DG
Dialog Gate
Get started
← Back to the home page

Personal Data Processing Policy

Effective date: 30 March 2026

This is a translation provided for convenience. In case of any discrepancy, the Russian version prevails.

1. General provisions

1.1. This Personal Data Processing Policy (hereinafter the “Policy”) defines the procedure for the processing and protection of personal data by Individual Entrepreneur Roman Valeryevich Kashcheev (hereinafter the “Operator”, the “Contractor”), who carries on business using the Dialog Gate software (hereinafter the “Platform”).

1.2. Details of the Operator:

  • Individual Entrepreneur Roman Valeryevich Kashcheev
  • INN: 384402058208
  • OGRNIP: 318246800129105
  • Address: 36 Norilskaya St., apt. 25, Krasnoyarsk, Krasnoyarsk Krai, 660115, Russia
  • Email: admin@dialoggate.ru
  • Phone: +7 (913) 507-99-04

1.3. The Policy has been drawn up in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (hereinafter “152-FZ”), Resolution of the Government of the Russian Federation No. 1119 of 1 November 2012, Order of the FSTEC of Russia No. 21 of 18 February 2013 and other regulatory legal acts of the Russian Federation.

1.4. The Policy applies to all personal data that the Operator receives from personal data subjects, including through the website dialoggate.ru and the Dialog Gate Platform.

1.5. Signing up on the website and using the Platform means the personal data subject’s unconditional consent to this Policy and to the processing conditions set out in it.

2. Basic concepts

The following concepts are used in this Policy:

  • Personal data — any information relating to a directly or indirectly identified or identifiable individual (the personal data subject).
  • Processing of personal data — any action (operation) or set of actions performed on personal data with or without the use of automation tools, including collection, recording, systematisation, accumulation, storage, rectification, retrieval, use, transfer, anonymisation, blocking, deletion and destruction.
  • Operator — Individual Entrepreneur Roman Valeryevich Kashcheev, who independently or jointly with other persons organises and/or carries out the processing of personal data.
  • Customer (Tenant) — a legal entity or an individual that has entered into an agreement with the Operator for the use of the Platform and is an independent personal data operator with respect to the data of its own customers.
  • End customer — an individual whose data is processed by the Platform on the Customer’s instruction in the course of providing communication and customer support services.
  • Platform — the Dialog Gate software provided under the SaaS model.

3. Purposes of processing personal data

3.1. The Operator processes personal data for the following purposes:

  • Providing access to the Platform and performing contractual obligations to Customers;
  • Identification and authentication of Platform users;
  • Processing, storing and transferring messages between Customers and their customers through the connected communication channels;
  • Keeping the billing and settlement system operational;
  • Sending notices related to the use of the Platform;
  • Technical support for users;
  • Improving the quality of the services provided and the functionality of the Platform;
  • Complying with the requirements of the legislation of the Russian Federation.

4. Legal grounds for processing

4.1. Personal data is processed on the following legal grounds:

  • Consent of the subject (Article 6(1)(1) of 152-FZ) — when signing up on the Platform and using the service;
  • Performance of a contract (Article 6(1)(5) of 152-FZ) — to provide access to the Platform and render services to Customers;
  • Instruction of an operator (Article 6(3) of 152-FZ) — to process the personal data of Customers’ end customers on their instruction;
  • Legitimate interest (Article 6(1)(7) of 152-FZ) — to ensure information security, prevent fraud and keep security logs;
  • Legal requirements (Article 6(1)(2) of 152-FZ) — to store accounting and tax records.

5. Categories of subjects and personal data processed

5.1. Customers (users of the Platform)

Data processed:

  • Surname, first name, patronymic (or the name of the organisation)
  • Email address
  • Phone number
  • Details of the organisation (INN, name, address)
  • Data on payments and financial transactions

5.2. Operators (employees of the Customer)

Data processed:

  • Surname, first name
  • Email address
  • Avatar (a photo or a generated image)

5.3. End customers of Customers

The data is processed on the instruction of Customers (Article 6(3) of 152-FZ). It comprises:

