Personal Data Processing Policy

1. General provisions

1.1. This Policy explains how Vialex LLC (the “Operator”) processes and protects personal data when visitors use kontur-dol.ru (the “Website”) or contact the Operator through its enquiry form, website chat or messenger bots linked from the Website.

1.2. This Policy is prepared under Russian Federal Law No. 152-FZ of 27 July 2006, “On Personal Data” (the “Law”), and is published pursuant to Article 18.1(2) of the Law.

1.3. This Policy does not cover the processing of data about children, their legal representatives or camp employees within the Kontur DOL system. Children’s recreation and health organisations process that data as operators; the Operator’s participation is governed by its agreement with the organisation.

1.4. Terms have the meanings given in Article 3 of the Law. Personal data means any information relating directly or indirectly to an identified or identifiable individual (the data subject). Processing means any operation involving personal data: collection, recording, organisation, accumulation, storage, clarification, retrieval, use, transfer, anonymisation, blocking, deletion or destruction. A cookie is a small file a website saves in a visitor’s browser.

2. The Operator

Name

Vialex Limited Liability Company (Vialex LLC)

Tax identifiers (INN / KPP)

7736306495 / 561401001

State registration number (OGRN)

1177746555073

Address

Office 422, Premises 2, 25A Lenina Avenue, Orsk, Orenburg Region, 462419, Russia

General Director

Alexander Valeryevich Popov

Person responsible for organising personal data processing

General Director Alexander Valeryevich Popov

Personal data enquiries

info@vialex.cloud or by post to the Operator’s address

3. Whose data is processed, what data and why

The Operator processes personal data only for the purposes listed below and only to the extent necessary for each purpose.

3.5. The Operator does not request special categories of personal data (health, racial or ethnic origin, political opinions and similar information) or biometric personal data. If such or other excessive information is received, for example in enquiry comments, the Operator restricts access and stops processing and destroys it unless a lawful basis applies. The Operator does not disclose data to an unrestricted group of persons or make decisions with legal consequences for the data subject solely through automated processing.

4. Processing procedures and conditions

4.1. Processing is lawful and fair, limited to the declared purposes and the data necessary for them. The Operator does not request excessive data.

4.2. When collecting personal data of Russian citizens, the Operator does not use databases outside the Russian Federation for recording, organisation, accumulation, storage, clarification or retrieval, except as permitted by the Law (Article 18(5)).

4.3. Personal data is not transferred across borders.

4.4. Within the organisation, authorised employees have access to the data needed for their duties. They receive new-enquiry notifications through the Operator’s internal messenger and corporate email. Website chat and chatbot enquiries enter the Operator’s enquiry management system. External recipients and processors acting on the Operator’s instructions are listed in section 4.5.

4.5. The Operator instructs the following entity to process data under Article 6(3) of the Law, subject to confidentiality and safeguards:

• YANDEX LLC, 16 Lev Tolstoy Street, Moscow: processing visit data through Yandex Metrica as described in sections 3.3 and 5. It receives visit data, not enquiry data or correspondence.
• Yandex.Cloud LLC processes technical data for Yandex SmartCaptcha form verification. See the service notice.

4.6. Data is provided to public authorities only where federal law requires it.

4.7. Processing stops when its purpose is achieved, its duration expires, consent is withdrawn or unlawful processing is identified. Data is destroyed within 30 days after the purpose is achieved or withdrawal is received unless another lawful basis applies. Unlawful processing stops within three working days; if it cannot be made lawful, the data is destroyed within ten working days of discovery. Data is blocked during verification where the Law requires it. The data subject and, where required, Roskomnadzor are notified of the measures taken (Article 21).

Enquiry form protection

Yandex SmartCaptcha is used when an enquiry is submitted. The service may receive the IP address and technical browser and device information to protect against automated submissions.

5. Cookies and Yandex Metrica

5.1. Yandex Metrica loads when the Website opens. On the first visit, a notice offers an opt-out.

5.2. The Website saves the visitor’s choice in browser storage (kd-cookie-consent in localStorage) so the notice need not be shown again. This entry is not a cookie and is not transmitted.

5.3. Yandex Metrica sets analytics cookies including _ym_uid and _ym_d (one year), _ym_isad (20 hours), and technical localStorage entries prefixed _ym. The complete list is in Yandex Metrica’s documentation.

5.4. Session Replay records page navigation, clicks and scrolling. Recording of enquiry form field contents is disabled: entered text is replaced with asterisks. Successful submission sends an “Enquiry received” event without the name, contact details or comments. Clicks on chatbot links are also counted.

5.5. YANDEX LLC processes this data on the Operator’s instructions under Yandex Metrica’s terms of use.

5.6. Visitors may opt out at any time using “Decline” in the notice or “Cookie settings” at the bottom of a Website page. The opt-out stops Metrica immediately in that browser and applies to subsequent visits. The Website removes accessible analytics cookies and storage entries on its own domain. Opting out does not delete data already transmitted or cookies on Yandex domains; contact info@vialex.cloud about previously collected data. Clearing site data in the browser may erase the saved opt-out.

5.7. Cookies may be deleted or blocked in browser settings. Yandex provides a browser opt-out extension to block Metrica on all websites.

6. Data subject rights

A data subject may:

• Obtain information about processing: confirmation that processing takes place, its legal bases, purposes and methods, the Operator’s and processors’ names and addresses, the data processed and its source, processing and storage periods, and how to exercise rights (Article 14(7));
• Request correction, blocking or destruction of incomplete, outdated, inaccurate, unlawfully obtained or unnecessary data;
• Withdraw consent;
• Request that processing stop;
• Challenge the Operator’s actions or omissions before Roskomnadzor or a court.

7. Requests and withdrawal of consent

7.1. Send requests to info@vialex.cloud or the Operator’s postal address. A request for information must contain the number of the principal identity document of the data subject or representative, its issue date and issuing authority, information confirming processing by the Operator (for example the enquiry date and the phone number or email provided), and a signature. An electronic-document request must be signed electronically (Article 14(3)).

7.2. To withdraw consent, write to info@vialex.cloud or the Operator’s postal address and identify the contact details used for the enquiry. If necessary, the Operator verifies the request using previously provided contact details. Enquiry contents are not disclosed to third parties before verification.

7.3. Response periods:

• Processing information: within ten working days of receipt, extendable by no more than five working days with a reasoned notice;
• Correction of incomplete, inaccurate or outdated data: within seven working days of receiving supporting information;
• Stopping processing at the data subject’s request: within ten working days, extendable by no more than five working days;
• Destruction after withdrawal of consent: within 30 days of receipt unless another lawful basis applies.

8. Personal data safeguards

The Operator takes the legal, organisational and technical measures required by Articles 18.1 and 19 of the Law:

• The General Director is responsible for organising personal data processing;
• Only employees who need data for their duties have access, using individual accounts;
• Data travels between the browser and Website over HTTPS;
• The enquiry form is protected against automated submissions and limits submissions from one address;
• Personal data databases are hosted on servers in the Russian Federation, with restricted server access;
• If unlawful or accidental transfer, provision, disclosure or access infringes data subject rights, the Operator sends an initial notice to Roskomnadzor within 24 hours of discovering the incident and the internal investigation results within 72 hours (Article 21(3.1)).

9. Final provisions

9.1. The Policy applies indefinitely until replaced. The current Russian edition is always available at kontur-dol.ru/privacy; its date appears at the beginning of the document. This English translation is available at /en/privacy/.

9.2. The Operator retains previous editions of the Policy and consent. Each accepted enquiry records consent, receipt time and the version of the consent document shown to the person submitting the enquiry.