Privacy Policy for Personal Data of Website Users

1. General Provisions

1.1. This Privacy Policy for personal data of website users (hereinafter referred to as the "Policy") is developed in compliance with the requirements of Article 18.1 of the Federal Law of July 27, 2006, No. 152-FZ "On Personal Data," as well as other regulatory legal acts of the Russian Federation in the field of protection and processing of personal data.
1.2. Individual Entrepreneur Kolesnikov Vladimir Ivanovich (TIN/INN: 772974815897, OGRNIP: 324774600526828, address: 115280, Moscow, Masterkova St., 1, apt. 240) (hereinafter referred to as the "Operator") ensures the protection of processed personal data from unauthorized access and disclosure, unlawful use, or loss in accordance with the requirements of the Federal Law of July 27, 2006, No. 152-FZ "On Personal Data."
1.3. The Policy is a publicly available document that applies only to the website located on the Internet information and telecommunications network at: https://www.annakolesnikova.com/ (hereinafter referred to as the "Website").
1.4. The Policy does not apply to third-party websites to which the personal data subject may gain access through the Website.
1.5. The Policy establishes mandatory general requirements and rules for the Operator's employees involved in the processing of personal data regarding work with all types of media containing personal data of the Website users.
1.6. The Policy does not apply to the security of personal data classified as state secrets of the Russian Federation.
1.7. The terms contained in Article 3 of the Personal Data Law are used in this Policy with the same meaning.
1.8. This Policy also uses the following terms:

• Personal Data Subject, Website User/Visitor: any person visiting the Website and using its information, materials, and services.
• Website: a set of software and hardware for computers that ensures the publication for public viewing of information and data united by a common purpose, through technical means used for communication between computers on the Internet.
• Confidentiality of Personal Data: a mandatory requirement for the Operator or any other person who has gained access to personal data not to disclose to third parties or distribute personal data without the consent of the personal data subject or the existence of another legal basis provided by federal law.

1.9. Basic rights and obligations of the Operator.
1.9.1. The Operator has the right to:

• independently determine the composition and list of measures necessary and sufficient to fulfill the obligations provided by the Personal Data Law and the regulatory legal acts adopted in accordance with it, unless otherwise provided by this law or other federal laws;
• entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by federal law, on the basis of a contract concluded with this person. The person processing personal data on behalf of the Operator is obliged to comply with the principles and rules of personal data processing provided by the Personal Data Law, maintain the confidentiality of personal data, and take necessary measures to ensure the fulfillment of the obligations provided by the said law;
• receive reliable information and/or documents containing personal data from the User for the processing purposes specified in clause 2.3 of the Policy;
• in case of the User's withdrawal of consent to the processing of personal data, as well as the submission of a request to terminate the processing of personal data, the Operator may continue processing personal data without the consent of the personal data subject only if there are grounds specified in the Personal Data Law.

1.9.2. The Operator is obliged to:

• organize the processing of personal data exclusively for the purposes specified in clause 2.3 of the Policy, in the manner established by the current legislation of the Russian Federation;
• provide the User with information regarding the processing of their personal data upon request;
• respond to inquiries and requests of the User and their legal representative in accordance with the requirements of the Personal Data Law;
• provide the authorized body for the protection of personal data subjects' rights with the necessary information within the timeframes established by law upon its request;
• take legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, provision, or distribution of personal data, as well as from other unlawful actions regarding personal data;
• cease the transfer (distribution, provision, access) of personal data, terminate processing, and destroy personal data in the manner and cases provided for by the Personal Data Law;
• fulfill other obligations provided for by the Personal Data Law.

1.10. Basic rights and obligations of the User.
1.10.1. The User has the right to:

• receive information regarding the processing of their personal data, including information about the Operator, confirmation of the fact of processing, as well as the right to access their personal data, except in cases provided for by the legislation of the Russian Federation;
• demand that the Operator clarify, block, or destroy their personal data if the personal data is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing, as well as take measures provided by law to protect their rights;
• withdraw consent to the processing of personal data, as well as submit a request to terminate the processing of personal data;
• appeal the actions or inaction of the Operator to the authorized body for the protection of personal data subjects' rights or in court, if they believe that the latter is processing their personal data in violation of the requirements of the Federal Law of July 27, 2006, No. 152-FZ "On Personal Data" or otherwise violates their rights and freedoms;
• exercise other rights provided for by the legislation of the Russian Federation.

