1. Definitions
Automated processing — processing of personal data by means of computing equipment.
Blocking — temporary suspension of processing, except where processing is required to update the data.
Personal data information system — the combination of personal data contained in databases together with the information technologies and technical means used to process it.
Client (User) — individuals and legal entities who visit the Website and/or the Operator’s communication channels and submit an enquiry in order to obtain information about the Operator’s services and/or to enter into a contract, as well as their representatives under the laws of the Russian Federation.
Anonymisation — actions after which it becomes impossible, without additional information, to attribute personal data to a specific data subject.
Processing — any action or set of actions performed on personal data with or without automation, including collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer (distribution, provision, access), anonymisation, blocking, deletion and destruction.
Operator — Individual entrepreneur Andrey Yurievich Kochanov, OGRNIP 326246800101626, INN 245209383475, address: 662978, Zheleznogorsk, Krasnoyarsk Krai, Russia, who alone or jointly with others organises and/or carries out the processing of personal data and determines the purposes of processing, the scope of data processed and the operations performed on it.
Personal data — any information relating to a directly or indirectly identified or identifiable individual (the data subject).
Policy — this Personal Data Processing Policy.
Website — the Operator’s official website at https://digital-hook.ru/, including all of its language versions and subdomains.
Operator’s communication channels — the Operator’s accounts and channels in Telegram, WhatsApp and MAX messengers, as well as the email address and phone number published on the Website.
Cookie — a small piece of data sent by a web server and stored on the User’s device, which the browser returns to the server on each request to the corresponding website.
IP address — the unique network address of a node through which the User accesses the Website.
Analytics services — third-party web analytics services used on the Website to collect anonymised visit statistics: Yandex.Metrica (including Session Replay and click maps) and Google Analytics.
Data subject — an individual aged 18 or older who is directly or indirectly identified or identifiable by personal data, as well as their legal representative.
Federal Law No. 152-FZ — Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”.
2. General provisions
2.1. This Policy defines how the Operator processes personal data obtained through the data subject’s use of the Website or the Operator’s communication channels, and describes the protection measures implemented in accordance with Federal Law No. 152-FZ.
2.2. The legal grounds for processing are:
- the Constitution of the Russian Federation;
- the Civil Code of the Russian Federation;
- Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”;
- Federal Law No. 149-FZ of 27 July 2006 “On Information, Information Technologies and Information Protection”;
- Federal Law No. 38-FZ of 13 March 2006 “On Advertising”;
- the Operator’s constitutive documents and the contracts concluded between the Operator and the data subject;
- the data subject’s consent to the processing of their personal data.
2.3. The Policy is a public document and is freely available at https://digital-hook.ru/privacy in accordance with Part 2 of Art. 18.1 of Federal Law No. 152-FZ.
2.4. Processing is carried out on a lawful and fair basis. The Operator does not process personal data in ways incompatible with the purposes for which it was collected.
2.5. Only personal data that matches the stated purposes is processed. The content and scope of the data processed correspond to those purposes; excessive data is not processed.
2.6. The Operator does not process special categories of personal data (racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sex life), biometric data, or data of persons under 18. The Website is not intended for use by persons under 18.
2.7. Recording, systematisation, accumulation, storage, updating and retrieval of the personal data of citizens of the Russian Federation is performed using databases located within the territory of the Russian Federation, in accordance with Part 5 of Art. 18 of Federal Law No. 152-FZ.
2.8. The Operator has filed a personal data processing notification with Roskomnadzor under Art. 22 of Federal Law No. 152-FZ and is listed in the register of personal data operators under registration number 12733/24 dated 25 July 2026.
2.9. Using the Website, submitting any form on it, or contacting the Operator through its communication channels constitutes the data subject’s acceptance of this Policy and of the processing terms set out in it. A data subject who does not accept these terms should refrain from using the Website and from submitting enquiries.
3. Purposes of processing and categories of data
3.1. The Operator processes personal data solely for the following purposes:
- handling enquiries and requests received through Website forms or communication channels, preparing a reply and a commercial proposal;
- concluding, performing and terminating service contracts for the development, support and automation of digital products;
- informing the data subject about the progress of work and about the Operator’s services;
- maintaining Website visit statistics, analysing user behaviour and improving the Website and the services;
- complying with the obligations imposed on the Operator by the laws of the Russian Federation, including tax and accounting legislation.
3.2. When Website forms are submitted, the Operator processes the following personal data voluntarily provided by the data subject:
- name or another form of address chosen by the data subject (including a company name);
- phone number;
- email address;
- messenger handle (Telegram, WhatsApp, MAX);
- project details voluntarily supplied by the data subject: project type, indicative budget, industry, and the text of the enquiry.
3.3. In addition, on form submission the Operator automatically records the technical details needed to evidence the consent given and to protect against automated submissions: date and time of submission, IP address, browser details (User-Agent), the URL of the page, and the text and version of the consent wording.
3.4. When the Website is visited, analytics services process anonymised information: IP address, cookies, browser and device details, operating system, screen resolution, referral source, pages visited, time and duration of viewing, and on-page behaviour (cursor movement, clicks, scrolling, interaction with form fields excluding the values entered). The scope of this data and the opt-out procedure are described in Annex No. 2.
