Personal data processing policy

1. General provisions

This Policy sets how the Ednice platform operator processes personal data. It works together with the Privacy policy, License agreement, Public offer and Student user agreement. Where student data is processed on an author’s instructions, the data-processing addendum also applies.

2. Operator

Operator: individual entrepreneur Baryshev Maxim Aleksandrovich, INN 540138067670, OGRNIP 323246800002946, address: 662822, Nizhny Suetuk, Ermakovsky District, Krasnoyarsk Territory, Russia. Bank details are on the contacts page. Personal-data requests: info@ednice.ru.

3. Processing roles

Ednice is an independent operator when it:

• registers an author or student account on the platform;
• provides security, prevents abuse and gives support;
• provides information exchange for payments and performs the legal duties applicable to it;
• keeps its own records of requests and contractual relations with the user.

Where an author or school defines the purposes of processing their students’ and other users’ data, they are the operators and Ednice processes that data on their instructions under the license addendum. Substantive requests then go to the author; Ednice assists technically.

4. Categories of data subjects

• visitors to the public site;
• authors and school owners;
• students and buyers of authors’ products;
• webinar and consultation participants;
• author representatives contacting support;
• legal representatives of minors, if their data is provided for product access.

5. Purposes and legal bases

The operator processes data to:

• register, sign in and maintain an account — performance of a contract and steps before it;
• provide access to courses, webinars, consultations and analytics — performance of a contract;
• take payments, have receipts issued by the partner and settle with the author — contract and legal duties;
• provide support and investigate incidents — contract and legitimate interest in service security;
• send service notices about access, payment and security — performance of a contract;
• improve the site using anonymized statistics — operator’s legitimate interest;
• comply with Russian law — operator’s legal duty.

Consent is requested where the law requires it. Reading the Privacy policy and this Policy at registration is not consent to marketing email if such email is introduced later.

6. Categories of data

Depending on the features used, processing may include:

• full name or display name;
• email, phone and other contact details;
• school name, seller details and author payout details without storing full card numbers;
• account, school, course, cohort and product identifiers;
• IP address, device, browser, session and security-event data;
• enrolment, attendance, progress and assignment results;
• messages, answers, uploaded files and other user materials;
• image, voice, audio and video when joining webinars and consultations;
• payment data: amount, status, product, payer, accepted document version;
• legal representative data for a minor, if provided for access.

Special categories and biometric personal data are not required for registration. Do not upload them unless a feature is expressly designed for that processing.

7. Processing operations

Processing may be automated, non-automated or mixed. The operator may collect, record, systematize, accumulate, store, update, extract, use, transfer to authorized persons and partners within this Policy, anonymize, block, delete and destroy data. Public disclosure of personal data is not a processing purpose unless the user published the information in a section available to them.

8. Place of processing

When personal data of Russian citizens is collected, recording, systematization, accumulation, storage, updating and extraction use databases located in the Russian Federation. Personal data is not transferred across the border.

9. Sharing with third parties

Data may be shared with:

• hosting and infrastructure providers in Russia — to run the platform;
• the payment partner (currently T-Bank) — to take payment and issue a receipt when required;
• email delivery services — for registration, access and support messages;
• the author or school — to the extent needed to perform the contract with the student;
• competent public authorities — on a lawful request.

A specific list of subprocessors for author-enabled features is provided in the cabinet or connection terms before they receive access to data.

10. Retention

Account data is kept while the account is active and needed to perform the contract or legal duties. When the processing purpose is achieved or consent is withdrawn, data is destroyed within the periods set by Federal Law No. 152-FZ unless a contract or law provides another basis to continue. Payment and document-acceptance records are retained to the extent and for the periods required for accounting, tax and contract purposes. The cookie-notice cookie is kept for up to one year.

Where data is processed on an author’s instructions, export and deletion timelines follow the addendum and the author’s instructions.

11. Data subject rights

A data subject may:

• receive information about processing of their data;
• request correction, blocking or destruction if data is incomplete, outdated, unlawfully obtained or no longer needed for the stated purpose;
• withdraw consent where processing is based on consent;
• complain to Roskomnadzor or a court;
• exercise other rights under Federal Law No. 152-FZ.

Withdrawal of consent does not affect the lawfulness of processing before withdrawal and does not cancel retention required by law or to perform a contract.

12. How to submit a request

Send a request to info@ednice.ru with the subject “Personal data” or via the contacts page. Include your name or cabinet display name, account email, information confirming your relationship with the operator, the request and how you want the reply. The operator may ask for data sufficient to verify identity. A response to an information request is sent within 10 business days; this may be extended by up to 5 business days with a reasoned notice. If the author is the operator for the relevant data, Ednice forwards the request without undue delay and informs the requester.

13. Security measures

The operator applies legal, organizational and technical measures under Articles 18.1 and 19 of Federal Law No. 152-FZ, including access control, security-event logging, protection of communication channels and limiting who may process data. Employees and contractors with access must keep data confidential. If an incident is detected, the operator contains and investigates it and notifies Roskomnadzor where and within the periods required by law.

14. Policy changes

The current version is published on this page. For material changes the operator publishes the updated text and, if required, notifies users or asks them to review it again in the cabinets.