DATA PROCESSING AGREEMENT
This document (the "Data Processing Agreement") forms an integral part of the agreement for the provision of paid services "Yandex 360 for Business" or any other agreement for the provision of the services "Yandex 360 for Business"(the "Agreement").
1. TERMS AND DEFINITIONS
The following terms are used in this Data Processing Agreement:
- Service - the service "Yandex 360 for Business", including all services listed at https://yandex.ru/support/business, or any individual service specified therein.
- Customer - a person who has entered into the Agreement with Yandex.
- User - a person using the Service in accordance with the terms of the Agreement.
- Yandex - a legal entity that has entered into the Agreement with the Customer.
If the Data Processing Agreement contains no unambiguous interpretation of any term, the interpretation of the term shall be governed by: first, applicable laws; second, definitions provided at https://yandex.ru/support/business; then, established (commonly accepted) Internet definitions.
If the applicable law does not define the concept "personal data controller" or other concepts used in this Data Processing Agreement, concepts with equivalent or similar meanings shall be applied to the interpretation of terms of the Agreement.
2. SUBJECT MATTER AND SCOPE OF THE DATA PROCESSING AGREEMENT
2.1. The Customer, acting as the personal data controller, instructs Yandex to process any personal data information and content posted by the User, the Customer, and/or the Customer's client (where the Customer extends the Service to third parties) on Yandex resources, when using the Service.
2.2. Yandex undertakes to process any personal data as instructed by the Customer in accordance with the applicable laws for the rendering of Yandex services under the Agreement, including any related technical support, as reflected in this Data Processing Agreement, and in accordance with any additional written instructions provided by the Customer and acknowledged by Yandex as instructions under this Agreement.
2.3. This Data Processing Agreement does not apply to personal data processed in connection with any other Yandex products or services unrelated to the Service.
2.4. This Data Processing Agreement becomes effective on the effective date of the Agreement and supersedes any prior arrangements between the Parties with regard to the data processing and/or data security in connection with the Service.
3. PERSONAL DATA PROCESSING
3.1. Parameters of the Customer's instruction for Yandex to process personal data:
|
Purposes of personal data processing as instructed by the Customer and further processing by Yandex |
Provision of the Service under the Agreement and other Yandex business operations related to the Service |
|
Categories of subjects whose personal data is processed |
|
|
Composition of personal data processed |
|
|
List of actions being performed on personal data |
Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), depersonalization, blocking, deletion, and destruction of personal data |
|
Personal data processing duration |
Until the purpose of processing is achieved |
3.2. Yandex shall destroy (delete) personal data processed as instructed in accordance with the Agreement and the applicable laws.
4. OBLIGATIONS OF THE PARTIES
4.1. The Customer undertakes to:
4.1.1. Ensure that there are valid legal grounds for the personal data processing, as sufficient under applicable laws for Yandex to process it within the scope and timeframe in accordance with this Data processing Agreement. It includes, in particular, the acquisition of necessary consents, such as for cross-border transfers of personal data, and duly notification of Users and other individuals whose data is processed in connection with the Service about the terms of personal data processing when using the Service.
4.1.2. Ensure the accuracy, relevance, and sufficiency of the personal data being processed in relation to the purposes for which it is processed.
4.1.3. Respond to User requests regarding the processing and protection of personal data.
4.1.4. Independently respond to requests from regulatory authorities regarding the processing and protection of personal data under this Data Processing Agreement.
4.1.5. Comply with requirements regarding the local storage of personal data within the territory of the relevant country, as well as other related requirements, including interactions with government authorities (if required by law).
4.1.6. Establish requirements for the protection of processed personal data in accordance with applicable laws. This obligation applies solely to the Customer and shall not be construed as an establishment by the Customer of specified requirements for Yandex with respect to the personal data protection.
