Personal Data Processing Policy

This Personal Data Processing Policy (hereinafter — the “Policy”) has been prepared in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” and defines the procedure for processing personal data and the measures taken to ensure the security of personal data by MESTRA LLC (hereinafter — the “Operator”) in respect of Users of the Mestra service available at mestra.chat (hereinafter — the “Service”, the “Website”).

The current version of the Policy is published at: mestra.chat/privacy.

1. Terms and definitions

1.1. Service — the Mestra SaaS platform that allows Users to combine customer correspondence from different messengers and platforms in a single window, keep customer cards (CRM), manage tasks, and issue invoices. MESTRA LLC is the rights holder of the Service.

1.2. Operator — MESTRA LLC, which organizes and (or) carries out the processing of personal data and determines the purposes of processing, the composition of personal data, and the actions performed with them.

1.3. User — an individual, an individual entrepreneur, or a legal entity (or its representative) that has registered on the Website and obtained the right to use the Service.

1.4. User’s Client — an individual whose personal data the User enters into the Service when using CRM functionality (customer cards, correspondence, documents) for the User’s own business activity.

1.5. Personal data — any information relating to a directly or indirectly identified or identifiable individual.

1.6. Processing of personal data — any action or set of actions with personal data, including collection, recording, systematization, accumulation, storage, clarification, extraction, use, transfer, depersonalization, blocking, deletion, and destruction.

1.7. Personal Account — a section of the Website available to the User after registration through which the User interacts with the Service.

1.8. User Agreement — the terms of use of the Service available at mestra.chat/terms.

1.9. Cookies — a small fragment of data sent by a web server and stored on the User’s device, which the web browser sends back to the server on subsequent visits to the Website.

1.10. Cross-border transfer of personal data — the transfer of personal data to the territory of a foreign state to a foreign public authority, a foreign individual, or a foreign legal entity.

2. General provisions

2.1. Use of the Service, registration on the Website, completion of feedback forms, and purchase of the Operator’s services constitutes the User’s consent to this Policy and to the terms of processing of the User’s personal data.

2.2. If the User disagrees with the provisions of the Policy, the User must stop using the Service.

2.3. The Operator does not verify the accuracy of personal data provided by the User and assumes that the User provides accurate information and keeps it up to date.

2.4. This Policy applies solely to the Service. The Operator is not responsible for third-party websites and services that the User may access via links available in the Service.

3. Subject of the Policy

3.1. Data provided by the User directly

• registration data: name, phone number, email address, company name, industry (business category);
• payment data for invoicing (full bank card details are not stored by the Operator — payments are processed by a certified payment partner);
• data entered in the Personal Account: contents of customer cards, files, documents, notes, correspondence, deal status.

3.2. Data received through connected services

The Service allows Users to connect third-party services for convenience of work in a single window. For each service, the Operator requests access only to the data necessary for the specific function, and only after the User has explicitly confirmed the connection through the official authorization procedure of the relevant service (for example, OAuth). The User may disconnect any integration at any time in the Service settings.

• messengers and social networks (Telegram, VKontakte, MAX, and others) — incoming and outgoing messages, for display and reply in the Service’s unified Inbox;
• classifieds and marketplaces (Avito, CIAN, HH.ru, Ozon, Wildberries, Yandex Realty) — publication of listings on behalf of the User and receipt of messages relating to such listings;
• Email — integration of email notifications and correspondence into the unified Inbox.

3.3. If the User connects Google Calendar

The Service primarily works with the Russian services listed above. Separately, and only by the User’s own choice, the User may connect an external Google Calendar. Because this requires access to data of a foreign service, a detailed description of the use of such data is provided below as required by Google’s rules.

When Google Calendar is connected, the Service requests access to the User’s Google Calendar in order to: display existing calendar events inside the Service; create, change, and delete events (for example, meetings with clients) scheduled through the Service; automatically send meeting reminders and video-call links for online events.

