This is a reference translation. The Russian version at quevell.com/ru/privacy/ is the legally binding text; if the two diverge, the Russian version prevails.
1. Who we are
1.1. This policy describes how personal data is handled in the Quevell service and on quevell.com, in accordance with applicable Russian data protection law.
1.2. The personal data operator (the controller under Russian law) is Quevell LLC (OOO "KYUVELL"), a company incorporated in the Russian Federation, OGRN 1265900011244, INN 5904419073, address: 6-27 Revolyutsii st., Perm, Perm Krai, Russia, 614007 ("we").
1.3. The policy applies to all personal data we receive through quevell.com, its subdomains and the Quevell service ("the Service").
1.4. This policy informs data subjects about how their personal data is handled. It is not a consent to processing: where a particular operation requires the data subject's consent, we obtain it separately, in the form the law requires.
2. Our two roles
2.1. Data of the Service's users and the site's visitors (registration and account data) we process as the data operator: we decide the purposes and the scope. Sections 3-11 apply to this data.
2.2. Data that a customer organisation puts into the Service about its employees and other people we process on that customer's instructions. The customer is the operator of that data; we process it only as needed to run the Service, under the terms of our agreement with the customer. Requests from the data subjects we forward to the customer.
3. What data we process
3.1. Account data: email address, first and last name (if provided), interface language, timezone, role in the customer's organisation.
3.2. Organisation data: the customer's organisation name and the details provided at registration and in settings.
3.3. Technical data: IP address, browser and device information, logs of actions in the Service, session identifiers.
3.4. Correspondence: the content of messages to our support and the sender's email address.
3.5. We do not ask for and do not purposefully collect special categories of personal data (health, beliefs and similar) or biometric data for our own purposes. Data a customer puts into the Service may contain such information only by the customer's own decision and on the customer's own lawful basis: we process it strictly on the customer's instructions (section 2.2).
3.6. Public page views and signup steps are measured with separate daily total counters of allowed page views, signup link clicks, signup starts and signup completions. We retain the UTC day, a fixed event type, a path from a closed list of pages without parameters, and the total count. Referral sources, UTM labels, IP addresses, browser data, visitor, user and company identifiers, issue text and comments are not recorded in these counters. Visits and signup are not linked to a particular company's subsequent activity. We do not use third-party advertising trackers or analytics systems.
4. Why we process data, and on what basis
4.1. To conclude and perform the agreement on access to the Service: creating and maintaining accounts, providing the Service functions, invoicing. Basis: the agreement with the customer; for users who are not a party to that agreement, the legitimate interests of Quevell and the customer in providing a workplace service, as recognised by Russian data protection law.
4.2. To send messages the Service needs to work: address confirmation, access recovery, notifications about events in the Service, notices of changed terms. Basis: the agreement.
4.3. To keep the Service secure: logging, preventing unauthorised access, investigating incidents. Basis: our legitimate interest and legal obligations.
4.4. To comply with legal obligations: accounting, responses to lawful requests of public authorities. Basis: the law.
4.5. To handle messages to our support and to the privacy and legal addresses: receiving the request, corresponding, diagnosing and fixing the problem. Basis: the legitimate interest of both sides in resolving the request.
4.6. We do not use personal data for third-party advertising, do not sell it, and make no decisions with legal consequences based solely on automated processing.
4.7. Anonymous total counts are used to assess site traffic and signup steps. These counts are not linked to an identified or identifiable person. We do not request separate consent for these statistics; signup and use of the Service remain available without additional actions.
5. How we process it
5.1. Processing includes collection, recording, organisation, accumulation, storage, updating, retrieval, use, transfer (provision, access), blocking, erasure and destruction.
5.2. Processing is carried out using automated means.
6. Where the data lives
6.1. Databases with personal data are located in the Russian Federation, on servers rented from Russian providers.
6.2. In our own processing, we do not transfer personal data across borders. Where a customer configures the Service to send data to external recipients (for example, outbound automation calls to addresses the customer chooses), the customer, as the operator of that data, decides on such transfers and is responsible for their lawfulness.
7. Recipients and service providers
7.1. We involve a narrow circle of parties acting on our instructions, to the extent the Service needs:
- an infrastructure provider (servers and storage in the Russian Federation);
- an email delivery service (sending transactional messages);
- a corporate mail service (handling messages sent to our addresses).
The current list of providers is published at quevell.com/en/legal/subprocessors/.
7.2. Personal data may be provided to public authorities on the grounds and in the order established by law.
7.3. We do not share data with anyone else.
8. Cookies
8.1. Authentication cookies are required to sign in and maintain a session: signing in is not possible without them. Interface settings, such as language and theme, are retained for convenience.
8.2. Advertising and analytics cookies are not used. Anonymous statistics write no data to localStorage or sessionStorage and retain no referral source. When the updated site or application loads, the previous statistics choice and source records are removed from browser storage; this cleanup does not run while the browser is closed or old pages have not been refreshed.
9. How long we keep data
9.1. Account data is processed while the account exists and is deleted or anonymised, within the periods set by the agreement with the customer, after the agreement ends.
9.2. Logs and technical data are kept as long as security purposes require, then deleted or anonymised.
9.3. Data we are legally required to keep (accounting documents, for example) is kept for the legally established periods.
9.4. Anonymous daily counts are kept for the last 30 UTC days plus the current day, with hourly cleanup. Company sources and milestones previously recorded with separate consent are no longer added to or used in reports. Their previous retention periods remain: sources up to 90 days after recording, milestones up to 90 days after the event and no longer than the company source, and previous daily counts for the last 30 UTC days plus today. Deleting a company deletes its previous source and milestones. Requests for early deletion of a previous company link can be sent to privacy@quevell.com; we verify the requester's authority. Removal from the working database does not mean immediate removal from protected backups, which expire on their own retention cycle.
10. Your rights
10.1. You have the right to:
- learn what personal data of yours we process;
- have inaccurate data corrected, blocked or destroyed;
- withdraw consent, where processing is based on consent;
- complain to the Russian data protection authority (Roskomnadzor) or to a court.
10.2. To exercise these rights, write to the address in section 13. We reply within the periods established by law.
10.3. For account data, technical data and correspondence with us, Quevell handles the request. For data put into a workspace by the organisation you work for, that organisation is the operator: address your request to it. If a request covers both, we answer within our own role and pass the rest to the organisation.
11. How we protect data
11.1. We apply legal, organisational and technical measures, including: encryption in transit and encryption of sensitive data at rest, access control at the database level, action logging, regular backups, regular security testing.
12. Changes to this policy
12.1. We may change this policy. A new version is published at quevell.com/en/privacy/ with its effective date. For material changes we notify registered users by email.
13. Contact
Quevell LLC (OOO "KYUVELL")
OGRN 1265900011244, INN 5904419073
6-27 Revolyutsii st., Perm, Perm Krai, Russia, 614007
Email for personal data matters: privacy@quevell.com