This is a reference translation. The Russian version at quevell.com/ru/privacy/ is the legally binding text; if the two diverge, the Russian version prevails.
1. Who we are
1.1. This policy describes how personal data is handled in the Quevell service and on quevell.com, in accordance with applicable Russian data protection law.
1.2. The personal data operator (the controller under Russian law) is Quevell LLC (OOO "KYUVELL"), a company incorporated in the Russian Federation, OGRN 1265900011244, INN 5904419073, address: 6-27 Revolyutsii st., Perm, Perm Krai, Russia, 614007 ("we").
1.3. The policy applies to all personal data we receive through quevell.com, its subdomains and the Quevell service ("the Service").
1.4. This policy informs data subjects about how their personal data is handled. It is not a consent to processing: where a particular operation requires the data subject's consent, we obtain it separately, in the form the law requires.
2. Our two roles
2.1. Data of the Service's users and the site's visitors (registration and account data) we process as the data operator: we decide the purposes and the scope. Sections 3-11 apply to this data.
2.2. Data that a customer organisation puts into the Service about its employees and other people we process on that customer's instructions. The customer is the operator of that data; we process it only as needed to run the Service, under the terms of our agreement with the customer. Requests from the data subjects we forward to the customer.
3. What data we process
3.1. Account data: email address, first and last name (if provided), interface language, timezone, role in the customer's organisation.
3.2. Organisation data: the customer's organisation name and the details provided at registration and in settings.
3.3. Technical data: IP address, browser and device information, logs of actions in the Service, session identifiers.
3.4. Correspondence: the content of messages to our support and the sender's email address.
3.5. We do not ask for and do not purposefully collect special categories of personal data (health, beliefs and similar) or biometric data for our own purposes. Data a customer puts into the Service may contain such information only by the customer's own decision and on the customer's own lawful basis: we process it strictly on the customer's instructions (section 2.2).
3.6. With a visitor's separate voluntary consent, we use our own source and conversion statistics: an allowed landing path, five campaign UTM labels, the referring hostname, an event type and a daily counter. For a new company, the source is linked once to its identifier and creation date; we retain the consent revision, recording time, first project, issue, invitation and second-member joining events, company activation and the latest purchased seat count. These statistics do not record issue text, email addresses, visitor identifiers, full referring URLs, IP addresses or browser details. No third-party advertising trackers or analytics systems are used.
4. Why we process data, and on what basis
4.1. To conclude and perform the agreement on access to the Service: creating and maintaining accounts, providing the Service functions, invoicing. Basis: the agreement with the customer; for users who are not a party to that agreement, the legitimate interests of Quevell and the customer in providing a workplace service, as recognised by Russian data protection law.
4.2. To send messages the Service needs to work: address confirmation, access recovery, notifications about events in the Service, notices of changed terms. Basis: the agreement.
4.3. To keep the Service secure: logging, preventing unauthorised access, investigating incidents. Basis: our legitimate interest and legal obligations.
4.4. To comply with legal obligations: accounting, responses to lawful requests of public authorities. Basis: the law.
4.5. To handle messages to our support and to the privacy and legal addresses: receiving the request, corresponding, diagnosing and fixing the problem. Basis: the legitimate interest of both sides in resolving the request.
4.6. We do not use personal data for third-party advertising, do not sell it, and make no decisions with legal consequences based solely on automated processing.
4.7. Our own statistics evaluate sources of company creation, activation and payment and help improve the website. The basis is the visitor's separate consent (Article 6, part 1, paragraph 1 of Law 152-FZ), given with the Allow statistics button. Consent is not a condition of registration or the agreement. Data, retention and withdrawal are described separately at quevell.com/en/privacy/analytics/.
5. How we process it
5.1. Processing includes collection, recording, organisation, accumulation, storage, updating, retrieval, use, transfer (provision, access), blocking, erasure and destruction.
5.2. Processing is carried out using automated means.
6. Where the data lives
6.1. Databases with personal data are located in the Russian Federation, on servers rented from Russian providers.
6.2. In our own processing, we do not transfer personal data across borders. Where a customer configures the Service to send data to external recipients (for example, outbound automation calls to addresses the customer chooses), the customer, as the operator of that data, decides on such transfers and is responsible for their lawfulness.
7. Recipients and service providers
7.1. We involve a narrow circle of parties acting on our instructions, to the extent the Service needs:
- an infrastructure provider (servers and storage in the Russian Federation);
- an email delivery service (sending transactional messages);
- a corporate mail service (handling messages sent to our addresses).
The current list of providers is published at quevell.com/en/legal/subprocessors/.
7.2. Personal data may be provided to public authorities on the grounds and in the order established by law.
7.3. We do not share data with anyone else.
8. Cookies
8.1. Authentication cookies and preference storage support the website and Service. Separate local storage for our own statistics is used only after voluntary consent. Authentication cookies are required to sign in and keep the session: signing in is impossible without them. Interface settings (language) are stored for convenience.
8.2. There are no advertising or analytics cookies. Our own statistics use localStorage for the visitor's choice for up to 30 days, and the first permitted source and sent-event flags, including a linked company identifier, for up to 24 hours on the same origin. This preserves the source when a confirmation email opens in another tab in the same browser. Expired entries are not used and are removed when next accessed; a closed browser does not run cleanup. There is no unique visitor identifier. The Site statistics button changes the choice and removes the browser source.
9. How long we keep data
9.1. Account data is processed while the account exists and is deleted or anonymised, within the periods set by the agreement with the customer, after the agreement ends.
9.2. Logs and technical data are kept as long as security purposes require, then deleted or anonymised.
9.3. Data we are legally required to keep (accounting documents, for example) is kept for the legally established periods.
9.4. Daily statistics retain the last 30 UTC days and the current day. The company source and consent evidence are kept for up to 90 days after attribution; milestones for up to 90 days after each event, and no longer than the company source. Cleanup runs hourly. After withdrawal, a refusal record without campaign labels may remain until the company's first day ends, to block a repeated attribution. Deleting a company removes its source and milestones. Deletion from the working database does not immediately delete protected backup copies: they expire under their own retention cycle.
10. Your rights
10.1. You have the right to:
- learn what personal data of yours we process;
- have inaccurate data corrected, blocked or destroyed;
- withdraw consent, where processing is based on consent;
- complain to the Russian data protection authority (Roskomnadzor) or to a court.
10.2. To exercise these rights, write to the address in section 13. We reply within the periods established by law.
10.3. For account data, technical data and correspondence with us, Quevell handles the request. For data put into a workspace by the organisation you work for, that organisation is the operator: address your request to it. If a request covers both, we answer within our own role and pass the rest to the organisation.
11. How we protect data
11.1. We apply legal, organisational and technical measures, including: encryption in transit and encryption of sensitive data at rest, access control at the database level, action logging, regular backups, regular security testing.
12. Changes to this policy
12.1. We may change this policy. A new version is published at quevell.com/en/privacy/ with its effective date. For material changes we notify registered users by email.
13. Contact
Quevell LLC (OOO "KYUVELL")
OGRN 1265900011244, INN 5904419073
6-27 Revolyutsii st., Perm, Perm Krai, Russia, 614007
Email for personal data matters: privacy@quevell.com