Personal Data Processing Policy

1. General provisions

1.1. This Policy sets out how Individual Entrepreneur Aleksey Yurievich Churilov (the "Operator") processes personal data of users of the website https://lefikantor.com (the "Website"), including the purposes and legal bases of processing, categories of data subjects, scope of data, methods and periods of processing, transfer, termination of processing and destruction of data, data subjects' rights and the security requirements implemented.

1.2. This Policy is drafted in accordance with Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" ("Law No. 152-FZ") and other applicable legislation of the Russian Federation and is published pursuant to Article 18.1(2) of Law No. 152-FZ.

1.3. This Policy is publicly available on the Website and accessible from the pages through which personal data are collected.

1.4. This Policy applies to visitors of the Website and to persons who send enquiries through the Website contact form or to the e-mail address published on the Website. Processing of personal data of clients under concluded legal services agreements, counterparties and other persons whose data are processed outside the Website is governed by the relevant agreements and the Operator's internal documents.

1.5. The Website is an information resource about the Operator's professional activity. The Website does not provide user registration, personal accounts, payments or marketing mailings.

1.6. Where a user contacts the Operator on his or her own initiative with a request for a consultation, legal analysis or document drafting, the data necessary to consider such a request and to conclude an agreement are processed without separate consent where an independent legal basis under Law No. 152-FZ exists. Consent is relied upon only for those purposes for which it is the required legal basis.

2. Operator details

Name: Individual Entrepreneur Aleksey Yurievich Churilov

OGRNIP (registration number): 326700000047114

INN (taxpayer number): 701718754703

E-mail for personal data matters: lefikantor@inbox.ru

Website: https://lefikantor.com

2.1. The functions of the person responsible for organising personal data processing (Article 22.1 of Law No. 152-FZ) are performed by the Operator personally.

3. Key terms

3.1. Personal data means any information relating to a directly or indirectly identified or identifiable natural person (data subject).

3.2. Processing means any operation or set of operations performed on personal data, with or without automated means, including collection, recording, organisation, accumulation, storage, updating, retrieval, use, transfer (provision, access), anonymisation, blocking, erasure and destruction.

3.3. User means any natural person who uses the Website, including a person sending an enquiry via the contact form.

3.4. Cookies means small text files and similar technologies (including browser local storage) stored on the user's device when visiting the Website. Their use is governed by the Cookie Policy published on the Website.

3.5. Yandex Metrica means the web analytics service of Yandex LLC used on the Website to analyse traffic subject to the user's consent.

4. Principles and methods of processing

4.1. The Operator processes personal data lawfully and fairly, only for predetermined and legitimate purposes, does not collect data excessively in relation to the stated purposes and does not combine databases processed for incompatible purposes.

4.2. Unless expressly stated otherwise for a specific purpose, processing is carried out by mixed means, with and without automated tools, with transmission over information and telecommunication networks where necessary for the relevant purpose.

4.3. Within the relevant purpose the Operator may collect, record, organise, accumulate, store, update, retrieve, use, transfer (provide, grant access to) in cases provided by law, block, erase and destroy personal data.

4.4. The Operator does not take decisions producing legal effects for the user or otherwise affecting the user's rights and legitimate interests solely on the basis of automated processing of personal data (Article 16 of Law No. 152-FZ).

5. Purposes, legal bases, scope and periods of processing

5.1. Operation and technical security of the Website

Data subjects: Website visitors.

Personal data: IP address, browser, operating system and device information, date and time of request, requested page addresses, referrer address, technical cookies and browser local storage entries necessary for the operation of the Website and for saving the user's cookie choice.

Purpose: Displaying the Website, ensuring its operation and information security, preventing abuse and technical failures, technical diagnostics, saving the user's choice regarding analytics technologies.

Legal basis: Article 6(1)(7) of Law No. 152-FZ - pursuit of the Operator's rights and legitimate interests provided that the rights and freedoms of the data subject are not infringed.

Method: Automated processing.

Retention period: For the period necessary for the relevant technical task; server logs are generally kept for no more than 30 days unless longer retention is required to investigate an incident or protect the Operator's rights. Retention periods of technical cookies are set out in the Cookie Policy.

Termination and destruction: Once no longer needed, the data are deleted or destroyed in the prescribed manner unless another legal basis for retention exists.

5.2. Handling enquiries sent via the contact form or by e-mail

Data subjects: Users who have contacted the Operator on their own initiative.

