Nova CRM Privacy Policy

1. General

This Policy is drawn up in accordance with Russian Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" (152-FZ) and describes how personal data is processed when the Nova CRM SaaS platform is used.

Operator of account personal data: [OPEN — legal entity, pending OA-002].

2. Data subjects and data categories

• Customer account data: e-mail address, name, sign-in data, session

history.

• Data of the Customer's clients arriving through connected channels

(Telegram, VK, web chat widget, and others): name, contact details, message content, conversation metadata.

• Technical information: IP address, device and browser data, event

logs.

• Payment data is handled directly by payment providers (YooKassa,

T-Business); Nova CRM does not store full card details.

3. Purposes and legal grounds

Data is processed to perform the contract (offer): providing access to the service, invoicing, support, service status notifications; to ensure security and prevent fraud; and to comply with the operator's legal obligations. No processing happens beyond these purposes; data is not used for advertising or profiling and is not shared with third parties except as provided by this Policy and by law.

4. Processing the Customer's clients' data on instructions

Nova CRM processes the data of the Customer's clients on the Customer's instructions under Article 6(3) of 152-FZ. The Customer is the operator of that data: it defines the purposes of processing and is responsible for the lawfulness of collection and for obtaining its clients' consents. Nova CRM processes such data solely to provide the service to the Customer.

5. Localization and cross-border transfer

The Nova CRM primary database (system of record) is hosted in a Russian hosting region; initial recording of personal data of citizens of the Russian Federation uses databases located in the Russian Federation in accordance with Article 18(5) of 152-FZ.

For certain messenger channels that operate through client sessions rather than official APIs, messages technically pass through infrastructure nodes outside the Russian Federation (during the pilot — the Netherlands; a backup node — another country or provider). This constitutes a cross-border transfer of the Customer's clients' data to the extent necessary for the channel to work; the nodes serve only as session and relay nodes, not as primary storage. A Customer connecting such a channel consents to this transfer.

Channel authorization and session data is encrypted at rest on the node; the inbound message buffer on the connector node is not encrypted at rest. This is a technical limitation of such channels disclosed to the Customer explicitly and accepted by the Customer when connecting them.

6. Retention and destruction

Project data is retained for 90 days after the project enters the suspended or canceled status and is then irreversibly deleted. Data required by accounting and tax legislation is kept for the periods it establishes.

7. Data subject rights

A data subject has the right to information about the processing of their data, to demand its rectification, blocking, or destruction where processing is unlawful, and to withdraw consent (Article 14 of 152-FZ). Requests go to privacy@zaipulayev.eu and are handled within the periods set by 152-FZ. Requests about the Customer's clients' data are forwarded to the Customer as the operator of that data.

8. Security measures

Legal, organizational, and technical measures under Articles 18.1 and 19 of 152-FZ: TLS in transit, encryption at rest for sensitive data categories except for the explicitly disclosed exception (section 5), role-based access control, audit of privileged actions, and restricting the set of persons with access to data.

9. Cookies and site analytics

Nova CRM uses only technically necessary cookies for authentication and session persistence. No third-party analytics, advertising, or tracking cookies are used on the public site or in the web application; the Policy will be updated in advance if any are added in the future.

10. Changes to this Policy

Changes to this Policy are published on the website with a new effective date; for material changes (new data categories, new processing purposes, new cross-border transfers) Customers are additionally notified through the account dashboard at least 14 days before the changes take effect.