Privacy policy

1. Scope

Applies to all personal data received through the Site: request forms, the 152-FZ site checker (the Scanner) and web analytics. Browsing without submitting forms or accepting analytics cookies involves no personal data processing beyond technical data needed to run and protect the Site.

2. Purposes

• Responding to requests and preparing proposals;
• concluding and performing contracts;
• delivering Scanner results and following up if a contact was left;
• running and protecting the Site;
• web analytics — only with consent to analytics cookies;
• handling requests of data subjects and legal obligations.

3. Data

• Name as provided;
• contact: phone, email or messenger handle;
• message text and topic;
• site address submitted to the Scanner and the result;
• technical data: IP address, browser and device, page, referrer, UTM;
• anonymous visitor id for Scanner rate limiting (cookie arson_cid);
• Yandex Metrica analytics data including session replay — only with consent.

4. Legal basis

• Consent given by ticking the box before submitting a form (Art. 6(1)(1), Art. 9), documented as a separate Consent;
• consent to analytics cookies via “Accept all”;
• steps to conclude a contract at the subject’s request (Art. 6(1)(5));
• legitimate interests for technical data (Art. 6(1)(7)).

5. Processing

Automated processing. Databases with personal data of Russian citizens are located in the Russian Federation (Art. 18(5)): Российская Федерация. Processors under Art. 6(3) agreements:

• хостинг-провайдер, серверы которого расположены на территории Российской Федерации — hosting;
• Yandex LLC (Russia) — Yandex Metrica, only with consent;

5.1. Storage of requests

Form data is stored on the Operator’s server in the Russian Federation. The Operator receives only a service notification about a new request (id, topic, page) in a messenger, without the name, contact or message. Personal data is not shared with third parties, including messenger operators, and does not leave the Russian Federation.

6. Retention

• Requests — until the purpose is achieved, max 3 years after the last interaction;
• Scanner results — 24 hours, then anonymised;
• technical and security logs — up to 1 year;
• analytics — per Yandex Metrica terms, session replays up to 14 days;
• consent records — 3 years after withdrawal (Art. 9(3)).

7. Your rights

Information about processing (Art. 14), correction, blocking or deletion, withdrawal of consent, complaints to Roskomnadzor or court. Requests: arson-support@yandex.ru. Reply within 10 business days, extendable by 5 with notice. After withdrawal data is destroyed within 30 days (Art. 21(5)).

8. Security

Legal, organisational and technical measures under Art. 18.1 and 19:

• HTTPS/TLS, servers and database in Russia;
• data minimisation: forms collect a name and one contact;
• rate limiting and bot protection on forms;
• access control, security logging, backups;
• analytics only after explicit, revocable consent.

9. Final provisions

The Operator may amend the Policy; the current version is always at https://tech.arson.one/en/privacy. Data breaches are reported to Roskomnadzor within the terms of Art. 21(3.1).