Data processing terms

The Organisation — a legal entity or sole trader that created an organisation in the Eyeward service or uses one — instructs, and the Processor — the owner of the Eyeward website and service (erp.frezal.by) — accepts the instruction to process the personal data the organisation puts into the service or receives through it.

The organisation’s owner in the service accepts these terms on its behalf — by creating the organisation, putting data into it or continuing to use the service after this document is published. The owner confirms they are authorised to act for the organisation. If a separate contract is concluded with the organisation, its personal data provisions prevail.

A user who keeps other people’s data in a personal space without an organisation accepts these terms in their own name.

The people the organisation keeps data about in the service: customers and their representatives, counterparties, staff and candidates, correspondents by email, in messengers and in the organisation’s website chat widget, visitors of the organisation’s websites and forms, and anyone else whose details the organisation puts in.

Any data the organisation puts into record fields, files, emails, messages, comments, documents and service settings, or receives through channels it connected: for example, names, contact details, job title, employer, details of deals, orders and payments, correspondence. This also includes the images, voices and meeting chat messages of participants in the organisation’s video meetings, and the recordings and transcripts of those meetings and their summaries, if the organiser turned them on.

Special categories of personal data (health, racial or ethnic origin, political views, religious beliefs, criminal records, biometric and genetic data) may be put in by the organisation only if it has a separate legal basis; the service is not designed to give them special protection and does not single them out.

• storing, searching, displaying and changing the organisation’s data by its users within the permissions the organisation set;
• sending and receiving emails and messages, running chats, forms and widgets, printing documents, notifications;
• the organisation’s video meetings and calls: passing participants’ images and sound through the Processor’s media server, meeting history and chat, guests’ consents; if the organiser turned recording on — a video recording of the meeting kept for the period the organisation set (30 days by default); if transcription is on — speech recognition on the Processor’s servers and storage of the text by speaker (180 days by default); a meeting summary from the transcript is written by an AI model the organisation or organiser connected — an external service of the organisation’s choice;
• exchanging data with outside services the organisation connected, and running the assistant — on its users’ actions;
• keeping the service secure and restoring its operation;
• helping the organisation at its request (technical support).

The Processor does not process the organisation’s data for its own purposes: it doesn’t analyse it for itself, use it for advertising or AI training, sell it or pass it to third parties other than under these terms.

Collection (through forms, widgets, email and messengers — per the organisation’s settings), recording, organisation, accumulation, storage, correction (alteration), retrieval, use, transfer (provision, access) to the organisation’s users and to outside services it connected, depersonalisation, blocking, deletion, destruction. Processing is automated, using the service’s tools.

The organisation’s instructions are the settings of its space in the service (roles and permissions, modules, rules, automation, connected channels and services) and its users’ actions. The Processor processes data only in accordance with them. If the Processor believes an instruction breaks the law, it tells the organisation and may decline to follow it.

• keep the data confidential and not disclose it without the organisation’s consent, except where the law requires;
• take the security measures required by Article 17 of Law No. 99-Z and Article 19 of Law No. 152-FZ: access control, encrypted connections, password hashing, encrypted keys for outside services, activity logging, a person responsible for internal control;
• let its staff access the organisation’s data only when needed for support requested by the organisation, fixing a failure or complying with the law, and bind them to confidentiality;
• notify the organisation of a security breach affecting its data without delay — where possible within 24 hours of discovery — describing what happened, what data is affected and what has been done, so the organisation can meet its own deadlines for notifying the Belarusian National Personal Data Protection Center and Roskomnadzor;
• help the organisation answer data subjects’ requests: the service offers search, editing and deleting records, export to Excel, deleting a customer’s data together with the correspondence; beyond that — at the organisation’s request;
• on request, provide information about the security measures taken that the organisation needs to demonstrate compliance;
• not engage other processors for the organisation’s data without notifying it; the Processor currently engages none.

• ensure a legal basis for processing the data it puts into the service, including obtaining data subjects’ consent where needed and informing them about processing (including that the data is kept and processed in the Eyeward service);
• answer requests and demands from its data subjects and tell the Processor if its help is needed;
• set roles and permissions so that its users see only the data they need, and be responsible for its users’ actions;
• assess and ensure the lawfulness of transferring data to outside services it connects (AI models, messengers, mail, calendars, 1C), including cross-border transfers; such services are the organisation’s choice, not the Processor’s sub-processors;
• meet its duties as operator: notifications to authorities, internal documents, its personal data processing policy.

The organisation’s data is stored and processed on servers managed by the Processor, with no cloud contractors. If the organisation is subject to the requirement of Part 5 of Article 18 of Law No. 152-FZ to record, organise, accumulate, store and update the data of Russian citizens using databases located in the Russian Federation, the organisation itself assesses whether using the service meets it.

These terms apply while the organisation uses the service. The organisation’s data is kept until it deletes it. When the organisation is deleted, its data is deleted from the service’s working systems; before deletion the organisation exports the data it needs with the service’s tools. The Processor keeps no data of the organisation for longer unless the law requires it.

The Processor is liable to the organisation for processing data in breach of these terms; the organisation, as operator, is liable to the data subject for the Processor’s actions (Article 7 of Law No. 99-Z, Part 5 of Article 6 of Law No. 152-FZ). Limits of liability are in the Terms of use.