Consent to the Processing of Personal Data

The consent is given to the personal data operator who runs the site at https://odin337.ru and receives the enquiries sent through the contact form.

Legal name

Individual entrepreneur (ИП) Roshchupko Danila Vyacheslavovich (Рощупко Данила Вячеславович)

Taxpayer number (ИНН)

772648810450

State registration number (ОГРНИП)

326774600329483

Address

25/2 Sumskoy Proezd, Moscow, Russian Federation

Address for personal data requests

privacy@odin337.ru

The operator is one person, not a company: the individual entrepreneur named above is personally answerable for the processing, and decides alone what happens to these data. Everyone else who touches the data at all is named individually — with the legal name, the address and what exactly reaches them — in the section on recipients. That section also states which of them process on the operator's instructions (Article 6(3) of Federal Law No. 152-FZ) and which act as operators in their own right.

This consent covers only the data submitted through the contact form on https://odin337.ru. It does not extend to data you give the operator by other means — in an email, over the phone, or under a signed contract: that processing rests on a different legal basis, set out in the Personal Data Processing Policy.

The consent is given by you — the person filling in the form. The operator identifies you solely by the data you entered yourself: your name and email address, plus the company name and the contact channel you chose, if you gave them. The operator neither asks for nor keeps any identity document.

That is a deliberate choice. A consent in written form under Article 9(4) of Federal Law No. 152-FZ has to carry the details of an identity document, but written form is only mandatory in the cases the statute names expressly. This consent is given electronically, which Article 9(1) allows in any form that permits the fact of consent to be confirmed. Asking for passport details merely to answer an enquiry would collect data excessive in relation to the purpose, which Article 5(5) forbids outright.

The fact of consent is recorded at the moment the form is submitted. The following is stored alongside the enquiry itself, in the same row of the same database:

• the fact that the box was ticked — the form is not sent until it is;
• the version of this consent text in force at that moment;
• the date and time of the submission;
• the IP address the form was sent from;
• the user agent string — the browser and operating system details that a browser reports to any site it connects to.

The consent is given on your own behalf. The form is not a channel for other people's data: if you enter someone else's contact details, the operator has no way to verify that you were entitled to, and the submission would amount to processing the data of a person who never consented. Where the subject lacks legal capacity, the consent is given by their legal representative (Article 9(6) of Federal Law No. 152-FZ).

There is one purpose: to consider your enquiry and to answer it. That covers contacting you at the details you supplied to clarify the brief, preparing a reply or an indicative estimate, and the correspondence that follows on that enquiry — until the conversation ends or you withdraw this consent.

The list of purposes is closed. The data are not processed for anything not named above. In particular, this consent is not given for, and cannot be read as covering:

• advertising or newsletter mailings. Advertising sent by email requires its own separate prior consent (Article 18(1) of Federal Law No. 38-FZ on advertising), and this document is not one;
• profiling, or assessing your personal qualities, solvency or behaviour;
• decisions taken solely by automated processing that produce legal effects (Article 16(1) of Federal Law No. 152-FZ);
• passing the data to third parties for their own purposes, selling it, trading it, or adding it to anyone's marketing database;
• dissemination of personal data, meaning disclosure to an unlimited circle of people (Article 10.1). Nothing submitted through the form is published;
• site analytics — that is a separate decision you make in the cookie banner, not here.

The Yandex Metrica analytics tag, session recording by Webvisor included, loads only after separate explicit consent given in the banner. A refusal means the script is never loaded at all. Submitting the form has no bearing on that choice, and withdrawing this consent does not reverse the analytics decision or the other way round — see the cookie policy.

The consent covers the data listed below, and nothing beyond it. The list is exhaustive: the form collects nothing else, and the operator neither obtains data about you from outside sources nor enriches what you sent with them.

Name

A required field, exactly as you typed it. The operator does not verify it and does not require a full legal name.

Email address

A required field. The primary channel for the reply, and the only one if you gave no other contact channel.

Company name

An optional field. A company name is not personal data by itself, but next to your name it relates to you, so it is kept and destroyed together with the rest of the enquiry.

Contact channel: a phone number or a messenger handle

An optional field, and what goes into it is your choice: either a phone number or a messenger handle. By giving it you agree that the operator may reach you that way about this enquiry and nothing else — a call or a message at the address you picked yourself. There will be no marketing calls and no marketing messages.

