Personal data processing policy

The personal data operator is the owner of the Eyeward website and service (erp.frezal.by). This policy covers the Eyeward website and service at erp.frezal.by, its desktop and mobile apps, the Eyeward Telegram bot and the emails the service sends.

The policy is issued under Article 17 of Law of the Republic of Belarus No. 99-Z of 7 May 2021 “On Personal Data Protection” (Law No. 99-Z) and, for data subjects whose data falls under Russian Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (Law No. 152-FZ), under Article 18.1 of that law. It was published before processing began, is freely accessible and applies together with the Terms of use.

For any question about how your data is processed, contact us through the request form on the website or the “Support” section in the app.

• Personal data — any information relating to an identified or identifiable natural person (data subject).
• Processing — any action with personal data: collection, organisation, storage, alteration, use, depersonalisation, blocking, disclosure, provision, deletion.
• Operator — whoever determines the purposes and means of processing.
• Authorised person (processor) — whoever processes data on the operator’s behalf and instructions.
• User — a person with an account in the service. Organisation — a company or sole trader that runs its work in the service (modules, records, mail, chats, customer conversations) and invites staff into it.
• Content — everything users and organisations put into the service: records, files, emails, messages, comments, questions to the assistant.

We are the operator for the data of website visitors, authors of requests and enquiries, user accounts, security logs and session recordings. Purposes and retention for these are set out in this policy.

We are a processor for the data an organisation (or a user in a personal space) puts into the service about other people: customers, contacts, counterparties, staff, email and messenger correspondents. The organisation is the operator of that data: it decides why and what to keep, obtains consents where needed and answers requests from its customers and staff. We process such data only to make the service work, on the organisation’s behalf — under the Data processing terms.

If an organisation corresponds with you through the service (email, Telegram, WhatsApp and other channels) or keeps a record about you, please contact that organisation about your data. If you don’t know whom to contact, write to us: we will pass your request on and help the organisation fulfil it.

A user who keeps other people’s data in a personal space for their own purposes is responsible for doing so lawfully.

We process data only for the purposes below and only to the extent they require. Each purpose is listed separately.

4.1. Replying to a demo request or enquiry

Whose data

authors of requests on the website and enquiries by email

What data

what to call you, company, email, phone, a description of your process and team size (whichever you fill in), your consent tick; with the request — the page address, the plan (if you came from the pricing page), the page language and your browser string (User-Agent). The IP address is used only in the server’s memory to limit how often requests can be sent (no more than three per 10 minutes per address) and is not saved with the request

Legal basis

consent — a separate consent document you accept by ticking the box in the form (Article 5 of Law No. 99-Z, Article 9 of Law No. 152-FZ)

Retention

while the request is needed to reply and talk things through, but no longer than 3 years from the last contact; if you become a user — then under purpose 4.2; deleted sooner at your request or when you withdraw consent

4.2. Registration and account, performing the terms of use

Whose data

users

What data

name, email address, username, password (stored only as an irreversible hash), photo and — if you add them — job title, bio, location, status and signature; the organisations and roles you belong to; interface settings; your personal mailbox address on the service domain (if you picked a username)

Legal basis

a contract with you — the Terms of use (Article 6 of Law No. 99-Z: data obtained under a contract with the data subject for actions under that contract; clause 5 of Part 1 of Article 6 of Law No. 152-FZ)

Retention

while the account exists; once it is deleted, the data is deleted except what we must keep by law and what belongs to an organisation (for example, your edits in its records stay in its history without your profile)

4.3. Sign-in, security and abuse prevention

Whose data

users and visitors

What data

sign-in sessions (time, IP address, browser string), connected devices and apps (name, platform, version), two-factor settings, rate limits, server logs (time, request address, IP address, response code, errors), the activity log within an organisation

Legal basis

a contract with you and the operator’s duty to protect personal data (Articles 16 and 17 of Law No. 99-Z, Article 19 of Law No. 152-FZ)

Retention

a session — 7 days from the last action or until you sign out; server logs — usually up to 14 days; an organisation’s activity log — while the organisation needs it

4.4. Running the service’s features

Whose data

users; for organisations’ content — see section 3

What data

the content you put in and receive: records, files, emails, messages, comments, assignments, calendars; conversations with the assistant and its memory about you (you can view, correct and delete it); notification subscriptions (your browser’s push service address, the Telegram bot link if you made one)

Legal basis

a contract with you; for organisations’ content — the organisation’s instructions

Retention

while the content is kept in the service — you or the organisation delete it; assistant conversations — until you delete them

4.5. Support

Whose data

users

What data

the text of your request, attachments, correspondence with support, account details needed to answer

Legal basis

a contract with you

Retention

while the account exists

4.6. Session recording (optional)

Whose data

website visitors and users who consented

What data

how you use the pages — in detail in the separate consent document

Legal basis

your separate consent (the “Accept all” button in the cookie notice)

