Personal data processing policy

1. General provisions and terms

1.1. This Personal Data Processing Policy (the “Policy”) has been drawn up in accordance with Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” (“Law No. 152-FZ”) and sets out the procedure for processing the personal data of visitors to the website located on the Internet at www.xteam.pro (the “Website”), and the measures taken to ensure the security of personal data.

1.2. The Policy applies to all personal data that the Operator receives from visitors to the Website, and covers the processing of personal data carried out using automated means.

1.3. The Policy uses the following terms:

• personal data — any information relating to a directly or indirectly identified or identifiable natural person (the personal data subject);
• operator — a legal entity that, on its own, organises and/or carries out the processing of personal data, and determines the purposes of processing, the personal data to be processed and the actions (operations) performed with personal data;
• processing of personal data — any action (operation) or set of actions (operations) performed with personal data, with or without automated means, including collection, recording, systematisation, accumulation, storage, clarification (updating, alteration), retrieval, use, transfer (provision, access), blocking, deletion and destruction;
• personal data subject — the natural person to whom the personal data relate; for the purposes of this Policy, a visitor to the Website;
• cross-border transfer of personal data — transfer of personal data to the territory of a foreign state, to an authority of a foreign state, a foreign natural person or a foreign legal entity;
• cookies — small pieces of data that a visitor's browser stores on the visitor's device when the Website is visited;
• analytics programs — web analytics software that collects depersonalised and/or indirectly identifying information about visits to the Website;
• destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and/or as a result of which the physical media of personal data are destroyed.

1.4. Use of the Website means that the visitor has familiarised themselves with this Policy. Processing of the personal data specified in the Policy begins only after the consent of the personal data subject has been obtained in the manner provided for in sections 5 and 6 of the Policy.

2. Operator

2.1. The operator of personal data is:

Full name

IKSTIM.PRO Limited Liability Company (IKSTIM.PRO LLC)Общество с ограниченной ответственностью «ИКСТИМ.ПРО» (ООО «ИКСТИМ.ПРО»)

INN (taxpayer number)

5044146126

OGRN (state registration number)

1265000005555

Address

141534, Russia, Moscow Region, Solnechnogorsk, SNT Krasnaya Gorka territory (Maryino village), house 188141534, Россия, Московская область, г. Солнечногорск, тер. СНТ Красная Горка (д. Марьино), дом 188

Email

hello@xteam.pro

For questions about the processing of personal data, write to hello@xteam.pro.

2.2. The Operator independently determines the purposes and composition of the personal data processed, and the actions (operations) performed with the personal data of visitors to the Website.

3. Personal data processed

3.1. The Operator processes the following categories of data of visitors to the Website.

3.1.1. Data provided by the visitor through the enquiry form on the Website:

• name;
• contact details: an email address or an identifier (username) in the Telegram messenger — at the visitor's choice;
• the description of the task (the substance of the enquiry), written by the visitor in free form.

3.1.2. Data collected automatically using cookies and analytics programs (where the visitor has given consent):

• information about cookies and other browser identifiers;
• IP address;
• information about the browser, operating system, and the type and screen resolution of the device;
• information about the date, time and duration of visits to the Website, the pages viewed, and the source from which the visitor came to the Website;
• information about the visitor's actions on the pages of the Website, including cursor movements, clicks and page scrolling (to the extent recorded by the Webvisor session recording technology of the Yandex Metrica service — see section 6 of the Policy).

3.2. The Operator does not process special categories of personal data (information about racial or national origin, political views, religious or philosophical beliefs, health or intimate life) or biometric personal data. The visitor should not include such information in the task description in the enquiry form.

3.3. The Operator does not collect personal data that the personal data subject has authorised for dissemination.

4. Purposes of processing personal data

4.1. The data specified in clause 3.1.1 of the Policy (the enquiry form) are processed solely for the purpose of considering the visitor's enquiry and sending a reply to it, including contacting the visitor through the contact they have provided.

4.2. The data specified in clause 3.1.2 of the Policy (cookies and analytics programs) are processed for the purposes of:

• keeping statistics of visits to the Website;
• analysing the behaviour of visitors on the Website in order to improve its operation, structure and content.

4.3. The Operator does not use visitors' personal data for purposes not specified in this section; in particular, it does not send advertising material and does not take decisions based solely on automated processing of personal data that produce legal consequences for the personal data subject.

5. Legal grounds for processing personal data

5.1. The legal ground for processing personal data is the consent of the personal data subject to the processing of their personal data (clause 1, part 1, Article 6 of Law No. 152-FZ).

5.2. Consent to the processing of data provided through the enquiry form is expressed by the visitor through conclusive actions: filling in the fields of the form and submitting it after reading this Policy, with a consent mark placed in the corresponding field of the form.

5.3. Consent to the processing of data using cookies and analytics programs is expressed by the visitor through the consent banner displayed on the first visit to the Website (see section 6 of the Policy). Until such consent is obtained, analytics programs are not connected on the Website and the data specified in clause 3.1.2 of the Policy are not collected.

5.4. Consent to the cross-border transfer of personal data when the Google Analytics 4 service is used is given separately, in the manner set out in clause 6.3 of the Policy.

5.5. Providing personal data is not mandatory. Refusing consent does not prevent viewing the Website; however, declining to fill in the enquiry form makes it impossible to consider the enquiry, and refusing consent to the use of cookies makes it impossible to collect visit statistics.

6. Cookies and analytics programs

6.1. General procedure. On the first visit to the Website, the visitor is shown a banner asking for consent to the use of cookies and analytics programs. The analytics programs listed in this section are connected and begin collecting data only after the visitor has given consent through the banner. The visitor is entitled not to give consent, and may at any time delete cookies and prohibit their storage in the browser settings.