3.5. The Operator does not take decisions producing legal effects concerning the data subject solely on the basis of automated processing of their personal data.
3.6. The Operator does not process personal data for the purpose of promoting goods, works or services through direct contact with potential customers without prior consent, and does not distribute personal data to an indefinite range of persons.
3.7. When you contact the Operator’s support bot in Telegram, the Operator processes your Telegram user ID, first name, username and interface language code. Message contents remain in Telegram and are not stored in the Operator’s systems.
4. How personal data is obtained and processed
4.1. Personal data is provided by the data subject voluntarily. Providing it is not mandatory; declining to do so only means that an enquiry cannot be submitted through the Website forms.
4.2. Consent to processing is given by ticking the corresponding checkbox in the form before it is submitted. Submitting a form without that tick is technically impossible. The consent wording is set out in Annex No. 1.
4.3. Consent to the processing of data collected by analytics services is given separately, by pressing “Accept” in the information banner shown on the first visit. Until that consent is given, Session Replay, click maps and other detailed behaviour recording tools are not activated. The consent wording is set out in Annex No. 2.
4.4. The Operator processes personal data both by automated means and without automation. The operations performed include collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer, anonymisation, blocking, deletion and destruction.
4.5. The data subject is responsible for the accuracy and currency of the information provided and for the lawfulness of passing third parties’ personal data to the Operator. The Operator assumes the data provided is accurate and is not obliged to verify it.
4.6. Processing ceases once its purposes are achieved, upon withdrawal of consent, upon detection of unlawful processing, or upon the Operator ceasing to operate.
5. Retention periods and storage
5.1. Personal data received through Website forms is stored in the Operator’s content management system hosted on servers located within the territory of the Russian Federation.
5.2. Personal data received through Website forms that does not result in a contract is retained for 1 (one) year from the date of last interaction with the data subject, unless the laws of the Russian Federation provide otherwise.
5.3. Personal data processed in connection with the conclusion and performance of a contract is retained for the term of the contract and for 5 (five) years after its termination, to the extent required by tax and accounting legislation.
5.4. Records evidencing the consent given (date, time, IP address, consent wording and version) are retained for the entire processing period and for 3 (three) years thereafter, as evidence of the lawfulness of processing.
5.5. The retention period for anonymised data collected by analytics services is determined by the rules of those services and is stated in Annex No. 2.
5.6. Once the purposes are achieved or the retention periods expire, personal data is destroyed or anonymised. Destruction is confirmed by a record drawn up by the Operator.
6. Anonymisation of personal data
6.1. Anonymisation is applied to reduce the harm from potential disclosure of personal data and for statistical and analytical purposes.
6.2. Anonymisation is applied in the following cases:
- once the purposes of processing have been achieved or the need to achieve them has been lost, where the data is retained for statistical or research purposes;
- at the request of the data subject, where the data is incomplete, outdated, inaccurate or unlawfully obtained;
- when aggregated statistics on enquiries and Website visitors are compiled.
6.3. Anonymised data does not allow attribution to a specific data subject without additional information and does not constitute personal data.
7. Protection of personal data
7.1. The Operator takes the legal, organisational and technical measures necessary to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, distribution and other unlawful actions.
7.2. The measures implemented by the Operator include:
- appointing a person responsible for organising the processing of personal data;
- adopting this Policy and internal rules on personal data processing;
- transmitting data between the User’s device and the Website exclusively over the secure HTTPS (TLS) protocol;
- hosting databases on servers located within the territory of the Russian Federation;
- limiting the range of persons with access to personal data and separating access rights in the content management system;
- applying anti-spam protection and rate limiting per IP address;
- regular backups and control over the integrity of storage media;
- briefing persons who process personal data on the requirements of the law and this Policy.
7.3. The Operator cannot guarantee absolute security of information transmitted over the Internet against the actions of third parties. The data subject accepts the risks inherent in the use of open communication channels.
7.4. If unlawful processing is detected, the Operator eliminates the breach within 3 (three) business days of detection, or, where elimination is impossible, destroys the data within 10 (ten) business days.
7.5. If unlawful transfer (provision, distribution or access) of personal data is established, the Operator notifies Roskomnadzor in the manner and within the deadlines set out in Part 3.1 of Art. 21 of Federal Law No. 152-FZ.
8. Transfer and disclosure of personal data
8.1. The Operator does not sell or transfer personal data to third parties, except in the cases expressly set out in this Policy and in the laws of the Russian Federation.
8.2. The Operator may entrust processing to the following categories of persons under contracts imposing confidentiality obligations and the requirements of Art. 6 of Federal Law No. 152-FZ:
- the hosting and server provider located within the territory of the Russian Federation, to the extent required to operate the Website and store data;
- the operators of analytics services (Yandex LLC — Yandex.Metrica; Google LLC — Google Analytics), limited to anonymised visit data and subject to consent having been given;
- the Operator’s contractors and specialists, to the extent required to handle the enquiry and deliver the services.