Use of data obtained through the Google API complies with the Google API Services User Data Policy, including Limited Use requirements:

• Google Calendar data is used solely for the calendar functions inside the Service described above;
• Google Calendar data is not used to serve advertising;
• Google Calendar data is not transferred or sold to third parties, except where necessary for the operation of the function itself (for example, to infrastructure providers processing data on behalf of the Operator subject to equivalent confidentiality obligations), or as required by law;
• access to Google Calendar data inside the Service is granted only to employees who need it to provide technical support, and only upon a specific request from the User;
• a connected Google Calendar is personal and relates solely to the team member (the User’s employee) who connected it. Other team members within the same workspace do not receive access to that calendar and do not see its contents;
• each employee independently manages the connection of their Google Calendar and may disconnect it at any time via the Service settings or directly via the security settings of their Google account (myaccount.google.com/permissions). Upon disconnection, the Service stops access to calendar data; previously synchronized data remains in the workspace and is deleted in the general order provided for in section 7 of this Policy (within 30 days from deletion of the workspace).

3.4. Data collected automatically

• technical data: IP address, device and browser type, operating system, session identifiers;
• Service usage data: features and sections used, frequency and time of log-in;
• Cookies and similar technologies — for authorization, saving settings, and basic analytics of Website use.

3.5. The Operator does not process personal data relating to Users’ racial or ethnic origin, political opinions, religious or philosophical beliefs, health, or intimate life.

4. Purposes of personal data processing

• registration and identification of the User, granting access to the Personal Account;
• providing the functionality of the Service: unified Inbox, CRM, tasks, invoices, calendar;
• performance of obligations under the User Agreement and contracts with the User, including invoicing and payment processing;
• providing customer support to the User, handling inquiries and requests;
• sending service and informational notices related to use of the Service;
• ensuring the security of the Service, preventing fraud and abuse;
• conducting statistical and analytical research on the basis of depersonalized data to improve the Service.

The Operator does not sell Users’ personal data to third parties and does not use the User’s Clients’ CRM data for the Operator’s own marketing purposes.

5. Legal bases for processing personal data

The legal basis for processing personal data is the set of regulatory legal acts in accordance with which the Operator carries out processing: the Constitution of the Russian Federation; the Civil Code of the Russian Federation; Federal Law No. 152-FZ “On Personal Data”; the Operator’s charter; contracts and agreements between the Operator and the User (including the User Agreement); the User’s consent to the processing of personal data, expressed upon registration on the Website by checking the corresponding box in the registration form.

6. Methods and periods of personal data processing

6.1. Storage of Users’ personal data is carried out in the territory of the Russian Federation, in accordance with the requirements of Federal Law No. 152-FZ “On Personal Data”.

The infrastructure providers that ensure storage and processing of data are: HostKey (server) and FirstVDS (cloud storage) — both in the territory of the Russian Federation; the payment gateway — YooKassa; the SMS mailing and call provider for confirmation codes (OTP) — RedSMS.

6.2. Personal data is processed without a time limit — until the purposes of processing are achieved or until the User withdraws consent, by any lawful means, including with the use of automation tools.

6.3. The Operator may transfer personal data to third parties in the following cases: the User has consented to such transfer; the transfer is necessary for the operation of Service functionality used by the User (including integrations connected by the User); the transfer is made to the infrastructure providers, payment systems, and SMS/OTP providers listed above — solely to the extent necessary to provide the relevant service; transfer to public authorities — on the grounds provided for by the laws of the Russian Federation.

6.4. All data recipients specified in clause 6.3 are legal entities registered in and processing data in the territory of the Russian Federation. Outside this list, cross-border transfer of personal data is not carried out, with one exception: if the User, by their own choice, connects a third-party foreign service (for example, Google Calendar — see clause 3.3), part of the data is transferred to the operator of that service to the extent necessary for the integration to work, with the User’s explicit consent given through the authorization procedure of the relevant service.

7. Clarification, cessation of processing, and destruction of personal data

7.1. Upon a written request from the User, the Operator must provide information about the processing of the User’s personal data within ten business days from receipt of the request. The period may be extended by no more than five business days, with notice to the User of the reasons for the extension.

7.2. The User may demand clarification, blocking, or destruction of their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or is not necessary for the stated purpose of processing.

7.3. The User may withdraw consent to the processing of personal data at any time by sending a request to the address specified in the “Contact information” section. The Operator shall cease processing and destroy the personal data within a period not exceeding 30 (thirty) days from the date of receipt of the withdrawal, except where longer storage is required by the laws of the Russian Federation (for example, for tax and accounting purposes).

