Personal Data Processing Policy
Version No. 10 of 21.10.2026. Identifier: 2026-10-21-10.
Terms used in this document: INN — taxpayer identification number; OGRNIP — primary state registration number of an individual entrepreneur; OGRN — primary state registration number; OOO — limited liability company; IP address — the network address from which a request originates; cookies — small records that a website stores in the browser.
1. General provisions and information about the Controller
1.1. The personal data Controller is Individual Entrepreneur Andrei Viktorovich Svirin:
- INN: 772872317733;
- OGRNIP: 322774600176722;
- correspondence address: P.O. Box 15, Moscow, 117647;
- email for personal data matters: zapros@svirin-pro-bono.ru;
- website: https://svirin-pro-bono.ru/.
1.2. This Personal Data Processing Policy (the Policy) determines the purposes, legal bases, data categories, procedures and periods for processing personal data by Individual Entrepreneur Andrei Viktorovich Svirin (the Operator) when using https://svirin-pro-bono.ru/ (the Website), considering email enquiries and subsequently interacting concerning them. Enquiries through web forms are not accepted. If the parties enter into a separate contract, necessary processing is also governed by that contract and the law.
1.3. The Policy applies to the personal data of Website visitors, persons submitting inquiries (hereinafter Applicants), Clients, their representatives and other individuals whose personal data is lawfully processed by the Controller in connection with the provision of services. The Controller considers inquiries personally.
2. Legal grounds and principles of processing
2.1. Personal data is processed in accordance with Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (hereinafter the Personal Data Law) and other applicable regulatory legal acts of the Russian Federation. The terms "personal data", "personal data processing", "controller", "provision of personal data", "depersonalization of personal data" and "destruction of personal data" are used with the meanings established by Article 3 of that Law.
2.2. Personal data is processed on a lawful and fair basis and is limited to achieving specific, predetermined and lawful purposes. The content and volume of the personal data processed must correspond to the stated processing purposes; excessive processing and processing incompatible with the purposes of the initial collection are not permitted.
2.3. Visiting the Website, clicking 'Write an email' and sending a regular email do not constitute blanket consent to the processing of personal data. Where necessary, consent is given separately and does not cover advertising mailings, advertising calls, publication of materials or optional analytics.
3. Purposes, scope of data and grounds for processing
3.1. Consideration of inquiries and feedback
3.1.1. Processing purposes: receiving and considering an enquiry, clarifying relevant circumstances, preparing and sending a response, and subsequent interaction solely concerning that issue. For the Website, this means preliminary consideration of a legal issue, determination of the feasibility of free assistance and preparation of a legal response. The main enquiry channel is zapros@svirin-pro-bono.ru.
3.1.2. Data categories: first name, or surname, first name and patronymic, to the extent provided by the applicant; email address; telephone number, if provided for a response; email text; information about the task; the applicant's own personal data in necessary documents and attachments; information relevant to the issue in subsequent correspondence. Unrequested and excessive data are not used for other purposes.
3.1.3. The receipt date and time, sender's address, subject, message identifier and necessary delivery metadata are used to register the email and confirm the circumstances of the enquiry. Where separate consent is given, its contents, receipt date, method of expression and version are retained. The Website does not create a web form submission record or attach information about visitor behaviour to the email.
3.1.4. The legal basis is determined by the enquiry's contents. Where the data subject initiates a contract, or a contract to which they are a party, beneficiary or guarantor is performed, clause 5 of part 1 of Article 6 of the Personal Data Law applies, solely to the extent of necessary processing. For other enquiries, where no independent basis exists, separately obtained and confirmed consent applies under clause 1 of part 1 of Article 6. The contractual basis does not automatically cover all data in attachments or information about third parties.
Contact by email
To ask an ordinary question or enquire about a service, simply send an email. You do not need to prepare consent using a template in advance, send it in a separate email, or repeat your question.
For entering into a contract at the initiative of the data subject, and for performing a contract to which the data subject is a party or under which they are a beneficiary or guarantor, paragraph 5 of part 1 of Article 6 of Russian Federal Law No. 152-FZ on Personal Data applies, solely to the data necessary for that purpose.
For other ordinary enquiries sent voluntarily, paragraph 7 of part 1 of Article 6 of the same law applies only where minimal processing is necessary for the legitimate interest of considering the enquiry and replying, is consistent with its purpose and the sender's reasonable expectations, and does not infringe the sender's rights and freedoms. The necessity of processing, the scope of the data and the permitted retention period are assessed for the particular enquiry; this is not blanket permission to process correspondence for any purpose.
