Kristina Data rights and deletion
Legal force. Only the Russian version of this document has legal effect. This translation is provided for convenience; if the two differ in any way, the Russian original governs — read the original. The service is operated under the law of the Russian Federation, and the Russian text is the one a court, a regulator and the parties rely on.
1. What you can ask for
- confirmation that processing is taking place, and the information listed in part 7 of article 14 of Federal Law No. 152-FZ;
- correction of data that is incomplete, inaccurate or out of date;
- blocking or destruction of data that is processed unlawfully or does not serve the stated purposes;
- withdrawal of consent where processing is based on consent — the text of the consent;
- objection to a decision producing legal effects and taken solely on the basis of automated processing (article 16 of Law No. 152-FZ);
- deletion of an account, a company or an individual conversation;
- a complaint about the Operator’s actions to the authority responsible for protecting the rights of data subjects or to a court — approaching the Operator first is not required for that.
2. Who the request goes to
If the data concerns you as a user of the service, the owner of the service is the operator and it is the owner who deals with the request.
If you contacted a company that uses Kristina AI, then that company is the operator of your data: it determined the purposes of processing, and the service processes the data on its instructions. The service has no authority to deal with such data on its own — it passes the request to the company and tells you that it has done so. Approaching the company directly is faster.
3. Sending a request
Requests are submitted through the form on the Russian version of this page: kristina-ai.ru/data-rights. The form is in Russian, and so are the replies to it — requests are handled in Russian, and a translated form would promise an answer in a language the Operator does not reply in. A request may also be sent by letter to the Operator’s address given in section 10 of the personal data processing policy.
State the email address you used and describe what you are asking for. Before acting on a request the Operator may ask for information confirming your identity and your involvement in a relationship with it (part 3 of article 14 of Law No. 152-FZ): acting on a request without establishing who made it would mean disclosing data to a stranger. The form does not reveal whether an account with the address given exists in the service.
4. Time limits
- information about processing is provided within 10 working days of the request; the period may be extended by no more than 5 working days, with the applicant informed of the reasons (part 2 of article 20 of Law No. 152-FZ);
- inaccurate data is corrected within 7 working days of the evidence of the inaccuracy being provided (part 2 of article 21 of Law No. 152-FZ);
- on withdrawal of consent, processing stops and the data is destroyed or de-identified within a period not exceeding 30 days (part 5 of article 21 of Law No. 152-FZ).
Time runs from the moment the applicant’s identity is confirmed. A refusal to act on a request is given in writing and must state reasons.
5. What happens after deletion
The account and the data connected with it are destroyed or de-identified. Data the Operator is required by law to keep is not destroyed — in particular payment records, within the periods set by the legislation on accounting and on taxes and levies — nor is data needed to perform a contract already concluded and to defend the parties’ rights in a dispute. Such data is processed solely for those purposes and is destroyed once the relevant periods expire.
Deletion on the service’s side neither replaces nor ends the client company’s own obligations to its customers.