Data Processing Agreement
Last updated: October 21, 2026. Effective as of [ДАТА_ВСТУПЛЕНИЯ].
Draft for completion and review before publication. Main document.
1 Parties and purpose
The Client, identified in the accepted order and hereinafter referred to as the Operator, instructs individual entrepreneur Roman Alexandrovich Romashenko, address: St. Petersburg, Dudergofsky Canal Embankment, Building 4, Bldg. 1, Apt. 428, hereinafter referred to as the Processor, to process personal data in the submitted procurement documents solely for the execution of the Buyora.ai contract. This Instruction is an appendix to the offer https://buyora.ai/en/legal/offer and applies to the specific Client company and its data space.
For its own visitor data, accounts, and payments, the Processor may act as an independent operator within the limits of the published Policy. This instruction does not grant the Processor the independent right to use the contents of the Client's documents.
2 Subject and volume
Automatic sending of requests to suppliers without separate approval is not authorized. Access to the mailbox or website is permitted only to the extent agreed upon and configured separately; external correspondence and documents outside the scope of the task are not collected.
Objectives: extracting data from applications and supplier quotes, comparing items, preparing comparison tables and AI recommendations, generating draft requests to suppliers, user verification, saving and uploading results, and providing technical support for these operations.
Categories of subjects: employees and representatives of the Operator, suppliers and other counterparties, individual entrepreneurs, information about whom is legally contained in the transferred materials.
List of personal data: full name, job title, work email and phone number, individual entrepreneur details, and information related to applications and proposals related to these individuals to the extent necessary for the task. Passport information, personal addresses, payment cards, special categories, information about minors, and biometric data for identification are not included in the assignment.
Operations: receipt from the Operator, recording, systematization, accumulation, storage, clarification according to the Operator's instructions, retrieval, use for agreed purposes, granting access to authorized users, transferring to approved processors, blocking, deletion, and destruction. Processing is automated or combined. Dissemination to an unspecified group of persons is not authorized.
Duration: the contractual performance period and the agreed-upon data unloading period, taking into account shorter legal deadlines for data termination and destruction. Additional retention periods are determined only by documented instructions with a legal basis.
3. Operator's Responsibilities
The Operator determines and documents the legal basis for processing each category of data, ensures that data subjects are informed and obtain consent for the processing, unless otherwise provided by law, as well as the legitimacy of subsequent transfer to specific recipients. The Operator provides confirmation of the basis upon reasonable request and does not knowingly commission unlawful operations.
The operator limits the upload volume to necessary information, manages the permissions of its users, and communicates instructions through the space administrator or approved contacts. Confirmation of upload on behalf of the company constitutes the company's instruction, not the consent of each data subject.
4. Obligations of the Processor
The Processor complies with the principles and rules of Federal Law No. 152-FZ, confidentiality, and the requirements of Part 5 of Article 18, Article 18.1, and Article 19 of the said law to the extent applicable; and ensures processing only in accordance with the Operator's documented, lawful instructions.
At the Operator's request, the Processor shall, within the term of the assignment, including prior to the commencement of processing, provide documents and information confirming the necessary measures have been taken and the requirements have been met. A response shall be provided without undue delay, generally within five business days; if a shorter period is legally required, within that timeframe.
The Processor grants access to data only to individuals who need access and are bound by confidentiality obligations, restricts access, records significant actions, ensures secure transmission and storage, and ensures recovery and deletion in accordance with agreed requirements. The actual configuration of measures and placement is recorded in a processing card accessible to the Operator.
The processor does not use documents for advertising, publishing, expanding the shared database, or training its own or other users' models on its own behalf. Such a new purpose requires separate approval and independent verification of its legality; general acceptance of this instruction is not sufficient.
If an unlawful instruction is discovered, the Processor will notify the Operator and suspend the relevant actions until the violation is rectified. Such notification does not relieve the Processor of its statutory obligations.
5. Involvement of other processors and foreign recipients
The main database, documents, and results are hosted on the Timeweb server in Moscow. When using AI, requests are transmitted through a proxy in Germany, OpenRouter, and the OpenAI provider in the United States. Recipients, transactions, and confirmed conditions are listed in the registry. The Russian hosting of the main database does not preclude subsequent processing abroad.
The Operator permits the use of only specific recipients specified in the accepted registry version https://buyora.ai/en/legal/ai-processors and the selected route card. The card specifies the recipient's legal name, address, and contact information, role, countries of processing, storage, and remote access, data categories, purposes, operations, deadlines, and conditions for deletion, training, and further transfer.
The processor ensures that each engaged party complies with this instruction and legal requirements and provides proof of such compliance. If the foreign provider's terms and conditions do not allow for the required regime, such a route for personal data will not be applied. Independent training or other independent purposes of the provider are not considered processing within the scope of this instruction.
Any change in recipient, country, or significant parameters is communicated to the Operator prior to the commencement of a new transfer; if necessary, new consents and notifications are provided. If the Operator disagrees, the relevant processing is terminated, a lawful alternative route is offered, or the affected service is terminated, with compensation for the unprovided portion.
Cross-border transfers are carried out only after the relevant parties have fulfilled their obligations under Article 12 of Law No. 152-FZ. Notifications and security assessments reflect the actual chain of custody, including the gateway and the final LLM provider. The distribution of activities between the parties is recorded in the file; notification by one party cannot be considered to automatically relieve the other of its obligations.
6 Subjects' Appeals and Incidents
The Processor assists the Operator in responding to data subjects' requests, clarifying, blocking, and deleting data within legally binding deadlines. Direct requests received are forwarded to the Operator no later than the next business day, unless otherwise required by law. The Processor does not interfere with the independent exercise of data subjects' rights.
The Processor shall notify the Operator of any established fact of unauthorized or accidental transfer, distribution, or access resulting in a violation of the rights of individuals without undue delay, but no later than six hours after discovery. The notification shall include the known circumstances, the categories and scope of the affected data, the anticipated consequences, the measures taken, and the contact information of the person responsible. Incompleteness of the initial information shall not delay the notification; additional information shall be transmitted as soon as it is discovered.
To fulfill the Operator's obligations, the Processor provides investigation materials and information on the perpetrators, if any. The statutory notification periods for Roskomnadzor, including the 24 and 72 hours under Part 3.1 of Article 21, are calculated from the moment established by law; contractual exchange does not extend them. Each party fulfills its own obligations independently.
7 Completion and Destruction
Upon completion of the assignment, the Processor provides the agreed-upon download and ceases further processing. Data in the primary system and backup copies is deleted within the legally established timeframes; third-party processors are provided with corresponding instructions. Retention of individual data is permitted only for independent legal grounds, with access and purpose restrictions.
The Processor shall provide confirmation of destruction, including a deletion report and the applicable log file, in accordance with Roskomnadzor Order No. 179 dated October 28, 2022. If deletion is technically impossible within the specified timeframe, blocking and the procedure specified in Part 6 of Article 21 of Federal Law No. 152-FZ shall be applied; the reason and timeframe shall be communicated to the Operator.
8 Responsibilities and contacts
Liability to the subject and between the participants is determined by Parts 5 and 6 of Article 6 of Federal Law No. 152-FZ and other applicable regulations. This instruction does not eliminate the Processor's liability for its own violations and does not transfer all risks to the Operator.
The Operator's contact information is provided in the order. The Processor's requests and incidents can be addressed to: info@buyora.ai, [ТЕЛЕФОН_ИНЦИДЕНТЫ]. BUYORA AI card version 2026 10 21 is saved with the order.