Personal Data Processing Policy

The operator of the personal data processed on https://odin337.ru is Roshchupko Danila Vyacheslavovich (Рощупко Данила Вячеславович), an individual entrepreneur (ип) registered in the Russian Federation.

Taxpayer number (ИНН)

772648810450

State registration number (ОГРНИП)

326774600329483

Address

25/2 Sumskoy Proezd, Moscow, Russian Federation

Address for personal data requests

privacy@odin337.ru

Any request arising from this policy — for information about the processing, for rectification, blocking, erasure, or withdrawal of consent — is accepted at the address above. No special form is required: a message making clear who is asking and what for is enough.

Personal data

Any information relating to a directly or indirectly identified individual (Article 3(1) of Federal Law No. 152-FZ). A name and an email address are the obvious examples; an IP address together with a request timestamp is one as well.

Data subject

The individual the data relates to. In this policy that is you: a visitor to the site, a person who submits the form, or a client.

Processing

Any operation performed on data, from collection to destruction, including storage, use and transfer (Article 3(3) of Federal Law No. 152-FZ). Looking at a record is processing too.

Operator

The person who determines the purposes of the processing and the set of data processed — here, the individual named above. In GDPR terms this is the controller, not a processor: responsibility for what happens to the data rests with them, not with contractors.

Pseudonymisation

Processing after which the data cannot be attributed to a person without additional information (Article 3(9) of Federal Law No. 152-FZ). The term is needed only in the analytics section.

This policy applies to all personal data the operator obtains in connection with https://odin337.ru: through the contact form, from the technical logs of the server that receives it, from the web analytics system, and from correspondence that began with one of those.

It does not replace a contract. Where a development contract exists between you and the operator, the processing of your employees' and users' data is governed by that contract and the instruction issued under it (Article 6(3) of Federal Law No. 152-FZ), not by this policy. The terms for using the site itself are in the Terms of Use.

The site is not intended for children and does not knowingly collect their data. The form does not ask for an age; if it becomes known that a submission came from a child, the data is erased on a request from either parent.

There are five purposes and the list is exhaustive. Data obtained for one of them is not used for another without a fresh legal basis.

Answering an enquiry and preparing a proposal

Reading the enquiry, contacting you through the channel you gave, asking clarifying questions, scoping the work and quoting a timeline and a price. This is the purpose the form exists for.

Performing a contract

Where an enquiry led to a contract — corresponding about the project, delivering the work, invoicing, and meeting accounting and tax record-keeping obligations.

Confirming that a human submitted the form

Protecting the form from automated submissions. Without this check the operator's mailbox and the leads database fill with junk within a day — and with it, data about people who submitted nothing.

Keeping the site working and secure

The technical logs of the server that receives submissions, and the `langPinned` cookie recording that a language was chosen deliberately. The logs exist to explain why a submission failed and to notice brute-force attempts; they are not used to analyse behaviour.

Web analytics — only with your consent

Understanding which pages are read and where visitors leave, in order to fix the site. Yandex Metrica is used. Without a separate consent the counter is not loaded at all — not run in some pseudonymous mode, but never attached. Details are in the Cookie Notice.

The data is not used for advertising, not shared with ad networks, not sold and not traded. There is no profiling. No decision producing legal effects is taken by automated means (Article 16 of Federal Law No. 152-FZ).

Each purpose rests on its own basis. One basis does not cover everything: consent withdrawn for analytics does not cancel the duty to keep accounting records, and terminating a contract does not cancel the consent given when the form was submitted.

Consent of the subject — Article 6(1)(1)

The basis for processing the form data and for web analytics. The two consents are given separately and withdrawn separately: the checkbox under the form does not switch analytics on, and consent to analytics does not permit an enquiry to be processed. The text of the first is the Consent to Personal Data Processing.

Performance of a contract — Article 6(1)(5)

The basis for processing the data of a contracting party and its representatives, and for the technical processing without which a submission physically cannot happen: the server log and the `langPinned` cookie, which is set in response to your own action.

A statutory obligation — Article 6(1)(2)

The basis for retaining primary accounting documents and data the operator is required to keep as an individual entrepreneur. Such documents are not erased on withdrawal of consent — the law expressly permits processing to continue (Article 9(2) of Federal Law No. 152-FZ) — and the processing is limited to what that requires.

Categories of subjects: visitors to the site, people who submit the form, clients, and representatives of clients. There are no others — the site has no user accounts, no registration, and does not collect data about third parties through its visitors.