Only the contact details, message and related information necessary for the enquiry are used. This procedure does not automatically authorise the processing of any and all data in attachments, information about third parties, special categories of personal data or biometric data. Advertising, optional analytics and publication of materials require their own applicable legal grounds and any necessary separate consents.
If consent is genuinely required for particular processing, a separate request specifying the purpose, categories of data, processing operations and duration will be sent before that processing begins. You do not need to send consent on your own initiative with every ordinary email.
3.1.5. A response is sent using the applicant's stated contact details and agreed channels. A telephone number provided for contact concerning the issue is not used for advertising. During a clarifying telephone conversation, only information necessary for the enquiry is processed; this description does not provide for audio recording of conversations.
3.1.6. Attachments are used for review, clarification of circumstances and preparation of a response. Initial submission does not authorise publication, advertising use or transmission of files to analytics. Submission rules are set out in the Terms for the Transfer and Use of Materials.
3.2. Entering into and performing a separate contract
3.2.1. If the parties enter into a contract, the processing purposes are agreement of its terms, performance of obligations, exchange of documents and delivery of the result. The extent of data is determined by the contract's subject matter, rather than the mere fact of contacting us through the Website.
3.2.2. Data categories: necessary surname, first name and patronymic, contacts, addresses, information about the task, documents and materials; information about a representative and their authority. Identification and payment information is requested only where necessary for a specific action. This provision does not mean pro bono assistance is paid or that payments are accepted on the Website.
3.2.3. Bases: clause 5 of part 1 of Article 6 for data of a party, beneficiary or guarantor and the data subject's own initiative to enter into a contract; clause 2 of part 1 of Article 6 for statutory obligations. A separate applicable basis is determined for representatives and other persons.
3.3. Performance of statutory obligations
3.3.1. Purposes: mandatory recordkeeping where required, compliance with lawful demands and requests from authorised bodies. Data categories are limited to the scope of the relevant obligation. The basis is clause 2 of part 1 of Article 6 and the provisions establishing that obligation.
3.4. Handling claims and protecting rights
3.4.1. Purposes: handling claims, resolving disputes, protecting rights and legitimate interests, and confirming the contents of interactions and lawfulness of processing.
3.4.2. Categories: documents and correspondence relevant to the specific dispute, necessary interaction information and a minimal consent record. Bases: legal requirements and clause 7 of part 1 of Article 6, subject to respect for the data subject's rights and freedoms. This provision does not authorise indefinite retention of all enquiries and attachments.
3.5. Website operation and security
3.5.1. Purposes: delivering pages, identifying errors, and protecting against unlawful requests and technical abuse. Categories: IP address, request date and time, page URL, request processing result and necessary browser information transmitted when connecting to the server.
3.5.2. Basis: clause 7 of part 1 of Article 6, ensuring Website operation and security while respecting the visitor's rights and freedoms. This information is not used on that basis for optional analytics or advertising.
3.6. Analytics and advertising
3.6.1. The Website has a prepared interface for a separate Yandex Metrica choice. The counter is currently disabled. For the future active setup, the purpose is to assess traffic, page use and Website usability; the categories are the IP address when the service receives a request, browser and visit identifiers, technical device information, page URLs without parameters or fragments, and visit times and events. The basis is separate consent under clause 1 of part 1 of Article 6. Consent is requested again when the active version is launched. No advertising subscription is provided; analytics consent does not include advertising or enquiries.
4. Processing procedure and data recipients
4.1. Within the purposes and legal bases, operations include collection, recording, organisation, accumulation, storage, updating, retrieval, use, transfer (disclosure, access), blocking, deletion and destruction. Processing is automated, non-automated or a combination of both.
4.2. The Operator considers the enquiry personally. Access is limited to what is necessary for the relevant function; enquiry and attachment contents are not made publicly available.
4.3. Technical hosting and delivery of enquiries are provided by the hosting and email infrastructure used by the Operator. Where processing is delegated, part 3 of Article 6 applies. Actual recipients are disclosed to the data subject in the manner prescribed by law. The prepared analytics setup provides for YANDEX LLC, address: 16 Lev Tolstoy Street, Moscow; data are transferred to that entity only after separate permission and actual activation of the counter. No data are currently transferred to Yandex Metrica. Engaging recipients does not release the Operator from obligations to the data subject.
4.4. Under a separate contract, disclosure of materials to agreed participants in performance is permitted only to the extent necessary on an applicable lawful basis. An enquiry does not itself authorise forwarding materials to any specialist.
