Personal Data Processing Instructions

1.1. These Instructions form an integral part of the ReplayBox User Agreement available at https://replaybox.ru/legal/user-agreement.

1.2. The Instructions apply only where the User independently determines the purposes and data categories for processing third parties' personal data in uploaded content and is legally the controller of that data.

1.3. Under these Instructions, the User is the “User Controller”, and individual entrepreneur Pavel Nikolaevich Strukov is the “Processor”.

1.4. For account, security, payment and support data, individual entrepreneur Pavel Nikolaevich Strukov

acts independently as the controller; this processing is governed by the Privacy Policy: https://replaybox.ru/legal/privacy.

1.5. If content contains no third-party personal data, or the User is not its controller, these Instructions apply only insofar as appropriate to the relationship.

2.1. The User Controller instructs the Processor to technically process personal data contained in user videos, audio tracks, notes, timestamps and related metadata.

2.2. Processing is performed solely to provide ReplayBox features and on the User Controller's documented instructions in the User Agreement, these Instructions and interface actions.

2.3. The Processor does not determine independent purposes for the entrusted data and does not use content for advertising, profiling or training its own models.

2.4. The Processor may refuse an instruction that clearly violates the law, notifying the User Controller unless notification is legally prohibited.

3.1. Processing purposes are:

• receiving and uploading a file;
• temporarily storing parts of an incomplete upload;
• checking format and technical integrity;
• creating previews and other technical derivatives;
• storing published content;
• playing and transmitting content to link recipients;
• applying the selected availability setting;
• displaying notes and timestamps;
• deleting content on instruction, expiration or a lawful request;
• ensuring security, diagnosing and resolving technical errors;
• reviewing complaints to the extent necessary to protect rights and comply with the law.

3.2. Any additional purpose requires separate lawful grounds and, where necessary, additional User Controller instructions.

4.1. Content may contain data relating to:

• the User Controller;
• gameplay participants;
• game project administrators and moderators;
• participants in voice or text communication;
• viewers and others whose information was captured in the recording;
• persons mentioned in notes or timestamps.

4.2. The User Controller must minimize inclusion of information about persons unrelated to the recording and publication purpose.

5.1. The Instructions may cover the following ordinary categories of personal data:

• nickname, username and game account identifier;
• character image, avatar and profile elements;
• images of individuals captured intentionally or unintentionally;
• voices and the content of voice communication;
• message and correspondence text;
• information about gameplay actions and events;
• recording date, time, duration and technical characteristics;
• notes and timestamp content;
• other ordinary personal data lawfully included by the User Controller.

5.2. The Processor does not use images or voices to establish identity and does not perform biometric identification.

5.3. Without a separate written agreement, transfer of special categories of personal data, biometric data for identification, state secrets or other legally protected secrets is prohibited.

6.1. The Processor may perform:

• collection through uploading;
• recording;
• organization;
• accumulation;
• storage;
• retrieval;
• use solely to provide technical features;
• copying and format conversion;
• creating previews;
• transmission and provision of access to unique link recipients;
• blocking;
• deletion;
• destruction.

6.2. Processing is automated. Limited access by authorized persons is permitted for support, security, moderation, data subject requests or legal requirements.

6.3. Dissemination to an indefinite audience occurs only on separate User Controller instructions and with the legal grounds required by law.

7.1. The User Controller must:

• have lawful grounds for each processing purpose;
• obtain necessary data subject consents, including separate consent to dissemination where required;
• provide data subjects with mandatory processing information;
• observe lawfulness, minimization and retention limitation principles;
• not issue unlawful instructions;
• choose an access setting appropriate to the purpose;
• independently determine a retention period no longer than the plan permits;
• handle requests from data subjects and government authorities;
• notify the Processor if the processing grounds change or cease;
• not upload prohibited data categories without a separate agreement.

7.2. The User Controller warrants that transferring data to the Processor and engaging the listed subprocessors are permitted by the applicable legal grounds.

7.3. The User Controller is responsible to data subjects for determining purposes, lawful collection, content and instructions.

8.1. The Processor must:

• process data only on documented instructions;
• maintain confidentiality;
• take the measures provided by Articles 18.1 and 19 of Federal Law No. 152-FZ;
• ensure that collection of Russian citizens' data uses databases in the Russian Federation;
• grant data access only to authorized persons;
• require those persons to maintain confidentiality;
• provide documents and information confirming compliance with the Instructions upon request, without disclosing other users' data or protected information;
• assist the User Controller in handling data subject requests and incidents;
• cease processing and delete data when the applicable grounds arise;
• notify the User Controller of incidents under section 12.

8.2. The Processor need not obtain separate data subject consent for actions lawfully entrusted by the User Controller, but may request confirmation of the legal grounds.