7.4. When the User stops using the Service, personal data is blocked and stored for a possible resumption of use of the Service for up to six months, after which it is subject to destruction.

8. Rights and obligations of the parties

8.1. The User may

• freely decide whether to provide their personal data and give consent to its processing;
• independently update and supplement the personal data provided;
• demand clarification, blocking, destruction, or cessation of processing of their personal data;
• request and receive information relating to the processing of their personal data;
• obtain a copy of their data in a machine-readable format.

8.2. The Operator must

• use the data obtained solely for the purposes specified in section 4 of this Policy;
• ensure the confidentiality of personal data and not disclose it without a lawful basis;
• take measures to protect personal data in accordance with section 9 of this Policy;
• notify the authorized body for the protection of the rights of personal data subjects (Roskomnadzor) in the event of an incident that resulted in unlawful access to, loss of, or disclosure of personal data, within the time limits established by the laws of the Russian Federation.

8.3. Special rules for the User’s Clients’ data

A User that is a legal entity or an individual entrepreneur and that enters into the Service the personal data of their Clients, employees, or counterparties thereby instructs the Operator to perform the following actions with such data for the purpose of providing the functionality of the Service: recording, systematization, accumulation, storage, clarification, use, transfer (granting access), depersonalization, blocking, deletion, and destruction.

In respect of such data, the Operator acts as a processor acting on the User’s instructions, while the User itself is the operator of the personal data of its Clients, employees, and counterparties. The User guarantees that: all necessary consents of the relevant personal data subjects have been obtained for the processing and transfer of their data to the Operator for the purpose of receiving the Service; the personal data subjects have been duly notified of the purposes of processing their data; the User independently bears responsibility as the operator of such data before the data subjects and authorized bodies.

9. Protection of personal data

9.1. The Operator takes the necessary organizational and technical measures to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, dissemination, and other unlawful acts of third parties, including:

• encryption of data in transit;
• access rights segregation for employees based on the principle of least privilege;
• regular backups;
• use of antivirus protection tools;
• regular internal audit of compliance with personal data legislation.

9.2. The User must keep the credentials of their account confidential and immediately notify the Operator of any unauthorized access to the Personal Account.

9.3. In the event of an incident that resulted in unlawful access to, loss of, or disclosure of personal data, the Operator shall notify Roskomnadzor within the time limits established by law of the fact of the incident, its causes, the measures taken to eliminate the consequences, and the results of the internal investigation, and shall also notify the affected Users if there is a risk to their rights and freedoms.

10. Liability of the parties

10.1. An Operator that has failed to perform its obligations under this Policy is liable for losses incurred by the User in connection with the unlawful use of personal data, in accordance with the laws of the Russian Federation.

10.2. The Operator is not liable for the lawfulness of processing and transfer of personal data of individuals that the User enters into the Service when using it in the User’s business activity — the User, as the operator of such data, bears that responsibility (see clause 8.3).

10.3. The User bears full responsibility for the accuracy and relevance of the personal data they provide, as well as for compliance with the laws of the Russian Federation when using the Service.

11. Dispute resolution

The laws of the Russian Federation in force apply to this Policy and to the relationship between the User and the Operator. Disputes are considered in the manner provided for by the laws of the Russian Federation.

12. Contact information

For all questions relating to the processing of personal data and this Policy, please contact us at info@mestra.chat.

MESTRA LLC (in Russian — ООО «МЕСТРА»), OGRN 1267700073222, INN 9713034182, address: 127238, Moscow, Lokomotivny Proezd 21, building 5, premises 45/5.

A written request to withdraw consent, or to clarify, block, or destroy personal data, must contain: information identifying the applicant or their representative; information confirming interaction with the Operator (for example, the account email address); the applicant’s signature (if sent on paper) or an electronic signature (if sent in electronic form).

13. Final provisions

13.1. The Policy enters into force upon publication on the Website and remains in effect indefinitely until replaced by a new version.

13.2. The Operator may amend this Policy unilaterally. In the event of material changes, the Operator shall notify Users by email or via a notice in the Service interface at least 7 (seven) days before the changes take effect.

13.3. Users are advised to review the current version of this Policy independently and on a regular basis.