Personal data processing policy

1.1. This Personal Data Processing Policy (the “Policy”) explains what personal data is processed when you use gigabytebot.com (the “Website”), why and how, and what rights you have. It is prepared in accordance with Federal Law of the Russian Federation No. 152-FZ of 27 July 2006 “On Personal Data” (the “Law”).

1.2. The data controller (the “Operator”) is the owner of the website, an individual. For personal data matters contact: aleksandrlepesa511@gmail.com or Telegram @qorzz.

1.3. The Policy applies to personal data of Website visitors and of persons who send a request through the Website or contact the Operator via the contacts listed on the Website (the “User”). It does not apply to third-party websites and services linked from the Website (messengers, social networks): their rules are set by their owners.

1.4. The Operator is based in the Russian Federation, so the main governing law is the law of the Russian Federation. If you are in another country, the Operator takes into account the mandatory requirements of local law to the extent they apply to its activities (see section 11).

1.5. The Policy is publicly available at gigabytebot.com/en/privacy before any data is processed. By ticking the consent box in the form, you confirm that you have read the Policy. Consent is a separate document: gigabytebot.com/en/consent.

2.1. When you send a request through the Website form, the Operator receives what you enter yourself:

• your name (or another form of address you give);
• a contact: Telegram, phone number or e-mail address;
• a description of your task or project and the selected service (if provided);
• the language version of the Website (Russian or English) and the address of the referring page.

2.2. The following technical information is processed automatically:

• IP address — briefly, in the server’s memory only, to limit how often the form can be submitted and to protect against automated spam; the IP address is not written to the database or to the request record;
• when you gave consent and which version of the documents you accepted (date, time, version of the Policy) — as proof of your consent.

2.3. The Website does not use cookies, web analytics, advertising pixels or other tools to track visitors (see section 7).

2.4. The Operator does not collect special categories of personal data (race, nationality, political opinions, religious or philosophical beliefs, health, sex life) or biometric data. Please do not include such information in your request. If you give data of other people (for example colleagues or clients), you confirm that you are entitled to do so.

2.5. The Website is intended for persons aged 18 and over. The Operator does not knowingly process data of minors; if you are under 18, please do not send a request without a parent or legal guardian.

3.1. Personal data is processed for the following purposes:

• handling your request, replying and advising about the Operator’s services (development of websites, landing pages and MVPs, Telegram bots and Mini Apps, technical audits and support);
• preparing a proposal and concluding and performing a services contract at the User’s initiative;
• protecting the Website and the form against spam, automated submissions and abuse;
• keeping contract records to the extent and for the periods required by law (accounting, tax), if a contract is concluded.

3.2. Legal bases: the User’s consent (Article 6(1)(1) of the Law); conclusion and performance of a contract at the User’s initiative (Article 6(1)(5)); compliance with legal obligations (Article 6(1)(2)); the Operator’s legitimate interest in protecting the Website against abuse, provided the User’s rights are not infringed (Article 6(1)(7)).

3.3. Consent is given separately from other documents — by ticking the box in the request form and the text of the consent (Article 9 of the Law).

4.1. The Operator carries out mixed processing (with and without automation): collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer (provision, access), blocking, deletion and destruction of personal data.

4.2. The Website database is hosted on a server located in Germany.

4.3. The data may be available to the following recipients and persons involved in processing:

• the hosting provider whose equipment runs the Website (located in Germany) — as a provider of server infrastructure; the provider has no substantive access to the content of requests;
• the Telegram messenger (Telegram Messenger Inc. and/or Telegram FZ-LLC) — to deliver to the Operator a notification of a new request (a copy of the request data);
• public authorities — only in cases and in the manner expressly provided for by law.

4.4. The Operator does not sell personal data, does not pass it to advertising networks, does not use it for mass mailings and does not make decisions with legal effect solely on the basis of automated processing. Promotional mailings are possible only with the User’s separate consent.

5.1. The servers of the Telegram messenger are located in various countries, including outside Belarus and Russia. Sending a copy of a request to Telegram, and hosting the Website database in Germany, may therefore be a cross-border transfer of personal data.

5.2. The transfer is made with the User’s consent and in the manner provided for by Article 12 of the Law, including notification of the authorised body (Roskomnadzor) where required. Only a copy of the data entered in the request is transferred, solely to notify the Operator.

5.3. A User who does not agree to such transfer may refrain from submitting the form and contact the Operator in another way listed on the Website.