1.10.2. The User is obliged to:

• ensure the accuracy of the personal data provided to the Operator, necessary for the processing purposes provided for in clause 2.3 of the Policy;
• inform the Operator of any clarification (update, change) of their personal data.

1.11. Liability for violation of the requirements of the legislation of the Russian Federation and the Operator's regulatory acts in the field of processing and protection of personal data is determined in accordance with the legislation of the Russian Federation.

2. Purposes and Legal Grounds for Processing Personal Data

2.1. The processing of personal data is limited to the achievement of specific, predetermined, and lawful purposes. Processing of personal data incompatible with the purposes of collection is not allowed.
2.2. Only personal data that meet the purposes of their processing shall be processed.
2.3. Processing of personal data by the Operator on the Website is carried out for the following purposes:

• preparation, conclusion, and execution of civil law contracts;
• establishing feedback on the Operator's Website, as well as providing customer and technical support;
• promotion of goods, works, and services in the market;
• collection and analysis of statistical data to improve the operation of the Operator's Website;
• sending advertising information to the subject (including in the form of advertising and other informational mailings);
• disclosure of information about the organization's activities in the Operator's official social media accounts, including the publication of reviews and photo/video materials.

2.4. Regulatory legal acts in execution of which and in accordance with which the Operator processes personal data:

• Constitution of the Russian Federation;
• Civil Code of the Russian Federation;
• Law of the Russian Federation of 07.02.1992 No. 2300-I "On Consumer Rights Protection";
• Federal Law of 27.07.2006 No. 149-FZ "On Information, Information Technologies and on the Protection of Information";
• Federal Law of 27.07.2006 No. 152-FZ "On Personal Data";
• Federal Law of 26.12.2008 No. 294-FZ "On the Protection of the Rights of Legal Entities and Individual Entrepreneurs in the Exercise of State Control (Supervision) and Municipal Control";
• Decree of the President of the Russian Federation of 06.03.1997 No. 188 "On Approval of the List of Confidential Information";
• Decree of the Government of the Russian Federation of 01.11.2012 No. 1119 "On Approval of Requirements for the Protection of Personal Data during their Processing in Personal Data Information Systems";
• Order of FSTEC of Russia of 18.02.2013 No. 21 "On Approval of the Composition and Content of Organizational and Technical Measures to Ensure the Security of Personal Data during their Processing in Personal Data Information Systems";
• other regulatory legal acts regulating relations related to the Operator's activities.

2.5. The legal grounds for processing personal data also include:

• processing of personal data is carried out with the consent of the personal data subject to the processing of their personal data;
• processing of personal data is necessary to achieve the goals provided by an international treaty of the Russian Federation or law, to exercise and perform the functions, powers, and duties assigned to the operator by the legislation of the Russian Federation;
• processing of personal data is necessary for the performance of a contract to which the personal data subject is a party, beneficiary, or guarantor, as well as for the conclusion of a contract at the initiative of the personal data subject or a contract under which the personal data subject will be a beneficiary or guarantor. A contract concluded with the personal data subject cannot contain provisions restricting the rights and freedoms of the personal data subject, establishing cases of processing personal data of minors, unless otherwise provided by the legislation of the Russian Federation, as well as provisions allowing the inaction of the personal data subject as a condition for concluding the contract.

