PRIVACY POLICY

concerning the processing of personal data

Version dated 22 January 2025

1. GENERAL PROVISIONS

1.1. This Privacy Policy has been prepared in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” and other Russian regulations. It sets out processing procedures and security measures for personal data that Denis Igorevich Lysov (the Operator) may collect about the User through the Operator's Resources, in order to protect human and civil rights and freedoms in the processing of personal data, including privacy and personal and familyconfidentiality.

1.2. This Privacy Policy applies to the processing of personal data collected by the Operator through active or passive means over the public Internet, regardless of the User's location.

1.3. The User may access and use the Operator's Resources for their intended purposes only after voluntarily providing specific, explicit, informed, conscious and unambiguous consent to the processing of personal data under this Privacy Policy, freely and in their own interests.

1.4. A User who agrees to processing under this Privacy Policy must notify the Operator using the method provided on the relevant Resource.

1.5. If the User disagrees with processing under this Privacy Policy, the Operator strongly requests that the User refrain from using the Operator's Resource.

1.6. When the User accepts this Privacy Policy and consents to processing, the Operator assumes that the User has read it; that the data is accurate, belongs personally to the User and is current on the date supplied; that the User has full legal capacity or is represented by a lawful representative; and that the User agrees to processing under this Policy. 

1.7. The User voluntarily, freely and in their own interests gives specific, explicit, informed, conscious and unambiguous consent to personal data processing under this Privacy Policy and Russian law, understands and accepts all legal consequences, and has first reviewed their rights and obligations as a data subject.

1.8. Where the User has partial legal capacity, the Operator assumes that consent was given by a lawful representative who has fully read and accepted this Privacy Policy and has sufficient authority to do so.

1.9. Unless expressly stated otherwise, the following terms apply when interpreting this Privacy Policy. They may appear in different grammatical forms, singular or plural, uppercase or lowercase, or as abbreviations:

1.9.1. Automated personal data processing - processing personal data using computer technology.

1.9.2. Blocking personal data - temporarily suspending personal data processing, except where processing is necessary to clarify the data.

1.9.3. Personal data information system - personal data held in databases together with the information technology and technical means used to process it.

1.9.4. Anonymization of personal data - actions making it impossible, without additional information, to link personal data to a particular User or other data subject.

1.9.5. Personal data processing - any action or set of actions involving personal data, automated or otherwise, including collection, recording, organization, accumulation, storage, updating or amendment, retrieval, use, transfer (dissemination, provision or access), anonymization, blocking, deletion and destruction.

1.9.6. Operator - Denis Igorevich Lysov (INN 910614216154).

1.9.7. Personal data - any information directly or indirectly relating to an identified or identifiable User.

1.9.8. Personal data authorized by the data subject for dissemination - personal data to which the data subject has granted access to an unlimited number of people by consenting to its processing for dissemination under Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”.

1.9.9. User (Data Subject) - any legally capable individual, or the lawful representative of a person with partial legal capacity, who voluntarily, freely and in their own interests gives the Operator specific, explicit, informed, conscious and unambiguous consent to personal data processing in the manner prescribed by this Privacy Policy.

1.9.10. Provision of personal data - actions intended to disclose personal data to a specific person or defined group of persons.

1.9.11. Dissemination of personal data - actions intended to disclose personal data to an indefinite group of persons or make it available to an unlimited audience, including publication in the media, posting on telecommunications networks or providing access by any other means.

1.9.12. Operator's Resources -  web-siteand the Operator's chatbots through which services are provided to Users: a collection of computer programs and other information in an information system accessible over the Internet.

1.9.13. Cross-border transfer of personal data - transferring personal data to a foreign state authority, foreign individual or foreign legal entity in the territory of a foreign state.

1.9.14. Destruction of personal data - actions resulting in the irreversible destruction of personal data, making further recovery of its contents impossible in the personal data information system, and/or destruction of physical media containing personal data.

1.10. This Privacy Policy may use terms not defined in this section. Such terms shall be interpreted under Russian law or, where no unambiguous definition exists, according to customary business practice.

