Personal data processing policy

1. General provisions

This Policy is issued by InnoSpector LLC (the Operator) and sets out how personal data is processed and how its security is ensured in connection with the website innospector.ru and the communication channels published on it.

The Policy covers personal data the Operator receives from website visitors. Processing of personal data of employees, job candidates, counterparties and other categories of data subjects is governed by the Operator’s separate internal regulations.

The Policy is based on the following legal acts:

• the Constitution of the Russian Federation (article 24);
• Federal Law No. 152-FZ of 27.07.2006 “On Personal Data”;
• Federal Law No. 149-FZ of 27.07.2006 “On Information, Information Technologies and Protection of Information”;
• Resolution of the Government of the Russian Federation No. 1119 of 01.11.2012 on requirements for the protection of personal data processed in personal data information systems;
• Order of FSTEC of Russia No. 21 of 18.02.2013 on the composition and content of organisational and technical personal data security measures;
• Order of Roskomnadzor No. 179 of 28.10.2022 on requirements for confirming the destruction of personal data.

The current version of the Policy is freely available at innospector.ru/privacy.

2. The Operator and the responsible person

Name

InnoSpector Limited Liability Company

Tax ID (INN)

1683032529

Registration (OGRN)

1261600015676

KPP

168301001

Address

1a Energotsentr quarter, Innopolis, Republic of Tatarstan, 420500, Russia

Email

info@innospector.ru

Telephone

+7 (986) 845-20-00

Website

innospector.ru

The personal data operator is InnoSpector LLC. The Operator has appointed a person responsible for organising the processing of personal data in accordance with article 22.1 of Federal Law No. 152-FZ.

Enquiries about personal data processing, including data subject requests and withdrawal of consent, should be sent to info@innospector.ru marked “Personal data”, or to the Operator’s postal address above.

The Operator complies with the requirement of article 22 of Federal Law No. 152-FZ to notify the authorised personal data protection body of its intention to process personal data.

3. Key definitions

Personal data

any information relating directly or indirectly to an identified or identifiable natural person — the data subject.

Processing

any operation or set of operations performed on personal data, with or without the use of automation.

Operator

the entity that organises and carries out the processing of personal data and determines the purposes of processing and the categories of data processed.

Data subject

the natural person to whom the personal data relates; under this Policy, a website visitor who has contacted the Operator.

Destruction

actions that make it impossible to restore the content of personal data and/or that destroy the physical media holding it.

4. Categories of data subjects and data processed

The Operator processes the personal data of website visitors — representatives of companies and sole traders who send a business enquiry on their own initiative, and other individuals who contact the Operator using the details published on the website.

The “Request a demo” form transmits the entered details to the Operator’s server, which forwards them by email to the Operator’s internal mailbox. The personal data reaches the Operator at the moment the form is submitted — once the visitor has ticked the consent box and pressed the send button. The form contents are not saved in a website database and exist only as that email.

The Operator processes the following personal data:

• first name, and also surname, patronymic and job title if the subject includes them in the enquiry;
• the name of the organisation the sender represents;
• telephone number;
• email address;
• the content of the enquiry, including the description of the inspection task and any other information the subject voluntarily includes in the message;
• correspondence records: the date, time and content of messages exchanged with the Operator.

While the website operates, web server and security logs automatically record technical information: IP address, date and time of the request, the requested page address, the server response code, browser and operating system type and version (User-Agent), and the referring address. Such information is treated as personal data where it allows a person to be identified indirectly, and is processed solely to keep the website available and secure.

The Operator does not process special categories of personal data (article 10 of Federal Law No. 152-FZ) or biometric personal data (article 11). The Operator does not request information about health, racial or ethnic origin, political opinions, or religious and philosophical beliefs. Please do not include such information in enquiries.

The website is addressed to professionals and representatives of organisations. The Operator does not knowingly collect the personal data of minors.

5. Purposes of processing

Personal data is processed for the following purposes:

• reviewing a business enquiry, preparing a response and conducting business correspondence;
• agreeing the terms of a demonstration, equipment supply, works or services, and concluding and performing a contract;
• keeping the website working, available and secure, and detecting and preventing technical faults and unlawful actions, including password-guessing attempts against the editorial section;
• complying with the Operator’s obligations under the laws of the Russian Federation, including responding to lawful requests from state authorities.

The Operator does not use personal data for marketing mailings, profiling or behavioural assessment, and does not take decisions producing legal effects concerning the subject based solely on automated processing (article 16 of Federal Law No. 152-FZ).

6. Legal grounds for processing

• the data subject’s consent to the processing of their personal data (clause 1 of part 1 of article 6 of Federal Law No. 152-FZ). Consent is given by a separate affirmative action — ticking a checkbox that is not pre-selected — and confirmed by the subject sending the email to the Operator themselves;
• the need to perform a contract to which the subject is a party, beneficiary or guarantor, and to conclude a contract at the subject’s initiative (clause 5 of part 1 of article 6);
• the need to fulfil functions and obligations imposed on the Operator by Russian law (clause 2 of part 1 of article 6);
• the requirements of Federal Law No. 149-FZ and acts adopted thereunder, which require information protection and the recording of technical data about the operation of the information system.

Providing personal data is voluntary. If the subject does not provide a name, contact details and a description of the task, the Operator will not be able to review the enquiry and prepare a response.

7. Procedure and conditions of processing

Processing is carried out in a mixed manner — both with and without the use of automation — while observing the confidentiality of personal data required by article 7 of Federal Law No. 152-FZ.

The Operator performs the following operations on personal data: collection, recording, systematisation, accumulation, storage, updating (modification, alteration), retrieval, use, transfer (provision, access), depersonalisation, blocking, erasure and destruction.

