Personal Data Processing Policy
KEMO LLC
1. General Provisions
1.1. This Personal Data Processing Policy (the "Policy") has been developed in accordance with paragraph 2, part 1, article 18.1 of Federal Law No. 152-FZ "On Personal Data" dated 27.07.2006 (the "Personal Data Law") and defines the position of KEMO LLC (the "Operator") regarding the processing and protection of personal data.
1.2. The Policy applies to all personal data processed by the Operator:
- on the websites kemo.ru (the company's official website) and stendos.kemo.ru (the promo site for the "StendOS" product);
- within the provision of booth-management and event-gamification automation services (the "Service"), including demo versions of the product;
- when providing access to demo games on kemo.ru, including with the option to choose a name or register.
1.3. The Policy applies to relations arising both before and after its approval.
1.4. The Policy is published in open access on kemo.ru and stendos.kemo.ru, and is also brought to the attention of data subjects by other means provided by law.
1.5. The core terms used in the Policy correspond to the definitions given in article 3 of the Personal Data Law:
- personal data — any information relating directly or indirectly to an identified or identifiable natural person (data subject);
- operator — KEMO LLC, organizing and/or carrying out the processing of personal data independently or jointly with other persons;
- processing — any action (operation) or set of actions performed on personal data, whether or not using automation tools, including collection, recording, systematization, accumulation, storage, clarification, retrieval, use, transfer, de-identification, blocking, deletion, destruction.
1.6. The Operator has the right to:
- independently determine the composition and list of measures necessary to fulfil its obligations under 152-FZ;
- entrust the processing of personal data to another party with the subject's consent, on the basis of an agreement;
- continue processing without the subject's consent where the grounds specified by law exist (including for the performance of a contract).
1.7. The Operator is obliged to:
- organize processing in accordance with 152-FZ;
- respond to requests and inquiries from data subjects within the established deadlines;
- report information to Roskomnadzor at its request within 10 business days (with a possible extension of 5 business days);
- inform Roskomnadzor of computer incidents that resulted in unlawful transfer of personal data, within the deadlines established by law (24 hours for the fact, 72 hours for the investigation results).
1.8. The data subject has the right to:
- receive information about the processing of their personal data (purposes, methods, timeframes, legal grounds, etc.);
- demand clarification, blocking or destruction of data if it is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated processing purpose;
- withdraw consent to processing (if processing is based on consent);
- appeal the Operator's actions or inaction to Roskomnadzor or in court.
1.9. A person authorized by order of the general director is appointed to be responsible for organizing personal data processing at the Operator.
1.10. Compliance with the requirements of the Policy is monitored by the authorized person.
2. Purposes of Personal Data Collection
The Operator processes personal data exclusively for the following purposes, grouped by source:
2.1. Processing purposes on the Operator's websites (kemo.ru and stendos.kemo.ru)
| No. | Purpose | Description |
|---|---|---|
| 2.1.1 | Processing service requests | Receiving inquiries from potential clients via contact forms, contact details, online chats, phone calls. |
| 2.1.2 | Consulting and preparing commercial proposals | Answering questions, preparing individual proposals for game development, gamification, renting the "StendOS" system, and other services. |
| 2.1.3 | Informing about news and promotions (with consent) | Sending news, updates, event and product announcements (only with separate consent). |
| 2.1.4 | Website analytics and improvement | Collecting visit statistics and user behaviour (via cookies and counters) to optimize content and usability. |
| 2.1.5 | Technical operation of the websites | Processing IP addresses, browser data, access logs to ensure security and stability. |
| 2.1.6 | Operation of demo games (without registration) | Allowing users to try games without creating an account. In doing so:
|
| 2.1.7 | Data processing upon demo-game registration | When a user chooses to register (providing a name, email address and/or Telegram handle), this data is processed to create a temporary account, save game progress, allow continuing the game on another device, and to contact the user if necessary. Registration is voluntary, and the user may choose the "without registration" option. |
2.2. Processing purposes when providing the "StendOS" Service (including demo versions) and similar products
| No. | Purpose | Description |
|---|---|---|
| 2.2.1 | Registration and authorization of booth participants | Enabling participant login by badge ID or magic email link, providing access to games, expert bookings, the merch shop. |
| 2.2.2 | Running game mechanics and awarding points | Recording game results, maintaining attempt history, calculating leaderboards, managing game sessions. |
| 2.2.3 | Organizing expert bookings and queue management | Processing consultation requests, schedule synchronization, notifications about queue status changes. |
| 2.2.4 | Merch shop operation | Placing orders for merchandise paid with points, stock control, automatic reservation release. |
| 2.2.5 | Event administration | Providing organizers (administrators) with access to the admin panel for monitoring, configuring games, managing queues, exporting reports. |
| 2.2.6 | Engagement analytics and reporting | Collecting participant activity statistics (number of sessions, bookings, merch issued) to improve event quality and provide reports to organizers. |
Note: processing for the purposes of section 2.2 is carried out not only at events but also in demo versions of the product, access to which may be provided on stendos.kemo.ru. The stendos.kemo.ru website itself serves as a promo page, while processing within the demo version takes place in the Operator's secure information system.
