Privacy Policy

1. General Provisions

1.1. This Policy was developed in accordance with:

• Constitution of the Russian Federation
• Federal Law No. 152-FZ dated 27.07.2006 "On Personal Data"
• Federal Law No. 38-FZ dated 13.03.2006 "On Advertising"
• Government Decree No. 687 dated 15.09.2008 "On Approval of Regulations on Personal Data Processing"

1.2. This Policy applies to all personal data that the Operator may receive from the User when:

• filling out contact forms on the Website
• placing orders for services
• subscribing to newsletters
• contacting support
• using any Website services

1.3. Personal Data Protection

The Operator ensures protection of personal data in accordance with Russian law and is responsible for its security.

1.4. Policy Changes

The Operator reserves the right to amend this Policy. The new version takes effect upon publication on the Website.

1.5. Applicable Law

This Policy and relations between the Operator and User are governed by the laws of the Russian Federation.

2. Personal Data Composition

2.1. Definition

Personal data means any information relating directly or indirectly to an identified or identifiable individual (data subject).

2.2. The Operator processes the following categories of personal data:

2.2.1. Data provided by the User:

• Full name
• Email address
• Phone number
• Company name
• Messages, files and other information submitted through forms, chat or support channels
• The fact of consent to personal data processing, including the date and source of consent
• Other information necessary for service provision

2.2.2. Data collected automatically:

• Device IP address
• Browser and operating system information
• Device specifications
• Cookie data
• Date and time of Website access
• Requested page addresses
• Technical session, message and consent-record identifiers, including hashed values used to demonstrate that consent was obtained

2.3. Required Information

Required information is marked accordingly on forms. Other information is provided at the User's discretion.

2.4. Data Accuracy

The Operator does not verify the accuracy of personal data and assumes that the User provides accurate information.

2.5. Third-Party Websites

This Policy applies only to pommedeterre.ru. The Operator is not responsible for third-party websites.

2.6. Categories of Data Subjects

The Operator processes personal data of the following categories of subjects:

• Website visitors
• Users who filled out contact forms
• Users who contacted the Operator through online chat or support channels
• Clients who ordered Operator services
• Newsletter subscribers

3. Purposes of Personal Data Processing

3.1. The Operator processes personal data for the following purposes:

3.1.1. Service Provision:

• Processing requests for website and web application development
• Technical client support
• Web development consultations

3.1.2. Contract Fulfillment:

• Processing service orders
• Financial settlements
• Providing work progress updates

3.1.3. User Communication:

• Sending order status notifications
• Processing inquiries and requests
• Processing online chat messages and routing them to a support operator
• Informing about new services (with User consent)

3.1.4. Service Quality Improvement:

• Analyzing Website performance
• Conducting surveys and research
• Developing new services

3.1.5. Legal Compliance:

• Fulfilling tax legislation requirements
• Demonstrating that consent to personal data processing was obtained
• Providing information to government authorities upon request

3.2. Purpose Limitation

The Operator does not process personal data for purposes not specified in this Policy.

4. Personal Data Processing and Transfer Conditions

4.1. Legal Grounds for Processing:

• User consent to personal data processing
• Contract to which the User is a party
• Federal Law No. 152-FZ "On Personal Data"

4.2. Processing Methods:

• Collection, recording, systematization, accumulation, storage
• Clarification (updating, modification)
• Extraction, use, transfer
• Depersonalization, blocking, deletion, destruction

4.3. Confidentiality

The Operator ensures confidentiality of User personal data.

4.4. Transfer to third parties and technical providers

The Operator may transfer personal data to third parties, technical providers and services that support the Website, chat, hosting, backups and communications in the following cases:

• User has explicitly consented
• Transfer is necessary for contract fulfillment
• Transfer is necessary to receive, route and process the User request
• Transfer is required by Russian law
• Transfer is necessary to protect Operator's rights

4.5. Cross-Border Transfer

When technical infrastructure, hosting, network routing, backups or support services are used, some personal data may be transferred to or processed outside the Russian Federation, including infrastructure located in the European Economic Area. Such transfer is performed only where there is a lawful basis and in compliance with applicable personal data law.

5. User Rights

5.1. The User has the right to:

• Receive information about their personal data processing
• Request clarification, blocking, or destruction of data
• Withdraw consent to personal data processing
• Access their personal data
• Appeal the Operator's actions or inactions

5.2. Contact Information

To exercise your rights, you may send a request via Telegram: https://t.me/pommedeterre_studio or to the Website: https://pommedeterre.ru

5.3. Response Time

The Operator will review the request within 30 days of receipt.

5.4. Consent Withdrawal Procedure

The User may withdraw consent to personal data processing by sending a written request via Telegram: https://t.me/pommedeterre_studio with the following information:

• Full name (if available)
• Contact details (email or phone) provided during registration
• Request to stop personal data processing

Upon receiving the withdrawal, the Operator will stop processing and destroy the data within 30 days, except when processing is required for contract fulfillment or by law.

