Legal information

Privacy Policy

This document defines how personal data of users of the OutStack website and CRM is processed and protected in accordance with Federal Law No. 152-FZ «On Personal Data».

Revision dated July 20, 2026

1. General provisions

1.1. This Privacy Policy (the «Policy») applies to all information that IE Fazyalzyanov Bulat Ramilevich (brand OutStack, the «Operator») may obtain about a user while using the website https://outstack.ru, CRM https://app.toptalenty.ru, and related services (the «Service»).

1.2. By using the Service and/or providing personal data through forms, the user confirms they have read the Policy. Separate consent to personal data processing is requested when filling out forms, registering, and entering into agreements.

1.3. The Policy is developed in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ «On Personal Data», Federal Law No. 149-FZ «On Information, Information Technologies and Information Protection», and other applicable regulations.

2. Personal data operator

legal.privacy.sections.s2.p1
OGRNIP: 324169000228018
TIN: 160904585516
Region: Republic of Tatarstan
Personal data inquiries: privacy@toptalenty.ru

3. What data we process

Depending on how the Service is used, the Operator may process:

  • identification and contact data: full name / name, email, phone, Telegram, city;
  • specialist profile data: role, experience, skills, portfolio, rate, languages, availability;
  • client data: company, task description, contract details (TIN and other information provided by the user);
  • CRM account data: email, password hash, role, profile settings, avatar;
  • messages and files within projects and personal CRM chats;
  • technical data: IP address, user-agent, request date and time, session cookies, security logs (without message text in audits).

The Operator does not request special categories of personal data (race, health, biometrics, etc.) unless the user voluntarily provides such information in free-text fields.

4. Processing purposes

  • providing specialist matching and project support services;
  • registration, authentication, and use of the CRM;
  • entering into and performing agreements, document flow;
  • communicating with the user regarding requests, applications, and support;
  • vetting performers for the OutStack network;
  • ensuring security and preventing abuse;
  • compliance with applicable Russian law;
  • improving the Service based on anonymized statistics (without identifying a specific person, where applicable).

5. Legal grounds

Processing is carried out on the basis of:

  • consent of the data subject (Articles 6 and 9 of 152-FZ);
  • performance of an agreement to which the subject is a party, or conclusion of an agreement at the subject's initiative;
  • fulfillment of the Operator's obligations established by Russian law;
  • legitimate interests of the Operator (security, service quality) provided they do not violate the subject's rights.

6. Methods and retention periods

6.1. Processing includes collection, recording, systematization, accumulation, storage, clarification, retrieval, use, transfer (in cases specified in the Policy), blocking, deletion, and destruction.

6.2. Processing is carried out with and without automation.

6.3. Retention period — until processing purposes are achieved or consent is withdrawn, unless otherwise required by law (e.g., accounting and contractual document retention). CRM accounts are retained while the account is active and needed to provide services, then anonymized or deleted within a reasonable period.

7. Transfer and processing delegation

7.1. The Operator does not sell personal data. Transfer to third parties is possible:

  • to performers and clients — to the extent necessary to execute a project (contacts, role, project materials);
  • to infrastructure contractors (hosting, email, e-document flow, video conferencing) — under the Operator's instructions and with confidentiality obligations;
  • upon request of authorized Russian government bodies.

7.2. Cross-border transfer of personal data is carried out only where legal grounds under 152-FZ exist.

8. Security measures

The Operator applies organizational and technical measures, including:

  • access control and server-side permission checks (RBAC, ACL);
  • secure sessions (httpOnly cookies), CSRF protection, rate limiting;
  • password hashing (bcrypt), HTTPS in production;
  • limited logging (no message text or passwords);
  • access control for chat/contract files and attachments.

9. Data subject rights

The subject has the right to:

  • receive information about processing of their data;
  • request clarification, blocking, or deletion of data;
  • withdraw consent to processing;
  • appeal the Operator's actions to Roskomnadzor or a court.

Send requests to privacy@toptalenty.ru. The Operator responds within the time limits established by 152-FZ.

10. Cookies and similar technologies

The Service uses cookies and similar technologies. Details are in the Cookie Policy.

11. Policy changes

The Operator may update the Policy. The current version is published on this page with the revision date. Material changes may additionally be communicated through the Service interface.

12. Related documents

Operator

IE Fazyalzyanov Bulat Ramilevich (OutStack)
OGRNIP 324169000228018, TIN 160904585516
Email: privacy@toptalenty.ru · hello@toptalenty.ru