Personal data policy

Version of 2 November 2026. Prepared under Russian Federal Law No. 152‑FZ of 27 July 2006 “On Personal Data”. This is a translation; if the versions differ, the Russian text prevails.

1. Who processes the data

Personal data operator: Nikolaeva Diana Vladimirovna, self-employed (professional income tax payer), INN 701739252398 (the Operator).

Contact for personal data questions and requests: delina.romanenko@mail.ru, Telegram @di_va_branding.

This policy covers every page of the site that links to it, in Russian and English. The current version is always published on this page.

2. Terms

Personal data is any information relating directly or indirectly to an identified or identifiable person. Processing is any action with such data: collection, recording, organising, accumulation, storage, updating, retrieval, use, transfer, anonymisation, blocking, erasure and destruction. Other terms have the meaning given in Law No. 152‑FZ.

3. Principles

The Operator processes only the data needed for the stated purposes, does not combine databases with incompatible purposes, keeps data accurate and stores it no longer than the purposes require.

4. Purpose: replying to an enquiry and preparing a proposal

• Whose data: site visitors who fill in the enquiry form or write to the Operator themselves.
• What data: name; contact method (Telegram username or phone number for WhatsApp); the chosen task; a free-form description of the business and project; approximate budget; the text of the enquiry.
• Legal basis: the visitor’s consent (art. 6(1)(1) of Law No. 152‑FZ), given as a separate document — the Consent to personal data processing — and steps taken at the visitor’s request before a contract (art. 6(1)(5)).
• Actions: collection, recording, organising, storage, updating, use, erasure, destruction.
• Period: until the purpose is achieved, but no longer than 1 year after the last message if no contract is signed, or until consent is withdrawn.

Please do not include other people’s data, health information, political or religious views or other special categories in your project description: they are not needed for the work.

5. Purpose: signing and performing a contract

• Whose data: clients and their representatives.
• What data: full name; contacts (phone, email, messenger); company name and tax number if the client is a business (needed for the receipt); project correspondence; payment details.
• Legal basis: a contract to which the client is a party (art. 6(1)(5)) and the duty to issue receipts under Federal Law No. 422‑FZ of 27 November 2018 on professional income tax (art. 6(1)(2)).
• Actions: collection, recording, organising, storage, updating, use, transfer to the tax authority when a receipt is issued in the “Moy Nalog” app, erasure, destruction.
• Period: for the term of the contract and 3 years after it is performed (the general limitation period, art. 196 of the Russian Civil Code).

6. Purpose: web analytics (Yandex Metrica)

The site uses Yandex Metrica to understand which pages are useful and to improve the site. Metrica is loaded only after the visitor allows analytics cookies in the banner. Without consent the counter is not loaded.

• Whose data: visitors who allowed analytics cookies.
• What data: cookies and browser identifiers; IP address; browser, operating system and device details; language and screen resolution; pages visited and referral source; date, time and length of the visit; actions on the site (sections viewed, form opened and steps, switching to a messenger).
• Not sent to Metrica: name, contacts, business description and enquiry text. Session recording (Webvisor) and advertising features are not used.
• Legal basis: the visitor’s consent (art. 6(1)(1)), given by pressing “Allow” in the cookie banner.
• Actions: collection, recording, storage, anonymisation, use as statistical reports, destruction.
• Period: cookies stay on the device for up to 1 year; statistics are used in anonymised form. Processing stops when consent is withdrawn.

Besides Metrica, the Tilda platform that hosts the site collects anonymised visit statistics for the technical operation of the site. Writing cookies to the visitor device is switched off for this on the site.

7. Purpose: site operation and security

• What data: IP address, browser details and technical cookies the site cannot work without (attack protection, load balancing), plus the cookie banner choice and the form draft, which are kept only in the visitor’s browser.
• Legal basis: providing the site at the visitor’s request (art. 6(1)(5)) and the Operator’s legitimate interest in protecting the site (art. 6(1)(7)).
• Period: hosting logs — within the hosting provider’s retention periods; browser data — until the visitor deletes it.

