AiGenda Data Processing Instruction

Version of 16 October 2026. Effective from the date of publication at https://aigenda.tech/en/dpa. This Data Processing Instruction is the English version of the Russian «Поручение на обработку персональных данных». If the versions differ, the Russian version prevails.

1. Scope

1.1. This Data Processing Instruction (the "Instruction") forms part of the AiGenda Terms of Service (https://aigenda.tech/en/terms, the "Terms") between you and AiGenda LLC (ООО «Айдженда», "we", "us") and remains in force for as long as the Terms remain in force. Capitalised terms have the meanings given in the Terms.

1.2. If you process personal data as an operator (a company, a sole entrepreneur, or an individual recording meetings for purposes other than personal or household ones), you instruct us to process the personal data of Meeting Participants and other people contained in your Materials under Article 6(3) of Federal Law No. 152-FZ "On Personal Data" of 27 July 2006 (the "Law"). An employee or representative who uses the Service for an organisation acts on its behalf; the organisation is the party to this Instruction.

1.3. If you are an individual recording meetings for personal or household purposes, this Instruction does not apply: we process that data as the operator under Section 2.3 of the AiGenda Privacy Policy (https://aigenda.tech/en/policy, the "Privacy Policy").

2. Purposes, data and operations

2.1. Purposes: providing you with the services under the Terms (receiving and storing Recordings, speech recognition, producing Results, giving access to Materials, including playback of the original Recordings, and deleting Materials), keeping the Service secure, and checking compliance with the Terms in the event of an incident or complaint.

2.2. Data subjects: Meeting Participants and people mentioned in Recordings.

2.3. Personal data: voice and speech; image in video recordings; information spoken during the meeting or contained in files you upload and their names; meeting titles; Meeting Participants' names.

2.4. Operations: collection, recording, organisation, accumulation, storage, updating, retrieval, use, transfer (giving access to people you designate and to the processors under Section 3.5), blocking, deletion and destruction, by automated means.

2.5. We do not review the content of Recordings. If information in the special categories of personal data (Article 10 of the Law) is disclosed in a meeting, we do not extract it and process it only as part of the Recording and Results; you are responsible for ensuring a legal basis for processing it.

3. Our obligations

3.1. We process the data only for the purposes set out in Section 2.1 and on your instructions given through the Service interface, the API or by e-mail.

3.2. We keep the data confidential and do not disclose it to third parties except in the cases set out in Sections 2.4 and 3.5 and where the law requires disclosure. Our staff view the content of Materials only in the cases set out in Section 4.3 of the Privacy Policy. If a staff member views Materials without your consent, we inform you, unless the law prohibits this.

3.3. We ensure the security of the data under Article 19 of the Law, including by: identifying security threats and ensuring the required level of protection under Russian Government Resolution No. 1119 of 1 November 2012; using information security tools that have passed conformity assessment where they are needed to neutralise relevant threats; giving staff access only as needed for their tasks and logging actions performed with the data; encrypting data in transit and at rest; detecting and responding to unauthorised access; restoring data after failures; and monitoring these measures.

3.4. We record, organise, accumulate, store, update and retrieve the data using databases on servers in Russia.

3.5. We engage other processors only to store and process data on servers in Russia, under contracts imposing the same obligations as this Section 3. The list of these processors is published at https://aigenda.tech/en/processors. We announce a new processor on the list page and at your Account e-mail at least 10 calendar days before it starts receiving data. If you do not agree to a new processor, you may terminate the Terms and receive a refund under Section 6.8 of the Terms.

3.6. We notify you immediately, and no later than 12 hours after detection, of any unlawful or accidental transfer (provision, dissemination or access) of the data that has violated data subjects' rights, stating what happened, the likely causes and harm, the measures taken and a contact person. No later than 48 hours after detection, we send you the results of our internal investigation and details of the persons whose actions caused the incident, if they have been identified.

3.7. At your request, at any time while this Instruction is in force, including before processing starts, we provide, within 10 business days, documents and other information confirming that we have taken the required measures and comply with the requirements of Article 6 of the Law.

3.8. We forward to you, within 3 business days, any requests from data subjects that we receive and, on your instruction, update, block or destroy the data within 3 business days of receiving the instruction. Data is deleted from backups within the period set out in Section 3.3 of the Privacy Policy; until then, backups are used only to recover from failures.

3.9. After the Terms end, we destroy the data within 30 days unless the law requires otherwise and, at your request, send you confirmation of the destruction.

3.10. We comply with Article 18.1 of the Law, including by appointing a person responsible for organising personal data processing, adopting internal rules on personal data processing, monitoring internal compliance with the Law and familiarising staff who process personal data with personal data legislation.

4. Your obligations

4.1. You ensure that there is a legal basis for the processing you entrust to us, including by notifying Meeting Participants and obtaining their consent where required (Section 4.1 of the Terms). If you process the data on the basis of data subjects' consent, that consent must cover entrusting the processing to us.

4.2. Your instructions must comply with the Law.

5. Liability

5.1. We are liable to you for breach of this Instruction within the limits set out in Section 9.1 of the Terms.