Retention

1 to 90 days, 14 by default; recordings from this browser are deleted at once when you withdraw consent

4.7. Necessary cookies and browser storage

Whose data

visitors and users

What data

see “Cookies and session recording”

Legal basis

a contract with you and technical necessity: sign-in and settings don’t work without them; no consent required

Retention

see the table under “Cookies and session recording”

4.8. Complying with the law

Whose data

all categories above

What data

data requested by an authorised public body or that the law requires us to keep

Legal basis

duties set by legislative acts (Article 6 of Law No. 99-Z, clause 2 of Part 1 of Article 6 of Law No. 152-FZ)

Retention

as long as the law requires

4.9. Video meetings and calls

Whose data

users and meeting guests

What data

the name (for a guest — the one they typed), camera and screen images, voice — during a meeting they pass through the operator’s media server and are not stored by themselves; IP address and connection details (connection type, quality); meeting history (who, when, how long); the meeting chat; if the organiser turned recording on — a video recording of the meeting (participants’ images, voices and names); if the organiser turned transcription on — the text of participants’ speech by speaker (recognised on the operator’s servers) and the meeting summary: a brief, decisions and tasks with assignees, written from that text by an AI model the organiser connected; a record of the guest’s consent (text version, time, what it covers)

Legal basis

a contract with you; for an organisation’s meetings — the organisation’s instructions; before joining, a guest consents to the processing of their name, image, voice and meeting chat messages and, if the meeting is being recorded or transcribed (or this will start by itself), to the recording, transcription and AI summary (Article 5 of Law No. 99-Z, Article 9 of Law No. 152-FZ); someone joining while recording sees a warning and can leave; the operator of this data is the organisation running the meeting

Retention

images and sound — only for the duration of the meeting; a recording — 30 days by default (the organisation can change this), then deleted automatically; the organiser can delete it sooner; a transcript and summary — 180 days by default (the organisation can change this), deleted together; meeting history and meeting chat — while the meeting exists, guests’ names and consent records are depersonalised or deleted after 180 days

We send no newsletters and show no advertising. Data from requests and accounts is not used for marketing, sold or shared for advertising. Should we ever want to send news, it will be only with a separate, optional consent.

Actions: collection, recording, organisation, accumulation, storage, correction (alteration), retrieval, use, transfer (provision, access) — only in the cases listed under “Who receives data”, depersonalisation, blocking, deletion, destruction. Processing is automated and mixed.

• We make no decisions that produce legal effects for you or otherwise affect your rights based solely on automated processing. The assistant and automation rules are tools that users set up and run; people make the decisions.
• We don’t knowingly collect special categories of personal data (health, racial or ethnic origin, political views, religious beliefs, criminal records) or biometric data. If an organisation puts such data into its records, it does so as the operator and secures a legal basis for it.
• We don’t use your data or content to train artificial intelligence models.
• We don’t sell personal data or share it for advertising.

Data is kept on servers managed by the operator. The service uses no cloud contractors for storage: the database, files, mail server, chat, search, document editor and semantic search (its models run on the operator’s own servers) are all deployed on the operator’s own infrastructure.

Passwords are stored only as irreversible hashes. Keys for connections to outside services (AI models, mailboxes, messengers, calendars, 1C) and session recordings are stored encrypted.

Video meeting sound and images pass through the operator’s media server. Meeting recordings are kept in file storage on that same media server; a recording can be watched or downloaded only through a link the service issues for 10 minutes to those who can see it (the meeting’s organisers and employees who attended).

We pass data on only:

• to outside services that you or your organisation connected and use — to the extent needed for the action you take (table below);
• to authorised public bodies — on their lawful demand;
• to the operator’s processors — there are none at the moment: no contractor has access to your data. If one appears, we will list it here before any transfer.

Cross-border transfers. Some services are in countries not on the list of states ensuring an adequate level of protection of data subjects’ rights. The risks of such a transfer: different data protection rules may apply in the recipient’s country, public bodies may gain access on other grounds, and it may be harder to exercise your rights there. We send data to such services only when you or your organisation connected and use them: for your own data this is an action under our contract with you (Article 9(1) of Law No. 99-Z) and your decision made after being informed of these risks; the organisation, as operator, is responsible for the basis for transferring other people’s data. For data subjects whose data falls under Law No. 152-FZ, transfers follow its Article 12. If you don’t want a transfer, don’t connect the service, or disconnect it in the settings.

The Eyeward website and app share one address (erp.frezal.by) and use necessary cookies and browser storage. Neither loads third-party analytics counters, ad pixels or other people’s scripts; fonts and images are served from this same address. The only optional part is session recording.