3. Legal Grounds for Processing Personal Data
3.1. Personal data processing is carried out on the basis of:
- the Constitution of the Russian Federation, the Civil Code, the Labor Code (with respect to the Operator's employees), the Tax Code;
- Federal Law No. 14-FZ "On Limited Liability Companies" dated 08.02.1998;
- Federal Law No. 152-FZ "On Personal Data" dated 27.07.2006;
- the Charter of KEMO LLC;
- agreements concluded with event organizers, service clients, and counterparties;
- consents of data subjects (website visitors, event participants, administrators, experts, and users registering in demo games), given in simple written or electronic form;
- other legal grounds provided by the legislation of the Russian Federation (e.g., performance of a contract to which the subject is a party, or for statistical purposes provided the data is de-identified).
4. Scope and Categories of Personal Data Processed, Categories of Subjects
4.1. On the Operator's websites (kemo.ru and stendos.kemo.ru)
Subjects: website visitors filling in contact forms, submitting inquiries, subscribing to the newsletter, and users playing demo games.
Data processed:
4.1.1. For inquiries and requests:
- Full name (if provided);
- Email address;
- Contact phone number;
- Company name, job title (optional);
- Content of the inquiry (message text, task description, preferences).
4.1.2. For demo games (without registration):
- In games where a name (nickname) can be chosen: this name is stored exclusively in the browser's local storage and is used only for display during gameplay. It is not transmitted to, processed by, or stored on the Operator's server.
- In games with a "play without registration" option: no data is collected, all interaction happens locally in the browser. Standard session data (session identifier, local-storage data) may be processed for technical operation, but it does not constitute personal data and does not allow user identification.
4.1.3. Upon demo-game registration (choosing the registration option):
- The name chosen by the user (may be a real name or a nickname);
- Email address;
- Telegram username (if provided);
- Additionally may be processed: IP address, device type, browser, registration time — for security and technical support purposes.
4.1.4. For all visitors (technical data):
- IP address, device type, browser, visit time, pages viewed (via cookies and technical logs) — processed in de-identified or statistical form.
4.2. When providing the "StendOS" Service (including demo versions)
4.2.1. Subjects: event participants (including demo users).
Data processed:
- Full name (if available);
- Telegram username (if provided);
- Email address (for sending magic links, notifications);
- Badge ID (a unique number assigned by the organizer or generated by the system for demo mode);
- Company, job title (if provided);
- Contact phone number (if needed for expert consultations);
- Activity history: session date/time, game results, points, expert bookings, merch shop orders;
- IP address, device type, operating system, browser data (for technical analytics and security).
4.2.2. Subjects: organizer representatives (event administrators or demo users with administrator rights).
Data processed:
- Full name;
- Email address (for admin panel login and communication);
- Login, password hash (or magic-link login data);
- Role (super admin, moderator, volunteer) and granted access rights.
4.2.3. Subjects: experts participating in the event.
Data processed:
- Full name;
- Contact details (phone, email);
- Consultation topics, schedule.
4.3. The Operator does not process special categories of personal data (biometric, health-related, racial or ethnic origin, political views, etc.), except where explicitly stated in an agreement with the organizer and with the subject's separate consent.
4.4. The scope of data processed strictly corresponds to the stated purposes and is not excessive.
5. Procedure and Conditions of Personal Data Processing
5.1. Personal data processing on the websites is carried out using automation tools (CRM, analytics systems, mail services) and without them (paper media if necessary).