6.1. Request data is kept until the purposes are achieved, but no longer than 3 years after the User’s last contact, unless a longer period is required by law or follows from a concluded contract (for example for accounting and within limitation periods).

6.2. Processing stops and data is destroyed within 30 days: when the purposes are achieved, when consent is withdrawn, when unlawful processing is detected (Article 21 of the Law), unless there are other grounds for retention provided by law.

6.3. Database backups are kept for up to 14 days and then deleted automatically; data deleted at your request is deleted again after any restoration from a backup.

7.1. The Website does not use cookies, web analytics, advertising pixels or other tools to track visitors and does not pass visit data to advertising or analytics services.

7.2. A service authentication cookie is used only in the Website’s control panel, available to the Operator, and is not set for visitors. The hosting provider may keep its own technical network logs; the Operator does not use them to track visitors. If analytics is ever enabled, it will be with your separate consent, and this Policy will be updated.

8.1. You have the right to:

• obtain confirmation that your data is processed and information about the Operator, the purposes, methods and periods of processing, the list of data and its source, recipients and cross-border transfer (Article 14 of the Law);
• demand that data be corrected, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose (Article 14);
• withdraw consent at any time;
• complain about the Operator’s actions or inaction to the authorised body (Roskomnadzor) or a court and claim damages and compensation for moral harm (Article 17).

8.2. The Operator replies within 10 working days of receiving your request; the period may be extended by no more than 5 working days with a reasoned notice (Article 20 of the Law).

9.1. Send your request (application, withdrawal of consent, request for information) to the Operator in writing or as an electronic document: aleksandrlepesa511@gmail.com or Telegram @qorzz — with the subject “Personal data”.

9.2. The request must contain information allowing the Operator to identify you and confirm your relationship with the Operator (for example the name and contact given in the request and the date) and the substance of your demand.

9.3. The reply is sent in the same form as the request unless it states otherwise.

10.1. The Operator takes legal, organisational and technical measures to protect personal data (Articles 18.1 and 19 of the Law):

• data between your browser and the Website is encrypted (HTTPS/TLS);
• only the Operator can access requests — through a password-protected control panel; login attempts and form submissions are rate-limited;
• only the minimum data necessary for the purposes is processed; the IP address is not stored in the database;
• the database is backed up regularly (backups are kept for up to 14 days);
• request data is not used for purposes other than those stated in this Policy.

10.2. In the event of unlawful or accidental transfer (provision, distribution, access) of personal data that has infringed data subjects’ rights, the Operator notifies Roskomnadzor within 24 hours of the incident and within 72 hours of the results of the internal investigation (Article 21(3.1) of the Law).

11.1. The Website can be used from many countries. This is what the Operator additionally takes into account.

11.2. Republic of Belarus. For a User located in Belarus, the Operator ensures the rights of withdrawing consent, obtaining information about processing and disclosure to third parties, changing and deleting data, and appealing to the National Personal Data Protection Centre of the Republic of Belarus, within the periods and scope described in sections 8 and 9. For Users from Belarus the Operator additionally applies the principles of Law of the Republic of Belarus No. 99-Z (in particular informing about the risks of cross-border transfer — section 5).

11.3. European Economic Area, United Kingdom, Switzerland. If you are located there and the Operator offers you its services, the EU General Data Protection Regulation (GDPR) or an equivalent national law also applies. The Operator acts as the controller. Legal bases: steps taken at your request before entering into a contract and its performance (Article 6(1)(b) GDPR); the legitimate interest in protecting the Website against abuse (Article 6(1)(f)); your consent (Article 6(1)(a)) for analytics cookies, if enabled. Transfers to third countries (Telegram, server location) rely on Article 49 GDPR (necessity for steps taken at your request before entering into a contract, and your explicit consent after being informed of the risks). You have the right to access your data and to request its rectification, erasure, restriction of processing and portability, to object to processing and to withdraw consent, and to lodge a complaint with the supervisory authority of your place of residence or work. We reply within one month. No data protection officer is required; contact: aleksandrlepesa511@gmail.com or Telegram @qorzz.

11.4. Other countries. Mandatory rules of the personal data protection law of your country of residence that cannot be changed by agreement remain in force. Write to the Operator and your request will be considered in light of those rules.

12.1. The Operator may update the Policy. A new version takes effect when published on the Website unless it states otherwise. The Operator announces material changes affecting how data is processed on the Website and, where necessary, asks for consent again. Previous versions are available on request.

12.2. For any questions about personal data: aleksandrlepesa511@gmail.com or Telegram @qorzz.

12.3. Version date: 02 October 2026.