Personal Data Processing Policy

1. General provisions

1.1. This Personal Data Processing Policy (the Policy) sets out how Индивидуальный предприниматель Дербенев Сергей Вячеславович (the Operator) processes personal data collected through the website soliton.studio (the Website) and the measures taken to secure that data.

1.2. The Policy is prepared in accordance with Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" of the Russian Federation and is published openly as required by Article 18.1(2) of that law.

1.3. The Policy applies to all personal data the Operator receives from visitors of the Website. Processing of employee and counterparty data outside the Website is governed by separate internal regulations.

1.4. Using the Website means the visitor has read this Policy. A visitor who disagrees with it should stop using the Website and refrain from submitting data through its forms.

2. Definitions

2.1. Personal data — any information relating directly or indirectly to an identified or identifiable natural person (the data subject).

2.2. Processing — any operation performed on personal data, including collection, recording, systematisation, accumulation, storage, rectification, retrieval, use, transfer, anonymisation, blocking, deletion and destruction.

2.3. Operator — the person who organises and carries out the processing and determines its purposes, the scope of data and the operations performed on it.

2.4. Subject — a visitor of the Website whose personal data is processed by the Operator.

3. Operator details

3.1. The operator of personal data is Индивидуальный предприниматель Дербенев Сергей Вячеславович, TIN (INN) 525813755846, state registration number (OGRNIP) 326527500120740.

3.2. Address for legally significant notices and data-related requests: 603135, Nizhny Novgorod, Lenina Avenue 53.

3.3. Email for data subject requests: info@soliton.studio. Telephone: +7 933 408-56-38.

3.4. The person responsible for organising the processing of personal data is the Operator himself — individual entrepreneur Sergey Vyacheslavovich Derbenev. The Operator works without employees, so he alone has access to personal data. Requests concerning the processing of personal data should be sent to info@soliton.studio; the responsible person reviews them within the periods stated in section 11.

4. Categories of data subjects and data

4.1. The Operator processes data of visitors who complete a form on the Website and of representatives of prospective and existing clients who make contact using the details published on the Website.

4.2. The following data is processed:

4.3. The Operator does not process data of persons under eighteen. The Website is not directed at them. Data found to have been provided by a minor without the consent of a legal representative will be deleted.

4.4. The Operator does not take decisions producing legal effects concerning the Subject solely on the basis of automated processing.

5. Purposes of processing

1. handling the Subject's enquiry, including replying by telephone, email or messenger;
2. preparing a preliminary estimate of cost and scope of work;
3. concluding, performing and terminating a services agreement and conducting the related correspondence;
4. complying with obligations imposed on the Operator by the law of the Russian Federation, including tax and accounting legislation;
5. keeping the Website operational and secure, detecting technical faults and fraudulent or automated submissions;
6. compiling anonymised traffic statistics to improve the Website.

5.2. The Operator does not use data collected through the Website for marketing messages. Marketing communication requires separate consent under Article 18 of Federal Law No. 38-FZ of 13 March 2006 "On Advertising".

5.3. The Operator does not sell personal data and does not disclose it for purposes other than those listed in clause 5.1.

6. Legal grounds

• consent of the Subject (Article 6(1)(1) of Federal Law No. 152-FZ), given by ticking the consent box in a Website form;
• necessity for the performance of a contract to which the Subject is a party, or for steps taken at the Subject's initiative towards concluding one (Article 6(1)(5));
• necessity for compliance with the Operator's statutory obligations (Article 6(1)(2));
• the legitimate interests of the Operator, provided the rights and freedoms of the Subject are not infringed (Article 6(1)(7)) — applied to technical logs kept for security purposes.

7. Methods of processing and retention periods

7.1. Processing is carried out by mixed means, both with and without automation. Data is transmitted over HTTPS.

7.3. Once the retention period expires, the purpose is achieved, consent is withdrawn or unlawful processing is identified, the data is destroyed or anonymised. Destruction is recorded in a formal act.

8. Disclosure to third parties

8.1. The Operator engages the following processors, each acting on the Operator's instructions under an agreement containing confidentiality and security obligations:

8.2. Data may be disclosed to public authorities upon a substantiated request, to the extent and in the manner prescribed by law.

8.3. The Website carries no social media widgets and no advertising networks that collect visitor data in order to serve advertising outside the Website. The only third-party script on the Website is the Yandex.Metrica counter; it is loaded only after the data subject has consented to analytics cookies and is used solely to collect anonymised traffic statistics. Fonts, styles and all other scripts are served from the Operator's own server rather than third-party content delivery networks.