8.3. The Processor reports clearly unlawful instructions and suspends their execution pending clarification.

9.1. The Processor applies measures appropriate to the data, risks and available technology, including:

• access separation and controls;
• authentication and session management;
• secure network connections;
• private object storage;
• unique, unpredictable links;
• logging significant technical events;
• restricting administrative access;
• monitoring, updates and vulnerability remediation;
• incident response and deletion procedures;
• oversight of engaged persons.

9.2. A public link is an access mechanism and does not replace encryption against the recipient. The User Controller is responsible for choosing the persons who receive a link.

9.3. A detailed public description of measures is provided in the Personal Data and Information Processing Policy: https://replaybox.ru/legal/personal-data.

10.1. The User Controller authorizes engagement of infrastructure provider Timeweb Cloud for server hosting and object storage in the Russian Federation.

10.2. The subprocessor list and documents are available at https://replaybox.ru/legal/data-processing#section-10.

10.3. Subprocessors are subject to confidentiality and security obligations no less strict than those applying to the relevant processing under these Instructions.

10.4. The Processor remains responsible to the User Controller for proper performance of the Instructions within the limits established by law and contract.

10.5. The Processor gives advance notice of plans to engage a new subprocessor with access to content. The User Controller may cease future processing if they reasonably object to the change.

11.1. Initial recording, organization, accumulation, storage, correction and retrieval of Russian citizens' data use databases in the Russian Federation.

11.2. The Processor does not intentionally transfer entrusted data across borders without documented instructions and completion of mandatory procedures.

11.3. A public link recipient may be outside the Russian Federation. The User Controller must consider this when selecting access settings and sharing links.

12.1. If unlawful or accidental transfer, disclosure, dissemination or access is identified, the Processor takes steps to stop the violation and reduce possible harm.

12.2. The Processor sends preliminary notice to the User Controller without undue delay and, where technically possible, within 12 hours after confirming the incident.

12.3. The notice contains available information about the incident's nature, affected data, possible consequences and measures taken.

12.4. Further internal investigation results are provided as available, taking account of the time the User Controller needs to fulfil obligations to Roskomnadzor and data subjects.

12.5. A notice does not constitute an admission of fault or liability.

13.1. The User Controller is the primary contact for data subjects regarding entrusted data.

13.2. If a request reaches the Processor directly, the Processor forwards it to the User Controller where permitted, or explains how to submit it.

13.3. The Processor provides reasonable assistance in finding, blocking, restricting or deleting content following a verified request.

13.4. Assistance must not disclose other users' data, security secrets or legally protected information.

13.5. A government authority request is fulfilled where lawful grounds exist. The Processor notifies the User Controller unless notification is prohibited.

14.1. Processing lasts for the plan's content retention period or until earlier deletion by the User Controller.

14.2. An incomplete upload session is retained for no longer than seven calendar days.

14.3. After expiration or deletion, the Processor ends active access and completes deletion within 30 calendar days, unless a different period is legally required.

14.4. Before deletion, the User Controller may download content using available Service features. Recovery is not guaranteed after deletion.

14.5. If destruction is impossible, data is blocked and destroyed within the period established by law.

14.6. Upon a justified request, the Processor confirms deletion in an applicable form.

15.1. Upon written request, the Processor provides documents and information reasonably necessary to confirm compliance measures under the Instructions.

15.2. Verification is primarily remote, no more than once a year, unless an incident or authority request justifies additional verification.

15.3. Requests must be submitted at least 15 working days in advance and must not threaten security or disclose other clients' data.

15.4. The parties keep received verification materials confidential.

16.1. The User Controller is responsible for lawful purposes, grounds, initial collection and instructions.

16.2. The Processor is liable to the User Controller for breaching its obligations under the Instructions in accordance with the law and User Agreement.

16.3. The User Controller must not shift costs that the law assigns to a controller onto data subjects.

16.4. Liability limitations do not apply where prohibited by law.

17.1. The Instructions apply from acceptance of the User Agreement while the Processor processes entrusted data.

17.2. Closing an account stops new operations except those needed for deletion, legal compliance and incident resolution.

17.3. Confidentiality obligations survive termination of the Instructions.

17.4. A new version is published at https://replaybox.ru/legal/data-processing and applies to future processing after notice under the User Agreement.

18.1. Processor: individual entrepreneur Pavel Nikolaevich Strukov, INN 771314210244, OGRNIP 324774600166372.

18.2. Address: 127591, Moscow, 69 Dubninskaya Street, Building 2, Apartment 126.

18.3. Email for Instructions and incident enquiries: support@replaybox.ru.

18.4. Current version: https://replaybox.ru/legal/data-processing.