The enquiry direction

A choice from a fixed list of the directions of work on offer. The field takes no free text. A direction is not personal data by itself, but alongside your name and email it relates to you, so it is kept and destroyed with the rest of the enquiry.

The budget band

A choice from fixed bands — not a figure, and not information about your finances. It exists for one thing: to tell the scale of the task before the conversation starts. It is not an assessment of your solvency and is not used for profiling.

Message text

A required free-text field. Everything you write in it is processed, so keep it to the point: no other people's data, no details of health, beliefs, religion or criminal record, no passwords and no payment credentials. The operator does not ask for any of that and does not need it to answer you.

Technical data recorded with the submission

The IP address, the user agent string, and the date and time of the submission. Recorded automatically with the enquiry and needed for two things: to evidence the fact of consent and to tell a person apart from an automated spam run.

The consent record

The fact of consent and the version of the text you agreed to. See the section on how the fact of consent is recorded.

Special categories of personal data — health, racial or ethnic origin, political opinions, religious beliefs, sex life — and biometric data are not processed, and this consent does not extend to them. If such information ends up in your message it will be there by your own choice; the operator will delete it on your request, or together with the whole enquiry when the retention period expires.

The consent covers the following operations on the data listed above (Article 3(3) of Federal Law No. 152-FZ): collection, recording, systematisation, accumulation, storage, updating and amendment, retrieval, use, transfer to the recipients named in the next section, blocking, erasure and destruction. The list is exhaustive.

The method is mixed. Some operations are automated — validating the form, writing to the database, sending the notification, deleting on schedule — and some are performed by a person without automation: reading the enquiry and replying to it. The operator takes no automated decisions that produce legal effects for you.

What happens once you press the submit button, in order:

1. Your browser sends the form to the operator's server at api.odin337.ru. That is the same machine in Moscow that serves the pages of the site, but a separate program: the request goes straight to it, bypassing the one that renders pages.
2. The server validates the contents of the form for correctness and required fields, and checks a hidden trap field that only automated scripts fill in. If validation fails, processing stops and nothing is stored.
3. The server verifies the Yandex SmartCaptcha response — the service that keeps automated submissions out. The captcha widget loads in your browser, so its provider (a Russian company) sees your IP address and the technical parameters of the connection; the contents of the form fields are not passed to it.
4. The data are written to PostgreSQL on a dedicated server in Moscow, Russian Federation. This is the primary record, and it is created before any other processing — which is how the requirement of Article 18(5) of Federal Law No. 152-FZ, that the database be located in Russia, is actually met.
5. Only after that write succeeds does a notification email go to the operator — to the operator's own mail server, running on the same machine. The message carries the same data and serves as an alert; no third-party mail service is involved, and the contents of the enquiry never leave the server.
6. Your browser receives the confirmation. The data go nowhere else.

The list of recipients is exhaustive: beyond those named below, nobody has access to your data. Each is given as Article 9(4)(6) of Federal Law No. 152-FZ requires — by legal name and address, not by role alone. The leads database itself is PostgreSQL on a dedicated server in Moscow, Russian Federation.

The operator

Roshchupko Danila Vyacheslavovich (Рощупко Данила Вячеславович) — reads the enquiry and replies to it. The only party that works with the content of your data.

Verifying that a human and not a script submitted the form (SmartCaptcha)

Yandex.Cloud LLC (ООО «Яндекс.Облако»). Address: 16 Lva Tolstogo St., Moscow, 119021, Russian Federation. Receives: IP address, connection parameters and in-widget behaviour. Not the form contents. Acts as an operator in its own right for the data it sees: its own purpose, not processing on the operator's instructions.

Site analytics — only with your consent

Yandex LLC (ООО «ЯНДЕКС»). Address: 16 Lva Tolstogo St., Moscow, 119021, Russian Federation. Receives: Pseudonymous visit data and Webvisor recordings. Not loaded without consent. Acts as an operator in its own right for the data it sees: its own purpose, not processing on the operator's instructions.

The data you submit through the form are recorded in Russia and do not leave it: they go straight to the operator's server (PostgreSQL on a dedicated server in Moscow, Russian Federation), and nobody other than the operator receives the contents of an enquiry. The site's pages are served from that same server in Moscow, so simply viewing the site does not send your IP address outside the country either. There is no cross-border transfer under Article 12 of Federal Law No. 152-FZ in this arrangement.