8.3. Notifications of new enquiries are additionally delivered to the Operator through the messaging service it uses, whose servers may be located outside the Russian Federation, which makes such delivery a cross-border transfer. The initial recording, systematisation, accumulation and storage of personal data nonetheless take place in databases within the Russian Federation. The notification contains the information supplied by the data subject in the form. By submitting a form, the data subject consents to that transfer.
8.4. The Operator discloses personal data to authorised state bodies on the grounds and in the manner prescribed by the laws of the Russian Federation, to the extent matching the lawful request.
8.5. The Website may contain links to third-party resources. The Operator is not responsible for their personal data practices; data subjects are advised to review their terms separately.
9. Rights of data subjects
9.1. The data subject has the right to obtain information concerning the processing of their personal data, including:
- confirmation that processing is taking place;
- the legal grounds and purposes of processing;
- the processing methods applied by the Operator;
- the Operator’s name and location, and details of persons with access to the data;
- the personal data being processed and its source;
- the processing periods, including retention periods;
- the procedure for exercising the rights provided by Federal Law No. 152-FZ;
- information on cross-border transfers carried out or intended.
9.2. The data subject may require the Operator to update, block or destroy their personal data where it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose, and may take the protective measures provided by law.
9.3. The data subject may withdraw consent at any time. The withdrawal may be sent in free form or using the template in Annex No. 3 to hello@digital-hook.ru or by post to the Operator’s address.
9.4. The Operator ceases processing and destroys the data within 30 (thirty) days of receiving the withdrawal, except where the law permits processing without the data subject’s consent (in particular, to perform a contract or to meet tax obligations).
9.5. A request must state the number of the identity document of the data subject or their representative, its date of issue and issuing authority, information confirming the data subject’s relationship with the Operator (in particular, the contact details used in the enquiry) or other information confirming that the Operator processes their data, and the signature of the data subject or their representative. The Operator replies within 10 (ten) business days of receiving the request.
9.6. The data subject may appeal the Operator’s acts or omissions to the authority for the protection of data subjects’ rights (Roskomnadzor) or in court.
9.7. Refusing cookies and analytics services is done in the ways described in Annex No. 2 and does not restrict access to the core features of the Website.
10. Final provisions
10.1. The Operator may amend this Policy. A new version takes effect once published on the Website, unless the new version provides otherwise.
10.2. The current version is permanently available at https://digital-hook.ru/privacy. The approval date of the current version is stated at the top of the document.
10.3. This Policy is drawn up in Russian. The English version is provided for convenience only and does not prevail in the event of any discrepancy.
10.4. All questions relating to the processing of personal data should be sent to hello@digital-hook.ru or raised by phone at +7 (999) 440-87-80.
10.5. The laws of the Russian Federation apply to relations connected with the processing of personal data.
Annex No. 1. Consent to the processing of personal data
By ticking the “I consent to the processing of my personal data” checkbox and submitting a form on the Website, the data subject freely, of their own will and in their own interest gives the Operator — Individual entrepreneur Andrey Yurievich Kochanov, OGRNIP 326246800101626, INN 245209383475, address: 662978, Zheleznogorsk, Krasnoyarsk Krai, Russia — consent to process the following personal data:
- surname and given name (or another form of address chosen by the data subject);
- phone number;
- email address;
- messenger handle;
- project details voluntarily entered in the form;
- date and time of submission, IP address, browser details, and the URL of the page.
Consent is given for the purposes of handling the enquiry and preparing a reply, concluding and performing a service contract, and informing the data subject about the progress of work.
The data subject permits the following operations on that data: collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer to the persons listed in clauses 8.2 and 8.3 of the Policy, anonymisation, blocking, deletion and destruction — both by automated means and without automation.
Consent is valid from the day it is given until the purposes of processing are achieved or until the day it is withdrawn. It may be withdrawn at any time in the manner described in section 9 of the Policy and Annex No. 3.
The fact of consent, its date and time, the IP address and the version of the consent wording are recorded by the Operator and retained under clause 5.4 of the Policy.
Annex No. 3. Template for withdrawing consent to the processing of personal data
A withdrawal is sent to hello@digital-hook.ru or by post to: 662978, Zheleznogorsk, Krasnoyarsk Krai, Russia. It may be drawn up in free form or using the template below.
To: Individual entrepreneur Andrey Yurievich Kochanov, OGRNIP 326246800101626, INN 245209383475, address: 662978, Zheleznogorsk, Krasnoyarsk Krai, Russia.
From: __________________________________________ (full name), identity document: ____________ No. ____________, issued by ____________________________ on ___ __________ ____, address: __________________________________________, contact details used when contacting the Operator: __________________________________________.
Statement of withdrawal of consent to the processing of personal data
Pursuant to Part 2 of Art. 9 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”, I withdraw my consent to the processing of my personal data given on ___ __________ ____ through the website https://digital-hook.ru/. I require that the processing of my personal data cease and that it be destroyed within the statutory period. Please send confirmation of compliance to: __________________________________________.
___ __________ ____ ____________________ / __________________________ (signature / name)
The Operator ceases processing and destroys the data within 30 (thirty) days of receiving the withdrawal, except where the laws of the Russian Federation permit processing without the data subject’s consent.