6. Cookies, Local Storage and Analytics

6.1. Technical Storage Unrelated to Analytics

The Website uses cookies and browser storage (localStorage and sessionStorage). Yandex Metrica is not enabled before separate consent to analytics. Browser records used for functions requested by the User may include the analytics choice, navigation state, brief drafts, calculator selections and, on restricted pages, temporary authenticated-session data. These records are not used for analytics or advertising. Draft contents and authentication data are not sent to Yandex.

6.2. Analytics Based on Separate Consent

Yandex Metrica is enabled only after the User selects “Allow analytics”. The choice applies to pommedeterre.ru and gistiq.ru/care/ and is transferred securely when the User navigates between them. Its purpose is visit statistics and analysis of navigation, clicks, scrolling and device characteristics. While the tag is operating, the data listed in Section 6.6 is sent automatically to YANDEX LLC (16 Leo Tolstoy Street, Moscow 119021, Russia), which processes it on the Operator’s instructions. The tag is not started on personal brief, calculator or administration pages. Session Replay is disabled in the Website code; Metrica is also prevented from recording field contents and form submissions. Refusal does not affect Website functionality.

6.3. Browser Storage and Retention

• The analytics choice is stored separately in each domain’s localStorage for no more than 12 months. When the User navigates between pommedeterre.ru and gistiq.ru/care/, the choice is passed in a short-lived signed technical code that is removed from the address immediately after reading. The record contains the choice, date, expiry, terms version and a technical consent identifier.
• Page position used during navigation is stored in sessionStorage until the tab is closed.
• Brief drafts and calculator selections are stored in localStorage for no more than 30 days after the latest change and are deleted after successful submission or when the User clears Website data in the browser.
• A technical marker for a successfully submitted brief or calculator is stored for no more than 30 days so that the submitted form is not shown again.
• After analytics is allowed, Yandex Metrica may store technical identifiers and service records in cookies and browser storage. The main cookies are _ym_uid and _ym_d for up to 1 year, _ym_isad for approximately 20 hours and _ym_metrika_enabled for 60 minutes. Additional records depend on Metrica settings and operation. Yandex publishes the current list, but its documentation does not specify a separate retention period for every localStorage record. Metrica records available to the Website domain are deleted when consent is withdrawn, expires or changes version; the User can also delete them in the browser.

Current Yandex Metrica cookie and storage list

6.4. Management and Withdrawal

The User can open “Cookie settings” at the bottom of any page and change the choice at any time. On withdrawal, the Website stops Metrica, deletes Metrica records available to it on the Website domain and saves the refusal. Cookies on Yandex domains are not accessible to the Website and can be deleted by the User in browser settings. Withdrawal does not affect processing lawfully performed before withdrawal. Metrica data collection can also be blocked with the browser extension offered by Yandex for compatible browsers.

Yandex Metrica Blocker

6.5. Consent Validity

The choice remains valid for no more than 12 months. The Website requests a new choice after expiry or when the purposes, analytics providers or these terms materially change. Existing consent does not extend to new processing purposes. To demonstrate consent and withdrawal, the Operator retains for up to 3 years a minimal server record containing the consent ID and version, time, category choice, Policy path and secret-keyed hashes of the IP address and User-Agent. Plain IP addresses and User-Agent values are not written to the consent audit log.

6.6. Analytics Data

If analytics is allowed, the following may be processed: IP address, approximate region, visit date and time, the URL and title of a public page, referrer, browser, operating system, screen and device information, a technical browser identifier, and page-view, navigation, click and scroll events. The Operator does not configure Metrica to receive names, phone numbers, email addresses, form-field contents, messages or other data that directly identifies the User.

7. Personal Data Protection Measures

7.1. General Measures

The Operator takes legal, organizational, and technical measures to protect personal data from unauthorized access, destruction, modification, blocking, copying, and distribution.

7.2. Technical Measures:

• HTTPS protocol usage
• Personal data encryption
• Data access control
• Regular software updates

8. Data Storage and Destruction

8.1. Storage Period

Personal data is stored no longer than required for processing purposes.

8.2. Storage Terms:

• Service data - contract duration + 3 years
• Financial documents - at least 5 years
• Requests, support inquiries and chat correspondence - for the period needed to process the request and up to 3 years after communication ends, unless a longer period is required by law or contract
• The analytics choice stored in the User’s browser - up to 12 months; consent records created when forms or messages are submitted - for the processing period and possible claims period, usually up to 3 years after processing ends
• Marketing data - until consent withdrawal

8.3. Destruction

Upon achieving processing purposes, data is destroyed in a manner preventing recovery.

9. Operator Contact Information

Inquiries are processed within 30 days.

10. Liability

10.1. Operator Liability

The Operator is liable for compliance with Russian personal data legislation in accordance with the Administrative Code and Criminal Code of the Russian Federation.

10.2. Dispute Resolution

Disputes arising from personal data processing are resolved through negotiations. If no agreement is reached, the dispute is referred to the court at the Operator's location.

10.3. Appeals

The User may appeal the Operator's actions or inactions to Roskomnadzor or through the courts.

11. Final Provisions

This Policy is a publicly available document.

All matters not covered by this Policy are governed by Russian law.

Policy changes do not create consent automatically. If a change affects consent-based processing and changes its purposes, data or recipients, the Operator requests a new separate consent before such processing begins.