This is a translation. The Russian original is at podcast.ru/privacy.
This Policy sets out the purposes, grounds and procedure for the processing of personal data in the use of Podcast.ru / PC.ST, including sign-up, the Dashboard, the connection of a podcast and the management of its page. It also establishes how data are protected and how data subjects exercise their rights.
1. Operator and scope
1.1. Operator of personal data: individual entrepreneur Akavov Telman Rakhmanovich. INN 782614915148. OGRNIP 319784700368803. Location: Saint Petersburg, Russian Federation. Email for enquiries: mail@podcast.ru; additional address: mail@pc.st.
1.2. Podcast.ru and PC.ST are domains of a single service providing Smart Links, Information Pages of podcasts and episodes, and a Dashboard for managing such pages (the “Service”). The Policy applies to podcast.ru, pc.st and those of their subdomains on which a link to it is posted.
1.3. The Service is part of the Podcasts.ru ecosystem. The fact that the projects belong to a single operator does not constitute general consent to the processing of data in all projects of the ecosystem. Using data for another project requires an independent lawful purpose and an appropriate legal basis.
1.4. The Policy applies to visitors, registered Users of the Dashboard, authors, publishers, rights holders and their authorised representatives, persons who contact support, and other individuals whose information is lawfully processed in connection with the operation of the Service.
1.5. The principal legislative act is Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”. The Policy does not limit the mandatory rights granted to the data subject by applicable law.
2. Principles of processing
2.1. The Operator processes data for specified lawful purposes and to the extent necessary to achieve them. Incompatible use of data, excessive collection and storage for longer than necessary are not permitted.
2.2. Merely visiting the site, using a Short Link or reading the Policy does not constitute consent to every possible type of processing. Where consent is the legal basis, it is requested separately and may be withdrawn.
2.3. Personal data means information relating, directly or indirectly, to an identified or identifiable individual. Technical identifiers and information from RSS may also constitute such data; the absence of a full name does not mean that the information is anonymised.
2.4. An Account, access to the management of a podcast and the public page of a podcast are distinct from one another. Creating an Account does not mean that all information about its owner is published, and deleting an Account does not replace a review of whether the public metadata are lawful.
3. Categories of data and sources
3.1. On sign-up and sign-in, the following are processed: the internal identifier of the Account, the email address used for the chosen sign-in method or the identifier with the authorisation provider, and information about the creation and status of the Account, sign-in times and sessions. The profile name and picture are processed if the User provides them or allows them to be passed through the chosen sign-in method. The set of mandatory fields is determined by the sign-up form; the absence of data necessary for sign-in may make access to the Dashboard impossible.
3.2. When the User signs in through an external authorisation service, the Operator receives the information provided for by the requested permissions and by that service’s response, and only to the extent necessary for sign-in and the operation of the Account. The email address, name and picture are not deemed to be received automatically with every sign-in method. The provider and the requested permissions are disclosed before the corresponding method is confirmed. The Operator does not request the password for the external account.
3.3. For Podcast Connection and verification of authority, the following may be processed: the identifier of the podcast, the address of the RSS or of another source page, the role declared by the User, a contact for verification, the result and date of the verification, technical confirmation of control and the necessary correspondence. Supporting materials are requested in proportion to the risk; a passport and a full set of documents establishing rights are not mandatory for every Podcast Connection.
3.4. In managing a page, the following are processed: the connection between the Account and the podcast, the level of access granted, the current settings of the page, the texts and images submitted by the User, update requests, and information about the time and result of changes. The action history, if it is kept for security and dispute resolution, is processed separately from the public content of the page.
3.5. When a search is made or a link is generated, the following are processed: the query entered, the podcast or episode selected, the page or RSS address provided, and the parameters necessary to fulfil the request. The composition of the public metadata is described in section 5. A podcast’s title or an RSS address is not always personal data.
3.6. When support is contacted, the following are processed: the sender’s address, the name they give, the content of the correspondence, the related pages and the necessary attachments. The applicant’s identity and authority are verified to the extent necessary to fulfil the specific demand or to the extent provided for by law.
3.7. During technical interaction, the following may be processed: the IP address, the date and time of the request, the address requested, the referral source, information about the browser, device, operating system and language, technical identifiers, and information about errors and security events. Sign-in codes, tokens and other secrets must not be included in analytics events or open logs.
3.8. For optional analytics, on the basis of separate consent, the following are processed: browser identifiers and information about visits, referral sources, clicks, visit duration and device characteristics. How Yandex Metrica and Session Replay are used is described in the Cookie Policy. Sign-in data and the materials used to verify authority are not intended for such analytics.