The list of data is exhaustive:

• Your name, as you typed it; no check for authenticity is performed.
• Your email address — the primary channel for a reply.
• Company name — if given; the field is optional.
• A contact channel: a phone number or a messenger handle, at your choice and only if you supplied one.
• The enquiry direction — a choice from a fixed list.
• The budget band — a choice from a fixed list of ranges.
• The message text — whatever you decided to write in it. Please do not include identity document numbers, card details or other people's personal data: the field is not intended for them.
• Technical data of the submission: IP address, user agent and timestamp. Recorded with the enquiry — this is the evidence that consent was given at that moment.
• The consent record: the fact, the version of the text, and the time.

Special categories of personal data (race, ethnicity, political opinions, religious beliefs, health, sex life) and biometric personal data are not processed — neither through the form nor by any other means.

The processing is mixed: some operations are automated, others are performed by a person reading the enquiry. They comprise collection, recording, systematisation, accumulation, storage, rectification, retrieval, use, transfer to the recipients named below, blocking, erasure and destruction. There is no dissemination — that is, no disclosure to an indeterminate group of people.

The path of a single submission, step by step:

1. The browser posts the form straight to the operator's server in Russia. The site's pages are served by a different platform, and form data does not pass through it.
2. The server validates the fields against a closed schema: anything extra is discarded rather than kept just in case.
3. The submission is checked to confirm a human sent it. Without a passed check the submission is rejected — this step is not optional.
4. The data is written to PostgreSQL on a dedicated server in Moscow, Russian Federation. This is the primary record, and it happens before any other processing.
5. Only after the write succeeds is a notification sent to the operator's mailbox. If the write failed there is no email and you get an error, not a false success.
6. The operator reads the enquiry and replies through the channel you gave.

The recording, systematisation, accumulation, storage, rectification and retrieval of the personal data of Russian citizens are carried out using a database located in Russia, as Article 18(5) of Federal Law No. 152-FZ requires. The database is PostgreSQL on a dedicated server in Moscow, Russian Federation.

The requirement is met by the order of operations and not merely by the server's address: the primary record is created in that database before the data reaches anywhere else, including the operator's mailbox. No copies of submissions are created in foreign services.

The list of recipients is exhaustive. Beyond those below, data is disclosed only where the law directly requires it — on a reasoned demand from a state authority entitled to make one.

Verifying that a human and not a script submitted the form (SmartCaptcha)

Yandex.Cloud LLC (ООО «Яндекс.Облако»). Address: 16 Lva Tolstogo St., Moscow, 119021, Russian Federation. Receives: IP address, connection parameters and in-widget behaviour. Not the form contents. Acts as an operator in its own right for the data it sees: its own purpose, not processing on the operator's instructions.

Site analytics — only with your consent

Yandex LLC (ООО «ЯНДЕКС»). Address: 16 Lva Tolstogo St., Moscow, 119021, Russian Federation. Receives: Pseudonymous visit data and Webvisor recordings. Not loaded without consent. Acts as an operator in its own right for the data it sees: its own purpose, not processing on the operator's instructions.

Recipients acting on the operator's instructions process the data only within the scope of those instructions and are bound to confidentiality and to the requirements of Article 19 of Federal Law No. 152-FZ. Recipients acting as operators in their own right answer for their own processing; their policies are published on their own sites.

There is no cross-border transfer of personal data. What you type into the form is recorded in Russia and is not transferred outside it; the leads database, the mail server and the human-verification check are all located in Russia. No notification under Article 12 of Federal Law No. 152-FZ is required and none has been filed.

This covers ordinary browsing, not only form submissions. The pages, scripts, stylesheets and fonts are served by the same Moscow server that stores the enquiries: there are no third-party CDNs and no externally hosted fonts. Your browser contacts exactly two other domains, both Russian: a Yandex domain for the human-verification widget when you open the form, and the Yandex Metrica domain only if you have accepted analytics. No foreign origin appears on any page, and that restriction is written into the Content Security Policy the browser enforces on its own.

An enquiry is kept for 365 days from receipt and is then destroyed automatically — by a scheduled job, not because someone remembered to do it. The term follows Article 5(7) of Federal Law No. 152-FZ: long enough to pick up a conversation started six months ago, short enough that the database is not an indefinite archive of everyone who once filled in a form.