On your first visit we show the cookie notice once — on the website or in the app, whichever you open first. Signing in doesn’t work without the necessary cookies, so they can’t be turned off; they don’t require consent.

Session recording. If you chose “Accept all” in the cookie notice, we record how you use the website and the app: which pages you open, where you click, how you scroll and what the page looks like at that moment. The recording helps us find bugs and awkward spots in the interface. If you chose “Necessary only”, nothing is recorded and the website and app work in full.

• The recording may include the text you type into fields yourself. Never recorded: passwords (including ones shown on screen), verification codes, keys and tokens, card numbers, the fields of sign-in and service connection forms, and what you write in chats, emails and to the assistant. Asterisks go into the recording instead.
• In the app the rest of the on-screen text and images are hidden by default too: the recording shows what you did, not the content of your data.
• The recording is made by our own code (the open-source rrweb library), stored encrypted on our servers and not shared with third parties. Only platform administrators can watch recordings.
• To keep several visits of the same guest together, the server compares an irreversible fingerprint of the IP address and the browser string; the IP address itself is not stored with the recording.

The terms of recording are set out in the consent to the processing of personal data for session recording — a separate document. To change your decision or withdraw consent: “Cookie settings” at the bottom of any page of the website, or “Change decision” in the “Cookies and session recording” card in your app profile. Recordings from this browser are deleted right away; we will delete recordings from other devices at your request.

We take the legal, organisational and technical measures required by Article 17 of Law No. 99-Z and Articles 18.1 and 19 of Law No. 152-FZ:

• a person responsible for internal control over personal data processing is appointed; staff with access to data have been made familiar with this policy and must keep data confidential;
• access is restricted: within an organisation — by the roles and access levels its owner sets; to service functions — only for platform administrators;
• all connections are encrypted (HTTPS/TLS); passwords are stored only as hashes; two-factor sign-in is available; sign-in attempts and form submissions are rate-limited;
• keys for outside services and session recordings are stored encrypted; links and tokens granting access without signing in are stored only as hashes;
• actions with data within an organisation are recorded in the activity log and version history;
• data is kept on the operator’s own servers, with no cloud contractors.

No measure is an absolute guarantee. Keep your password safe, turn on two-factor sign-in and tell us about anything suspicious.

• We notify the National Personal Data Protection Center of Belarus of a breach of personal data protection systems immediately, and no later than three working days after we learn of it (Article 16 of Law No. 99-Z).
• If data under Law No. 152-FZ is affected, we notify Roskomnadzor within 24 hours of the incident itself and within 72 hours of the results of the internal investigation (Part 3.1 of Article 21 of Law No. 152-FZ).
• We tell any organisation whose data we process on its behalf without delay, so it can meet its duties as operator.
• We tell affected people when doing so helps them protect themselves (for example, by changing a password).

You have the right to:

• withdraw consent at any time without giving reasons — for session recording, in one click (see “Cookies and session recording”); for a request — by writing to us;
• get information about how your data is processed: who the operator is, what data, on what basis, for what purposes, how long it is kept, who processes it on the operator’s behalf;
• have your data corrected if it is incomplete, outdated or inaccurate (much of it you can correct yourself in your app profile);
• find out to whom your data was provided over the past year;
• require us to stop processing and delete your data where there is no basis for processing;
• appeal the operator’s actions — to the National Personal Data Protection Center of Belarus, to Roskomnadzor (for data subjects whose data falls under Law No. 152-FZ), or in court.

How to make a request. Write through the request form on the website or the “Support” section in the app. Under Article 14 of Law No. 99-Z a request is made in writing or as an electronic document and states your surname, first name and patronymic, address, date of birth, identification number (or the number of your identity document), the substance of your demands and your signature. So as not to disclose your data to someone else, we may ask you to confirm that the request comes from you — for example, by replying from your account’s email address.

Response times.

• under Law No. 99-Z: information about processing — 5 working days; information about provision to third parties — 15 days; correction — 15 days; stopping processing, deletion or blocking, including on withdrawal of consent — 15 days;
• under Law No. 152-FZ: a reply to a request — 10 working days (may be extended by no more than 5 working days with reasons); correcting inaccurate data — 7 working days; stopping processing and destroying data on withdrawal of consent — within the time limits of Article 21 of Law No. 152-FZ.

We answer free of charge, in the same form as the request unless you ask otherwise. Information may be refused only in the cases expressly provided by law, with reasons.

The website and service are intended for organisations and adult users. We don’t knowingly collect children’s data. If you learn that a child has given us their data, tell us and we will delete it.

We update the policy when processing or the law changes. The new version is published on this page with its date at the top and applies from publication unless it says otherwise. We warn users of material changes in advance — in the service or by email. Previous versions are available on request.

The policy is written in Russian; the English translation is for convenience, and the Russian text prevails in case of discrepancy.