3.9. To record legally significant actions, the following may be retained: the version of the agreement accepted, the date and method of its acceptance, the cookie categories chosen, the date and version of a consent or of its withdrawal, and a technical record of the fulfilment of a demand. Recording a consent does not permit tracking beyond the purpose consented to.
3.10. The Service is not intended for the provision of special categories of personal data or for biometric identification. Do not send information about health or intimate life, or other excessive data. The presence of a photograph or a voice in a podcast does not in itself mean that the Operator uses this information to identify a person biometrically.
4. Purposes and legal grounds
4.1. Sign-up, sign-in, maintaining a session, providing the Dashboard, connecting the Account to the podcast and executing page management commands are carried out in order to conclude and perform the User Agreement at the User’s initiative. For the necessary processing, clause 5 of part 1 of Article 6 of Federal Law No. 152-FZ applies. This legal basis does not automatically extend to optional analytics, advertising or the publication of personal contact details.
4.2. Search, the generation and use of Smart Links, viewing Information Pages and the operation of the requested playback and Embedding elements are carried out to fulfil the User’s request within the scope of the agreement being concluded. Only the necessary part of the information referred to in section 3 is processed.
4.3. Verification of authority, prevention of unlawful Podcast Connection and page substitution, restoration of access and consideration of competing claims are carried out to perform the agreement and to protect the rights of Users and the legitimate interests of the Operator, with due regard for the rights of data subjects. Clauses 5 and 7 of part 1 of Article 6 of Law No. 152-FZ apply, and, where an obligation established by law is performed, clause 2 also applies.
4.4. Responses to requests, correction of data and consideration of demands from rights holders are carried out on the basis of the performance of the agreement, obligations under the law or the protection of rights and legitimate interests, depending on the content of the demand. Binding requests from state authorities are complied with on the basis provided for by law.
4.5. Protecting Accounts, preventing spam, fraud and attacks, detecting errors and ensuring the resilience of the Service are carried out to the extent necessary for security and for the protection of legitimate interests, with due regard for the rights of data subjects, and also to perform obligations under the law.
4.6. Analysis of traffic and of the usability of the interface by means of optional analytics technologies is carried out on the basis of separate consent under clause 1 of part 1 of Article 6 and Article 9 of Law No. 152-FZ. Declining analytics does not prevent sign-up, Podcast Connection or the use of the main features of the Dashboard.
4.7. The publication of information about an individual on a podcast page is permitted where there is an independent legal basis, taking into account Article 10.1 of Law No. 152-FZ. Where consent to dissemination is required, it is obtained separately and specifies the data permitted. Acceptance of the agreement or sign-up does not replace such consent.
4.8. Service messages about sign-in, verification of authority, security, a change of access or the consideration of a request are sent for the operation of the Dashboard and the performance of the agreement. Advertising mailings and offers from other projects are not enabled automatically; where necessary, separate consent is obtained for them in advance.
4.9. Minimal records of consents, acceptance of the agreement and fulfilment of demands are retained to confirm the lawfulness of actions and to perform the Operator’s obligations. They are not used as a basis for continuing processing after its original purpose has ceased.
5. Public pages and private Dashboard data
5.1. An Information Page may be generated from RSS, podcast catalogues and information provided by authorised persons. It may display the title, description, author or publisher, artwork, information about episodes, publication dates and links. Editing through the Dashboard is a separate source of updates.
5.2. Sign-in data, the Account’s private contact details, session information, confirmations of authority and the non-public action history do not become publicly available as a result of sign-up or Podcast Connection. Only content intended for the public page is published, and only where the necessary legal basis exists.
5.3. The User must distinguish between a contact for sign-in or verification of authority and a contact for public posting. The technical address of the RSS owner is not transferred to a public directory merely because it is available in the feed. The dissemination of personal contact details, a name, an image or other personal data is subject to an independent check of the legal basis.
5.4. The availability of an RSS feed or of information on the internet does not in itself mean that every method of processing and disseminating personal data is permitted. Where data are obtained from someone other than the data subject, the obligation to inform the data subject and the exceptions provided for by law are taken into account.
5.5. A representative of a podcast may not authorise the processing of other persons’ data beyond the scope of their authority. Where information relates to a host, a guest or another individual, the Operator takes into account the legal basis for processing that specific information. Permission to use a work and consent to the dissemination of personal data are not substitutes for each other.
5.6. For the correction, restricted display or deletion of information, send a request to mail@podcast.ru or use the available Dashboard feature. The Operator takes measures in respect of its own page and the copies under its control. It cannot itself delete the source feed or the materials of independent platforms.
5.7. After an Account is deleted, a public page previously generated from independent sources may be retained only to the extent that an independent legal basis remains for it. The Account’s private information, withdrawn permissions and data subject to deletion may not be retained as a public catalogue on the pretext that the page exists.
