This is a courtesy translation. The legally binding document is the Russian version published at spgsales.ru/privacy/. Personal data of individuals in the Russian Federation is processed under Russian law, and in the event of any discrepancy between the two texts, the Russian version prevails. Section numbering is identical in both versions.
Operator: Individual Entrepreneur Nune Ashotovna Oganyan TIN (ИНН) 682710537390 · State registration number (ОГРНИП) 324774600810801 Address: 5A bldg. 1, Polyany St., Moscow, Russia Contact for data subject requests: info@spgsales.ru, +7 (993) 246-36-15 Website: https://spgsales.ru
Revision of 4 August 2026.
1. General provisions
1.1. This Policy establishes the procedure for processing personal data (hereinafter — PD) and the measures taken by the Operator to secure it. It is issued pursuant to Part 2 of Article 18.1 of Federal Law No. 152-FZ of 27 July 2006 "On Personal Data".
1.2. This Policy applies to all information about data subjects that the Operator receives in connection with the operation of the website https://spgsales.ru.
1.3. This Policy is a public document and is published at a permanent address on the Operator's website.
1.4. The Operator is entered in the register of operators processing personal data under registration number 77-25-309337 of 20 June 2025. The entry can be verified in the Roskomnadzor register (pd.rkn.gov.ru/operators-registry/operators-list/) by TIN 682710537390.
2. Definitions
2.1. Personal data — any information relating directly or indirectly to an identified or identifiable natural person (the data subject).
2.2. Processing of PD — any operation or set of operations performed on personal data, with or without the use of automation: collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer, anonymisation, blocking, deletion, destruction.
2.3. Operator — the person who organises and carries out the processing of PD and determines the purposes of processing, the composition of the PD processed and the operations performed on it.
2.4. Anonymisation of PD — operations after which it becomes impossible, without the use of additional information, to attribute the PD to a specific data subject.
2.5. Destruction of PD — operations after which the PD is irretrievably destroyed and its content cannot be restored.
2.6. Cross-border transfer of PD — transfer of PD to the territory of a foreign state, to a foreign state authority, or to a foreign natural or legal person.
3. Legal grounds for processing
3.1. PD is processed on the following legal grounds:
- consent of the data subject to the processing of their personal data (Clause 1, Part 1, Article 6 of Federal Law No. 152-FZ);
- the necessity of processing in order to conclude a contract at the initiative of the data subject, or a contract to which the data subject is a party (Clause 5, Part 1, Article 6 of Federal Law No. 152-FZ).
3.2. This Policy and the consents of data subjects, executed as separate documents, also serve as a legal ground for processing.
3.3. Federal Law No. 152-FZ is not in itself a legal ground for processing — it sets the requirements applicable to processing.
4. Principles of processing
4.1. PD is processed on a lawful and fair basis.
4.2. Processing is limited to the achievement of specific, predetermined and lawful purposes; processing incompatible with the purposes of collection is not permitted.
4.3. Only PD that corresponds to the purposes of processing is processed; its content and volume match the stated purposes and are not excessive (the data minimisation principle).
4.4. PD is not stored for longer than the purposes of processing require.
5. Categories of data subjects and composition of the personal data processed
5.1. Categories of data subjects: the Operator's clients and prospective clients; representatives of counterparties; website visitors; applicants for vacancies with the Operator.
5.2. Composition of the PD processed:
| What the data subject fills in | Personal data |
|---|---|
| Callback form, consultation forms, project brief, quiz | name; telephone number; email address; the content of the enquiry and the answers given in the form |
| Job application form | name; telephone number; email address; the information contained in the attached CV |
| Technical information about the visit | anonymised device and network address identifier; the address of the page from which the enquiry was sent; date and time of the enquiry |
5.3. The Operator does not process special categories of personal data (concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, health or sex life), nor biometric personal data.
5.4. Anonymisation of technical information. The network address (IP) and the device identifier (User-Agent) are stored solely in anonymised form — by irreversible transformation using a secret key. The original values are not stored. The page address is stored without query parameters.
