Policy on processing personal data

1. General provisions

1.1. This Policy on the processing of personal data (hereinafter — the Policy) sets out how the Operator processes personal data and the measures taken to keep it secure, and is issued pursuant to Part 2 of Article 18.1 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (hereinafter — 152-FZ, as amended on 24 June 2025).

1.2. The personal data Operator:

• Individual Entrepreneur Tatiana Olegovna Afinogenova;
• INN 504410095381, OGRNIP 324508100519374;
• correspondence address: Moscow Region, Solnechnogorsk, Polezhayki village, Mechtateley Street, 6;
• website: маркетинговое-агентство.online; e-mail: afinogenova.to@yandex.ru; phone: +7 (916) 260-68-57.

1.3. The Policy applies to all personal data that the Operator receives from visitors and users of the website маркетинговое-агентство.online (hereinafter — the Site), primarily through the request form (“Send a request”).

1.4. The Policy covers the processing of personal data carried out both with and without the use of automation.

1.5. The current version of the Policy and the information on the personal data protection requirements implemented by the Operator (Section 9 of the Policy) are freely available on the Site at маркетинговое-агентство.online/legal/privacy, in accordance with Part 2 of Article 18.1 of 152-FZ.

1.6. Key terms (personal data, processing, operator, subject and others) are used in the meanings defined by Article 3 of 152-FZ.

2. Legal grounds for processing

2.1. Personal data is processed on the basis of:

• the Constitution of the Russian Federation;
• 152-FZ and the subordinate acts adopted to implement it (including Russian Government Decree No. 1119 of 1 November 2012 and the requirements and orders of Roskomnadzor and FSTEC of Russia);
• the Civil Code of the Russian Federation;
• Federal Law No. 149-FZ of 27 July 2006 "On Information, Information Technologies and Information Protection";
• Federal Law No. 38-FZ of 13 March 2006 "On Advertising" — as regards the sending of advertising messages;
• the consents of personal data subjects;
• this Policy.

2.2. The specific legal grounds for processing are:

• the subject's consent to the processing of their personal data (Clause 1 of Part 1 of Article 6 and Article 9 of 152-FZ; Article 15 — for the purpose of promoting services; Article 18 of 38-FZ — for advertising);
• performance of a contract to which the subject is a party, and taking steps at the subject's initiative before the contract is concluded (Clause 5 of Part 1 of Article 6 of 152-FZ) — handling a request sent by the subject;
• pursuit of the Operator's legitimate interests (Clause 7 of Part 1 of Article 6 of 152-FZ) — keeping the Site working and secure — provided that the rights and freedoms of the subject are not infringed;
• the subject's consent to the use of analytics cookies (Clause 1 of Part 1 of Article 6 of 152-FZ) — web analytics.

3. Categories of subjects and personal data

3.1. The Operator processes the personal data of the following categories of subjects: users of the Site who have sent a request through the form; other visitors to the Site (as regards the automatically collected data listed in clause 3.3).

3.2. Data the subject provides personally when filling in the request form:

• name (as the subject introduces themselves);
• contact details — phone number and (or) e-mail address;
• information the subject voluntarily enters in the free-text “project” field (a description of the request). The Operator asks that special categories of personal data not be entered in this field. The Operator bears no responsibility for the processing of special categories of data if the subject has entered them in the free-text field of their own accord.

3.3. Data collected automatically when the Site is used:

• IP address;
• browser and device information (including the User-Agent);
• the date and time of the visit, the address of the Site page and the referral source;
• cookies and web analytics identifiers (see Section 8).

3.4. The Operator does not request or deliberately process special categories of personal data (concerning racial or ethnic origin, political views, religious beliefs, health or sex life), nor biometric personal data.

3.5. The Site and the request form are not intended for persons under 18. The Operator does not request or deliberately collect the personal data of minors. If the Operator learns that data has been received from a minor without the consent of a legal representative, such data is subject to deletion.

4. Purposes of processing

4.1. Personal data is processed for the following purposes:

• reviewing and handling a request, responding to the subject, advising the subject, and preparing, concluding and performing a service contract;
• communicating with the subject about the request they have sent (a phone call, a letter);
• sending advertising and informational messages (mailings) — only where the subject has given separate consent;
• operating, securing and improving the Site, statistical research and web analytics;
• meeting the obligations set out in the legislation of the Russian Federation.

4.2. Processing incompatible with these purposes is not carried out. The volume of data processed matches the stated purposes (the minimization principle, Part 5 of Article 5 of 152-FZ).

5. Procedure and conditions of processing

5.1. Processing includes the following actions: collection, recording, systematization, accumulation, storage, updating (renewal, modification), retrieval, use, transfer (provision, access), anonymisation, blocking, deletion and destruction of personal data.

5.2. Processing is carried out by mixed means (with and without the use of automation), with and without the transmission of data over information and telecommunications networks.

5.3. Localization. When collecting personal data, including via the Internet, the Operator records, systematizes, accumulates, stores, updates (renews, modifies) and retrieves the personal data of citizens of the Russian Federation using databases located in the territory of the Russian Federation. Using databases located outside the territory of the Russian Federation for these actions is not permitted (Part 5 of Article 18 of 152-FZ as amended by Federal Law No. 23-FZ of 28 February 2025).

5.4. The Operator does not carry out cross-border transfer of personal data. Should such transfer be planned, the Operator will notify Roskomnadzor in advance under Article 12 of 152-FZ.

