Personal Data Processing Policy

1. Controller and scope

This Policy describes personal data processing on https://niteus.ru/ (the Website).

Controller: Sergeev Alexey Nikolaevich (Сергеев Алексей Николаевич), acting as a private individual. Controller’s address: 474 Lenina St., Stavropol, 355000, Russia. Personal data enquiries: niteus@niteus.ru.

The Policy covers Website visitors and people submitting enquiries through its forms. Processing is governed by Russian Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” and other applicable rules. Data processing for entering into and performing a contract may have separate purposes, grounds and retention periods communicated to the relevant individuals separately.

2. Data and purposes

Handling enquiries and responding. The Controller processes your name; preferred contact method and the email address, telephone number or Telegram username you provide; company name, if supplied; selected service; and project description. The purposes are to receive and assess your enquiry, clarify your requirements, respond and agree on further steps at your request. The basis is your separate consent. Where the relevant conditions are met, processing may also be based on taking steps to enter into a contract at your initiative or performing a contract.

Enquiry administration and evidence of consent. The enquiry also includes its identifier, language, source page, UTM parameters submitted with the form, submission time, status, relevant internal notes, and consent version and timestamp. These records support enquiry handling and evidence of the circumstances of submission. They are not used for advertising profiling. The basis is consent within the scope of handling the enquiry; any separate retention to demonstrate compliance requires an applicable legal basis.

Website operation and security. Connections to the Website involve technical processing of IP addresses and HTTP request information. Form protection uses technical identifiers, a cookie preventing forged requests, and a temporary identifier derived from the network address to limit request frequency. Web server logs record the IP address with the last octet zeroed, the date and time of the request, the method and requested page path without parameters, the response code and size, processing time and a technical request identifier. Browser and operating system details are not logged. The purposes are page delivery, abuse prevention and investigation of technical failures. The basis is the Controller’s rights and legitimate interests in maintaining Website operation and security, subject to visitors’ rights.

The Website is not intended to collect sensitive categories of personal data or biometric data. Do not include passport details, health information, passwords, access keys or unnecessary information about other people in your enquiry.

3. Processing and access

Processing involves automated tools and human involvement: collection, recording, organisation, accumulation, storage, correction, retrieval, use, granting access in the circumstances described in this Policy, restriction, deletion and destruction.

Enquiries are stored in the Website database. Access is restricted to authorised persons to the extent required for their duties. Personal data are not published openly or sold.

The Website runs on a virtual server provided by SOESTA CJSC (ЗАО «СОЕСТА»), 18 Artema St., Stavropol, 355002, Russia in a data centre in the Russian Federation. The provider operates the hardware and network connectivity; it is not given credentials to the Website or its database and does not process personal data on the Controller’s behalf. When processing is entrusted to a service provider, its terms and security duties are defined in the relevant agreement. Data may be disclosed to authorised public bodies where there is a lawful basis.

Enquiry content is not automatically forwarded to external email or Telegram: the Controller reviews enquiries in the Website’s administration area. Responses use the channel you select: the Controller’s email on the niteus.ru domain (the mail server is hosted by SOESTA CJSC in the Russian Federation), telephone, or the Telegram messenger. Selecting a contact channel does not itself replace the Controller’s obligations concerning data transfers.

4. Storage locations and transfers

The primary database is hosted in the Russian Federation on a server provided by SOESTA CJSC. Backups to external storage are not currently made; if introduced, backup copies will be hosted in the Russian Federation and this Policy will be updated. Applicable Russian database localisation requirements are observed when collecting personal data of Russian citizens.

The Controller does not transfer personal data across borders. If you choose Telegram as your contact method, the response is sent through that messenger using only your Telegram username and the information needed to respond. Before any other cross-border transfer begins, the Controller fulfils applicable legal requirements and updates this Policy.

5. Retention and deletion

Enquiry data are retained until the purpose of handling the enquiry has been achieved, but for no longer than 90 calendar days from submission unless another lawful basis applies. Withdrawal of consent is assessed with regard to any such basis. Contract records, if created, are retained separately for the periods applicable to their purposes and legal obligations.

Technical logs are retained for no longer than 30 days and deleted automatically; temporary rate-limit keys for no longer than 24 hours; no backups are made to external storage. On expiry or another applicable legal trigger, data are deleted or destroyed within statutory deadlines. Any paper records are destroyed in a way that prevents reconstruction.

Enquiries are deleted from the Website database automatically when the retention period expires. If backups are introduced, deleted data in backups will not be used for routine operations, and processing restrictions and deletions will be reapplied after any restore.

6. Cookies and analytics

The Website uses technical cookies to protect forms and session cookies for access to the administration area. You can restrict cookies through browser settings, although some functions may become unavailable. Lifetimes: the form protection cookie (csrftoken) up to 1 year; the administration session cookie up to 2 weeks.

The Website does not use advertising cookies. Visit statistics are collected with Yandex Metrica, provided by YANDEX LLC (ООО «Яндекс»), 16 Lva Tolstogo St., Moscow, 119021, Russia. The counter loads only after you click “Allow” in the notice on the Website; if you decline, it does not load.

Yandex Metrica processes cookie identifiers (such as _ym_uid and _ym_d, for up to 1 year), IP address, browser, device and operating system details, viewed page addresses and referrer, and on-page actions (navigation, clicks, scrolling). Form field recording (Webvisor) is not used. The purpose is to analyse traffic and improve the Website. The basis is your consent. You can withdraw it by clearing the Website’s data in your browser settings: the counter will not load until consent is given again. Yandex processes the data it receives under its own privacy policy.

Consent to handling an enquiry does not constitute consent to analytics or advertising.

7. Your rights and requests

You may request information about processing, request correction, restriction or destruction where grounds exist, withdraw consent, and complain to Roskomnadzor or a court.

Contact niteus@niteus.ru or write to 474 Lenina St., Stavropol, 355000, Russia. Describe your request and provide information sufficient to locate your enquiry, such as the contact used and approximate submission date. Necessary verification of identity or authority may be requested to prevent disclosure to unauthorised persons. Do not send a passport copy through ordinary email without first agreeing on a secure method.

Requests and justified requirements are handled within applicable statutory deadlines. If processing ceases but particular records must be retained on an independent lawful basis, the Controller informs the requester.

8. Security and updates

The Controller implements legal, organisational and technical measures appropriate to processing risks, including access restrictions, connection protection, software updates and recovery measures. The actual measures depend on the Website’s operational arrangements.

The current English version is published at https://niteus.ru/en/privacy/. Changes do not automatically expand consent already given. Consent for a new purpose is requested separately where required. This English text is intended to convey the same processing conditions as the Russian version.