Principles
The operator processes data lawfully and fairly, for predetermined purposes, in the minimum necessary scope, maintains accuracy and does not retain data longer than required by the purposes or law. Incompatible purposes are not combined.
Grounds and processing records
For each purpose, the operator determines the data subjects and data, lawful ground, operations, period, termination condition, recipients and safeguards. Before processing begins through the live form, the operator fulfils the applicable Roskomnadzor notification obligation and updates the notification when information changes.
Roskomnadzor notification
The processing notification is filed before processing begins. Changes are reported no later than the fifteenth day of the month following the month of change, and cessation of processing within ten business days. Actual processing must match the information filed by the operator.
Access and appointed processing
Access is granted only to persons who need it for their duties and only within their role. A party processing data on the operator's instructions acts under contract, complies with confidentiality, localisation and security measures, evidences compliance and reports incidents to the operator.
Localisation and transfers
Online collection of Russian citizens' data is organised using databases in the Russian Federation for the operations required by law. An international transfer is permitted only after a separate assessment, Roskomnadzor notification and completion of other applicable requirements.
Security measures
The operator establishes access rules, confidentiality duties, session and channel protection, event monitoring, controlled backup, incident detection, recovery and regular effectiveness assessment. Details whose disclosure could weaken security are not published.
Incidents
If unlawful or accidental access, disclosure, dissemination, alteration, restriction, copying or destruction results in a violation of data-subject rights, the operator investigates, limits the consequences and notifies Roskomnadzor: an initial notice within 24 hours and internal investigation results within 72 hours.
Unlawful processing
If the operator identifies unlawful processing, it stops the processing or makes it lawful within three business days. If lawfulness cannot be achieved, the data is destroyed within ten business days of detection, and the data subject or their representative is informed of the action taken.
Destruction and evidence
When the applicable condition occurs, data is deleted from active systems and appointed processors receive the corresponding instruction. If immediate deletion from a backup is technically impossible, access is restricted until the copy's lifecycle expires. Destruction is evidenced by an act and, for automated or mixed processing, a log extract; the evidence is retained for three years.
Responsibility and oversight
The operator appoints a responsible person, maintains the required internal documents, trains persons with access, handles data-subject requests and checks that actual processing matches the published documents, consent and Roskomnadzor notification.