• Data is erased sooner if you ask for it or withdraw consent — except where the law obliges the operator to keep a document.
• Achieving the purpose also ends the processing: if a conversation led to no contract and you asked for the correspondence to be deleted, it is deleted.
• The data of a contracting party is kept while the contract is in force and thereafter for as long as accounting and tax rules require.
• Destruction is recorded by the same job that performs it: the row leaves the database, and that is visible in the job's log.

Where destruction is required following your request, it is carried out within 30 days (Article 21(5) of Federal Law No. 152-FZ). Where destruction is impossible — a document that must be retained, for instance — the processing is blocked instead: the data remains, but nothing further is done with it.

The rights below are yours by law and do not depend on whether the operator is happy about them. Exercising them is free, and you do not have to explain why.

To learn whether your data is processed — Article 14(1)

And if so — to receive information about it: the legal basis and the purposes, the methods used, the data being processed and where it came from, the retention periods, who it is disclosed to, and the names of any processors (Article 14(7) of Federal Law No. 152-FZ). The answer is given in an accessible form and contains no data about other people.

Rectification, blocking or destruction — Articles 14(3), 21(1)

Where the data is incomplete, out of date, inaccurate, unlawfully obtained, or unnecessary for the stated purpose. The operator must rectify it within seven working days of the fact being confirmed and must block the processing while the matter is checked.

To withdraw consent — Article 9(2)

At any moment and without explanation. The procedure is in the Consent to Personal Data Processing; consent to analytics is withdrawn separately, using the switch in the Cookie Notice. Withdrawal does not make the processing that preceded it unlawful.

To object to decisions and to marketing

No decision producing legal effects is taken by automated means (Article 16 of Federal Law No. 152-FZ) and the operator sends no marketing (Article 18 of Federal Law No. 38-FZ requires prior consent), but the right to object exists whether or not the operator uses such tools.

To appeal — Article 14(5)

The operator's acts or omissions may be appealed to Roskomnadzor — the authority for the protection of data subjects' rights — or to a court. There is no obligation to contact the operator first, though it is usually quicker.

Send a request to privacy@odin337.ru. It is answered within 10 working days of receipt (Article 20(1) of Federal Law No. 152-FZ). Where more time is needed, the period may be extended by no more than five working days, with notice of the reasons.

The law requires a request to make clear who is asking (Article 14(3) of Federal Law No. 152-FZ): information confirming your identity, an indication of what connects you to the operator — the date and subject of the enquiry you sent, or the email address it came from — and a signature. A message from the same address that was given in the form usually settles the point by itself.

The list below is the measures actually in place, not the measures it is customary to claim. Article 18.1(2) of Federal Law No. 152-FZ requires information about implemented measures to be published, and the word implemented is taken literally here.

• Data travels from browser to server over HTTPS only. The site declares HSTS, so a browser will not open it over an unencrypted connection even from a direct link.
• The form is accepted against a closed schema: fields that are not part of it are discarded rather than kept in reserve.
• Form requests are signed: the receiver accepts them only from this site and rejects everything else. A request rate limit is in place.
• The human-verification check runs server-side. If its key is not configured the receiver returns an error and accepts nothing — the check cannot be bypassed by switching it off.
• A strict Content Security Policy limits what code the page may execute and where it may connect.
• Access to the database and the server belongs to the operator named above and to nobody else. There are no employees, no contractors and no shared accounts. Server login is by key only; password login is disabled.
• Database backups are held in Russia, with the same provider as the database itself, and are subject to the same retention period.
• Removal of expired enquiries is performed by a scheduled job, not by hand.

The operator is an individual entrepreneur working alone. There is no separate person responsible for organising the processing of personal data, because there is nobody to appoint: the duties Article 18.1(1)(1) of Federal Law No. 152-FZ places on such a person are discharged by the operator directly. There are no certifications, no independent audits and no penetration tests, and claiming otherwise would be untrue.

A form collecting a name and an email address does not fall within the exemptions from the duty to notify Roskomnadzor: a notification under Article 22 of Federal Law No. 152-FZ is required. As at the date of this revision it has been prepared but not yet filed, and the operator is not yet listed on the register of personal data operators.

This policy may change — when the law changes, or when what actually happens to the data changes. The current version is always at /legal/privacy, with its number and effective date shown next to the heading.

Superseded versions remain recoverable: the text is kept in the project's version history, and any earlier wording can be obtained by its number on request to the operator. There is no separately published archive of past versions.

Amending this policy does not retroactively rewrite a consent you have already given: a consent attaches to a specific version of the text, that version number is stored with the enquiry, and if a new version asks more of you, consent is sought again.