Personal data: Surname, first name, patronymic (if provided), name of the organisation (if provided), e-mail address, content of the enquiry, date and time of sending, technical details of form submission (IP address, browser information). Other data are processed only to the extent the user has included them in the text of the enquiry.

Purpose: Considering the enquiry, contacting the user, clarifying the task, checking for conflicts of interest, agreeing terms and concluding a legal services agreement at the user's initiative, or sending a reasoned refusal.

Legal basis: Article 6(1)(5) of Law No. 152-FZ - processing necessary to conclude an agreement at the initiative of the data subject and to perform an agreement to which the data subject is a party. Article 6(1)(7) of Law No. 152-FZ - as regards conflict checks and protection of the Operator's rights.

Method: Mixed processing. A form enquiry is received by the Website server and forwarded to the Operator's e-mail address.

Retention period: If no agreement is concluded - generally no more than 3 years from the date of the last interaction, which corresponds to the general limitation period and is necessary for conflict checks. If an agreement is concluded - for the term of the agreement and the statutory retention periods for documents relating to its performance.

Termination and destruction: Upon expiry of the applicable period the data are destroyed unless further retention is required by law, by agreement or to protect the Operator's legitimate interests.

5.2.1. The user is advised not to include in the enquiry special categories of personal data, information protected by law as confidential, or personal data of third parties. By including information about third parties, the user confirms that he or she has a lawful basis for its transfer to the Operator. Prior to concluding an agreement, the Operator is not obliged to accept materials for safekeeping and may ask the user to send them by another agreed method.

5.3. Traffic analytics and Website improvement (Yandex Metrica)

Data subjects: Website visitors who have consented to analytics cookies.

Personal data: Cookie and local storage identifiers generated by Yandex Metrica, IP address, browser, operating system, device and screen resolution information, referrer address, pages visited, time and sequence of actions on the Website to the extent generated by the service. Session recording (Webvisor) is not used; the content of contact form fields is not transmitted to the analytics service.

Purpose: Statistical analysis of traffic, error detection and improvement of the Website.

Legal basis: Article 6(1)(1) of Law No. 152-FZ - the user's consent expressed by an affirmative action in the cookie choice panel. The Yandex Metrica counter is not loaded until consent is given.

Method: Automated processing. Processing on the side of Yandex LLC is carried out in accordance with the Yandex Metrica terms of use and the privacy policy of Yandex LLC.

Retention period: Within the lifetime of the relevant cookies set out in the Cookie Policy and until consent is withdrawn.

Termination and destruction: Upon withdrawal of consent, analytics technologies on the Website side are disabled; previously stored cookies may be deleted by the user via browser settings.

5.4. Compliance with legal requirements and protection of the Operator's rights

Data subjects: Users whose data are necessary to comply with a legal obligation, to handle a claim, a dispute or a lawful request of a competent authority.

Personal data: Data to the extent necessary to comply with the relevant obligation or protect the right.

Purpose: Compliance with mandatory legal requirements, provision of information to competent authorities, pre-trial and court work, protection of the rights and legitimate interests of the Operator and third parties.

Legal basis: Article 6(1)(2) and 6(1)(7) of Law No. 152-FZ.

Method: Mixed processing.

Retention period: For the periods established by law and the applicable limitation periods.

Termination and destruction: Upon expiry of the mandatory retention period and in the absence of other grounds, the data are destroyed.

5.5. The Operator does not request special categories of personal data or biometric personal data via the Website, does not disseminate users' personal data under Article 10.1 of Law No. 152-FZ, does not profile users for advertising purposes and does not send marketing mailings. If new purposes of processing arise, this Policy is amended and, where necessary, separate consent is obtained.

6. Transfer of personal data and processors

6.1. To operate the Website the Operator engages a hosting provider whose servers are located in the Russian Federation and uses, to receive enquiries, an e-mail service of a Russian provider whose servers are located in the Russian Federation. Processing by such persons is carried out on the Operator's instructions in accordance with Article 6(3) of Law No. 152-FZ under agreements defining the list of operations, purposes of processing, and obligations of confidentiality and security of personal data.

6.2. Subject to the user's consent, the data referred to in clause 5.3 are processed by Yandex LLC (16 Lva Tolstogo St., Moscow, 119021, Russia) as the operator of the Yandex Metrica service under the terms published at https://yandex.ru/legal/metrica_termsofuse and in accordance with the privacy policy published at https://yandex.ru/legal/confidential.

