Personal data
The company and RevRoute agree how personal data will be processed when setting up the program. For each scenario, identify whose information is used, why, how much is needed and who receives access. The lawyer then selects the documents, and the team checks forms and integrations.
📝 Russian-law draft materials
The linked templates and processing map are Russian drafts for completion and legal review. This English guide explains their use; it is not an English legal version of those documents. External legal review of the package has not yet been completed.
💡 A simple starting scenario
The partner sends a link and the customer contacts the company directly. RevRoute receives only the information needed for attribution and calculations. Customer contact details are shared with the service and the partner only where needed and where an applicable ground for processing exists.
How data moves
Separate three data flows
| Flow | What to define |
|---|---|
| Partner data | Contact details, status, authority, payment details and documents. The company uses them for its relationship with the partner; RevRoute also has its own account, security and payment-related purposes |
| Customer data | Application fields and attribution information. The company defines the purposes of its work with the customer; processing by RevRoute on the company’s behalf requires appropriate processing instructions |
| Visitors and analytics | Actual cookies, IP addresses, identifiers and events. For each tool, establish its purpose, ground for processing, recipient, processing location and retention period |
The bank and payment provider have roles determined by their agreements and actual activities. They must not automatically be treated as RevRoute’s processors.
Prepare the documents in four steps
1. Choose the customer’s route
The customer contacts the company directly. The company displays processing information and obtains the necessary confirmations in its form. The partner only needs access to the result and their remuneration, without unnecessary customer contact details.
The partner submits a contact. The company defines the permitted fields, purposes and recipients in advance. The partner retains evidence of the applicable ground, and the company checks the transfer and meets its obligations when receiving data from someone other than the individual. The partner’s consent to processing their own data does not authorise processing the customer’s data.
2. Complete the processing map
For each flow, record the purpose, category of individuals, exact fields, operator and processor, ground and evidence, recipients and countries, systems, retention periods, deletion process and responsible person. Use the Russian Markdown worksheet.
List the actual CRM systems, databases, files, logs, backups and analytics tools. Check that form data and personal data in URLs do not enter analytics beyond what is necessary.
3. Select grounds and separate confirmations
The lawyer selects the ground for each purpose. Processing necessary for a contract or a legal obligation does not require consent merely because personal data is involved. Customer data and company representative data must be assessed separately; a contract with another person does not automatically provide a ground for processing their data.
Where consent is required, use a separate text and a separate confirmation. Record assent to the offer, that consent and any optional advertising consent separately. Reading a policy or continuing to visit a website does not itself replace required consent.
📝 Choose the document for the specific purpose
The Russian consent template is intended for ordinary electronic confirmation of a selected purpose. Mandatory written consent, special categories of data, biometrics and dissemination to an unrestricted audience require separate review. Do not add passport details or an electronic signature to an ordinary form without a need.
4. Agree processing instructions and check implementation
For processing by RevRoute on the company’s behalf, use the Russian draft processing instructions. Complete the data fields, operations, purposes, access, hosting, contractors, safeguards, deletion and incident response arrangements. Distinguish processing on the company’s instructions from RevRoute’s own purposes.
Processing instructions do not replace the company’s ground for processing or any required consent to processing on its behalf. Sharing data with an identified recipient does not itself mean that a second document called “consent to transfer” is always required: the lawyer assesses the ground, disclosure of roles and legal requirements for the particular scenario.
Check the process before launch
- Check that the form displays the necessary documents and separates confirmations; optional items must not be preselected.
- Verify that the accepted text, its version, the individual, the action and the time are retained. Collect additional evidence only to the extent necessary.
- Check that partners see only the information needed about their own results, and that forms do not expose unnecessary data through logs or analytics.
- Verify a working process for requests, withdrawal of consent, deletion and incident response. Account for separate obligations to retain documents.
- Match notices and documents to the actual processing map. For foreign recipients, separately assess cross-border transfers and the applicability of foreign law.
Record the available functions and manual steps with the setup owner. Completed documents must describe the actual systems and processes; these checks are requirements for your setup, not confirmation that they have already been completed.
The detailed grounds and worksheet are in the Russian data processing launch guide. They connect to section 9 of the Russian agreement template and step 8 of the full Russian agreement guide. The short English agreement guide explains how the documents fit together.
Legal sources
Russian Federal Law No. 152-FZ covers processing purposes and grounds, consent, processing instructions, localisation, cross-border transfers and operator obligations. For international scenarios, consult the EDPB Guidelines 3/2018 .