Deletion of a Koinonia account

Operator of the passport account: ООО «Койнония», OGRN 1265000035035, INN 5029299826, KPP 502901001, address: Московская область, г. Мытищи, ул. Юбилейная 4-336. Email address for inquiries regarding the processing of personal data, including account deletion requests: support@koinonia.ru. Full registration details are provided in the "Operator contacts" section below.

This page is available without logging into the application and explains in plain language how to delete a Koinonia account, what data is deleted in the process, what data is retained and why, as well as the time frames within which deletion takes place. The page is published in fulfilment of the requirements of application stores (including the Google Play requirement for an accessible means of deleting account data) and the provisions of Federal Law No. 152-FZ of 27.07.2006 "On Personal Data".

1. Who processes your data (roles)

On the Koinonia platform, different data is processed by different parties, and this affects who deletes what.

• Operator of the passport account — Koinonia LLC. Upon registration, a "passport account" is created — the minimal set of data that makes you recognizable in the application: phone number, first name, last name, username, and, if you wish, a profile photograph (avatar) and email address, as well as technical data (device identifiers, information about sessions and access tokens). With respect to this set of data, Koinonia LLC acts as an independent operator. Hereinafter this set is referred to as "passport data".
• Operator of data within an organization — the organization itself. When you join an organization's workspace, the organization, as operator, determines which of your data it processes in connection with your membership or participation (for example, information about participation in the community, in small groups and areas of activity, as well as correspondence in the group chats of that workspace). With respect to this data, the operator is the organization, while Koinonia LLC acts as the party carrying out processing on the organization's instructions (the processor) — in accordance with Part 3 of Article 6 of Federal Law No. 152-FZ. The terms of such processing are set out in the document "Data Processing Agreement (DPA)".

Deletion of the passport account (see below) results in the deletion of your passport data held by Koinonia LLC and in the termination of your participation in all workspaces. Questions relating to data that the organization, as an independent operator, processes in its own record-keeping systems (outside the platform) may be addressed by you directly to the organization using its contact details.

2. How to delete an account

You can delete your account in one of two ways.

Method 1. In the application (recommended)

1. Open the Koinonia application and log into your account.
2. Go to the "Profile" section.
3. Select the "Delete account" option.
4. Confirm the deletion.

After confirmation, the application sends a request to the platform server to delete the account (technically, a DELETE /users/me request transmitted over a secure TLS connection) and initiates the deletion procedure described below.

Method 2. By letter to the operator

If you do not have access to the application, send an account deletion request by email to support@koinonia.ru.

In your letter, indicate the phone number under which the account is registered and the username, if you know it — this will help identify the account.

In order not to delete an account at the request of an unauthorized person and not to disclose your data to third parties, we verify that the request comes from the account owner (as part of exercising the rights of the data subject in accordance with Articles 14 and 20 of Federal Law No. 152-FZ). To confirm ownership of the account, we are entitled to request:

• that the letter be sent from the email address specified in your account; or
• confirmation via a one-time code (SMS) sent to the phone number under which the account is registered.

A deletion request submitted by email triggers the same procedure as deletion in the application: placing the account in a pending state (soft-delete), a 30-day recovery period, and the subsequent irreversible deletion of passport data (see the "Deletion time frames" section). Immediate deletion by letter is not performed — this is done, among other reasons, for your protection, so that you retain the ability to cancel an erroneous or unauthorized request.

3. What is deleted

When an account is deleted, the following data is deleted, in particular:

• the user profile: first name, last name, username, and profile photograph (avatar);
• the passport data of the account — the entire passport account set defined in Section 1: phone number, email address (if one was provided), as well as technical and account data — information about sessions, access tokens, and device identifiers;
• your personal contacts saved in the application and the related contact-matching data;
• the marker of your registration in other users' address books: after deletion, the link of your account to their contacts is removed, and in other people's phone books you cease to be displayed as a user registered in Koinonia (the entry that the address book owner themselves made about you in their phone book remains with them — this is already their own data);
• your participation (membership) in all organization workspaces within the platform.

After the deletion procedure is completed, you will no longer be displayed as an active participant in the application, and the data listed above will be deleted from the systems of Koinonia LLC.

4. What is retained and why

Under the requirements of Russian law, some data cannot be deleted immediately or in full. So that you understand exactly what is retained, an honest description is provided below.

4.1. Messages in group chats are not physically deleted but de-identified

Messages that you sent to the group chats of organization workspaces are not physically deleted from the system. Instead, they are de-identified: your name as the sender is replaced with the neutral designation "Former participant", and your profile photograph (avatar) is deleted. The content of the messages is retained in the process.

