Personal Data Processing Policy

1. 01The Operator and contacts

   Personal-data operator (the term used by 152-FZ, Russia's Federal Law on Personal Data): Kolpakov German Andreevich, INN 230607795024.

   Address for enquiries about data processing: [email protected], phone +7 (918) 456-94-75.

   The Operator personally organises the processing of personal data and personally handles enquiries about it, within the period established by law.

2. 02What data is processed

   The Operator processes the data the subject provides themselves by filling in forms on the website, and technical details of how the form was sent:

   • the name or other form of address the subject has given;
   • an email address;
   • a phone number, if the subject has given it;
   • a Telegram handle, if the subject has given it;
   • company name, field of activity, size, website address and role, on the brief and the audit form;
   • the content of the enquiry: description of the task, budget and time frame, links and attached files, including a CV when applying for a vacancy;
   • source-tracking (UTM) tags, when the brief is submitted;
   • details of how the form was sent: the IP address, the time of the enquiry, the browser, operating system and type of device (the User-Agent header), and the approximate location (country, region, city) derived from the IP address.

   The location is looked up on the Operator's own server in a local DB-IP database: the IP address is not passed to anyone for this, and the precision goes no further than a city. The Operator does not process special categories of personal data or biometric personal data. Data of minors is not deliberately collected.

3. 03Purposes of processing

   • replying to an enquiry and preparing a commercial proposal;
   • concluding and performing a contract for the provision of services;
   • considering an application for a vacancy;
   • sending a guide or other materials requested through a form;
   • sending informational materials by newsletter, only where separate consent has been given;
   • protecting the website and its forms from spam and abuse, and checking that an enquiry was sent by a person (the IP address, location and device details serve this);
   • performing the obligations imposed on the Operator by law.

   The data is not used to take legally significant decisions solely on the basis of automated processing.

4. 04Legal grounds

   Processing is carried out on the basis of the consent of the personal-data subject, of a contract to which the subject is a party, and of the requirements of the legislation of the Russian Federation, including Federal Law No. 152-FZ "On Personal Data".

5. 05Retention periods

   • enquiries that did not lead to a contract, 1 year from the date of the last contact;
   • data relating to concluded contracts, for the period established by law for the corresponding documents;
   • applications for vacancies, 6 months, unless the subject has agreed to longer storage;
   • an address used for the mailing, until consent is withdrawn.

   Once the period has expired, the data is deleted or depersonalised manually by the Operator: there is no automated deletion job in the system. Withdrawal of consent entails termination of the processing, except where the law obliges the Operator to keep documents.

6. 06Place of processing, processors and cross-border transfer

   The primary database is kept on a server in the Russian Federation, with the hosting provider Timeweb.

   The Operator involves the following processors and shares data with them to the extent their work requires:

   • Telegram, delivering the new-enquiry notification to the Operator's working chat: name, contacts, the content of the enquiry, the IP address, approximate location and device details. Telegram's servers are outside Russia, so this is a cross-border transfer;
   • Google, sending email through the Gmail mail service (name, email address, message text) and visit statistics through Google Analytics 4. Google's servers are outside Russia, so this is a cross-border transfer;
   • Yandex, visit statistics through Yandex Metrica and the office map on the Contact page. The Yandex infrastructure the site uses is located in Russia;
   • the hosting provider (Timeweb), hosting the site and the database in Russia.

   Personal data is not sold and is not transferred to third parties for marketing purposes.

7. 07Rights of the subject

   • to obtain confirmation that processing is taking place and information about it;
   • to obtain a copy of the data being processed;
   • to demand that inaccurate or unlawfully obtained data be corrected, blocked or destroyed;
   • to withdraw consent to the processing;
   • to appeal against the Operator's actions to Roskomnadzor (the Russian data-protection regulator) or in court.

   A request is sent to [email protected] and must make it possible to identify the subject. A reply is provided within the period established by law (no more than 10 working days under Art. 14 of 152-FZ).

8. 08Protective measures

   • transmission of data over a secure connection (HTTPS);
   • access to the data is limited to the Operator and to persons the Operator has engaged to provide services under a contract, on a need-to-know basis;
   • logging of access to enquiries;
   • backups and integrity control;
   • regular updating of the software in use.

9. 09Changes to the Policy

   The Operator has the right to amend the Policy. The version in force is always available at its address on the website; the date of the last change is stated at the beginning of the document.

Questions about this document: [email protected]