3. Scope and Categories of Processed Personal Data, Categories of Data Subjects

3.1. The content and volume of processed personal data must correspond to the stated processing purposes provided for in Section 2 of this Policy. Processed personal data must not be excessive in relation to the stated purposes of their processing.
3.2. The Operator may process personal data of the following categories of personal data subjects:
3.2.1. Operator's counterparties, including their representatives, clients, and website visitors - for the purpose of preparing, concluding, and executing civil law contracts: surname, first name, patronymic; email address; residential address; registration address; phone number.
3.2.2. Website visitors - for the purpose of sending advertising information to the subject (including in the form of advertising and other informational mailings): surname, first name, patronymic; email address; phone number.
3.2.3. Counterparties, clients of the Operator - for the purpose of disclosing information about the organization's activities on the Website and in the Operator's official social media accounts, including the publication of reviews and photo/video materials: surname, first name, patronymic; profession; education details; photo/video image of the face.
3.2.4. Website visitors, clients, and counterparties of the Operator - for the purpose of promoting goods, works, and services in the market: surname, first name, patronymic; email address; phone number; information collected via metric programs.
3.2.5. Website visitors - for the purpose of collecting and analyzing statistical data to improve the operation of the Operator's Website: surname, first name, patronymic; email address; phone number; information collected via metric programs.
3.2.6. Website visitors - for the purpose of establishing feedback on the Operator's Website, as well as providing customer and technical support: surname, first name, patronymic; email address; phone number.
3.3. The Operator does not process biometric personal data (data characterizing physiological and biological features of a person, on the basis of which their identity can be established), as well as special categories of personal data concerning racial or national origin, political views, religious or philosophical beliefs, health status, or intimate life, except in cases provided for by the legislation of the Russian Federation.
3.4. All personal data should be obtained directly from the User. In case of obtaining consent to the processing of personal data from a representative of the User, their authority must be confirmed in the manner prescribed by law.

4. Procedure and Conditions for Processing Personal Data

4.1. Processing of personal data is carried out by the Operator in accordance with the requirements of the legislation of the Russian Federation by the following methods:

• non-automated processing of personal data;
• automated processing of personal data with or without transmission of the obtained information over information and telecommunication networks;
• mixed processing of personal data.

4.2. List of actions performed by the Operator with the personal data of personal data subjects for the purposes provided for in clause 2.3 of the Policy:
collection; recording; systematization; accumulation; storage; clarification (updating, changing); extraction; use; transfer (provision, access); depersonalization; blocking; deletion; destruction; distribution.
4.3. Processing of personal data is carried out by the Operator with the consent of the personal data subjects to the processing of their personal data, as well as without such consent in cases provided for by the legislation of the Russian Federation.
4.4. Access to personal data is provided only to those Operator employees whose job duties involve the processing of personal data. The list of such employees is determined by the Operator's local regulatory acts and approved by the Operator's order.
4.5. The Operator carries out the distribution of personal data permitted by the User for distribution, i.e., performs actions aimed at their disclosure to an indefinite circle of persons, in compliance with the requirements, prohibitions, and conditions established by Part 9 of Art. 9, Art. 10.1 of the Personal Data Law. Disclosure to third parties and distribution of personal data without the User's consent is not allowed, unless otherwise provided by federal law. Consent to the processing of personal data permitted by the User for distribution is оформляется (executed) separately from other consents of the User to the processing of their personal data. The requirements for the content of consent to the processing of personal data permitted by the personal data subject for distribution are approved by Roskomnadzor Order of 24.02.2021 No. 18.
4.6. Transfer of personal data to state authorities, local self-government bodies, and other authorized bodies is carried out within the framework of fulfilling the requirements of the legislation of the Russian Federation, subject to mandatory verification of the lawfulness and validity of such a request.
4.7. The Operator guarantees the confidentiality of the User's received personal data. When processing personal data, the Operator takes or ensures the adoption of necessary legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, provision, distribution of personal data, as well as from other unlawful actions regarding personal data.
4.7.1. The security of personal data is achieved by the following methods:

• identifying threats to the security of personal data during their processing in personal data information systems;
• applying organizational and technical measures to ensure the security of personal data during their processing in personal data information systems, necessary to meet the requirements for the protection of personal data;
• using information protection tools that have passed the conformity assessment procedure in the prescribed manner;
• adopting local regulatory acts and other documents regulating relations in the field of processing and protection of personal data;
• appointing a person responsible for organizing the processing of personal data;
• assessing the effectiveness of the applied measures to ensure the security of personal data;
• accounting for machine carriers of personal data;
• detecting facts of unauthorized access to personal data and taking appropriate measures;
• restoring personal data modified or destroyed as a result of unauthorized access;
• establishing rules for access to personal data processed in the personal data information system, as well as ensuring the registration and accounting of all actions performed with personal data in the personal data information system;
• exercising constant control over the measures taken and the security level of personal data information systems;
• training Operator employees directly involved in the processing of personal data on the provisions of the legislation of the Russian Federation.

