1. General provisions
The policy covers data users provide through website forms, the WhatsApp channel, inquiries to the company and connected services. The technical scope of WhatsApp and the inquiry processing system has been inventoried separately; the full scope covering the website, forms, analytics, CRM and other channels remains subject to legal approval.
2. Controller details
The controller determines the purposes and methods of personal data processing and is responsible for compliance with applicable requirements. The controller of the VSF Export website is also the contracting party with the client and the payment recipient.
| Information | Confirmed details |
|---|---|
| Controller's full name | ROSBRIDGE LIMITED LIABILITY COMPANY (ООО «РОСБРИДЖ») |
| OGRN / INN | 1267700243898 / 9727133842 |
| Registered address | 1 Feodosiyskaya St., Building 11, Severnoye Butovo Municipal District, Moscow, 117216, Russia |
| Contact for personal data and deletion requests | vasif.quliyev00@gmail.com |
3. What data may be processed
Depending on how you contact us, this may include:
- name, phone number, email address and preferred communication channel;
- information from a supply estimate request and attached documents;
- technical information about website visits, including IP address, device and browser type;
- referral source, UTM tags and cookies, if the relevant technologies are enabled;
- business correspondence history and information in the inquiry processing system.
Verified technical data for the WhatsApp channel
The current inbound system receives the sender’s number, message text, type and service fields, the provider’s message ID, the business number ID and the Meta event time. Text, image, document, audio, interactive and location messages are supported; the current code does not download binary media files, but message object service fields may be saved in the protected inbound record. A profile name may be present in the original Meta event, but the current adapter neither transfers it to the private queue nor uses it.
4. Why data is needed
Technically, the WhatsApp workflow authenticates incoming events, prevents duplicate processing, determines the intent of an enquiry, prepares a service reply, respects the service window, records marketing opt-outs and maintains a safe retry queue. Receiving a webhook does not itself constitute consent or automatically create a CRM lead.
The main processing purposes are responding to enquiries, preparing preliminary estimates, entering into and performing contracts, supporting clients, securing the website and analysing its operation.
5. How data is processed
The confirmed WhatsApp technical route passes through the Meta WhatsApp Cloud API, a protected network perimeter, the hosted inquiry processing server, an encrypted inbound queue and a local queue for prepared replies. The number and incoming message content are stored within an encrypted record; pseudonymized references are used in the index and status layer. The message ID prevents duplicates, and the business number is checked against the permitted value.
The prepared reply text is stored in a local queue without separate content encryption, but file access is restricted by permissions. A daily read-only preview is deployed on Hetzner. The mechanism can replace the text of a completed record with a technical clearing marker after 7 days, but actual execution is disabled; `pending/failed` records are unaffected.
The current automated WhatsApp handler does not send message text to a local language model, Google Sheets or Telegram. Outbound sending and automatic handover to a manager are disabled; an ordinary incoming event does not automatically create a CRM lead.
The commands `STOP`, `СТОП` and `UNSUBSCRIBE` record an opt-out and block marketing messages, but do not by themselves delete previously stored data.
6. Who may receive data
The confirmed technical flow involves Meta WhatsApp Cloud API, Cloudflare and Hetzner. The hosted environment uses a network gateway and isolated inquiry processing services. Access may be granted only to organizations and specialists involved in handling inquiries or operating the systems, provided there is a proper basis and data protection obligations.
7. Retention periods and deletion
Data must not be retained longer than required by the approved processing purposes, contractual relationships or mandatory legal requirements. Once the purpose is fulfilled, data must be deleted or anonymised unless there is a lawful basis for further retention.
Current WhatsApp technical status: Safe retention preview v1 is deployed on Hetzner and enabled on a daily schedule. The schedule runs only an aggregated read-only preview; execution requires a separate enable flag and an exact confirmation phrase. For completed incoming records older than 30 days, it replaces encrypted record content with a technical clearing marker while preserving metadata and idempotency; for completed replies older than 7 days, the text is replaced. `pending/failed` records, consent, STOP/suppression and the sender ledger are unchanged; no SQL DELETE is performed. There is no user-facing deletion API yet. Limiting the list of hashed or pseudonymised duplicate identifiers is not a general retention policy and does not establish irreversible anonymisation. The current daily CRM backup does not separately back up WhatsApp storage; external provider snapshots have not been confirmed.
Technical proposal for legal approval
The engineering baseline proposes these guidelines: encrypted incoming messages, 30 days with an absolute maximum of 90; prepared replies, 7 days after completion and up to 30 days if unfinished; hashed or pseudonymized technical metadata and sending logs, 90 days; minimized consent records, while consent remains active and for 3 years after it ends; minimized opt-out records, while the contact could enter a mailing list, but at least 3 years; unconverted leads, 12 months; active clients, 24 months after the relationship ends or the last activity; proposed operational backup window, 30 days; deletion operation logs without direct identifiers, 3 years. Transaction documents require a separate legal archive.
8. User rights
Users may request information about the processing of their data, request its correction, blocking or deletion, and withdraw consent where processing is based on consent. Whether a request can be fulfilled depends on the applicable basis and mandatory retention periods.
9. Data protection
For the inbound WhatsApp workflow, the following safeguards are technically verified: secure HTTPS connection, event signature and authorised business number verification, request rate and size limits, encryption of private inbound records, pseudonymisation of index references, limited application logging and a safe default block on outbound messages. The public description does not disclose secrets, exact paths or security configuration.
11. Policy changes
The current version of this policy must remain available on this page. In the event of material changes, users are notified in a manner appropriate to the nature of the changes and applicable requirements.
12. How to contact us about data
The public channel confirmed by the owner for inquiries about personal data, withdrawal of consent and deletion: vasif.quliyev00@gmail.com.
Do not send passwords, payment details, copies of documents or other unnecessary information. To locate an inquiry initially, provide the channel used, the WhatsApp number in international format or email address, and the approximate inquiry date.
Consent to data processingData deletion instructionsCookie policyDocuments and company