8. How data reaches the Operator

The site form. An enquiry from the form is first saved on the Tilda platform (Tilda Publishing) that runs the site. For Russian accounts the platform collects and stores data on servers in Russia. Tilda then forwards the enquiry text to the Operator in Telegram (see section 9).

Messengers. If a visitor chooses Telegram or WhatsApp and writes to the Operator directly, the data is also processed under that messenger’s rules, which the Operator does not control. The site sends nothing to a messenger without the visitor’s action: it only opens the chat and inserts or copies the text.

When the personal data of Russian citizens is collected, it is recorded, organised, accumulated, stored, updated and retrieved using databases located in the Russian Federation (art. 18(5) of Law No. 152‑FZ).

9. Who receives the data

The Operator does not sell personal data or pass it on for advertising. Data is processed on the Operator’s behalf by:

• Yandex LLC (Russia) — Yandex Metrica, only with consent to analytics cookies;
• Tilda Publishing — site hosting and receiving form enquiries, stored on servers in Russia.

Cross-border transfer. So the Operator receives enquiries quickly, Tilda forwards them to the Telegram messenger (Telegram Messenger Inc.), whose servers are outside Russia. Only the enquiry data is sent: name, contact method, chosen task, project description, budget. The legal basis is the visitor’s consent (art. 12(10) of Law No. 152‑FZ); the Operator has notified Roskomnadzor of the cross-border transfer (art. 12(3)). The original enquiry stays on servers in Russia.

Data may be disclosed to public authorities where the law requires.

10. Cookies

Cookies are small files a site stores in your browser.

• Necessary (Tilda platform, your cookie banner choice): always on; without them the site does not open or forgets your choice.
• Analytics (Yandex Metrica: _ym_uid, _ym_d, _ym_isad, _ym_metrika_enabled, yandexuid and other Yandex service files, up to 1 year): set only after you press “Allow”.

You can change your choice at any time with the “Cookie settings” link at the bottom of every page, or delete and block cookies in your browser settings. Refusing analytics cookies does not affect the site or the form.

11. Your rights

You can:

• find out which of your data is processed, why, by whom and for how long (art. 14 of Law No. 152‑FZ);
• ask for your data to be corrected, blocked or destroyed if it is incomplete, outdated, inaccurate or processed unlawfully;
• withdraw your consent to data processing and to analytics cookies;
• ask for processing to stop;
• complain about the Operator to Roskomnadzor or a court.

To use these rights, write to delina.romanenko@mail.ru or Telegram @di_va_branding. Please give the name and contact you left in your enquiry so the Operator can find your data.

The Operator replies within 10 working days of receiving the request; this may be extended by up to 5 working days with a reason. After consent is withdrawn, the Operator stops processing and destroys the data within 30 days, unless there is another legal basis to keep it (for example, a duty to keep contract documents).

12. How data is protected

The Operator is personally responsible for organising personal data processing. Only the Operator has access to enquiries and correspondence; the Tilda and Telegram accounts holding the data are protected by strong passwords and two-factor authentication (a cloud password in Telegram); data is not published or used for other purposes. The Operator takes the legal, organisational and technical measures required by arts. 18.1 and 19 of Law No. 152‑FZ.

The Operator notifies Roskomnadzor of any unlawful transfer of data within the periods set by art. 21(3.1) of Law No. 152‑FZ.

13. Deletion

When the processing period ends, the purpose is achieved, consent is withdrawn or unlawful processing is found, the data is deleted from the Operator’s Tilda and Telegram accounts, correspondence and files. Destruction is confirmed as required by Roskomnadzor Order No. 179 of 28 October 2022.

14. Changes

The Operator may update this policy. A new version applies from its publication on this page; the version date is shown at the top.