1.11. Legal grounds for processing personal data: the Constitution and Civil Code of the Russian Federation; Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”; Federal Law No. 149-FZ of 27 July 2006 “On Information, Information Technologies and Information Protection”; Federal Law No. 38-FZ of 13 March 2006 “On Advertising”; Government Resolution No. 1119 of 1 November 2012 approving requirements for protecting personal data processed in personal data information systems; Government Resolution No. 687 of 15 September 2008 approving regulations on non-automated personal data processing; FSTEC Order No. 21 of 18 February 2013 approving organizational and technical measures for protecting personal data processed in information systems; Regulation (EU) 2016/679 of the European Parliament and Council on the protection of natural persons with regard to personal data processing and the free movement of such data, repealing Directive 95/46/EC; other Russian regulations on personal data collection, processing and protection; the Public Offer Agreement; and Consent to Personal Data Processing.

2. SUBJECT OF THE PRIVACY POLICY

2.1. This Privacy Policy establishes the Operator's obligations not to disclose personal data supplied by the User in connection with using the Operator's Resources and to protect its confidentiality. It also sets out the grounds, categories, purposes, periods, methods, principles, procedures and conditions for processing and storing User data, the Parties' rights and obligations, and procedures for giving and withdrawing consent.

2.2. When processing User data, the Operator ensures full confidentiality and compliance with Russian legal requirements.

3. PERSONAL DATA PROCESSED AND CATEGORIES OF DATA SUBJECTS

3.1. Personal data authorized for processing under this Privacy Policy is supplied by the User through special forms on the Operator's Resource and includes: 

- email address;

- Telegram username;

- Telegram ID.

3.2. The User may change browser settings at any time to block all cookies or notify them when cookies are sent. The User should understand that certain functions and services on the web-sitemay stop functioning or work incorrectly.

3.3. Categories of data subjects: clients (principals), prospective clients and their representatives; visitors and users of the Operator's Resources.

3.4. The Operator does not process personal data authorized for dissemination, biometric data, or special categories concerning race, nationality, political views, religious or philosophical beliefs, health, intimate life or criminal convictions.

4. PERSONAL DATA PROCESSING METHODS AND PERIODS

4.1. Processing methods: non-automated processing with receipt and/or transmission of data over the Internet, including collection, recording, organization, accumulation, storage in Russia until the legal grounds for processing cease and for statutory retention periods, transfer (provision or access), updating or amendment, retrieval, use, anonymization, blocking, deletion and destruction.

4.2. The Operator processes User data lawfully through the Internet and personal data information systems, without automated means, for as long as necessary to achieve and fulfill the processing purposes.

5. PURPOSES OF PERSONAL DATA PROCESSING

5.1. The Operator processes User data for the following purposes:

⎯ identifying the payer and payment; 

⎯ communication and providing information;

⎯conducting statistical and other research using anonymized data, providing secure and convenient website features, displaying information effectively, exercising and/or performing functions, powers and duties imposed on the Operator by Russian law, and fulfilling other obligations. 

6. CONSENT TO PERSONAL DATA PROCESSING

6.1. The User voluntarily, freely and in their own interests gives the Operator specific, explicit, informed, conscious and unambiguous consent to personal data processing under this Privacy Policy by pressing “I have read and consent to the processing of my personal data” in the special form on the Operator's Resource. For both Parties, this action has the legal effect of written consent.

6.2. Consent to processing personal data authorized for dissemination is provided directly to the Operator, separately from other processing consents. The Operator complies with the conditions and restrictions in Article 10.1 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”.

7. CONDITIONS AND PRINCIPLES OF PERSONAL DATA PROCESSING

7.1. User data is processed only with consent given in the prescribed manner and for the purposes specified in this Privacy Policy, subject to exceptions established by Russian law.

7.2. User data remains fully confidential, except where the User voluntarily consents to processing, including dissemination to an unlimited audience, and actually provides personal information about themselves.