  • Name (nickname, display name in the messenger)
  • Phone number
  • Email address
  • Messenger identifier (Telegram ID, WhatsApp ID, etc.)
  • Avatar (profile photo in the messenger)
  • Message content (text, files, images, voice messages)
  • Message metadata (date, time, delivery status)

5.4. Visitors to the website and the widget

Data processed:

  • IP address
  • Browser type and version (User-Agent)
  • Cookies and the session identifier
  • URLs of the pages visited
  • Data provided voluntarily when communicating through the widget

6. Procedure and conditions of processing

6.1. Personal data is processed using automation tools in the personal data information system of the Platform.

6.2. The Operator performs the following actions with personal data: collection, recording, systematisation, accumulation, storage, rectification (updating, modification), retrieval, use, transfer (provision, access), anonymisation, blocking, deletion and destruction.

6.3. Personal data is not transferred to third parties, except in the following cases:

  • Transfer of messages through communication channels (messengers, SMS, email) in the course of providing services to the Customer;
  • At the request of authorised state bodies in accordance with the legislation of the Russian Federation;
  • To process payments through payment systems (YooKassa);
  • With the consent of the personal data subject.

6.4. The Operator does not make automated decisions that produce legal effects for the personal data subject.

7. Periods of processing and storage

7.1. Personal data is processed until the purposes of processing are achieved or until the personal data subject withdraws consent.

7.2. Storage periods:

  • Customers’ data — during the term of the agreement and for 30 days after its termination;
  • Operators’ (employees’) data — for as long as the account exists and for 30 days after it is deleted;
  • End customers’ data — during the term of the agreement with the Customer. At the Customer’s request the data is deleted within 30 days;
  • Financial data — 5 years, as required by the tax legislation of the Russian Federation;
  • Backup copies — 90 days from creation, after which they are destroyed automatically.

7.3. When the storage periods expire, personal data is destroyed within no more than 30 days.

8. Procedure for destroying personal data

8.1. Personal data is destroyed when any of the following occurs:

  • The purposes of processing are achieved;
  • The personal data subject withdraws consent;
  • The agreement with the Customer is terminated;
  • The personal data subject so requests;
  • The storage periods expire.

8.2. Destruction is carried out by permanently deleting the records from the database and the related files from the Operator’s servers. The fact of destruction is recorded in the audit log.

9. Cross-border transfer

9.1. Personal data is primarily stored on servers located in the territory of the Russian Federation, as required by Article 18(5) of 152-FZ.

9.2. When messages are sent through communication channels (Telegram, WhatsApp, VK and other messengers), the content of the messages is transferred through the infrastructure of the respective services, whose servers may be located outside the Russian Federation. This transfer is carried out solely for the purpose of delivering messages to end customers on the Customer’s instruction.

9.3. The Operator does not carry out deliberate cross-border transfers of personal data databases.

10. Rights of personal data subjects

10.1. A personal data subject has the right to:

  • Receive information concerning the processing of their personal data;
  • Demand rectification, blocking or destruction of personal data if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;
  • Withdraw consent to the processing of personal data;
  • Receive their personal data in a machine-readable format (the right to portability);
  • Appeal against the Operator’s actions or omissions to Roskomnadzor or in court.

10.2. To exercise their rights, a personal data subject may send a request:

  • By email: admin@dialoggate.ru
  • By post to the Operator’s address

10.3. The request must contain: the full name, contact details, a description of the action requested and information that makes it possible to identify the subject. A reply to the request is provided within no more than 10 business days.

10.4. End customers of Customers exercise their rights by contacting the Customer directly, as the Customer is the operator of their personal data. The Customer passes the request on to the Operator for technical execution.

11. Measures to protect personal data

11.1. The Operator takes the necessary and sufficient organisational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying and dissemination, as well as against other unlawful actions:

  • Encryption of communication channels using the TLS protocol;
  • Identification and authentication of users using JWT tokens;
  • A role-based access control model;
  • Isolation of data between Customers (multi-tenant architecture);
  • Regular backups of the databases;
  • Firewalling of the server infrastructure;
  • Logging of security events;
  • Monitoring of data availability and integrity.

11.2. The level of protection of personal data is determined in accordance with Resolution of the Government of the Russian Federation No. 1119 of 1 November 2012.