5.2. Data processing within the "StendOS" Service is carried out in secure information systems hosted on servers located in the territory of the Russian Federation (in accordance with part 5, article 18 of the Personal Data Law).
5.3. Only Operator employees whose job duties include personal data processing, and who are familiar with the requirements of the law and this Policy, are admitted to processing.
5.4. The Operator takes the necessary legal, organizational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, distribution, including:
- appointing responsible persons;
- organizing the accounting and storage of media;
- using encryption, rate limits, intrusion detection systems;
- maintaining access logs;
- regular training and checks of employees.
5.5. The Operator has the right to transfer participants' personal data to event organizers (clients) to the extent necessary to perform the contract (e.g., for issuing merch, preparing reports). Transfer is carried out on the basis of an agreement containing confidentiality obligations.
5.6. The Operator has the right to engage third parties (technical contractors) to process personal data, on the basis of an agreement requiring them to comply with 152-FZ.
5.7. Cross-border transfer of personal data to foreign states is not carried out, except where expressly provided for by international treaties of the Russian Federation or federal laws.
5.8. Personal data retention periods:
- on the websites:
- for inquiries: until a reply is given, but no longer than 1 year (if no contract is concluded);
- for demo games without registration (including a chosen name): session data and the chosen name are stored exclusively in the browser's local storage until cleared by the user; they are not transmitted to or stored on the server;
- upon demo-game registration: account data (name, email, Telegram) is stored for the lifetime of the demo version, but no longer than 1 year from registration, unless the user requests earlier deletion;
- within the Service — for the term of the agreement with the organizer and 30 days after the event (or demo session) ends, for reporting purposes, unless a longer period is provided by the agreement or the law.
5.9. Upon expiry of the retention periods, personal data is destroyed or de-identified in the manner established by the Operator's internal acts.
6. Updating, Correcting, Deleting, Destroying Personal Data, Responding to Requests
6.1. A data subject or their representative has the right to receive information about the processing of their personal data. The Operator must provide this information within 10 business days of receiving the request (the period may be extended by no more than 5 business days, with reasoned notice to the subject).
6.2. The request must contain:
- the number of the subject's or their representative's primary identity document;
- information confirming the subject's involvement in a relationship with the Operator (e.g., badge ID, the email address used to log in, or another identifier);
- the subject's (or their representative's) signature.
When a request is sent by email, it may be signed with a simple electronic signature in accordance with the law.
6.3. The information provided must not contain personal data relating to other subjects, except where there are legal grounds for its disclosure.
6.4. If inaccurate personal data is identified, the Operator blocks it for the verification period (no more than 7 business days), then clarifies (updates) it based on the information provided by the subject and lifts the block.
6.5. If unlawful processing of personal data is identified, the Operator blocks it from the moment of discovery and remedies the violation.
6.6. Personal data is destroyed in the following cases and within the following timeframes:
| Grounds for destruction | Timeframe |
|---|---|
| The processing purpose has been achieved or is no longer needed | 30 days |
| Expiry of the maximum retention period for documents containing personal data | 30 days |
| Withdrawal of the subject's consent (if processing is based on consent) | 30 days (unless otherwise provided by the agreement or the law) |
| At the subject's request (upon confirmation that processing was unlawful) | 7 business days |
6.7. The destruction of personal data is documented by an act drawn up by a commission appointed by order of the general director of KEMO LLC.
7. Contact Information
For any questions related to personal data processing, you may contact:
- Legal address: [Enter the legal address of KEMO LLC]
- Postal address for correspondence: [Enter the postal address, if different from the legal address]
- Email for data subject requests: [Enter the email for personal-data requests]
- Phone: [Enter the contact phone number]
- Responsible person: [Enter the job title and full name of the person responsible for organizing personal data processing]
8. Final Provisions
8.1. This Policy takes effect on the date of its approval by the general director of KEMO LLC and remains in force until replaced by a new version.
8.2. The Operator has the right to amend the Policy. Amendments take effect from the date a new version is published on kemo.ru and stendos.kemo.ru (at stendos.kemo.ru/en/privacy). Data subjects are responsible for independently monitoring the current version.
8.3. In all other respects not regulated by this Policy, the legislation of the Russian Federation applies, including Roskomnadzor's clarifications and court practice.
Approved by order of the general director of KEMO LLC dated [date].