6. Recipients of data and external services
6.1. To operate the Service, the Operator may engage providers of hosting, storage, content delivery, email, technical support and information security. Access is granted only to the extent necessary. Where processing is entrusted to another party, the terms on the purposes, the scope of the data, confidentiality and security are set out in a contract in accordance with part 3 of Article 6 of Law No. 152-FZ.
6.2. The provider of the chosen external sign-in method may receive technical information about the authorisation and pass the permitted profile data on to the Operator. The specific provider is indicated when the sign-in method is chosen; its own processing purposes are determined by its documents. Using external sign-in does not permit arbitrary access to the contacts, correspondence and other data of the external account.
6.3. Where consent to analytics has been given, the corresponding technical information is received by the provider of Yandex Metrica, Yandex LLC. Information about the analytics technologies, the settings and the provider’s documents is given on the /cookies page.
6.4. When external artwork, audio and embedded elements are loaded, the browser may contact the servers of the publisher or of the corresponding platform. Such a server receives the technical information necessary to respond to the request, in particular the IP address and browser information. Such contact may occur as soon as the element is loaded, and not only after a link is followed.
6.5. If a page loads fonts through Google Fonts, the browser also contacts the infrastructure of that service. This loading is not to be equated with analytics cookies. The terms of processing by external providers are determined by their documents; the Operator is separately responsible for the lawfulness of its own integrations.
6.6. When the User goes to an External Platform, further processing of data is governed by its rules. The User Agreement of Podcast.ru / PC.ST does not replace agreements with such platforms.
6.7. Data may be provided to authorised bodies where there is a basis provided for by law. This Policy does not permit the sale of personal data, their transfer for advertising purposes or mailings from other projects of the ecosystem without an independent legal basis.
6.8. Information about the persons to whom the processing of your data has been entrusted or to whom they have been disclosed is provided on request, to the extent and in the manner established by Article 14 of Law No. 152-FZ.
7. Data localisation and cross-border transfer
7.1. The processing of the data of citizens of the Russian Federation is subject to localisation requirements. Part 5 of Article 18 of Law No. 152-FZ restricts the use of foreign databases when such data are collected. The User’s consent does not override this requirement.
7.2. A cross-border transfer organised by the Operator is permissible only if the requirements of Article 12 of Law No. 152-FZ and other applicable rules are met, including prior notification of Roskomnadzor where it is required, and compliance with the established prohibitions and restrictions.
7.3. Naming an external service in the documents does not constitute the User’s consent to any transfer of data. On request, the Operator provides the information relating to the data subject about a cross-border transfer that has been carried out or is planned, its purposes, the categories of data and the recipients, to the extent provided for by law.
7.4. The requirements are also checked in respect of sign-up, authorisation and Podcast Connection data, logs and backups. Hosting the site on a Russian server does not in itself determine where all these data are processed.
8. Methods of processing and protection
8.1. Data are processed by automated means and, when requests are considered, also with the involvement of authorised persons. Possible operations include collection, recording, systematisation, storage, updating, retrieval, use, provision in the cases provided for, blocking, deletion and destruction. Dissemination is permissible only for data and purposes for which there is an independent legal basis.
8.2. The Operator puts in place access restrictions, separation of privileges, protection of connections, monitoring of technical events and measures to prevent unauthorised access. The specific measures are chosen with regard to the nature of the processing and the requirements of Article 19 of Law No. 152-FZ.
8.3. Access to page management is limited by the rights of the corresponding Account. In the event of a dispute or signs of a takeover, the Operator may suspend changes and carry out a check. This does not mean that the applicant’s data are automatically passed to the other party to the dispute. The necessary information is disclosed only where there is a legal basis.
8.4. If a breach is detected, the Operator takes measures to stop it, remedy its consequences and notify the authorised bodies and data subjects in the cases and within the time limits established by law. Incident reports are accepted at mail@podcast.ru with the subject “Security”.
9. Retention periods and deletion
9.1. Account data and the data of an active Podcast Connection are retained for as long as they are necessary for the use of the Dashboard and the performance of the agreement. After a confirmed request to delete the Account, or once the corresponding purpose has ceased, they are deleted within the applicable time limits, unless there is an independent legal basis for retaining certain information.
9.2. Contact-related and other excessive attachments to a verification of authority are retained until the verification is completed and for no more than 90 calendar days thereafter, unless they are necessary for a specific dispute. A minimal record of what access was granted, to whom and on what basis is retained for as long as the access is in effect. Once the access ends, that record may be retained only where there is a justified need to protect rights, and only in a limited form.
9.3. The current settings of a page and the published materials are retained for the period of their lawful use. The non-public history of actions and changes is retained for no more than 90 calendar days, unless longer retention of a specific record is required to investigate an incident or resolve a dispute. This rule does not mean that the content of a deleted Account is retained without a separate legal basis.
