Leads and personal data

The lead form collects a visitor’s name, phone number and email. Under Russian law 152-FZ this is personal data, and collecting it comes with rules. Below is what a site owner needs to do, briefly and without legal jargon. This is not legal advice: when in doubt, check with a lawyer.

Who is responsible for what

Three steps

1. 1

   Notify Roskomnadzor

   Every controller files a personal data processing notification (Article 22) once, regardless of the number of sites and domains. The “personal and family needs” exemption does not cover taking orders. The form is on the Roskomnadzor website, submitted via Gosuslugi. Fine for not filing: individuals 5,000–10,000, sole proprietors and officials 30,000–50,000, legal entities 100,000–300,000 rubles.

2. 2

   Publish a personal data processing policy

   The document must be available on the site (Article 18.1): what data you collect, why, how long you keep it, how to delete it. A template is on the Roskomnadzor website. You can add the policy link in the widget settings — it then appears next to the consent checkbox.

3. 3

   Get consent

   The form has a consent checkbox — whether to show it is your call in the widget settings. When it is on, a lead cannot be sent without it, and along with the lead we store the submission time and IP address — this confirms the consent.

Lead delivery

• Leads always stay in the cabinet — this is the main way to work with them.
• The Telegram notification contains no visitor data: only the fact of a lead and a link to the cabinet. There is no cross-border transfer.
• The email contains the full text of the lead. Emails are sent via Yandex Cloud Postbox, servers in Russia.

Storage and deletion

Leads are stored in the Inero database in Russia until you delete them along with the widget or the site. CSV export is in the “Leads” section.

Links

• Roskomnadzor notification form
• Text of law 152-FZ

Still have questions — write to support@inero.ai