6.2. Yandex Metrica. The Website uses the Yandex Metrica web analytics service provided by YANDEX LLC (Russian Federation). The service collects the data specified in clause 3.1.2 of the Policy using cookies. The following components of the service are used:

• the visit counter — collection of depersonalised statistics on visits to the Website;
• Webvisor technology — recording of visitor sessions (replay of the visitor's actions on the pages of the Website: cursor movements, clicks, scrolling, interaction with page elements);
• the click map — aggregated information about clicks on page elements.

The Operator has configured the Website so that the contents of the enquiry form fields are not recorded by Webvisor. The terms on which the service processes data are set by the documents of YANDEX LLC, available on the service's website.

6.3. Google Analytics 4. Cross-border transfer of personal data. The Website uses the Google Analytics 4 web analytics service provided by Google LLC (United States of America). When this service is used, the data specified in clause 3.1.2 of the Policy are transferred to servers of Google LLC located outside the Russian Federation, which constitutes a cross-border transfer of personal data within the meaning of Article 12 of Law No. 152-FZ.

The Operator openly informs visitors of the following:

• the United States of America is not included in the list of foreign states that ensure adequate protection of the rights of personal data subjects, approved by the authorised body for the protection of the rights of personal data subjects (Roskomnadzor);
• cross-border transfer of personal data to the territory of such a state is permitted, in particular, where the personal data subject has consented to such transfer and the Operator complies with the procedure provided for in Article 12 of Law No. 152-FZ, including the Operator's obligation to notify the authorised body of its intention to carry out cross-border transfer of personal data before such transfer begins;
• the Operator does not control, and is not responsible for, the subsequent processing of data by Google LLC; the terms of such processing are set by the documents of Google LLC.

Consent to connecting Google Analytics 4 and to the related cross-border transfer of data is requested through the consent banner separately and explicitly; until it is obtained, the service is not connected. If the visitor refuses such consent, the Website remains fully accessible.

6.4. Data collected by analytics programs are used by the Operator in aggregated form and are not used to establish the identity of a specific visitor.

7. Procedure and periods of processing and storing personal data

7.1. Personal data are processed using automated means. The Operator performs the following actions with personal data: collection, recording, systematisation, accumulation, storage, clarification, retrieval, use, transfer (to the extent specified in section 6 of the Policy), blocking, deletion, destruction.

7.2. The Operator takes the necessary legal, organisational and technical measures to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, provision and dissemination, and from other unlawful actions, in accordance with Articles 18.1 and 19 of Law No. 152-FZ, including restricting access to personal data, using secure data transmission channels and keeping a record of the persons who have access to personal data.

7.3. Periods of processing and storage:

• data provided through the enquiry form (clause 3.1.1) are processed until the purpose of processing is achieved — the end of the correspondence on the enquiry — but for no longer than one year from the date of the last interaction with the visitor, unless a longer storage period is required under the legislation of the Russian Federation;
• data collected by analytics programs (clause 3.1.2) are stored for the periods set in the settings of the respective services and are processed by the Operator until the visitor withdraws consent;
• cookies are stored on the visitor's device for the period set for each cookie, or until the visitor deletes them.

7.4. Once the purposes of processing have been achieved, and also if the personal data subject withdraws consent to the processing of personal data, the personal data are to be destroyed or depersonalised within a period not exceeding thirty days, unless otherwise provided by the legislation of the Russian Federation.

7.5. The Operator does not transfer personal data to third parties, except in the cases specified in section 6 of the Policy (processing of data by analytics services) and in cases where such transfer is mandatory under the legislation of the Russian Federation.

8. Rights of the personal data subject and withdrawal of consent

8.1. The personal data subject has the right to:

• receive information relating to the processing of their personal data, to the extent provided for in Article 14 of Law No. 152-FZ;
• demand that their personal data be clarified, blocked or destroyed if the personal data are incomplete, out of date, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;
• withdraw consent to the processing of personal data at any time;
• appeal against the actions or inaction of the Operator to the authorised body for the protection of the rights of personal data subjects (Roskomnadzor) or in court.

8.2. To exercise their rights, including withdrawing consent to the processing of personal data, the personal data subject sends a request to the Operator's email address: hello@xteam.pro. The request must contain information that makes it possible to identify the personal data subject and their personal data processed by the Operator (in particular, the name and contact given when filling in the enquiry form), and the substance of the demand.

8.3. The Operator replies to a request from the personal data subject within ten working days of the request. This period may be extended by no more than five working days, with a reasoned notice sent to the personal data subject.

8.4. If consent is withdrawn, the Operator stops processing the personal data and destroys them within a period not exceeding thirty days from the date the withdrawal is received, except where the Operator is entitled to continue processing without the consent of the personal data subject on the grounds provided for in Law No. 152-FZ.

8.5. The visitor may also withdraw consent to the use of cookies and analytics programs on their own, by deleting cookies and prohibiting their storage in the browser settings.

9. Changes to the Policy

9.1. The Operator is entitled to make changes to this Policy. A new version of the Policy takes effect from the moment it is posted on the Website, unless the new version provides otherwise.

9.2. The current version of the Policy is permanently available on the Website at www.xteam.pro. The revision date is stated at the beginning of the document.

9.3. Continued use of the Website after a new version of the Policy takes effect does not mean that the consents provided for in sections 5 and 6 of the Policy are given automatically; if the composition or purposes of processing change materially, the corresponding consents are requested again.