Nova CRM Privacy Policy (International)

1. General

This Policy describes how the Nova CRM SaaS platform processes personal data of customers outside Russia and Kazakhstan and of those customers' clients. It is written to be compatible with widely adopted data protection principles (including those of the EU General Data Protection Regulation where it applies).

Controller for account data: [OPEN — legal entity pending OA-002].

2. Data we process

• Customer account data: e-mail address, name, sign-in data, session

history.

• Data of the Customer's clients arriving through connected channels

(Telegram, VK, web chat widget, and others): name, contact details, message content, conversation metadata. For this data the Customer is the controller and Nova CRM acts as a processor on the Customer's documented instructions; the Customer is responsible for having a lawful basis for collection.

• Technical information: IP address, device and browser data, event logs.
• Payment data is handled directly by payment providers; Nova CRM does

not store full card details.

3. Purposes and legal bases

Performance of the contract (provision of the Service, invoicing, support), legitimate interests (service security, fraud prevention, service status notifications), and compliance with legal obligations. Data of the Customer's clients is processed solely to provide the Service to the Customer and is never used for advertising or profiling by Nova CRM.

4. International transfers and data location

The Nova CRM primary database (system of record) is hosted in the Russian Federation. By using the Service the Customer instructs this hosting location; Customers subject to transfer-restriction regimes (such as GDPR Chapter V) are responsible for confirming that this instruction is permissible for them before connecting their clients' data.

For certain channels that operate through client sessions rather than official APIs, message intake and routing technically pass through infrastructure nodes in other countries. A Customer connecting such a channel consents to the transfer of its clients' data to the extent necessary for the channel to work. The inbound message buffer on the connector node is not encrypted at rest — a limitation disclosed to the Customer explicitly, not an oversight.

5. Retention

Project data is retained for 90 days after the project enters the suspended or canceled status and is then irreversibly deleted.

6. Data subject rights

Depending on the applicable law, data subjects may have the rights of access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent, as well as the right to complain to a supervisory authority. Requests go to privacy@zaipulayev.eu. Requests concerning the Customer's clients' data are forwarded to the Customer as the controller.

7. Security measures

TLS in transit, encryption at rest for sensitive data categories except for the explicitly disclosed exception (section 4), role-based access control, and audit of privileged actions.

8. Cookies

Only technically necessary cookies for authentication and session persistence are used. No third-party analytics, advertising, or tracking cookies; the Policy will be updated in advance if any are introduced.

9. Changes to this Policy

Changes are published on the website with a new effective date; for material changes (new data categories, new purposes, new international transfers) Customers are additionally notified through the dashboard at least 14 days in advance.