4.2. When processing personal data as instructed by the Customer, Yandex undertakes to:
4.2.1. Process personal data lawfully and strictly in accordance with the Customer's instructions.
4.2.2. Comply with applicable law governing the principles and rules of personal data processing.
4.2.3. Maintain the confidentiality and security of personal data.
4.2.4. Implement, to the extent required by applicable laws, appropriate measures to protect personal data.
4.2.5. Notify the Customer without undue delay of any unlawful or accidental transfer (provision, distribution, access) of personal data that results in a violation of the rights of personal data subjects and occurs due to Yandex's fault. Yandex shall provide the Customer with any relevant necessary and sufficient information and support needed to enable the Customer to fulfill their legal obligations and mitigate potential adverse consequences of such event. Such notification, provision of information, and support by Yandex shall not, under any circumstances, be construed by the Parties as an acknowledgment or confirmation of Yandex's liability for any unauthorized access, transfer, or distribution of personal data processed by Yandex as instructed by the Customer.
4.2.6. In the event that a personal data subject submits a request for information regarding data processing, or requests the clarification, blocking, or destruction of their personal data due to incompleteness, obsolescence, inaccuracy, unlawful acquisition, or lack of necessity for the stated processing purpose, forward such requests to the Customer (unless otherwise required by applicable laws).
4.2.7. Grant access to processed personal data to its employees, contractors, or other third parties only when strictly necessary to fulfill the instructions under this Data Processing Agreement and only after appropriate measures have been taken to ensure compliance with security and confidentiality requirements.
5. LIABILITY
5.1. Yandex shall be liable to the Customer, within the limits established by the Agreement and this Data Processing Agreement, for culpable violations related to the processing of personal data of subjects as instructed by the Customer, including actions or omissions by its employees who have access to personal data processed as instructed by the Customer that result in unauthorized disclosure of such personal data.
5.2. Yandex is not responsible for ensuring the lawfulness of personal data processing, including obtaining consents from personal data subjects, informing them of processing terms, or determining the composition of personal data.
5.3. The Customer is responsible to personal data subjects and authorized bodies for actions taken by Yandex in executing the instructions.
5.4. The Customer is responsible for responding to requests from personal data subjects and authorized bodies regarding personal data processing and protection.
5.5. In the event that Yandex faces instruction-related claims, demands, or legal actions from third parties, including personal data subjects or authorized bodies, arising from the Customer's failure to comply with obligations under this Data Processing Agreement, including failure to follow the statutory procedure for personal data processing (including failure to obtain required consents or other legal bases for such processing), the Customer undertakes to:
- resolve such claims and legal actions at its own expense, notify Yandex of the progress of such resolution, and provide prior notice to Yandex regarding any proposed steps for such resolution;
- if Yandex is required to participate in the resolution of such claims, demands, or legal actions, or is held liable for violating the statutory procedure for personal data processing, at Yandex's request, compensate Yandex for any losses and, upon Yandex's request, participate in the resolution of such claims, demands, or legal actions.
5.6. The Parties agree that the amount of damages payable to Yandex for any violation of this instruction shall be deemed equal to:
- the amount of fines, penalties, compensations, and other payments to any third parties that Yandex may be required to make in connection with the relevant circumstances (including damages recoverable from Yandex or from third parties engaged by Yandex to perform its obligations under the Agreement) pursuant to a court judgment, arbitral award, or decision of an international commercial arbitration (including a settlement agreement approved by the said bodies), or a decision of an authorized body;
- the amount of legal and consulting expenses incurred by Yandex in protecting its rights and interests in connection with the above circumstances.
6. ENGAGING THIRD PARTIES TO PROCESS PERSONAL DATA
6.1. Yandex may engage third parties to process personal data, including in the Russian Federation, under agreements concluded with such parties, without prior notice to or approval from the Customer. Yandex shall remain responsible to the Customer for the performance of its obligations under the instructions.
6.2. Any person processing personal data on behalf of Yandex shall comply with the principles and rules for processing personal data, as established by applicable laws and this Data Processing Agreement, including obligations to maintain the confidentiality and ensure the security of personal data.
7. MISCELLANEOUS
7.1. The current version of this Data Processing Agreement is available online at: https://yandex.com/legal/dpa_360.
7.2. Yandex may unilaterally amend this Data Processing Agreement. If the Customer does not agree with the updated version of the Data Processing Agreement, the Customer shall cease using the Service.
Date of publication: 16.10.2025