4.8. The Operator stores personal data in a form allowing the identification of the personal data subject for no longer than required by each processing purpose, unless the storage period of personal data is established by federal law or contract.
4.8.1. In case the documents generated in the course of the Operator's activities containing personal data become archival documents, their storage period may be determined in accordance with Rosarkhiv Order of 20.12.2019 No. 236 "On Approval of the List of Typical Management Archival Documents Generated in the Course of Activities of State Bodies, Local Self-Government Bodies, and Organizations, Indicating Their Storage Periods."
4.8.2. The storage period of personal data processed in personal data information systems corresponds to the storage period of personal data on paper media.
4.9. The processing period of personal data is determined by the achievement of the purposes for which they were collected, unless a different period is provided by a contract or agreement with the User, as well as by current legislation.
4.9.1. Conditions for the termination of personal data processing may include: the achievement of the purposes of processing personal data or the loss of necessity in achieving these purposes, the expiration of the consent period or the withdrawal of consent to the processing of personal data (if there are no other grounds for processing personal data provided by legislation), the detection of unlawful processing of personal data, as well as in case of cessation of the Operator's activities.
4.10. Upon the User's request to the Operator to terminate the processing of personal data, processing shall cease within a period not exceeding ten working days from the date the Operator receives the corresponding request, except in cases provided for by the Law. This period may be extended, but by no more than five working days. For this, the Operator must send the User a motivated notification indicating the reasons for the extension.
4.11. When collecting personal data via the "Internet" information and telecommunication network, the Operator ensures the recording, systematization, accumulation, storage, clarification (updating, changing), and extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except in cases specified in the Personal Data Law.
4.12. The Operator ensures the confidentiality and security of personal data during their processing in accordance with the requirements of the Operator's local regulatory acts and the requirements of current legislation.
4.13. The User has the right to refuse the mailing of information by sending a written statement to the Operator at the email address specified in clause 6.3 of the Policy, with a request to terminate the processing of their personal data in this manner. From the moment the Operator receives such a statement, the User's personal data is immediately excluded from the mailing list.
4.14. Cross-border transfer of personal data by the Operator is not carried out.
4.15. To analyze User behavior on the Website, improve the quality of its operation and content, as well as for targeting advertising materials, the Website uses metric programs (web analytics services).
4.15.1. By using the Website, the User agrees to the automatic processing of data transmitted by their browser using the specified programs, including: IP address, cookie data, browser information, technical characteristics of equipment and software, date and time of access, addresses of requested pages, and other similar information.
4.15.2. The Website uses the following metric programs:
Yandex.Metrica. Data processing is carried out in accordance with Yandex's Privacy Policy: https://yandex.ru/legal/confidential/.
4.15.3. Metric programs collect generalized statistical information that does not identify a specific User and is not used to establish their identity. The obtained data is intended to understand how Users interact with the Website and helps the Operator improve its functionality and content.
4.15.4. The User can prohibit data collection by metric programs by disabling cookies in their browser settings or using special software tools to block them.
4.15.5. Disabling the use of metric programs may lead to a deterioration in the quality of the Website's operation and limit the availability of some of its functions.
4.16. The Operator transfers personal data to the following third parties:

• Limited Liability Company "Yandex", TIN: 7736207543. Address: 119021, Moscow, Lev Tolstoy St., 16. Purpose of data transfer: collection and analysis of statistical data to improve the operation of the Operator's Website.
• Joint Stock Company "Tilda Publishing", TIN: 9707041449. Address: 107031, Moscow, Petrovskie Linii St., 2, premise 4/1. Purpose of data transfer: provision of hosting services.

4.17. Persons processing personal data of Users on behalf of the Operator are obliged to comply with the principles and rules of personal data processing provided by the legislation of the Russian Federation.

