Personal Data Processing Policy

Effective date: 04.07.2026

Last updated: 04.07.2026

1. General provisions

This Personal Data Processing Policy (hereinafter — the Policy) is developed in accordance with Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" and defines the procedure for processing personal data and the measures taken to ensure their security.

The Policy is published and freely accessible at https://pflow.pro/page/privacy and applies to all personal data the Operator receives from data subjects while they use the Platform.

2. Definitions

Personal data (PD) — any information directly or indirectly related to an identified or identifiable natural person (the data subject).
Operator — the person carrying out the processing of personal data (see section 3 of this Policy).
Data subject — a natural person to whom personal data relate.
Platform — the ProcessFlow cloud service available at https://pflow.pro.
Manager (expert) — a user registered on the Platform who provides works and services to their own clients and uses the Platform to manage the corresponding business processes within a "box" (tenant).
Portal client — a person who accesses the tracking portal of a process by a unique link or via a personal account.
Box — an isolated workspace of a Manager on the Platform.
Processing of PD — any action or set of actions performed with PD (collection, recording, storage, transfer, deletion and others).
Cookie — technical files saved by the browser on the user's device when visiting the Platform.

3. Operator of personal data

Name: Individual Entrepreneur Херсун Антон Анатольевич

INN (Tax ID): 544614419760

OGRNIP (State Registration Number): 308547228000019

Registered address: 633204, Новосибирская область, г. Искитим, ул. Молдавская, д. 6

Email for data subject requests: admin@pflow.pro

The Operator is included in the register of operators carrying out the processing of personal data maintained by the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) under registration number 54-25-036574 of 04.06.2025.

4. Principles of PD processing

The Operator processes PD in accordance with the following principles (Article 5 of 152-FZ):

Lawfulness and fairness — processing is carried out only in cases provided for by law or with the consent of the data subject.
Limitation to pre-defined purposes — PD are processed only for purposes declared in this Policy (see section 6).
Adequacy of content and scope — the Operator does not collect excessive data.
Accuracy and relevance — the Operator takes measures to keep PD accurate and up to date; the data subject has the right to request updates.
Storage period — PD are stored no longer than required by the purposes of processing or by law.
Destruction upon achievement of purposes — when consent is withdrawn or the purposes of processing are achieved, PD are destroyed unless otherwise required by law.

5. What data is processed

Manager data (box users):

Full name or display name
Email address
Phone number (if provided)
Password hash (the plain password is not stored)
Interface language, time zone
IP address, device and browser data (User-Agent)
Logs of actions on the Platform

Portal client data:

Full name or name
Email address
Phone number (if provided)
Data that the client independently uploads to the Manager's processes: photos, document scans, text comments, files.

Technical data collected automatically:

Cookies (see the Cookie Policy)
IP address and session data
Browser User-Agent
Date and time of requests to the Platform

Special categories of PD and biometrics. The Operator does not process personal data of special categories (race, nationality, political views, religious beliefs, health, private life, criminal record), except where the data subject independently uploads such information into process files — in which case the legal basis is the data subject's consent (see section 7). Biometric personal data are not processed by the Operator.

6. Purposes of processing

The Operator processes PD to achieve the following purposes:

Provision of access to the Platform and its features.
Identification and authentication of users.
Performance of obligations under the agreement on use of the Platform (public offer).
Promotion of works and services provided by Managers to their clients through the Platform.
Delivery of notifications related to the progress of processes.
Technical support and improvement of the service quality.
Ensuring the security of the Platform and preventing fraud.
Compliance with the requirements of the laws of the Russian Federation.

7. Legal bases for processing

Consent of the data subject to the processing of their data (clause 1, part 1, Article 6 of 152-FZ) — for registration, use of client portals, and cookies.
Performance of a contract (public offer) to which the data subject is a party (clause 5, part 1, Article 6 of 152-FZ).
Legitimate interests of the Operator — ensuring security, preventing fraud, resolving disputes (clause 7, part 1, Article 6 of 152-FZ).

8. Procedure and conditions of processing

The Operator carries out automated and mixed processing of PD. The operations include: collection, recording, systematization, accumulation, storage, updating, use, transfer, deletion, destruction.

Localization of databases in the Russian Federation. Collection, recording, systematization, accumulation, storage, updating and retrieval of PD of citizens of the Russian Federation are carried out using databases located on the territory of the Russian Federation (part 5, Article 18 of 152-FZ).

Cross-border transfer is not carried out. The Operator does not transfer PD outside the territory of the Russian Federation.

9. Third parties involved in processing

To ensure the operation of the Platform, the Operator engages LLC "TimeWeb" (TimeWeb Cloud, Russia) — hosting the Platform servers (VPS, hosting).

Files uploaded by users are stored on MinIO object storage self-hosted by the Operator on the same servers.

Email notifications are sent from the Operator's own SMTP server; no external email services are engaged.

Payments are not accepted on the Platform; no payment operators are engaged.

In addition to the contractors listed above, the Operator transfers PD to state authorities on the grounds provided for by the laws of the Russian Federation (upon a reasoned request).

10. Cookies

The Platform uses technical and functional cookies necessary for the operation of the service. Advertising or tracking third-party cookies are not used. For details see the Cookie Policy.

11. Storage periods

Manager account data — for the duration of the agreement and 3 years after the account is deleted.
Portal client data — for the duration of the associated process and 3 years after its completion.
Action logs — 12 months.
Backups — no more than 30 days.

Exception: data that the Operator is obliged to keep longer by the laws of the Russian Federation (for example, accounting records — 5 years).

12. Rights of the data subject

You have the right to:

Receive information about the fact, legal bases, purposes and storage periods of the processing of your PD.
Require updating, blocking or destruction of your PD if they are incomplete, outdated, inaccurate, unlawfully obtained or no longer necessary for the declared purposes.
Withdraw consent to the processing of PD at any time.
Appeal against the actions of the Operator to Roskomnadzor or to a court.

How to submit a request: send a message to admin@pflow.pro or use the Data Subject Request page.

Response time: 10 working days from the date of receipt of the request.

13. Measures for the protection of personal data

Legal measures:

Development and updating of this Policy.
Refusal of any processing methods that do not comply with the purposes and requirements of the law.

Organizational measures:

Restriction of the circle of persons having access to PD.
Use of high-entropy passwords and two-factor authentication.
Regular review of access rights.

Technical measures:

Encryption of data transmission over communication channels (TLS/SSL).
Hashing of passwords using resilient cryptographic functions (bcrypt).
Backups with a limited retention period.
Logging and audit of access to PD.
Tenant (box) isolation at the application level.

14. Changes to the Policy

The Operator has the right to make changes to this Policy unilaterally. The current version is published at https://pflow.pro/page/privacy. Continued use of the Platform after changes enter into force means the data subject's consent to the new version.

15. Contacts

For any questions related to the processing of personal data:

Email: admin@pflow.pro
Postal address: 633204, Новосибирская область, г. Искитим, ул. Молдавская, д. 6
Roskomnadzor register entry: 54-25-036574