6.3. Personal data may be provided to competent state authorities in the cases and in the manner prescribed by the legislation of the Russian Federation.

6.4. Personal data collected through the Website are not transferred across borders.

6.5. The Operator does not sell personal data and does not provide them to third parties for their own use for advertising or other purposes without a legal basis.

7. Consent to processing

7.1. Where processing is based on consent, the consent must be specific, purpose-limited, informed, conscious and unambiguous and is obtained separately from any other information or documents confirmed or signed by the data subject.

7.2. Consent to analytics cookies is expressed by the user's affirmative action in the cookie choice panel. The panel contains no pre-selected options; declining analytics cookies is as easy as accepting them and does not restrict the use of the Website. Continued use of the Website, scrolling, closing the panel or inaction is not deemed consent.

7.3. The Operator keeps evidence of consent: date and time, version of the panel text and of the Cookie Policy, the option chosen by the user and the necessary technical details.

7.4. Consent may be withdrawn at any time via the "Cookie settings" link on the Website or by sending a request to the Operator's e-mail address. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. If an independent legal basis remains after withdrawal, the data may be processed to the corresponding extent.

8. Rights of data subjects and handling of requests

8.1. The user is entitled to receive the information about the processing of his or her personal data provided for in Article 14 of Law No. 152-FZ; to request rectification, blocking or destruction of personal data that are incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose; to request termination of processing; to withdraw consent; and to appeal the Operator's actions or omissions to the supervisory authority (Roskomnadzor) or to court.

8.2. Requests are sent to the Operator's e-mail address specified in Section 2. A request must contain the information required by Article 14(3) of Law No. 152-FZ to the extent allowing identification of the applicant and his or her personal data. To protect the data, the Operator may request additional information necessary to verify the applicant's identity.

8.3. A response is provided within the period set by Article 20 of Law No. 152-FZ: within 10 business days from receipt of the request; this period may be extended by no more than 5 business days with a reasoned notice to the applicant.

8.4. A data subject's demand to terminate processing is executed within no more than 10 business days from its receipt; this period may be extended by no more than 5 business days with a reasoned notice to the data subject (Article 21(5.1) of Law No. 152-FZ). Upon withdrawal of consent, processing is terminated and the personal data are destroyed within no more than 30 days from receipt of the withdrawal, unless another legal basis for continued processing exists (Article 21(5) of Law No. 152-FZ).

9. Localisation, security and destruction of personal data

9.1. When collecting personal data of citizens of the Russian Federation, including via the Internet, the recording, organisation, accumulation, storage, updating and retrieval of personal data are carried out using databases located in the Russian Federation, in accordance with Article 18(5) of Law No. 152-FZ.

9.2. The Operator takes the necessary and sufficient legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination and other unlawful actions (Articles 18.1 and 19 of Law No. 152-FZ), including: identification of security threats and the level of protection of personal data; access control and logging for information systems; use of information security tools, encryption in transit and anti-virus protection; backups; use of hosting and services ensuring protection of personal data; internal control of compliance with legal requirements.

9.3. Upon achievement of the purpose of processing or withdrawal of consent, in the absence of another legal basis, personal data are destroyed within no more than 30 days in accordance with Article 21 of Law No. 152-FZ. Destruction is documented in accordance with the requirements established by the supervisory authority.

9.4. Upon detection of an incident involving unlawful or accidental transfer (provision, dissemination, access) of personal data resulting in a violation of data subjects' rights, the Operator acts in accordance with Article 21(3.1) of Law No. 152-FZ, including notifying Roskomnadzor within the statutory time limits.

10. Cookies

10.1. The Website uses necessary (technical) cookies and browser local storage entries for the proper functioning of the Website and to save the user's cookie choice. Such technologies do not require consent and are used on the basis of the Operator's legitimate interests.

10.2. Yandex Metrica analytics cookies are used only after the user's consent has been obtained in accordance with Section 7. No other non-essential cookies, including advertising cookies, are used on the Website.

10.3. The list of cookies used, their retention periods and the ways to manage them are set out in the Cookie Policy published on the Website, which forms an integral part of this Policy.

11. Amendments to this Policy

11.1. The Operator may amend this Policy. A new version is published on the Website with the version date and takes effect upon publication unless otherwise stated in the new version.

11.2. In case of a material change in the purposes, scope of data or conditions of processing for which consent is required, the Operator obtains consent anew.

11.3. Questions relating to this Policy may be sent to the Operator's e-mail address specified in Section 2.