Privacy policy constructor

1. General provisions

This Personal Data Processing Policy (the “Policy”) defines how personal data is processed and secured by the operator: [operator name] (the “Operator”, legal entity), and applies to the website [site address] and its related subdomains (the “Site”).

The Policy complies with the Constitution of Russia, Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (“152-FZ”) and related regulations, and applies to all personal data the Operator may obtain in connection with the use of the Site.

By using the Site, the data subject confirms that they have read this Policy.

2. Terms and definitions

• Personal data — any information relating to a directly or indirectly identified or identifiable individual (the subject).
• Processing — any operation on personal data (collection, storage, use, transfer, deletion, etc.).
• Operator — the entity that organises and/or carries out processing and determines its purposes and data.
• Subject — the individual the personal data relates to.

3. Processing principles

• lawfulness and fairness of processing;
• processing only for predefined and lawful purposes;
• data adequacy and minimisation relative to the stated purposes;
• accuracy and relevance of data; storage no longer than necessary.

4. Categories of data subjects

• Site visitors and users;
• persons who submitted a request via Site forms;
• prospective, current and former clients, and representatives of counterparties.

5. Purposes, legal bases, data, actions and retention

6. Personal data processed

• identification and contact data: name, phone number, email;
• request data: selected service/project type, comment;
• technical data: IP address, cookies, browser/device data, visit date/time, on-site actions, referral source;
• correspondence data if the subject provides it.

Special categories of personal data (race, health, political views, etc.) and biometric data are not processed. Data of minors is not collected intentionally.

7. Processing conditions

Processing is carried out both with and without automation (mixed). The Operator keeps personal data confidential and does not disclose it to third parties without the subject’s consent, except as provided by law.

8. Data collection via the Site, cookies and analytics

The Site uses cookies and web analytics (Yandex Metrica). Analytics cookies and counters load only after the user’s consent given via the banner.

9. Database localisation

Collection, recording, systematisation, accumulation, storage, update and retrieval of personal data of Russian citizens are performed using databases located in the Russian Federation (Art. 18(5) 152-FZ).

10. Data transfer and processors

The Operator may engage third parties to process personal data under a confidentiality and data-protection agreement, including: Yandex Metrica. When engaging a processor, the Operator remains responsible to the subject.

No cross-border transfer of personal data is carried out. Disclosure to other third parties is possible only with the subject’s consent or at the request of authorised state bodies as provided by law.

11. Retention and destruction

Retention is determined by achievement of purposes, the consent term, and contractual/statutory periods. Once purposes are achieved or consent is withdrawn, data is destroyed or anonymised within the periods set by 152-FZ, unless retention is required by law.

12. Security measures

The Operator applies legal, organisational and technical measures (Art. 18.1, 19 152-FZ), including:

• appointing a person responsible for processing;
• access restriction and segregation;
• secure channels (HTTPS) and backups;
• harm assessment and incident response.

13. Subject rights and how to exercise them

The data subject has the right to:

• obtain information about the processing of their data;
• request rectification, blocking or destruction of incomplete, outdated or unlawfully obtained data;
• withdraw consent to processing;
• appeal the Operator’s acts to Roskomnadzor or a court.

A request can be sent to [contact email]. The Operator responds within the timeframes set by 152-FZ (typically 10 business days, extendable to 30 days).

14. Responsible person and contacts

Enquiries on personal data matters are accepted at [contact email].

15. Final provisions

The Operator may amend the Policy. A new version takes effect upon publication on the Site. This version is effective from 26 June 2026.