5.5. Cookies. The website uses two groups of cookies:
- strictly necessary — they make the website work, remember the language choice and protect the forms against automated submissions; they are always used, because without them the website does not function;
- analytics — used to collect anonymised traffic statistics and loaded only after the visitor has given consent by pressing a button in the cookie notice. Until consent is given, no web analytics service is started on the website and no requests are made to it.
5.6. Web analytics services. Anonymised traffic statistics are collected using Yandex.Metrica (counter 99000884). That service processes data under its own terms; personal data allowing identification of the data subject is not transferred to it.
5.7. Changing the cookie decision. The data subject may change their decision at any time using the "Cookie settings" control at the bottom of any page of the website, and may also manage cookies in the browser settings. Withdrawal of consent stops the analytics services and deletes the cookies they have set. Disabling strictly necessary cookies through the browser may make certain website functions unavailable.
6. Purposes of processing personal data
6.1. The Operator processes PD for the following purposes:
- receiving, registering and reviewing enquiries submitted through the website forms;
- preparing and concluding a service contract at the initiative of the data subject, and communicating with the data subject regarding their enquiry;
- reviewing applications for vacancies with the Operator;
- protecting the website and its forms against automated submissions;
- measuring website traffic by means of web analytics — subject to the visitor's consent.
6.2. PD is not processed for any other purpose without a separate legal ground.
7. Procedure and conditions of processing
7.1. Method of processing: automated, without transfer over an internal network, with transfer over the Internet.
7.2. Database localisation (Part 5, Article 18 of Federal Law No. 152-FZ): the collection, recording, systematisation, accumulation, storage, updating and retrieval of PD of citizens of the Russian Federation are carried out using databases located in the territory of the Russian Federation — in data centres at 74 km MKAD, bldg. 3, Khimki, Moscow Region (technical facilities of the website, receipt and storage of enquiries) and at 42 bldg. 5, Volgogradsky Prospekt, Moscow (technical facilities of the mail server through which notifications of enquiries are delivered).
7.3. Transfer to third parties. The Operator entrusts the processing of PD to the following persons (Part 3, Article 6 of Federal Law No. 152-FZ), to the extent necessary for the relevant purpose:
- Individual Entrepreneur Evgeniy Samuelovich Boateng, TIN 774319428786, ОГРНИП 318774600624112, address: 71 Smolnaya St., Moscow — receipt of enquiries from the website forms, their storage and transfer to the Operator, delivery of email notifications, and recording of enquiries in the customer relationship management system;
- LLC "Hosting-Technologies", TIN 7721833428, address: 2/1 bldg. 2, 1st Frezernaya St., Moscow 109202 — hosting of the website technical facilities, receipt and storage of enquiries (data centre);
- LLC "ADMINVPS", TIN 7708257630, address: 19 Leninskaya Sloboda St., Moscow 115280 — hosting of the mail server through which notifications of enquiries are delivered (data centre);
- JSC "amoCRM", TIN 7709477879, address: 38 Lyusinovskaya St., Moscow 115093 — recording of enquiries in the customer relationship management system.
In addition, anonymised technical information is transferred to a person that determines the purposes of processing independently and acts as a separate operator:
- LLC "Yandex", TIN 7736207543, address: 16 Lva Tolstogo St., Moscow 119021 — protection of forms against automated submissions (Yandex SmartCaptcha) and web analytics (Yandex.Metrica, subject to the visitor's consent).
Processing is entrusted on the basis of a contract containing an obligation to maintain confidentiality and to comply with Federal Law No. 152-FZ. PD is not transferred to any other person except in the cases provided for by the legislation of the Russian Federation.
7.4. No cross-border transfer of personal data is carried out. All persons listed in clause 7.3 are located in the territory of the Russian Federation, and the processing servers are located in the Russian Federation.
7.5. Dissemination of PD, that is, disclosure to an indefinite group of persons, is not carried out.
7.6. The Operator does not take decisions producing legal effects concerning the data subject based solely on automated processing of their PD.