7.3. As a general rule, the Operator does not disclose or disseminate personal data to third parties without the User's consent, except as provided by Russian law and this Privacy Policy. When transferring data to third parties, the Operator complies with this Policy and takes measures to safeguard the data.

7.4. The Operator may transfer User data to third parties where the User has consented; where transfer is necessary to achieve this Policy's purposes or fulfill obligations to the User; where Russian law provides for transfer; or to protect the Operator's rights and legitimate interests.

7.5. Information collected by other services, including online payment acquiring, payment systems, communications services and other providers, is stored and processed by those operators under their own rules and Russian law. The User must independently review those third-party documents. 

7.6. The Operator is not responsible for third-party operators that independently process personal data, except where the Operator has issued them a corresponding processing instruction in the prescribed manner.

7.7. The Operator organizes personal data processing according to these principles:

7.7.1. Lawful purposes and methods, and good faith and fairness in the Operator's activities. Processing is limited to specific, predetermined and lawful purposes. Processing incompatible with the purposes of collection is prohibited.

7.7.2. Accurate personal data, sufficient for the processing purposes, without collecting data excessive for the purposes stated at collection.

7.7.3. Collection and processing only of data relevant to the purposes of collection and processing.

7.7.4. The content and volume of data collected and processed must correspond to the stated processing purposes. 

7.7.5. Data processed must not be excessive in relation to the stated purposes.

7.7.6. Databases containing personal data processed for incompatible purposes must not be combined.

7.7.7. Data must be accurate, sufficient and, where necessary, up to date for the processing purposes. The Operator takes or ensures necessary measures to delete or correct incomplete or inaccurate data.

7.7.8. Data is stored in a form allowing identification of the User for no longer than required by the processing purposes, unless a retention period is prescribed by federal law or a contract to which the User is a party, beneficiary or guarantor.

7.7.9. Data is destroyed or anonymized when the processing purposes are achieved or no longer necessary, unless federal law provides otherwise.

7.8. Data is obtained directly from the User as data subject, or from their authorized representative, in accordance with Russian law, unless federal laws provide otherwise.

7.9. The User independently decides whether to provide personal data and gives consent voluntarily and freely, of their own will and in their own interests.

8. OPERATOR'S RIGHTS AND OBLIGATIONS

8.1. The Operator may:

- provide User data to third parties where required by Russian law, including tax and law enforcement authorities;

- refuse to disclose personal data in cases prescribed by Russian law;

- use User data without consent in cases provided by Russian law and to a justified extent;

- obtain accurate information and/or documents containing personal data from the User;

- continue processing without consent after withdrawal of consent or a request to stop processing, where grounds exist under Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”;

- independently determine the measures necessary and sufficient to meet obligations under Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” and its implementing regulations, unless federal laws provide otherwise;

- exercise other rights granted by Russian law.

8.2. The Operator must:

- provide the User, on request, with information about processing their personal data;

- organize processing in accordance with applicable Russian law;

- respond to Users and their lawful representatives within 10 (ten) business days of an inquiry or receipt of a request. This period may be extended by no more than 5 (five) business days if the Operator sends the data subject a reasoned notice explaining the extension;

- supply information requested by the authorized data protection authority within 10 (ten) business days of receipt. This period may be extended by no more than 5 (five) business days if the Operator sends the authority a reasoned notice explaining the extension;

- publish or otherwise provide unrestricted access to this Privacy Policy on every page of the Operator's Resource where personal data is collected;

- allow each User to review documents and materials containing their personal data, unless Russian law provides otherwise;

- take legal, organizational and technical measures to protect data from unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful actions;

- stop transfer (dissemination, provision or access), stop processing and destroy data in the manner and cases prescribed by Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”;

- perform other duties prescribed by Russian law.