5.5. Transfer to third parties. The Operator may entrust the processing of personal data to another party with the consent of the personal data subject, on the basis of a contract with that party which defines the list of personal data, the list of actions with it and the purposes of processing, and establishes the obligation to maintain confidentiality and to meet the requirements of Part 5 of Article 18 and Article 18.1 of 152-FZ (Part 3 of Article 6 of 152-FZ). Personal data may be transferred to:

• the hosting provider (hosting of the Site and the database);
• the web analytics operator — Yandex LLC (INN 7736207543, 16 Lva Tolstogo Street, Moscow 119021), the Yandex Metrica service — for the purpose of Site traffic statistics. That party processes the data on the basis of the subject's consent to the use of analytics cookies (in accordance with Article 9 of 152-FZ), and this is not an assignment of personal data processing within the meaning of Part 3 of Article 6 of 152-FZ, since the data is used in anonymised and aggregated form for statistics;
• the mailing service provider — when advertising messages are sent on the basis of separate consent.

The current list of parties engaged to process personal data may change; subjects are notified through the publication of a new version of the Policy.

The list of parties engaged to handle requests, together with their details, is also given in the Consent to the Processing of Personal Data (маркетинговое-агентство.online/legal/consent-pdn). Data is transferred to other third parties only on the grounds provided by law (at the request of authorized state bodies).

5.6. The Operator does not take decisions that produce legal consequences for the subject solely on the basis of automated processing (Article 16 of 152-FZ).

6. Processing and storage periods

6.1. Personal data is processed until the purposes of processing are achieved or until the subject withdraws consent, unless otherwise provided by law or by contract.

6.2. Personal data is subject to destruction within a period not exceeding 30 days: from the date the purpose of processing is achieved (Part 4 of Article 21 of 152-FZ) or from the date a withdrawal of consent is received, if retaining the data is no longer required for the purposes of processing (Part 5 of Article 21 of 152-FZ) — unless otherwise provided by a contract or agreement with the subject, or unless the Operator is entitled to continue processing without consent on the grounds provided by law. Where destruction within that period is not possible, the Operator blocks the data and ensures its destruction within no more than six months (Part 6 of Article 21 of 152-FZ). Destruction is confirmed in accordance with the requirements of the authorized body (Part 7 of Article 21 of 152-FZ).

6.3. Data collected by web analytics systems and cookies is stored for the periods set by the respective services and by the settings of the subject's browser.

7. Rights of the personal data subject

7.1. The subject has the right to obtain information about the processing of their personal data (Article 14 of 152-FZ), including the purposes, methods and periods of processing and the parties that have access to the data.

7.2. The subject may demand that personal data be updated, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the purposes of processing, and may take the measures provided by law to protect their rights.

7.3. The subject may withdraw consent to the processing of personal data at any time by sending a statement to the e-mail afinogenova.to@yandex.ru or to the Operator's postal address. After withdrawal, the Operator stops processing and destroys the data within the period set out in clause 6.2, except where processing may be continued on the grounds set out in Clauses 2–11 of Part 1 of Article 6, Part 2 of Article 10 and Part 2 of Article 11 of 152-FZ.

7.4. The subject may appeal the acts or omissions of the Operator to the authorized body for the protection of the rights of personal data subjects (Roskomnadzor) or in court.

7.5. A request from the subject must contain the information needed to identify them (to the extent set out in Part 3 of Article 14 of 152-FZ). A reply is provided within the periods set by 152-FZ.

8. Cookies and web analytics

8.1. The Site uses cookies — small files saved in the subject's browser — to keep the Site working, remember settings and collect traffic statistics. Analytics cookies are set only after the subject's consent has been obtained. Consent is requested on the first visit to the Site through a pop-up notice (a cookie banner) that lets the subject accept or decline the use of analytics cookies.

8.2. Traffic is analyzed using the Yandex Metrica service (Yandex LLC). The service collects information about user behavior on the Site, including the IP address, browser and device information and an identifier assigned to the user. The counter is enabled only after the subject has consented to the use of analytics cookies. The terms of processing are set out in the documents of Yandex LLC.

8.3. The subject may restrict or block the use of cookies in their browser settings. Disabling cookies may affect how some functions of the Site work.

9. Security measures

9.1. The Operator takes the necessary legal, organizational and technical measures to protect personal data against unlawful access, destruction, modification, blocking, copying, distribution and other unlawful acts (Articles 18.1 and 19 of 152-FZ), including the following:

• the Operator, being an individual entrepreneur, organizes the processing of personal data personally;
• issues this Policy and internal acts on processing matters;
• restricts and differentiates access to personal data;
• keeps records of storage media and assesses the harm that may be caused to subjects;
• applies information protection tools and performs internal checks that processing complies with the requirements of the law.

10. Notification of Roskomnadzor

10.1. The Operator files a notification with Roskomnadzor of its intention to process personal data under Article 22 of 152-FZ and is entered in the register of operators. The information in the notification is kept up to date.

11. Changes to the Policy

11.1. The Operator may amend the Policy. A new version takes effect from the moment it is published on the Site, unless the new version provides otherwise.

11.2. The current version is always available at маркетинговое-агентство.online/legal/privacy.

11.3. For questions about the processing of personal data: e-mail afinogenova.to@yandex.ru.