4.5. Data are disclosed to courts and public authorities in the cases and manner prescribed by law. Disclosure of contact details to third parties for their own advertising is not permitted without a separate lawful basis.
4.6. When collecting personal data of citizens of the Russian Federation, the Operator ensures compliance with part 5 of Article 18 of the Personal Data Law concerning the use of databases in the Russian Federation. The applicant's choice of email service does not remove the Operator's obligations.
4.7. Before a cross-border transfer begins, the Operator complies with Article 12 of the Personal Data Law, identifies recipients and provides the necessary information to data subjects. Consent concerning an enquiry does not override localisation or cross-border transfer requirements. Stating that hosting is in Russia does not itself confirm the location of all email systems.
5. Processing, retention and deletion periods
5.1. Ordinary enquiries for which no contract is concluded, including correspondence and attachments, are retained for the period necessary for consideration, but no more than 90 calendar days from the last substantive message or agreed clarifying telephone conversation. If there was no follow-up, the period runs from receipt of the enquiry. Automatic replies and service notifications do not extend it.
5.2. Data under a separate contract are retained during its performance and for the statutory retention periods for the relevant documents. An independent basis is required after that. Mandatory retention of individual documents does not authorise keeping all excessive attachments.
5.3. Ordinary technical security logs are retained for no more than 30 calendar days. Information about a specific incident may be retained longer only on an independent basis for the period necessary for investigation or protection of rights.
5.4. A minimal consent record may be retained on an independent basis for no more than three years from the date consent was expressed, if needed to demonstrate lawful processing or protect rights while respecting the data subject's rights and freedoms. Contents: name, if given, contact details linking the consent to the enquiry, separate consent text, date and time, message identifier and document version. The complete original enquiry, its attachment contents and names, and excessive technical headers are not included. This limit does not impose an obligation to keep the record for all three years.
5.5. Information necessary for a specific claim or dispute is retained to the extent necessary on an independent basis. The reason and period for that retention are determined separately; ordinary correspondence does not automatically become an archive for protecting rights.
5.6. Once the purpose is achieved, the period expires or the basis ends, data are deleted or destroyed unless an independent lawful basis requires further retention. When the purpose is achieved, the periods in part 4 of Article 21 of the Personal Data Law apply. Deletion covers email, attachments, local copies, information systems used and copies held by processors. Keeping data in 'Sent', 'Archive' and 'Trash' folders counts as retention.
5.7. On withdrawal, processing based on consent ceases. If the data are no longer needed and no other basis exists, destruction is ensured under part 5 of Article 21: as a general rule, within no more than 30 days of withdrawal, subject to statutory exceptions.
5.8. A request to cease processing is governed by part 5.1 of Article 21: as a general rule, processing ceases within no more than 10 working days; where statutory grounds exist, this may be extended by no more than five working days with a reasoned notice. Lawful exceptions are considered separately.
5.9. If destruction within the statutory period is impossible, data are blocked and destroyed under part 6 of Article 21, as a general rule no later than six months, unless a different period is set by federal law. A backup copy does not itself authorise further use of the data.
6. Cookies, saving choices and analytics
6.1. Cookies are small browser records; localStorage consists of records on the device without a built-in deletion deadline. Submission of enquiries through a form remains disabled: the button opens an email application.
6.2. A necessary server-signed cookie site_analytics_choice_v2 (HttpOnly, Secure, SameSite=Lax) and localStorage record site-analytics-choice-v2 are used to save and implement the choice. The choice lasts 180 days from saving. These records contain the choice, technical identifier, version and expiry; they are not used to analyse behaviour. An expired local record is deleted on the next visit or expiry check on an open page. When the Website is closed, its code cannot remotely delete local storage.
6.3. Minimal server confirmation of the choice contains a random identifier, result, date and time, version, document URL and deletion deadline. It is not linked to contacts, emails or files. On an independent basis, where needed to demonstrate lawful processing or protect rights, it may be retained for up to three years from the choice date. Expired records are deleted when the log is accessed and during daily maintenance; data are deleted earlier if the basis is lost. Ordinary technical logs remain subject to the period in clause 5.3.
6.4. Yandex Metrica is currently disabled even if the visitor has chosen to allow it. An active version is published and a new choice requested before the counter starts operating. In the active setup, the counter runs only after positive server confirmation. Before permission, after refusal, if confirmation fails, on legal pages and when the configuration is disabled, no requests are sent to Metrica. No noscript pixel is installed.