9.4. For ordinary technical logs, the retention period is no more than 30 calendar days. Information about a specific incident may be retained separately until the investigation is completed and the related demands are resolved, where there is a legal basis.
9.5. Ordinary correspondence with support is retained until the request is closed and for no more than 90 calendar days thereafter. Where it is necessary to perform an obligation under the law or to resolve a dispute, only the part relating to it is retained, for the necessary period.
9.6. The User’s cookie choice is stored for up to six months. The lifetimes of sessions and of individual browser records are disclosed in the Cookie Policy and in the settings of the Service. The lifetime of a cookie is not the same as the period for which data are stored on the server.
9.7. Minimal evidence of consents, their withdrawal, acceptance of the agreement and fulfilment of demands may be retained for up to three years after the corresponding relationship ends, if this is genuinely necessary to protect rights. This does not permit further analytics, publication of withdrawn data or use for new purposes.
9.8. Metadata from RSS are retained for as long as they are necessary for an active Information Page and a legal basis exists. Analytics data are processed until the stated purpose is achieved or the legal basis ceases. Statistics that have genuinely ceased to relate to an identifiable person may be used separately; replacing a name with a technical identifier does not amount to such anonymisation.
9.9. When the purpose has been achieved or consent has been withdrawn, and there is no other legal basis, the data are destroyed within the time limits of Article 21 of Law No. 152-FZ, as a rule within 30 calendar days. Special time limits, including shorter ones, apply to demands to stop processing or dissemination, to demands for correction and to certain breaches. Those time limits take precedence over the general periods of this section.
9.10. Deletion is also arranged with the processors engaged and in the copies under the Operator’s control. Backups do not constitute grounds for indefinite retention. If destruction within the established time limit is objectively impossible, blocking and the procedure of part 6 of Article 21 of Law No. 152-FZ apply.
10. Rights and the procedure for requests
10.1. The data subject is entitled to obtain information about the processing and to access their data, to demand that the data be updated, blocked or destroyed where there are grounds for this, to withdraw consent, to demand that processing be stopped, and to appeal against the Operator’s actions to Roskomnadzor or to a court.
10.2. Requests are sent to mail@podcast.ru or mail@pc.st with the subject “Personal data”. State the substance of your demand, the related pages or correspondence, and how you would like the reply to be sent. Do not send a copy of your passport unless it is necessary. A formal access request is subject to the requirements of part 3 of Article 14 of Law No. 152-FZ; the Operator will explain what information is needed to confirm identity and authority.
10.3. Deletion of the Account, Podcast disconnection and deletion of the public page are different actions. A request may specify one or more of them. The absence of a dedicated button does not deprive you of the right to send a demand by email. Verification of identity and authority must be proportionate and must not create unjustified obstacles.
10.4. Information in response to an access request is provided within 10 working days. An extension of no more than 5 working days is possible, with a reasoned notice. The time limits of Articles 20 and 21 of Law No. 152-FZ apply to correction, deletion, cessation of processing and other demands, and those of Article 10.1 also apply to the cessation of dissemination.
10.5. The choice regarding analytics can be changed via “Cookie settings”. Withdrawal of consent applies to further processing and does not render unlawful any actions lawfully taken before the withdrawal. Where another legal basis remains, the Operator explains it and limits the processing to the corresponding purpose.
11. Development of the Dashboard and future statistics
11.1. The ability to receive statistics for one’s own page and to add arbitrary custom links relates to the development of the Service. The mention of these features in the documents does not mean that they are already available, and does not in itself permit the collection of additional personal data in advance.
11.2. Before launching any new processing, the Operator determines its purposes, the scope of the data, the recipients and the retention periods, updates the relevant documents and obtains the necessary consents. Podcaster statistics are expected to use aggregate metrics; the provision of individual identifiers, IP addresses and the history of specific visitors is not permitted by the general terms of the Dashboard.
11.3. An author’s permission to receive statistics is not their listeners’ consent to tracking. Adding external links does not give the author the right to install arbitrary pixels, scripts or other data collection tools on the page. Such integrations require a separate assessment and their own terms.
12. Changes to the Policy and related documents
12.1. The Operator publishes a new revision when the processing of data or the legal requirements change. A change in the text does not in itself extend consent given earlier. If new consent is required, it is requested separately before the corresponding processing begins.
12.2. The Policy is available at podcast.ru/privacy and pc.st/privacy. Related documents: the Cookie Policy, podcast.ru/cookies and pc.st/cookies; the User Agreement, podcast.ru/useragreement and pc.st/useragreement.
12.3. The date of the revision is shown on the page. The provisions on processing apply together with the mandatory requirements of the law, not instead of them.