Personal data processing policy

Version of [DATE OF VERSION]. This text is based on Federal Law No. 152-FZ of 27 July 2006 "On Personal Data". The Russian-language version is the authoritative one.

1. General provisions

1.1. This policy sets out how personal data of users of the website [WEBSITE ADDRESS] (the "website") is processed and protected, in accordance with Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" (152-FZ).

1.2. Personal data operator:

• name: [OPERATOR NAME];
• Tax ID (INN): [INN], registration number (OGRN/OGRNIP): [OGRN];
• address: [LEGAL ADDRESS];
• email for personal data enquiries: [EMAIL FOR ENQUIRIES];
• person responsible for personal data processing: [NAME, POSITION].

1.3. By submitting a form on the website, the user confirms that they have read this policy and consents to the processing of their personal data on the terms set out here. The form cannot be submitted without consent.

1.4. The policy applies only to data the operator receives through the website. The website may contain links to third-party resources (social networks, messengers); the operator is not responsible for their data processing policies.

2. Key terms

Personal data means any information relating to a directly or indirectly identified individual (the data subject). Processing means any action or set of actions with personal data, performed with or without automation. Operator means the person organising and carrying out the processing, named in clause 1.2.

3. Purposes and legal grounds

3.1. The operator processes personal data for the following purposes:

• to contact the user about their enquiry, answer questions and prepare a commercial proposal;
• to hold the consultation the user asked for in the form;
• to keep a record of enquiries and analyse website performance (in anonymised form);
• to comply with the legislation of the Russian Federation.

3.2. The legal grounds are the data subject's consent (Article 6(1)(1) of 152-FZ), steps taken at the data subject's request before entering into a contract (Article 6(1)(5)) and performance of duties imposed on the operator by law.

3.3. The operator does not process special categories of personal data (health, political or religious views, ethnic origin, etc.) or biometric data. Please do not include such information in the message field.

4. Data we process

4.1. Data subjects are website visitors who submit the contact form.

4.2. Data the user enters in the form:

• name;
• email address (required);
• phone number (optional);
• Telegram contact (optional);
• message text describing the task (optional).

4.3. Stored automatically with the request: the interface language, the address of the website page the form was sent from, the date and time of submission and the mark of consent to data processing.

4.4. The sender's IP address is not stored with the request. To protect the form from mass submission, an irreversible hash of the IP address is used; it is kept in the application's temporary memory for 10 minutes and then deleted.

5. Actions with data and methods of processing

5.1. The operator performs the following actions: collection, recording, systematisation, accumulation, storage, clarification (updating, changing), retrieval, use, transfer (provision, access), blocking, deletion and destruction.

5.2. Processing is carried out both with and without automation (mixed processing).

5.3. Only the operator's employees who need the data to handle enquiries have access to it. The operator takes the legal, organisational and technical protection measures provided for by Article 19 of 152-FZ: access rights separation, a secure connection (HTTPS), password protection of accounts, backups and action logs.

6. Storage, retention and destruction

6.1. Databases with requests are hosted on servers located in the territory of the Russian Federation: [HOSTING PROVIDER / DATA CENTRE NAME, SITE ADDRESS].

6.2. Personal data is stored no longer than the purposes of processing require: requests that did not lead to a contract for no more than [RETENTION PERIOD, FOR EXAMPLE 12 MONTHS] from receipt; data needed to perform a contract for its term and the period set by law.

6.3. Data is destroyed or anonymised when the purposes are achieved, when the retention period ends, and within 30 days of withdrawal of consent unless the law requires otherwise.

7. Disclosure to third parties

7.1. The operator does not sell personal data or pass it to third parties for marketing.

7.2. When a request arrives, a notification is sent to the operator's employees by email and/or to an internal Telegram chat. The notification contains the data the user entered in the form (name, contacts, message text, page of submission). Telegram belongs to a foreign organisation and its servers may be located outside the Russian Federation, so sending the notification involves a cross-border transfer of data. The operator uses Telegram only as a notification channel: the main database of requests is stored on servers in Russia.

7.3. If you do not want information about you to reach Telegram, leave the "Telegram" field empty and include nothing in the message beyond what is necessary, or send your enquiry directly to the email address in clause 1.2.

7.4. Data may be provided to state authorities in cases and in the manner provided by the legislation of the Russian Federation.

7.5. The operator may engage processors (hosting, email services) under a contract obliging them to keep data confidential and protected. List of processors: [LIST OF PROCESSORS].

8. Cookies and web analytics

8.1. The website uses technical cookies needed for operation: the form's protection token (CSRF) and, when staff sign in to the admin panel, session cookies. They are not used to track visitors.

8.2. [IF YANDEX METRICA IS ENABLED, KEEP THIS PARAGRAPH, OTHERWISE DELETE] The website uses the web analytics service Yandex Metrica (Yandex LLC, Russian Federation). The service collects anonymised visit information: pages, traffic source, device and browser type. This data is used to improve the website.

8.3. The user can block or delete cookies in browser settings; the contact form may then not work correctly.

9. Rights of the data subject

9.1. The user has the right to:

• obtain confirmation of the processing of their data and information about it (Article 14 of 152-FZ);
• demand clarification, blocking or destruction of data that is incomplete, outdated, inaccurate or not needed for the stated purpose;
• withdraw consent to processing at any time;
• appeal the operator's actions to Roskomnadzor or in court;
• protection of their rights and legitimate interests, including compensation for damages.

9.2. The operator considers enquiries and replies within the period set by Article 20 of 152-FZ (10 working days, extendable unless the law provides otherwise).

10. Withdrawing consent and making enquiries

10.1. To withdraw consent, obtain information about your data or demand its deletion, send a letter to [EMAIL FOR ENQUIRIES] or to [OPERATOR POSTAL ADDRESS]. In the enquiry state the name and contact you entered in the form so that the operator can find your request.

10.2. After receiving a withdrawal, the operator stops processing and destroys the data within 30 days unless the law provides otherwise, and informs the user.

11. Final provisions

11.1. The operator may amend the policy. A new version takes effect when published on the website unless it provides otherwise.

11.2. The current version is always available at [POLICY PAGE ADDRESS].

11.3. Questions about personal data processing: [EMAIL FOR ENQUIRIES], [PHONE].