Personal data is collected when the visitor submits the enquiry form, and when the Operator receives an email or other enquiry. The website keeps no enquiry database and does not store form values on the server: the data is delivered by email to the Operator’s internal mailbox. A draft of the form is additionally kept in the visitor’s browser using sessionStorage; it is removed once the form has been sent and when the browser tab is closed.

Access to personal data is granted to those employees of the Operator who need it to perform their duties, and only to the extent necessary to achieve the purposes of processing.

8. Storage of data in the Russian Federation

When collecting personal data, including via the website, the Operator ensures that the recording, systematisation, accumulation, storage, updating and retrieval of the personal data of citizens of the Russian Federation is carried out using databases located within the Russian Federation (part 5 of article 18 of Federal Law No. 152-FZ).

The website, corporate email and the systems storing business correspondence are hosted with Russian service providers on servers located within the Russian Federation.

9. Transfer of personal data

The Operator does not disclose or disseminate personal data to third parties except as set out in this section and as required by Russian law. Personal data is not made publicly available; the Operator neither requests nor executes consent to the dissemination of personal data (article 10.1 of Federal Law No. 152-FZ).

The Operator may entrust the processing of personal data to Russian providers of hosting, email and information system support services under a contract (part 3 of article 6 of Federal Law No. 152-FZ). Such a contract obliges the processor to preserve confidentiality, apply the security measures required by article 19 of the Law, and process the data only to the extent and for the purposes assigned. The Operator remains liable to the data subject for that processor’s actions.

Personal data may be provided to state authorities upon reasoned requests made in accordance with Russian law, and only to the extent set out in such a request.

The Operator does not carry out cross-border transfers of personal data (article 12 of Federal Law No. 152-FZ). Should such a transfer become necessary, the Operator will notify the authorised body beforehand, satisfy the other statutory conditions, and amend this Policy accordingly.

10. Retention periods and destruction of data

Personal data is processed for no longer than the purposes of processing require.

Enquiries and correspondence

until the purpose of processing is achieved, but no longer than 3 (three) years from the date of the last message, unless a different period is set by contract or by law.

Contract data

for the term of the contract and the retention periods set by accounting and archiving legislation.

Technical logs

no more than 12 months from the date of the record.

On withdrawal of consent

destruction within no more than 30 days from receipt of the withdrawal, unless retention is required on another lawful ground.

Once the purposes of processing are achieved, upon withdrawal of consent, or where unlawful processing is identified, personal data is destroyed. Destruction is confirmed by a statement of destruction and an export from the information system’s event log, in the manner set by Order of Roskomnadzor No. 179 of 28.10.2022.

11. Security measures

The Operator applies the legal, organisational and technical measures required by articles 18.1 and 19 of Federal Law No. 152-FZ and by Government Resolution No. 1119 of 01.11.2012, including:

• appointing a person responsible for organising personal data processing;
• issuing internal regulations on the processing and protection of personal data and familiarising employees with them;
• limiting the employees who have access to personal data and separating access rights;
• identifying personal data security threats and applying protection measures matching the established protection level;
• transmitting data between the browser and the website over HTTPS;
• protecting the website’s editorial section: password access, session cookies with the HttpOnly and SameSite attributes, limits on login attempts and verification of the request origin;
• backing up and restoring data;
• internal audits of processing against statutory requirements and assessment of the harm that may be caused to data subjects.

Where unlawful or accidental transfer of personal data is established, the Operator notifies the authorised body of the incident within 24 hours and of the results of its internal investigation within 72 hours (part 3.1 of article 21 of Federal Law No. 152-FZ).

12. Rights of the data subject

Under articles 14–17 of Federal Law No. 152-FZ, the data subject has the right to:

• obtain and review the information about the processing of their personal data listed in part 7 of article 14 of the Law;
• demand that their personal data be corrected, blocked or destroyed where it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;
• withdraw consent to the processing of personal data;
• object to the processing and demand that it cease;
• appeal against the Operator’s acts or omissions to Roskomnadzor or in court, and claim damages and compensation for moral harm.

13. How to submit a request

A request should be sent to info@innospector.ru or to the Operator’s postal address. Under part 3 of article 14 of Federal Law No. 152-FZ, the request must contain:

• the number of the main identity document of the subject or their representative, and the date and issuing authority of that document;
• information confirming the subject’s relationship with the Operator (the date and email address from which the enquiry was sent, a contract number), or other information confirming that the Operator processes their data;
• the signature of the subject or their representative; a power of attorney must be attached where a representative applies.

The request may be submitted electronically and signed with an electronic signature in accordance with Russian law.

The Operator reviews the request and provides a reasoned response within 10 working days of receipt. This period may be extended by no more than 5 working days, with notice to the subject stating the reasons for the extension (part 1 of article 20 of Federal Law No. 152-FZ). Information is provided in an accessible form and must not contain the personal data of other subjects unless there are lawful grounds for disclosing it.

Consent may be withdrawn in free form by the same means. From the moment the withdrawal is received, the Operator ceases consent-based processing and destroys the data within no more than 30 days, except where processing may continue on another ground provided for by part 2 of article 9 and part 2 of article 21 of Federal Law No. 152-FZ.

14. Cookies and technical data

The cookies and browser storage mechanisms used, the purposes for which they are used and the ways to manage them are described in the Cookie Policy, which forms an integral part of this Policy.

Cookie policy

15. Changes to the Policy

The Operator may amend this Policy. A new version takes effect when it is published on the website unless the version itself provides otherwise. The date of the current version is given at the start of the document. The Operator gives separate notice of material changes affecting the purposes of processing or the categories of data processed.

The authorised body for the protection of data subjects’ rights is the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor), rkn.gov.ru.