6.5. You can change your choice or withdraw permission using 'Analytics settings'. Refusal immediately blocks the counter in the browser, including if saving on the server fails; the change also applies in other open tabs. First-party _ym records in cookies and localStorage are cleared when it stops. This action does not automatically delete data previously transferred to Yandex systems; requests concerning those data are sent to the Operator.
6.6. For the future active setup, the main Metrica cookies are: _ym_uid and _ym_d — up to one year; _ym_isad — 20 hours; _ym_metrika_enabled — 60 minutes; _ym_visorc_* — 30 minutes when Webvisor is enabled. Additional records and their purposes are described in the Yandex documentation. Cookie lifetimes do not determine server data retention periods.
6.7. The maximum period for analytics data attributable to a visitor or browser is up to three years from collection, ending earlier when the purpose is achieved or consent withdrawn if no other basis exists. The maximum period must be ensured through settings and actual deletion or anonymisation; the banner code does not change retention at Yandex. Webvisor is disabled in the current configuration. If lawfully enabled later, its recordings are limited to the service's period of 15 days, including the current day.
6.8. The full terms are set out in the Analytics Consent and Cookie Policy. Deleting browser data does not delete emails or server logs. A technical refusal or permission for analytics does not replace consent for other purposes.
7. Rights of the personal data subject
7.1. The personal data subject has the right to receive information about the processing of their personal data, to demand its correction, blocking or destruction in the cases provided for by law, to withdraw consent to processing, and to appeal against the Controller's actions or omissions in the manner prescribed by law.
7.2. Inquiries and requests from personal data subjects are accepted at the email address zapros@svirin-pro-bono.ru or at the correspondence address specified in section 1 of the Policy.
7.3. To identify the inquiry, it is recommended to specify the contact details used when submitting it, the approximate submission date and the inquiry identifier, if available. The Controller may request proportionate verification of the subject's identity or their representative's authority. Requests provided for in Article 14 of the Personal Data Law are subject to the requirements for request contents established by that Article.
7.4. Information about the processing of personal data is provided to the subject or their representative within 10 working days from the date of the inquiry or receipt of the request. Where grounds provided for by law exist, this period may be extended by no more than five working days, with a reasoned notification stating the reasons for the extension being sent.
7.5. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal was received. If the processing of certain data continues on an independent lawful basis, the Controller informs the subject of such processing and its legal basis.
7.6. The subject may seek protection of their rights from the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) or in court.
8. Processing of third parties' personal data
8.1. Email submission of documents and information should be limited to what is needed to consider the enquiry. Before sending materials, it is recommended to remove or redact excessive passport, financial, medical and other personal data.
8.2. The Applicant's consent applies to their personal data and does not constitute the consent of other persons whose personal data is contained in the submitted materials.
8.3. Where materials are sent by a representative or third parties' personal data is provided, the Controller checks that the relevant authority and legal basis for processing exist. In the absence of a sufficient legal basis, the data is not used to provide services and must be blocked and deleted within the periods provided for by law.
8.4. Special categories of personal data and biometric personal data are processed in compliance with Articles 10 and 11 of the Personal Data Law. Consent expressed through a regular email does not replace written consent where that form is expressly required by law.
8.5. When submitting files, the applicant ensures they were lawfully obtained and may lawfully be provided to the Operator for considering the enquiry. The applicable terms are the Material Transfer and Use Terms. The email itself is not considered consent from everyone named in the documents and does not release the Operator from obligations. In case of doubt, authority and grounds for submission are requested, access is restricted and use of materials is suspended.
9. Personal data protection and final provisions
9.1. The Controller takes the necessary legal, organizational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful acts. Such measures include restricting access, ensuring secure data transmission, monitoring retention periods and monitoring compliance with requirements by engaged processors.
9.2. Personal data is destroyed by methods that preclude restoration of its contents in the information system and/or provide for the destruction of physical media containing personal data. The Controller ensures documentary confirmation of destruction in the cases and manner established by legislation.
9.3. The current version of the Policy is posted on the Website with its revision date. Changes to the Policy do not change the scope of consent previously given. If subsequent processing requires new consent, such consent is obtained separately before the relevant processing begins.
Counter and connection status
For svirin-pro-bono.ru, a dedicated Yandex Metrica counter No. 110490116 is specified. The number was provided by the Operator. Analytics collection is disabled until compliance with the prescribed data retention limits has been verified. Saving a visitor's choice does not itself enable the counter. After verification, it may run only with separately saved consent; upon refusal, no loading or new analytics requests take place. Webvisor is disabled.