Consent to Personal Data Processing

Effective date: 05.08.2026

This Consent is executed as a separate document under Article 9(1) of Russian Federal Law No. 152-FZ of 27.07.2006 "On Personal Data". Accepting the Terms of Use does not grant this Consent, and vice versa.

Translation

The Russian version is the legally binding one. This translation is provided for convenience.

1. Data operator

Operator	Individual entrepreneur Aigiz Iskuzhin
INN	024803896842
OGRNIP	326028000044859
OKVED	62.01 "Computer software development"
Roskomnadzor operator registry	No. 2-26-056967
Service	Pir2Pir (also written «Пир2Пир» in Cyrillic — the same name) — Telegram bot @pir2pirbot and related services
Contact	legal@pir2pir.ru

Pir2Pir is an independent data operator. The Operator is not affiliated with ANO «Школа 21» (School 21) and does not act on its behalf.

2. Data subject

The subject is a natural person who has connected their School 21 account to Pir2Pir and confirmed ownership of it with a code sent to their student email at {login}@student.21-school.ru.

Confirming that mailbox is how the subject is identified for the purposes of this Consent.

3. Personal data processed

The Operator processes the data listed below and requests no other categories.

3.1. Identification data

• School 21 account login;
• student email address at {login}@student.21-school.ru;
• first and last name as present in the Telegram profile;
• Telegram numeric user id (telegram_user_id);
• Telegram username (@username), if set.

3.2. Study profile, retrieved from the School 21 public API

• campus, wave and education form;
• level, experience, internal points, code review points and peer review points;
• the list of projects the subject takes part in, and their statuses;
• the history of those figures: a daily snapshot of level, experience and points, and records of projects moving from one status to another.

The history is kept because the public School 21 API reports only the current value and overwrites the previous one: without a snapshot, any record of how someone progressed would be lost for good. It is available to the subject and is not disclosed to other participants.

3.3. Image

• Telegram profile photo, unless the subject declines its use as an avatar.

3.4. Chat content

• the text of messages participants exchange in a chat after both agree to a review;
• files attached to those messages (images, documents, archives);
• a short excerpt of a message (up to 200 characters) included in a notification delivered to the web application; no such excerpt leaves the Operator's infrastructure.

Chat content is kept for a limited time: once a conversation ends, message text and attachments are deleted and only the fact that a review took place is retained. The retention period is stated in the Privacy Policy.

3.5. Technical data

• internal Pir2Pir account identifiers;
• service request logs required for diagnostics and security.

3.6. Review of the service

• the text of a review the subject writes on their own initiative;
• the subject's School 21 login, shown beside it.

A review is published on a public page of the service and becomes available to an unlimited audience, including people who are not participants. The conditions are set out in section 6.3.

3.7. Inviting another participant (referral link)

• the personal invitation code the service generates for each participant;
• the record of which participant registered using another participant's code, and the date of that registration;
• the participant's position in the ranking by number of people invited.

3.8. Forwarded School 21 notifications (where the participant sets it up)

Processed only if the participant has set forwarding up themselves in their own mail service. Without that, no data in this category is processed.

The participant configures their mailbox (Yandex, Mail.ru, Gmail or another) to forward School 21 mail to an address of the form login@pir2pir.ru. From each message received, the following are extracted and stored:

• the type of notification (a registration for a review, a review starting soon, a review cancelled);
• the code of the project the notification concerns;
• the review date and time stated in the notification;
• the login of another School 21 participant, where the notification names one;
• technical details of the message itself: its message identifier, the sender address, the address it arrived at, and whether the sender signed it electronically.

The text of the messages is not stored. A message is deleted from the mailbox as soon as those details are read; anything that is not a School 21 notification is deleted unread.

The Operator does not process special categories of personal data (Article 10) or biometric personal data (Article 11).

4. Purposes of processing

Consent is granted solely for the following purposes:

1. confirming ownership of a School 21 account and creating a Pir2Pir account;
2. finding and matching participants for mutual project reviews;
3. sending a request to talk to a specific participant identified by their exact School 21 login;
4. enabling correspondence between participants who have agreed to a review or to talk;
5. delivering service notifications to connected channels (web application, Telegram bot);
6. receiving School 21 notifications forwarded by the participant under their own settings, and delivering them to the participant's connected channels — within the scope of section 3.8;
7. sending a single invitation to a School 21 student who is not registered with the service, at a participant's request — within the scope and on the terms of section 6.2;
8. publishing a review of the service written by the subject on their own initiative — within the scope and on the terms of section 6.3;
9. accounting for invitations: recording which participants joined through another participant's code, and displaying the ranking by number of people invited — within the scope and on the terms of section 6.4;
10. handling support requests;
11. complying with the legislation of the Russian Federation.