The following are not part of the chain and receive no form data: CRM systems, third-party form or mailing services, advertising platforms and any analytics system. The platform serving the pages receives no form contents either: it hands the browser HTML, CSS and JavaScript, and the form is submitted past it — but the IP address and user agent of a page request do reach it, as stated above.

Messengers, separately, because this is easy to mislead about. There is no automated delivery of enquiries into a messenger — no bot, no integration: that was removed when the site was rebuilt and will not return. But if you gave a messenger handle as your contact channel, the reply goes there: to the address you chose yourself, and nowhere else.

Data are disclosed to public authorities only on a reasoned request, in the cases the law provides for and to the extent the law requires. No consent is needed for that, and withdrawing this consent does not remove the obligation.

The consent takes effect when the form is submitted and lasts until the first of two events: the expiry of 365 days from the date of submission, or the operator's receipt of your withdrawal.

The 365-day term follows the rule in Article 5(7) of Federal Law No. 152-FZ: data are kept no longer than the purpose requires. It is long enough to pick up the thread if you come back with the same question a few months later, and short enough that the database does not become an indefinite archive of everyone who once filled in a form.

When the term runs out the record is destroyed automatically: a scheduled job removes it from the database without human involvement. The fact of destruction is recorded by the lead receiver as the job runs; the destroyed data themselves are not kept in that record. Each new submission is a new consent with a term of its own, not an extension of the previous one.

If the enquiry leads to a contract, the data needed to perform it and to satisfy accounting and tax rules are kept on a different basis — performance of the contract and statutory obligation under Article 6(1) of Federal Law No. 152-FZ, not this consent — and for the periods those rules set. They are not used to contact you about anything new.

You may withdraw this consent at any time and without giving reasons (Article 9(2) of Federal Law No. 152-FZ). To do so, write to privacy@odin337.ru.

So that the operator can find your record without having to write back with questions, the message needs to state:

• in your own words, that you are withdrawing your consent to the processing of your personal data;
• the email address you gave in the form: it is what locates the enquiry in the database;
• the name as you typed it in the form and the approximate date of the submission — if there was more than one enquiry, or if your email address has changed since;
• the address the confirmation should go to, if it differs from the address you are writing from.

What follows a withdrawal: processing stops, and the data are destroyed within no more than 30 days of the withdrawal being received (Article 21(5) of Federal Law No. 152-FZ). A confirmation is sent to the address the withdrawal came from. Any other request — whether your data are being processed, and how — is answered within 10 working days (Article 20(1)).

The one exception is data the operator is required by law to keep, or that are needed to perform a contract already concluded: those are retained on that basis and to the extent the law prescribes, but are no longer used to contact you. Everything else is deleted.

Withdrawal is not your only right. Article 14 of Federal Law No. 152-FZ also entitles you to confirmation that your data are being processed and to information about that processing, to demand that inaccurate data be corrected, blocked or destroyed, and to challenge the operator's actions before Roskomnadzor or in court. Those rights, and how to exercise them, are enumerated in the Personal Data Processing Policy.

Withdrawing has no consequences for you beyond ending the correspondence the form began. It does not make the processing carried out before it was received unlawful, and it does not touch your analytics decision: that is governed by the cookie policy, not by this document.

By ticking the box and submitting the form you confirm that:

• you are giving this consent freely, by your own will and in your own interest (Article 9(1) of Federal Law No. 152-FZ);
• you read this text and the Personal Data Processing Policy before ticking the box, and you understand what data are processed and why;
• the data you entered relate to you and are accurate, and the form contains no other person's data;
• you have the legal capacity required to give consent — or the consent is being given by your legal representative.

The consent is voluntary. You are not obliged to give it, and refusing costs you nothing except one channel: the form simply will not send. You can still write to the operator directly at privacy@odin337.ru — in which case the only data processed are the ones you chose to put in your message.

The version number and the effective date appear at the top of this document. The version in force is always published at /legal/consent.

When the form is submitted, the version number of the text that was shown to you at that moment is stored together with the enquiry. That makes it possible to establish afterwards exactly which wording you agreed to — not from a date and not from memory, but from a value in the same database row as the enquiry itself.

Amendments do not apply retroactively. A new version governs enquiries submitted after it is published; a consent given earlier remains in force in the wording that was accepted. A substantive change — a new purpose, new data, a new recipient or a different retention period — raises the minor version number; a typo fix that does not alter the meaning raises the patch number only.