9. USER'S RIGHTS AND OBLIGATIONS

9.1. The User may:

- obtain information about processing their data within 10 (ten) business days of a request, except as prescribed by federal laws, or within no more than 15 (fifteen) business days in certain cases. The Operator provides the information in an accessible form without disclosing other Users' data unless there are lawful grounds. The information available and procedure for obtaining it are set out in Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”;

- request correction, blocking or destruction of data that is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose, and take lawful measures to protect their rights;

- request a list of their data processed by the Operator and information about its sources;

- obtain information about processing periods, including retention periods;

- require notification of everyone previously supplied with inaccurate or incomplete data about all deletions, corrections or additions;

- require prior consent for processing for marketing goods, works or services;

- withdraw consent and request that processing stop;

- challenge the Operator's unlawful actions or omissions in processing personal data before the authorized data protection authority or a court;

- exercise other rights granted by Russian law.

9.2. The User must:

- if voluntarily choosing to provide personal data, supply accurate data necessary for the processing purposes and, where required, substantiate its accuracy with original documents;

- inform the Operator of corrections, updates or changes to their personal data;

- perform other duties prescribed by Russian law.

10. CROSS-BORDER TRANSFER OF PERSONAL DATA

10.1. As a general rule, the Operator does not transfer personal data across borders. If such a transfer occurs, the Operator will notify the User in the manner and within the periods prescribed by Russian federal law.

10.2. Cross-border transfer means transferring data to third parties in countries with an adequate level of protection or in other countries. The Operator ensures the required level of protection by complying with this Privacy Policy.

10.3. Before beginning cross-border transfers, the Operator must notify the authorized data protection authority of its intention, separately from the notification of intended personal data processing, and ensure that the destination country adequately protects data subjects' rights.

10.4. Before notifying the data protection authority, the Operator must obtain the relevant information from the foreign authorities, individuals or legal entities to which data is to be transferred.

11. MINORS' PERSONAL DATA AND PROTECTION OF CHILDREN'S INTERESTS

11.1. The Operator urges minors not to use its Resources or provide information about themselves without parental or other lawful representative permission and participation. The terms of this Privacy Policy require parents or other lawful representatives to continuously and directly supervise their minor children's use of the Resource. 

11.2. The Operator does not knowingly process minors' personal data without the consent of their lawful representatives and requires that the Resource be used only by persons aged 18 or over. Lawful representatives are responsible for minors' use of the Resources and submission of requests. 

11.3. The Operator takes every measure within its control to prevent minors from using the Resource without a lawful representative's consent. If it learns that it has obtained a minor's personal data without such consent, it will take every possible measure to stop processing immediately.

12. PERSONAL DATA PROTECTION MEASURES

12.1. The Operator protects User data through the legal, organizational and technical measures required by Article 19 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” and implementing Russian regulations.

12.2. The Operator safeguards User data and takes all possible measures to prevent unauthorized access, including:

12.2.1. Assessing the effectiveness of data security measures before implementing them.

12.2.2. Detecting unauthorized access, addressing it and preventing recurrence.

12.2.3. Restoring data altered or destroyed through unauthorized access.

12.2.4. Establishing access rules for data processed in the personal data information system.

12.2.5. Recording and accounting for all actions involving data in the personal data information system.

12.2.6. Checking that contracts with third parties contain personal data confidentiality provisions and including them where necessary.

12.2.7. Monitoring the security measures taken and the protection level of personal data information systems.

12.3. Third parties given access to personal data on the Operator's instructions undertake to implement the necessary organizational and technical measures to protect its confidentiality on the personal device used for processing.

12.4. Interaction with federal executive authorities concerning processing and protection of User data takes place within the framework of Russian law.

13. CONFIDENTIALITY OF PERSONAL DATA

13.1. The Operator and authorized persons with access to User data must not disclose or disseminate it to third parties without the User's consent, unless federal law provides otherwise, and must take all possible measures to protect it from unauthorized third-party access.

13.2. If unlawful or accidental transfer (provision, dissemination or access) of personal data to third parties infringes a User's rights, once the incident is discovered by the Operator, the authorized data protection authority or another interested person, the Operator shall notify that authority:

13.2.1. Within 24 (twenty-four) hours, of the incident, its presumed causes, the presumed harm to the User's rights, measures taken to address the consequences, and the person authorized by the Operator to liaise with the authority about the incident; 

13.2.2. Within 72 (seventy-two) hours, of the internal investigation results and, where available, the persons whose actions caused the incident.