12. Processing of personal data on instruction

12.1. With respect to the personal data of Customers’ end customers, the Operator acts as a person processing data on the instruction of an operator (Article 6(3) of 152-FZ).

12.2. The Customer, as an independent personal data operator, is responsible for:

  • Obtaining the necessary consents from its customers to the processing of personal data;
  • Informing its customers that the Operator is engaged to process the data;
  • Defining the purposes and legal grounds for processing its customers’ data;
  • Handling its customers’ requests to exercise the rights of personal data subjects.

12.3. The Operator undertakes to:

  • Process the data solely for the purposes defined by the Customer;
  • Keep the personal data confidential;
  • Ensure the security of the data in accordance with section 11 of this Policy;
  • At the Customer’s request, delete or return all personal data of end customers;
  • Notify the Customer of security incidents involving its customers’ data.

12.4. The terms of processing on instruction are set out in detail in the Terms of Service (offer) published at: dialoggate.ru/terms.

13. Cookies and analytics

13.1. The Platform and the Operator’s website use cookies and localStorage for the following purposes:

  • Authentication and authorisation of users;
  • Saving user settings (theme, interface parameters);
  • Identification of visitors to the web chat widget;
  • Collection of anonymous traffic statistics (Yandex.Metrica).

13.2. The user may disable cookies in the browser settings. Disabling cookies may limit the functionality of the Platform.

14. Incident notification

14.1. If an incident involving unlawful access to personal data or its leakage is detected, the Operator undertakes to:

  • Notify Roskomnadzor within 24 hours of detecting the incident;
  • Notify the affected Customers within a reasonable time;
  • Take measures to minimise the consequences of the incident;
  • Investigate the incident and eliminate its causes.

15. Person responsible for the processing of personal data

15.1. Individual Entrepreneur Roman Valeryevich Kashcheev has been appointed as the person responsible for organising the processing of personal data.

15.2. Contact details for enquiries about the processing of personal data:

  • Email: admin@dialoggate.ru
  • Phone: +7 (913) 507-99-04
  • Postal address: 36 Norilskaya St., apt. 25, Krasnoyarsk, Krasnoyarsk Krai, 660115, Russia

16. Procedure for making changes

16.1. The Operator may amend this Policy. The current version of the Policy is published at: dialoggate.ru/privacy-policy.

16.2. In the event of material changes, the Operator notifies users by publishing a notice on the website or sending a message by email.

16.3. Continued use of the Platform after the changes are made means that the personal data subject agrees to the new version of the Policy.

17. Dialog Gate browser extension

17.1. The Dialog Gate browser extension is installed by the Customer’s operator on a workstation and adds a chat button next to a phone number on the pages of those websites that the operator has allowed themselves. The extension works only on allowed websites; it does not request access to all websites.

17.2. Data processed locally

The following data is processed only in the browser on the workstation and is not transferred outside it:

  • the text of open pages of allowed websites — solely to find phone numbers in order to place a button next to them;
  • the addresses of the websites on which the operator has turned the extension on (the list of permissions granted by the browser);
  • the operator’s session tokens and the chat window settings — in the extension’s protected storage (chrome.storage.local).

17.3. Data transferred to the server

The following is transferred to the Customer’s Platform server (and only to it):

  • the phone number in normalised form — to find conversations with that customer;
  • the operator’s email address and password — when signing in to the extension;
  • the content of the messages that the operator sends through the chat window.

17.4. What the extension does not do

  • it does not collect analytics or telemetry and does not transfer data to third parties;
  • it does not access the browser history, saved passwords or autofill data;
  • it does not tell the Platform server on which website the chat is open: the Referer header is not sent when the chat window is loaded;
  • it does not place the phone number in the page markup — third-party scripts of the website (analytics, session recording) cannot read it from the elements added by the extension;
  • it does not save or restore the correspondence after the page is reloaded.

17.5. Management and removal

17.5.1. The operator may at any time turn the extension off on a particular website or pause it on all websites in the extension settings. Revoking the permission for a website stops the extension on it immediately, without reloading the page.

17.5.2. When the operator signs out of the account in the extension, the session tokens are deleted from local storage. Removing the extension from the browser deletes all the data it has saved.