5. Updating, Correction, Deletion, Destruction of Personal Data, Responses to Subject Access Requests

5.1. Procedure for providing access to personal data based on an application (request).
5.1.1. Information provided for in Part 7 of Art. 14 of the Personal Data Law is provided to the User within ten working days from the date the Operator receives the request. This period may be extended by no more than five working days, provided a motivated notification is sent to the User.
5.1.2. The Operator provides the requested information to the User or their representative in the form in which the corresponding application or request was sent, unless otherwise specified in the application or request. If the application (request) does not reflect all necessary information in accordance with Part 3 of Art. 14 of the Personal Data Law, or the personal data subject does not have access rights to the requested information, a motivated refusal is sent.
5.1.3. The User's right to access their personal data may be restricted in accordance with Part 8 of Art. 14 of the Personal Data Law, including if access to their personal data violates the rights and legitimate interests of third parties.
5.2. Procedure for updating and correcting personal data.
5.2.1. In case of detecting inaccurate personal data upon the User's or their representative's application or request, or upon the request of the authorized body for the protection of personal data subjects' rights, the Operator blocks the personal data relating to this User from the moment of such application or receipt of the specified request for the verification period, if blocking the personal data does not violate the rights and legitimate interests of the User or third parties.
5.2.2. In case of confirmation of the fact of inaccuracy of personal data, the Operator, on the basis of information provided by the User or their representative, or the authorized body for the protection of personal data subjects' rights, or other necessary documents, clarifies the personal data within seven working days from the date of presentation of such information and removes the blocking of personal data.
5.3. Procedure for terminating unlawful processing of personal data.
5.3.1. In case of detecting unlawful processing of personal data upon the User's or their representative's application (request) or the authorized body for the protection of personal data subjects' rights, the Operator blocks the unlawfully processed personal data relating to this User from the moment of such application or receipt of the request for the verification period.
5.3.2. In case of confirmation of the fact of unlawful processing of personal data, the Operator, within a period not exceeding three working days from the date of this detection, terminates the unlawful processing of personal data or ensures its termination. If it is impossible to ensure the lawfulness of processing personal data, the Operator, within a period not exceeding ten working days from the date of detection of unlawful processing of personal data, destroys such personal data or ensures their destruction.
5.4. Deletion of personal data from the Website is carried out on the basis of a written application of the User (their representative) or the authorized body for the protection of personal data subjects' rights, including in the form of an electronic document signed with an electronic signature in accordance with the legislation of the Russian Federation.
5.5. Procedure for the destruction of personal data by the Operator.
5.5.1. The Operator destroys personal data in the following cases and within the established timeframes:

• upon achieving the purpose of processing personal data or losing the necessity of achieving it - within thirty days;
• at the request of the User (their representative) upon providing confirmation that the personal data was obtained unlawfully or is not necessary for the stated purpose of processing - within seven working days;
• upon the User's withdrawal of consent to the processing of their personal data, if their retention for the purpose of their processing is no longer required - within thirty days;
• upon reaching the storage periods of documents containing personal data - within thirty days.

5.5.2. Upon achieving the purpose of processing personal data, as well as in case of the User's withdrawal of consent to the processing of personal data, they are subject to destruction, unless otherwise provided by a contract or other agreement with the User, or the Operator is not entitled to process without the User's consent on the grounds provided by the Personal Data Law or other federal laws.
5.5.3. The destruction of personal data is carried out by a commission created by the Operator's order.
5.5.4. The methods of destroying personal data are established in the Operator's local regulatory acts.

6. Final Provisions

6.1. The Policy is approved by the order of the Individual Entrepreneur No. 1-S dated 02.09.2026, and is valid indefinitely until a new version of the Policy comes into force.
6.2. In case of changes in the legislation of the Russian Federation in the field of personal data protection, the Operator adopts a new version of the Policy taking into account the changes. Until that moment, the Policy is valid in the part that does not contradict the current legislation of the Russian Federation.
6.3. For the purpose of communication with the Operator, the following contact details may be used:
Tel.: +7 (985) 127-98-01
E-mail: info@annakolesnikova.com
Postal address: 115280, Moscow, Masterkova St., 1, apt. 240.