Data Processing on a Client's Instructions
Effective date: January 1, 2026. This revision applies to a user after it is made available and, where required, accepted. These terms are intended to be agreed with a company or entrepreneur. By themselves, they do not authorize the processing of any personal data.
1. Scope and roles
The client determines the purposes and scope of processing its data. Жужгов Роман Алексеевич (the Provider) processes the agreed data on the client's documented instructions while providing Akmelo services. For the Provider's own purposes of account administration, billing, and security, its role is determined by the actual processing and the Personal Data Processing Policy.
An instruction takes effect for a particular processing activity only after the parties agree its description and necessary terms in a separate order or agreement. Publishing these terms and providing a technical function are not sufficient. Until the terms are agreed, personal data belonging to third parties must not be submitted for processing on the client's instructions.
2. Required description of processing
The order records the categories of personal data and data subjects, purposes, legal bases and duration of processing, sources, recipients, territory, specific operations, confidentiality and security requirements, the period for notifying the client of an incident, and the procedure for ending processing. Permitted operations are selected from collection, recording, organization, accumulation, storage, correction, retrieval, use, transfer to an authorized recipient, blocking, deletion, and destruction.
The client provides the necessary legal bases, notices, and consents from data subjects, including consent to delegated processing where required, and checks data localization and cross-border transfer requirements. Special categories, biometric data, children's data, and protected secrets may not be included without a separate written agreement. These instructions do not authorize collecting data for the automated assistant.
3. Provider's duties
Where Russian law applies to the instructed processing, the Provider must meet the requirements of Article 18(5) and Article 18.1 of Federal Law No. 152-FZ, provide security under Article 19, and notify the client of the cases specified in Article 21(3.1). Specific safeguards, evidence of compliance, and the notification period are set out in the agreed processing description so the client can meet its mandatory deadlines.
The Provider undertakes to observe the principles and rules of applicable processing, confidentiality, and security; to supply, at the client's request and through an agreed secure process, documents and information about meeting those requirements, including before processing begins; to implement the agreed safeguards; and to limit access to authorized personnel.
If the Provider discovers unlawful or accidental disclosure, provision, distribution, or access that infringes data subjects' rights, it notifies the client without undue delay, taking account of the agreed period and the client's mandatory reporting duties. As facts become known, the notice describes the nature of the incident, affected data, consequences, measures, and a contact for coordination. Each party retains its duties toward supervisory authorities.
The Provider assists with justified requests from data subjects and verification of the instructions, reports an instruction it believes is unlawful, and may suspend it pending clarification. The Provider may not change the purposes on its own initiative except where it processes data independently on a legal basis provided by law.
4. Subcontractors, storage, and completion
Other processors may be engaged only through the procedure agreed by the parties and subject to the necessary confidentiality and security obligations. Recipient details: The inso identity service provides Akmelo with the sign-in identifier, name, email address, and avatar for access and profile display. Authorized personnel maintaining infrastructure and storage in Russia receive only the technical access necessary for their work. The email service processes the recipient address and message content. For an agreed payment, a bank or payment provider processes the necessary payment details, and the Russian Federal Tax Service receives the information required for a professional income tax receipt. When AI features are invoked, AIHubMix and Mistral AI may process the request and selected context needed for an answer; free-form text, code, and attachments may contain personal data, so complete anonymization is not guaranteed. Transfers outside Russia occur only after checking the lawful basis and mandatory procedures. Data is disclosed to public authorities where required by law.. Territory: Russian Federation. These instructions do not replace the authorizations and procedures required for cross-border transfers.
Retention, deletion, return, and backup arrangements: Active account data, tasks, and results are retained while needed to provide the service. After a verified request to cease processing, data with no other lawful retention ground is erased within the applicable mandatory period, generally no later than 30 calendar days; a shorter legal deadline prevails. Backups containing such data must be cleared within the same period or isolated until safe erasure without resuming active processing. Technical signals linking accounts are retained for no more than 180 days after last observation; closed review materials for no more than 365 days after closure unless a specific lawful ground requires longer retention. Payment and tax records are kept for mandatory accounting periods, and any such exception is explained when a request is reviewed., as specified further in the order. When the instructed processing ends, data is returned or destroyed as agreed, except for retention required by law, of which the client is informed. Confirmation is provided on request. Allocating contractual duties does not exclude either party's statutory liability. Contact: support@insoweb.ru.