Personal data processing policy
1. Controller and scope
The Controller is Individual Entrepreneur Svirin Andrei Viktorovich, INN 772872317733, OGRNIP 322774600176722. Postal address: P.O. Box 15, Moscow, 117647. Contact for data matters: mail@svirin.work. Controller details.
This Policy applies to visits to svirin.work, consideration of related inquiries, and agreeing and performing orders. Personal data are processed in accordance with Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" and other applicable requirements.
2. Principles and legal bases
Processing is limited to specific lawful purposes and the data necessary for them. Incompatible combination of purposes and excessive retention are not permitted. The Controller takes steps to keep information up to date, confidential and secure.
Depending on the circumstances, the legal basis is separately expressed consent, entering into a contract at the data subject's initiative and performing it, statutory obligations, protecting rights and legitimate interests while respecting the data subject's rights, or another applicable basis. Consent for one purpose does not automatically extend to others.
Contact by email
To ask an ordinary question or enquire about a service, simply send an email. You do not need to prepare consent using a template in advance, send it in a separate email, or repeat your question.
For entering into a contract at the initiative of the data subject, and for performing a contract to which the data subject is a party or under which they are a beneficiary or guarantor, paragraph 5 of part 1 of Article 6 of Russian Federal Law No. 152-FZ on Personal Data applies, solely to the data necessary for that purpose.
For other ordinary enquiries sent voluntarily, paragraph 7 of part 1 of Article 6 of the same law applies only where minimal processing is necessary for the legitimate interest of considering the enquiry and replying, is consistent with its purpose and the sender's reasonable expectations, and does not infringe the sender's rights and freedoms. The necessity of processing, the scope of the data and the permitted retention period are assessed for the particular enquiry; this is not blanket permission to process correspondence for any purpose.
Only the contact details, message and related information necessary for the enquiry are used. This procedure does not automatically authorise the processing of any and all data in attachments, information about third parties, special categories of personal data or biometric data. Advertising, optional analytics and publication of materials require their own applicable legal grounds and any necessary separate consents.
If consent is genuinely required for particular processing, a separate request specifying the purpose, categories of data, processing operations and duration will be sent before that processing begins. You do not need to send consent on your own initiative with every ordinary email.
3. Purposes and categories of data
3.1. Considering an inquiry
When a message is sent voluntarily, the sender's address, name and other contact details provided, message content, information about the object and necessary data in attachments are processed. The purpose is to understand the request, clarify the circumstances and send a response.
The website does not accept inquiries or file uploads through a server-side form. An email link opens the visitor's application. An inquiry does not create an advertising subscription or permit optional analytics. If processing is based on consent, it is expressed separately as described in the consent for inquiries.
3.2. Entering into and performing a contract
Information about the Client, their representative and the agreed recipient of the result, contact and payment details, the assignment, necessary materials, correspondence, the result and performance documents are processed. The purposes are to arrange and fulfil the order, settle payments and deliver the result to an authorised person.
3.3. Mandatory documents and protection of rights
Payment, contractual and other mandatory documents are processed to comply with the law. Information about complaints and disputes is used to consider them and protect rights to the necessary extent. These purposes do not permit unlimited retention of all materials.
3.4. Page delivery and security
When a page is requested, the hosting infrastructure receives the IP address, time, requested address, technical headers sent by the browser and other information necessary for the network connection. Technical logs are used to operate the service, diagnose issues and ensure security. Their contents and technical retention periods depend on the infrastructure selected; using these logs for advertising on this basis is not permitted.
3.5. Optional analytics
After separate permission, Yandex Metrica, counter 113803049, is enabled on the production domain. Data may include the IP address when the service receives a request, cookie and visit identifiers, technical device and browser information, pages visited, time and referral source.
Session Replay, click maps, e-commerce and automatic external-link tracking are disabled. The website does not send correspondence, contact details or inquiry materials as analytics parameters. Detailed terms and the choice procedure are set out in the analytics consent and cookie rules.
3.6. Advertising messages
Advertising sent to contact details is permitted only after separate prior consent to receive it and with a proper legal basis for processing mailing-list data. An inquiry, entering into a contract, viewing pages or consenting to analytics does not create such a subscription.
The website has no automated subscription form. The documents on receiving advertising and on mailing-list data apply when voluntary consent is arranged separately; they do not themselves activate any mailing.
4. Processing procedure and recipients
To the necessary extent, processing includes collection, recording, storage, organisation, updating, retrieval, use, granting access where a legal basis exists, restriction, deletion and destruction. Processing may be automated, manual or a combination of both.
Hosting and email infrastructure are used for technical delivery and storage. Engaging a technical service provider does not authorise its independent advertising use of data; statutory requirements apply where processing is entrusted to it. Recipients and the permitted scope of disclosure are determined by the applicable legal basis and agreed channel before transfer.
For analytics, YANDEX LLC receives data to the extent necessary for the permitted service functions. Its processing terms are published in Yandex's policy and the Metrica terms.
An inquiry alone is not a basis for publishing materials in a portfolio, advertising or a public database. A specialist or laboratory is engaged, or the result delivered to a representative, only with the necessary legal basis and regard to confidentiality. Legally required permissions and undertakings are documented separately.
5. Processing and deletion periods
- An inquiry without a concluded contract and necessary materials: until the purpose is achieved, but no longer than 90 calendar days after the last substantive interaction; if there is no follow-up, from receipt.
- Contract materials and documents: within the purposes of performance and applicable mandatory retention periods. Excess materials are not retained merely because mandatory accounting documents exist.
- Analytics choice: up to 180 days in the browser. A new choice is requested on expiry; merely viewing a page does not extend it.
- Analytics data are subject to a maximum retention period of three years from collection, ending earlier when the purpose is achieved or statutory grounds arise. The service infrastructure terms are considered separately from cookie validity.
- Minimal information about consent, implemented opt-outs and protection of rights: only the necessary data, on an independent lawful basis and for as long as actually necessary.
When consent is withdrawn or the purpose achieved, processing on that basis stops and data are destroyed within statutory periods unless another independent legal basis exists. Deletion covers working and email copies, rather than only the visible inquiry record.
6. Cookies and local preferences
The website itself stores the analytics choice and animation mode in the browser. The analytics library loads only after permission and only on svirin.work and www.svirin.work; the private review version does not use the production counter. Refusal does not restrict access to content or contact details.
The "Analytics settings" button is available on the main and legal pages. It lets you change or withdraw your choice. Deleting cookies locally does not delete data already processed in the service infrastructure; a separate request concerning those data must be sent to the Controller.
7. Rights and requests
The data subject may obtain information about processing as provided by law, request correction, restriction or destruction where grounds exist, withdraw consent and challenge the Controller's actions before the competent authority or a court.
Send a request to mail@svirin.work or to the postal address. Provide information allowing the inquiry or order to be located. Proportionate verification of identity or authority may be required to protect data. Additional data are requested only to the necessary extent.
8. Third parties and protected information
The sender must have a lawful basis and authority to transfer materials. Their consent is not the consent of every person mentioned. The Controller separately assesses whether the legal basis is sufficient and how much processing is necessary.
Special categories, biometric data and restricted-access information should not be included in the initial email. If necessary for the agreed task, the permissible legal basis, scope and safeguards are determined before transfer. Ordinary inquiry consent does not replace mandatory written consent or statutory permission. See the terms for transferring materials.
9. Security and changes
The Controller restricts access, uses the safeguards provided by the selected systems, checks the grounds for disclosure and takes organisational and technical measures appropriate to the data. A new Policy version does not automatically extend previously expressed consent.
The current version is published on this page.