This Personal Data Processing Policy (the “Policy”) has been drawn up in accordance with Russian Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (the “Law”). It sets out how the personal data of visitors to telfi.pro (the “Site”) is processed and protected. The Policy is published on the Site and is available to anyone without restriction (part 2, art. 18.1 of the Law).
1. Data controller (Operator)
Operator: sole proprietor Polina Vladimirovna Smolina (the “Operator”, “I”)
OGRNIP: 325390000087177
INN: 391302380959
E-mail for requests: smolpol01@yandex.ru
Telegram: @telfi2001
Location of personal data databases: Russian Federation
2. Whose data and what data is processed
People who submit a request through the form on the Site:
- name (or nickname);
- contact details — phone number, Telegram username or e-mail address;
- a message describing the project or request (if provided) and the request topic.
Site visitors who have consented to web analytics (via cookies and the Yandex Metrica service; without consent this data is not collected):
- IP address, browser, device, operating system and screen resolution data, cookie identifiers;
- referral source, pages viewed, date and time of the visit;
- on-page actions: link clicks, clicks, scrolling, cursor movements (the Session Replay and Click Map tools). Text typed into form fields is not recorded.
Special categories of personal data (health, political views, etc.) and biometric data are not processed. The Site is not intended for persons under 18; such data is not collected intentionally and is destroyed if discovered.
3. Purposes of processing
- replying to your request and contacting you to discuss the project;
- assessing possible cooperation and preparing a commercial proposal;
- entering into and performing a service agreement;
- analysing Site traffic and usability, fixing errors and improving the Site (Yandex Metrica data).
The data is not used for advertising mailings without your separate consent.
4. Legal grounds
- your consent (clause 1, part 1, art. 6 of the Law). For form data, consent is given separately from other documents (part 1, art. 9 of the Law): you tick “I consent to the processing of personal data”, which links to the consent text. The form cannot be sent without it. For web analytics data, consent is given separately — by clicking “Accept” in the cookie notice. Until then the Yandex Metrica counter is not loaded on the Site; if you click “Decline”, no web analytics data is collected;
- entering into and performing a contract to which you are a party, including steps taken at your request before it is concluded (clause 5, part 1, art. 6 of the Law).
5. Actions with data and processing methods
The Operator performs the following actions with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, blocking, deletion, destruction.
Some of these actions are performed on the Operator’s behalf by Yandex.Cloud LLC and YANDEX LLC (part 3, art. 6 of the Law) — see section 6.
Processing is mixed — with and without automation tools, with transmission over the Internet via the secure HTTPS protocol.
6. Where the data is stored and who receives it
Requests. Form data is sent directly to the Yandex Cloud platform (Yandex.Cloud LLC, Russia): a Yandex Cloud Functions function receives it and saves it to private Yandex Object Storage in data centres in the Russian Federation. Only the Operator and the service account that writes the requests have access to the storage. A copy of each request is e-mailed to the Operator’s mailbox in Yandex Mail (YANDEX LLC, Russia).
Site. The Site’s pages are hosted in Yandex Cloud; the domain names are served by Yandex Cloud DNS. When pages are opened, the provider receives technical request data (IP address, time, page address, browser data) to deliver pages and protect against attacks.
Web analytics. Yandex Metrica data is processed by YANDEX LLC in accordance with the Yandex Metrica terms of use and the Yandex privacy policy. The Operator receives this data as aggregated reports and session recordings and does not use it to identify you.
Yandex.Cloud LLC and YANDEX LLC process the data on the Operator’s behalf (part 3, art. 6 of the Law) to the extent required to provide their services and are obliged to keep it confidential and protect it. The data is not transferred or disclosed to third parties, partners or advertising networks. No cross-border transfer of personal data takes place: all data is stored and processed in the Russian Federation (part 5, art. 18 of the Law).
7. Processing period and destruction of data
Personal data is processed and stored until one of the following occurs: the purposes of processing are achieved (the request is answered, the contract is concluded and performed), you withdraw your consent, or the Operator ceases activity as a sole proprietor — whichever comes first. The data is then destroyed within 30 days unless otherwise provided by federal law or contract (parts 4 and 5, art. 21 of the Law).
If unlawful processing is detected, it is stopped within 3 working days, and if lawfulness cannot be ensured, the data is destroyed within 10 working days (part 3, art. 21 of the Law). Destruction is confirmed in the manner established by Roskomnadzor.
Web analytics data is stored in Yandex Metrica in accordance with its terms of use.
8. Your rights
You have the right to:
- receive information about the processing of your personal data (art. 14 of the Law);
- demand that your data be clarified, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not needed for the stated purpose;
- withdraw your consent at any time by writing to smolpol01@yandex.ru;
- withdraw your consent to web analytics at any time — click “Cookie settings” at the bottom of any page and choose “Decline”: the Yandex Metrica counter is switched off and its cookies are deleted; the Site keeps working. You can also delete cookies in your browser settings or install the Yandex Metrica blocker;
- appeal the Operator’s actions to Roskomnadzor or in court.
Send requests to smolpol01@yandex.ru, stating the contact you left in your request — it is needed to find your data. The Operator replies within 10 working days; this period may be extended by no more than 5 working days with a reasoned notice to you (part 3, art. 14; part 1, art. 20 of the Law).
9. Security measures
The Operator takes legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying and dissemination (arts. 18.1 and 19 of the Law):
- data is transmitted only over the secure HTTPS protocol;
- the request storage is closed to public access; the service account can only write requests;
- only the Operator has access to the cloud and the mailbox, protected by passwords;
- data is stored only in data centres in the Russian Federation.
10. Final provisions
The Operator may amend this Policy. A new version takes effect when it is published on the Site. The current version is always available at telfi.pro/privacy; the version date is shown at the top of the document.
For any questions about personal data processing: smolpol01@yandex.ru · @telfi2001