14. TERMINATION OF PROCESSING AND DESTRUCTION OF PERSONAL DATA

14.1. Processing may end when its purposes are achieved, consent expires or is withdrawn, unlawful processing is identified, or the Operator is liquidated or reorganized.

14.2. The User may withdraw consent at any time, including for data authorized for dissemination, by sending an electronic withdrawal document to the Operator's email address: Leinup@yandex.ru with the subject “Withdrawal of consent to personal data processing”. Consent ceases to apply when the Operator receives the withdrawal.

14.3. If the User discovers inaccurate data, they must update it by sending an electronic correction request to the Operator's email address: Leinup@yandex.ru with the subject “Personal data update”, or by completing the relevant form on the Operator's Resource required to provide the service.

14.4. Where inaccurate data is identified, the Operator must, at the User's request, block the relevant data from the time of the request throughout verification, provided blocking does not infringe the rights or legitimate interests of the User or third parties.

14.5. If inaccuracy is confirmed, the Operator must correct the data within 5 (five) calendar days of receiving updated data from the User and unblock it.

14.6. Persons who provide false information about themselves, or information about another data subject without that person's consent, are liable under Russian law.

14.7. Once the processing purpose is achieved, the Operator stops processing or ensures that it stops, and destroys the data or ensures its destruction within 30 (thirty) calendar days.

14.8. Electronic data is destroyed by erasure and/or formatting of the storage medium. Documents and other physical media are destroyed by burning, shredding or crushing, or chemical decomposition. 

14.9. Following destruction, the Operator prepares a destruction report and/or generates and retains an export from the event log of the information system, such as accounting or HR software, the corporate web-site, another similar computer program or another data collection and storage source.

14.10. If unlawful processing is identified, the Operator must stop it within 3 (three) calendar days of discovery.

14.11. If processing cannot be made lawful, the Operator must destroy the data within 10 (ten) calendar days of discovering the unlawful processing and notify the User of correction of the violations or destruction of the data.

14.12. After considering withdrawal of consent, the Operator may continue using information about the User in anonymized form in cases prescribed by federal law.

15. DISPUTE RESOLUTION

15.1. The Operator shall notify the claimant in writing of the outcome within 30 (thirty) calendar days of receiving a claim. This period may be extended by no more than 15 (fifteen) calendar days if the Operator sends the User a reasoned notice explaining the extension.

15.2. If the Parties cannot reach agreement, the dispute shall be referred to a court under the applicable jurisdiction rules and Russian law.

16. FINAL PROVISIONS

16.1. This Privacy Policy applies to all relations between the Operator and User concerning personal data collection, processing and protection, and to all data collected and processed. Matters not covered by this Policy are governed by Russian personal data law.

16.2. This Privacy Policy remains effective indefinitely until a new version is adopted. Amendments are made if the scope, methods or procedures of processing change or new legislation or special regulations on data processing and protection are introduced. Changes are incorporated into the Policy, followed by publication of the revised version and its publication date.

16.3. The User may exercise all data subject rights and obtain clarification about the collection, processing and protection of their data by contacting the Operator at: Leinup@yandex.ru

16.4. The original copy of this Privacy Policy is kept at the Operator's location.

16.5. The User may access this Privacy Policy at any time without additional conditions, except when the Operator's Resource is unavailable for technical reasons.

16.6. Политика конфиденциальности составлена на русском языке в соответствии с законодательством Российской Федерации. Во исполнение требований части 2 статьи 18.1 Федерального закона от 27.07.2006 № 152-ФЗ «О персональных данных» Политика конфиденциальности публикуется в свободном доступе на едином сайте Оператора, доступном по адресам https://leingpt.ru, https://leingpt.com и https://lein.su. Доменные имена leingpt.ru, leingpt.com и lein.su используются для доступа к одному и тому же сайту. Положения настоящего документа применяются к использованию сайта независимо от доменного имени, по которому осуществляется доступ к нему.

17. OPERATOR DETAILS