9. Cross-border transfer and location of databases

9.1. Collection, recording, systematisation, accumulation, storage, rectification and retrieval of the personal data of Russian citizens is carried out using databases located within the Russian Federation, as required by Article 18(5) of Federal Law No. 152-FZ.

9.2. The Operator does not carry out cross-border transfers of personal data. Should such a transfer become necessary, the Operator will first notify the competent supervisory authority under Article 12 of Federal Law No. 152-FZ and obtain separate consent.

9.3. Where a Subject contacts the Operator through the Telegram messenger, the exchange takes place within that service's infrastructure and under its own terms. The Operator does not control such transfer and recommends other channels for sensitive information.

10. Cookies and web analytics

10.1. The Website uses cookies. Their purpose, composition and retention are described in the separate Cookie Policy.

10.2. Strictly necessary cookies are set without prior consent because the Website cannot function without them. Analytics cookies are set only after the visitor presses "Accept" in the cookie notice. The Website uses the Yandex.Metrica web analytics service (operator: Yandex LLC, TIN 7736207543, servers located in the Russian Federation). The counter is not loaded and no analytics cookies are set before "Accept" is pressed; choosing "Strictly necessary only" does not enable analytics. The analytics files and their retention periods are listed in the Cookie Policy.

10.3. A visitor may change that decision at any time:

Reset the cookie choice and show the notice again

11. Rights of the data subject

• to obtain confirmation that their data is being processed and the information listed in Article 14(7) of Federal Law No. 152-FZ;
• to require rectification, blocking or destruction of data that is incomplete, outdated, inaccurate, unlawfully obtained or no longer necessary;
• to withdraw consent;
• to object to processing for purposes unrelated to performance of a contract;
• to complain to Roskomnadzor or to bring court proceedings;
• to protection of their rights, including compensation for losses and moral harm.

11.2. A request should be sent to info@soliton.studio or to the postal address in section 16. It must state the number of the Subject's identity document, its date of issue and issuing authority, information confirming that the Operator processes the data, and be signed by the Subject or their representative. A representative must attach proof of authority.

11.3. The Operator responds within ten business days of receipt. This may be extended by up to five business days with a reasoned notice to the Subject.

12. Withdrawal of consent

12.1. Consent may be withdrawn at any time by a free-form notice to info@soliton.studio under the subject line "Withdrawal of consent to personal data processing".

12.2. The Operator ceases processing and destroys the data within thirty days of receiving the withdrawal, unless another legal ground for continued processing applies.

12.3. Processing may continue without consent in the cases expressly provided for by Articles 6(1) and 9(2) of Federal Law No. 152-FZ, in particular where the data is needed to perform a concluded contract or to comply with a statutory duty. In that case the Operator limits processing to the minimum necessary and informs the Subject of the ground.

12.4. Withdrawal does not affect the lawfulness of processing carried out beforehand.

13. Security measures

The Operator applies the legal, organisational and technical measures required by Article 19 of Federal Law No. 152-FZ, including: identification of the person responsible for organising processing; restricted access to the data — the Operator works without employees, so he alone can access enquiries; transmission exclusively over TLS/HTTPS; hosting of the Website and databases on servers located in the Russian Federation; minimisation of the data collected — the Website forms do not request identity document details, payment details or special categories of data; anonymisation of technical identifiers — the visitor's IP address is not stored in its original form but as an irreversible derivation; two-factor authentication protecting access to the Operator's mailbox; regular updates of Website and server software; confidentiality and security clauses in contracts with processors; and internal compliance monitoring.

14. Incident response

14.1. Where unlawful or accidental transfer of personal data results in a breach of confidentiality, the Operator notifies the competent supervisory authority in accordance with Article 21(3.1) of Federal Law No. 152-FZ: within 24 hours of the incident, its presumed causes, the presumed harm and the measures taken; and within 72 hours of the results of the internal investigation.

14.2. The Operator informs affected Subjects of the nature of the incident and the steps they may reasonably take to reduce possible adverse consequences.

15. Amendments

The Operator may amend this Policy. A new version takes effect once published on the Website. The current version is always available at https://soliton.studio/en/legal/privacy. Material changes affecting the purposes of processing or the scope of data are additionally announced on the Website.

16. Operator details

Related documents: Consent to Personal Data Processing, Cookie Policy, Terms of Use.