8. Processing and storage periods
8.1. Enquiries received through the website are processed and stored for 3 (three) years from the date of the data subject's last enquiry. Conditions for terminating processing: withdrawal of consent by the data subject, achievement of the purposes of processing, or cessation of the Operator's activity.
8.2. Upon expiry of the processing period, achievement of the purposes, or withdrawal of consent, the PD is subject to destruction unless otherwise provided by the legislation of the Russian Federation.
8.3. Compliance with the period is ensured automatically: information whose storage period has expired is deleted from the information system on a schedule, without a separate decision by the Operator.
9. Updating, blocking and destruction of personal data (Article 21 of Federal Law No. 152-FZ)
9.1. If inaccurate PD or unlawful processing is identified — including following a request from the data subject or the competent authority — the Operator updates or blocks the relevant PD for the duration of the verification.
9.2. If the inaccuracy is confirmed, the Operator updates the PD within 7 working days and lifts the block. If unlawful processing is identified and cannot be remedied, the Operator ceases processing and destroys the PD within no more than 10 working days, notifying the data subject accordingly.
9.3. Upon achievement of the purposes of processing or withdrawal of consent, the Operator ceases processing and destroys the PD within the periods established by Federal Law No. 152-FZ.
10. Personal data security measures (Articles 18.1 and 19 of Federal Law No. 152-FZ)
10.1. The Operator takes legal, organisational and technical measures to protect PD against unlawful access, destruction, alteration, blocking, copying, dissemination and other unlawful acts, including:
Legal: issuing and publishing this Policy; obtaining data subjects' consent as a separate document; concluding data processing instructions with the persons listed in clause 7.3.
Organisational: determining the list of PD processed and the places where it is stored; limiting the group of persons admitted to processing and differentiating their access rights; keeping a record of data subject requests; internal monitoring of the compliance of processing with statutory requirements; establishing the procedure for responding to incidents and for destroying PD once the purposes of processing have been achieved. The functions of the person responsible for organising the processing of PD are performed by the Operator personally.
Technical: encryption of the data transmission channel between the visitor's browser and the server; restriction of network access to the server by a firewall, with administrative access by authentication keys; protection of forms against automated submissions and rate limiting; anonymisation of network addresses and device identifiers on storage; regular backups; logging of operations performed on PD; automatic deletion of information whose storage period has expired.
10.2. Cryptographic information protection tools are not used.
11. Rights of the data subject
11.1. The data subject has the right to:
- obtain information about the processing of their PD to the extent provided for by Part 7 of Article 14 of Federal Law No. 152-FZ;
- obtain access to their PD;
- demand that their PD be updated, blocked or destroyed if it is incomplete, out of date, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;
- withdraw consent to the processing of PD;
- appeal against the acts or omissions of the Operator to Roskomnadzor or through the courts;
- protection of their rights and lawful interests, including compensation for losses and for moral harm.
11.2. The Operator undertakes to: provide the data subject, upon request, with information about the processing of their PD; respond to requests from data subjects and their representatives; provide the competent authority, upon its request, with the necessary information within 10 working days of receiving the request; take measures to protect PD; cease processing and destroy PD in the cases provided for by Federal Law No. 152-FZ.
12. Procedure for handling data subject requests
12.1. Requests are to be sent to info@spgsales.ru or made by telephone at +7 (993) 246-36-15.
12.2. A request must contain information allowing the data subject to be identified and the substance of the demand. The Operator may request additional information necessary to confirm the identity of the person making the request.
12.3. The response period is 10 working days from the date the request is received. This period may be extended by no more than 5 working days, with notice to the data subject stating the reasons for the extension.
12.4. Withdrawal of consent is given effect by ceasing processing and destroying the data subject's PD, except where processing may continue on the grounds provided for by Part 2 of Article 9 and by Articles 6, 10 and 11 of Federal Law No. 152-FZ.
13. Final provisions
13.1. The Operator may amend this Policy. The current revision is published on the website at a permanent address; the revision date is stated at the beginning of the document.
13.2. Matters not governed by this Policy are resolved in accordance with the legislation of the Russian Federation.