data is returned to the client or destroyed |
| Keeping the Website and the Service running, security, investigation of failures and unauthorised access attempts | The duty to ensure the security of data (article 19 of 152-FZ) and the legitimate interest of the Operator (article 6(1)(7) of 152-FZ) | Server logs — up to 12 months; cookies — the periods stated in section 6 |
| Demonstrating that consent to optional cookies was obtained or refused | The duty to demonstrate that consent was obtained (Article 9(4) of Federal Law 152-FZ) and the Operator’s legitimate interest (Article 6(1)(7) of Federal Law 152-FZ) | 3 years from the date of the record |
| Collecting Website visit statistics and analysing visitor behaviour by means of web analytics | Consent of the data subject to analytics cookies (clause 1 of part 1 of article 6 of 152-FZ) | Until consent is withdrawn; retention on the web analytics service side is set by its owner |
5. Procedure and conditions of processing
Processing is carried out both with and without automation and includes collection, recording, systematisation, accumulation, storage, updating (renewal, alteration), retrieval, use, transfer (provision, access), blocking, erasure and destruction of personal data.
When parsing incoming requests, the Service uses automated text recognition and machine learning language models. All models run inside the infrastructure of the Operator or of the client: personal data is not sent to external cloud artificial intelligence services.
No decision producing legal consequences for a data subject is taken solely on the basis of automated processing. The output of the models is a suggestion to the Service operator: a request becomes an order only after a person confirms it.
Databases containing personal data of citizens of the Russian Federation are located in the territory of the Russian Federation (article 18(5) of 152-FZ).
6. Cookies
The Site uses cookies without which it cannot work and — with the visitor’s consent — analytics cookies of a web analytics service. Until consent is given, analytics cookies are not set and the corresponding scripts are not loaded. Advertising and profiling cookies are not used.
| Cookie | Purpose | Lifetime |
|---|---|---|
cb_lang |
The selected interface language. Written only when the language is switched manually | 12 months |
cloudybus.auth |
Signing in to the client portal. Set after a successful sign-in and not readable by page scripts | Up to 200 minutes after the last action |
.AspNetCore.Antiforgery.* |
Protection of forms against cross-site request forgery | Until the browser is closed |
cb_consent |
Stores the visitor’s choice of cookie categories | 12 months |
The Website uses the following web analytics services: Яндекс Метрика (включая Вебвизор — запись действий посетителя на странице). They collect anonymised visit statistics and set their own cookies.
Cookies can be deleted or blocked in the browser settings. The Website will still work, but the selected language will not be remembered and signing in to the client portal will not be possible.
The choice you make in the cookie notice is recorded on the Operator’s server: date and time, the version of the consent text, the categories selected, your IP address and browser details (User-Agent), and a random record identifier not linked to any account. The record is kept for 3 years and used solely to demonstrate that consent was given or refused; it is not used for advertising, profiling, or any other purpose. Changing your decision does not overwrite the earlier record but adds a new one, preserving the history of choices.
The cookies, their purposes and retention periods are described in detail in a separate document — the Cookie Policy.
7. Processing on behalf of clients
In respect of data that a client supplies to the Operator in requests, lists and documents (including data of passengers and of the client’s employees), the Operator acts as a person processing personal data on behalf of the operator under article 6(3) of 152-FZ. The client remains the operator of that data.
The purposes of processing, the composition of the data and the list of permitted actions are determined by the client in the contract and in its instructions. The Operator does not determine the purposes of processing and does not use such data for its own purposes; it maintains confidentiality and complies with the security requirements of articles 18.1 and 19 of 152-FZ.
Obtaining consent from the data subjects whose data is supplied to the Operator is the client’s responsibility. The Operator forwards a request from such a data subject to the client and responds to it in the manner set out in the contract with the client.
8. Transfer of data to third parties
The Operator does not sell personal data and does not transfer it to third parties for advertising. Transfer is possible only in the cases listed below.
To the client on whose instructions the Operator processes the data — to the extent and on the terms set by the contract and the processing instruction (section 7).
Hosting of the Website and Service servers: ООО «МТ ФИНАНС» (RuVDS, ruvds.com), Russian Federation. No processing of personal data is entrusted to the hosting provider.
To the web analytics service: Яндекс Метрика (включая Вебвизор — запись действий посетителя на странице). It receives the visitor’s IP address, browser and device details, the addresses of the Website pages viewed and information about the visitor’s actions on them. The transfer begins only after the visitor has consented to analytics cookies and stops if consent is refused or withdrawn. The service processes this data on the Operator’s instructions and within the Russian Federation.
To authorised state bodies — on the grounds and in the manner established by law.
No cross-border transfer of personal data takes place: both the Operator and the recipients named above process the data within the Russian Federation. Fonts, stylesheets and images are served by the Website from its own servers, and it requests none of them from third-party domains. Should a cross-border transfer become necessary, the Operator will carry it out in compliance with article 12 of 152-FZ: with prior notification of Roskomnadzor and an assessment of whether the receiving party protects the rights of data subjects.
9. Rights of data subjects
A data subject has the right to:
- obtain information about the processing of their data: the legal ground and purposes, the composition and source of the data, the processing and retention periods, and the parties the data is transferred to;
- demand that the data be corrected, blocked or destroyed if it is incomplete, outdated, inaccurate, obtained unlawfully or not necessary for the stated purpose of processing;
- withdraw consent to processing in whole or in part; withdrawal does not affect the lawfulness of processing carried out before it was received;
- appeal against the acts or omissions of the Operator to Roskomnadzor or in court.
A request should be sent to the e-mail address info@cloudybus.com or by post to: 693000, г. Южно-Сахалинск, пер. Мебельный, д. 6. The request should contain information making it possible to identify the applicant and their relation to the data requested.
Information about processing is provided within 10 working days; this period may be extended by no more than 5 working days with notice to the applicant. Data is destroyed following a justified demand or the withdrawal of consent within 30 days.
10. Security measures
The Operator takes the legal, organisational and technical measures required by articles 18.1 and 19 of 152-FZ: internal regulations on the processing and protection of personal data have been adopted; access to data is separated by role and granted on a need-to-know basis; connections to the Website and the Service are encrypted (TLS); access logs and backups are maintained; internal compliance control and staff training are carried out; an incident response procedure is in place, including notification of Roskomnadzor.
The person responsible for organising the processing of personal data: Индивидуальный предприниматель Сташевская Арина Евгеньевна.
11. Erasure periods and final provisions
Personal data is destroyed or anonymised once the purposes of processing have been achieved, upon withdrawal of consent and in other cases provided by law — within 30 days, unless another period is set by law or by the contract with the client.
The Operator may amend the Policy. A new version takes effect once published on the Website; the date of the current version is shown at the top of the document.
Questions about the processing of personal data: info@cloudybus.com. Phone: +7 (917) 114-98-80.
If the language versions of this Policy differ, the Russian version prevails.