Processing for any other purpose — in particular advertising, promotion, or transfer to recruiting or other commercial services — is not covered by this Consent and requires separate consent.

5. Processing actions

Collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer (provision, access) within the scope of section 6, anonymisation, blocking, deletion, destruction.

Processing is both automated and non-automated. The Operator makes no decisions producing legal effects for the subject solely on the basis of automated processing.

6. Disclosure to other participants

The service keeps no directory of participants and offers no search for people. Reaching a specific participant requires knowing their exact School 21 login in advance; the service offers no suggestions and no matching on part of a login.

Identity is disclosed only at the moment of agreement. While a search for a reviewer is running, a candidate is told the project and the campus, not who is asking. Once both have agreed, participants see login, name, level and experience, wave, and the profile photo where set.

The Operator does not disclose one participant's messenger accounts, email address or other contact details to another participant. If participants choose to continue elsewhere, they exchange such details themselves, inside the chat, and it is not the Operator who disclosed them.

6.1. Chat content

Messages in a chat are available only to its two participants. The Operator does not make them available to other users of the service.

Chat content does not leave the Operator's infrastructure. A new-message notification is delivered only to the web application. A messenger is told only that a reviewer was found or that a request to talk was received; no excerpt, no full text and no attachments are sent to a messenger.

6.2. Contacting a student who is not registered with the service

Where a login given by a participant belongs to a School 21 student who is not registered with the service, the participant may send them one short invitation. The Operator delivers it in its own name, to the email address derived from the login under School 21's convention and/or to School 21's internal chat.

The invitation contains: the sender's login, the text they wrote, a brief description of the service and an opt-out link. No other information about the sender or the recipient is transmitted, and the sender is not given the recipient's address — they are shown only a masked hint of the form g*****@….

Processing is limited as follows:

• no more than one invitation to one recipient from one sender in any 30 days;
• no more than three invitations to one recipient from all senders in any 30 days;
• no more than ten invitations per day from one sender.

Opting out. Every invitation carries a link that takes effect immediately, permanently and across all channels; it requires no account and no reason. After an opt-out the Operator sends nothing further to that login. The opt-out is retained even if the recipient later registers with the service.

The recipient of an invitation is not a participant and has not given this Consent. The basis for processing their login and the address derived from it is the sending of a single message at a participant's initiative; the message itself serves as notice to the recipient of what is processed about them, where it came from and how to stop it. No account is created for such a recipient.

6.3. Publishing a review of the service

A participant may write a review of the service. It is not published automatically: the Operator reviews it first, and only then does it become public.

Once published, the review is available to an unlimited audience, including people who are not registered with the service and have not given this Consent. Only the author's School 21 login is shown beside the text; the first name and surname are not published.

This is the only case in which information about a participant is disclosed beyond the circle of participants, and it happens only on that participant's own initiative.

A participant may withdraw the review at any time, and it is removed from the public page. The Operator does not control copies made by third parties before removal, including search engines: the review is removed from the service, but not from anyone else's archive.

Editing a published review returns it for re-checking and removes it from publication until that is done.

6.4. Invitations and the ranking

Each participant is given a personal invitation code. If another person registers using it, the Operator records the link between the two accounts and the date the invited participant registered.

The invited participant can see who invited them, and the inviting participant can see the list of people who joined with their code, with login and registration date.

The ranking by number of people invited is available to registered participants and is not published outside the service. A participant may at any time turn off the display of their login and photograph in the ranking: their position is kept, and the row is shown without a name.

The Operator notes that with a small number of participants, hiding a name does not guarantee anonymity — a participant may be identified by elimination.

7. Validity and withdrawal

This Consent is valid from the moment it is granted until the purposes are achieved or it is withdrawn.

Withdrawal is performed by:

• the account deletion command in the Telegram bot @pir2pirbot; or
• a written request to legal@pir2pir.ru.

After withdrawal the Operator stops processing and destroys the personal data within 30 days, except data whose retention is required by law. Withdrawal makes the service unusable, since processing the listed data is necessary for it to function.

8. Rights of the data subject

The subject may obtain information about the processing of their data, require its correction, blocking or destruction, withdraw this Consent, and appeal the Operator's actions to Roskomnadzor or in court.

The procedure is described in the Privacy Policy.

9. Confirmation

By granting this Consent the subject confirms that they:

• act freely, of their own will and in their own interest;
• have read the purposes, data list and processing actions above;
• have been informed of the withdrawal procedure and its consequences;
• are entitled to provide the data listed.

Consent is granted in a form allowing the fact of its receipt to be confirmed: by pressing the confirmation button in the Telegram bot. The Operator records the date and time.