It is important to understand the distribution of roles. Group chats of a workspace are data processed under the operatorship of the respective organization: it is the organization, as operator, that determines the purposes of processing the correspondence of its participants and the grounds for its storage. With respect to these messages, Koinonia LLC acts as a processor on the organization's instructions (Part 3 of Article 6 of Federal Law No. 152-FZ) and de-identifies and stores the content on the instructions of the organization-operator and by virtue of the requirements of law.

The grounds for retaining the content of such messages:

• The requirements of Federal Law No. 374-FZ of 06.07.2016 (the so-called "Yarovaya Law") — concerning the mandatory storage of users' messages for the established period (no less than six months). During this period, physical deletion of messages is not permitted.
• Protection of the rights and legitimate interests of other participants in the correspondence. A message in a group chat is shared correspondence of several persons, and its deletion would violate the integrity of the correspondence for the remaining participants. This ground is provided for by Clause 7 of Part 1 of Article 6 of Federal Law No. 152-FZ: the processing of personal data is permitted where it is necessary for exercising the rights and legitimate interests of the operator or third parties, or for achieving socially significant aims, provided that the rights and freedoms of the data subject are not thereby violated. Since, upon de-identification, your identifying data (name, avatar) is deleted from the messages, the rights and freedoms of the data subject are not violated, while the other participants retain the integrity of their own correspondence. This ground is a ground of the organization as operator of the relevant data; Koinonia LLC implements it on the organization's instructions.

After de-identification, such messages are no longer linked to your profile and do not allow you to be identified as the sender in the application interface.

4.2. Technical logs are de-identified

Technical logs of the platform's operation, which may contain identifiers linked to your account, are de-identified: identifiers that allow a record to be linked to you are deleted or replaced with de-identified values. This makes it possible to retain logs for the purposes of ensuring the security and operability of the platform without retaining your personal data.

5. Deletion time frames

• Recovery period (grace period) — 30 days. After a deletion request, the account is placed in a state from which it can be recovered. Within 30 days you can cancel the deletion and recover the account — for example, by logging back into the application and confirming recovery, or by contacting support@koinonia.ru. During this period, the passport data is still retained to allow for recovery.
• Notice before irreversible deletion. Approximately 7 days before the end of the recovery period, we send you a notice (SMS) of the upcoming irreversible deletion, so that you have the opportunity to recover the account if the deletion was erroneous or unauthorized.
• Irreversible deletion after 30 days. If recovery has not been requested within 30 days, the passport data is irreversibly deleted, while the messages in group chats have by that point already been de-identified, as described in Section 4. Recovery of the account after this is not possible.

5.1. Retention period for de-identified messages

So that our description is honest and not misleading, we explicitly disclose the actual mode of storing correspondence.

Messages in group chats that are subject to storage by virtue of the requirements of law (see Section 4) are not physically deleted and are stored in de-identified form:

• the minimum retention period is no less than 6 months by virtue of the requirements of Federal Law No. 374-FZ of 06.07.2016 (the "Yarovaya Law");
• in practice, the de-identified content of messages may be stored indefinitely — physical deletion of messages in the system is not performed (including no deletion of storage sections containing former messages).

Deletion of your account does not result in automatic deletion of these messages after 6 months or any other period: it merely de-identifies them (removes your link to them as the sender). The content of the messages itself in de-identified form is retained independently of the deletion of the account.

6. Your rights

In accordance with Article 14 of Federal Law No. 152-FZ, you are entitled to demand the rectification of your personal data, the blocking or destruction thereof, as well as to withdraw the previously given consent to the processing of personal data (Part 2 of Article 9 of the said law). Deletion of an account is one of the means of exercising the right to terminate processing and destroy personal data in the part processed by Koinonia LLC.

If your data is processed by the organization as an independent operator in its own systems, questions concerning the exercise of your rights with respect to this data may be addressed by you directly to the relevant organization (its registration details are in the "Operator contacts" section).

7. Operator contacts

Operator of the passport account:

Operator of data within an organization. The operator of data processed within the workspace of a specific organization is that organization itself. Its registration details (name, OGRN, INN, address, contact for personal-data inquiries) are specified in its Personal Data Processing Policy and in the organization's card in the Koinonia application; using these details, you are entitled to contact it directly.

The servers and databases of Koinonia LLC are located within the territory of the Russian Federation. Cross-border transfer of personal data is not carried out.

Related platform documents.

• "Personal Data Processing Policy" (Privacy Policy) — describes what data and for what purposes Koinonia LLC processes as operator of the passport account and as a processor on the instructions of organizations: koinonia.ru/legal/privacy.
• "Data Processing Agreement" (DPA) — sets out the terms of processing of the data of organization-operators by Koinonia LLC as a processor and is an integral part of the "End-User License Agreement": koinonia.ru/legal/dpa.
• "End-User License Agreement" (EULA) — governs the terms of use of the application and the platform: koinonia.ru/legal/eula.