Personal data processingpolicy

1. General provisions

This is a translation for convenience; the Russian version of the policy prevails.

1.1. This policy sets out how the personal data of visitors to the salyut.su website (the “site”) is processed and protected. It is drawn up under Article 18.1 of Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” (the “Law”).

1.2. The personal data operator is AKTO LLC (TIN 1216009142, PSRN 1021202253820), address: 3B Zelenaya St., Volzhsk, Mari El Republic, 425000, Russia (the “operator”).

1.3. For questions about personal data, write to info@salyut.su.

1.4. The policy is published at https://salyut.su/en/privacy and is available to any visitor of the site.

2. What data is processed

• from the “Contact a process engineer” form on the home page — name, phone, company name and the text of your question;
• from the form on the “Contacts” page — name, phone and the text of your message;
• from the “Order a sample” form on a product page — name, phone, e-mail address and the product you request a sample of;
• cookies and information collected by Yandex services (Yandex Metrica and the map on the “Contacts” page): IP address, browser and device details, referral source, pages viewed, actions on the page;
• server logs: IP address, date and time of the request, page address, browser details.

The operator does not process special categories of personal data or biometric data. Please do not enter in the forms any information that is not needed to answer your request.

3. Purposes of processing

• answering your request: process engineer consultation, product selection, preparing a quote, sending a sample;
• traffic statistics and improving the site;
• operation and security of the site;
• answering visitors’ requests concerning their personal data.

4. Legal grounds

• for data from the forms — the visitor’s consent (clause 1, part 1, Article 6 of the Law). Consent is given by ticking the box in the form before sending it; the text of the consent opens via the link next to the form: consent to the processing of personal data;
• for cookies and Yandex Metrica — the visitor’s consent, given by continuing to use the site after the cookie notice;
• for server logs — the operator’s legitimate interest in running the site and protecting it from attacks (clause 7, part 1, Article 6 of the Law).

5. Processing operations

Collection, recording, systematisation, accumulation, storage, clarification (updating, changing), retrieval, use, transfer (provision, access), blocking, deletion and destruction. Processing is mixed: with and without automation. No decisions with legal consequences for a visitor are made solely on the basis of automated processing (Article 16 of the Law).

6. Who receives the data

A request from a form goes to the operator’s employees by corporate e-mail and/or to the operator’s Bitrix24 CRM system. Requests are handled only by sales staff and process engineers who need them for their work.

Recipients of the data:

• 1C-Bitrix LLC (Russia) — the Bitrix24 CRM system, if requests are passed to it;
• Yandex LLC (Russia) — Yandex Metrica and Yandex Maps: cookies, IP address, browser details and actions on the site;
• the operator’s hosting provider and e-mail service — to the extent needed for the site and e-mail to work.

The data is stored on servers in the Russian Federation (part 5, Article 18 of the Law); no cross-border transfer takes place. Data is disclosed to public authorities only where required by law. The operator does not sell the data or share it for advertising.

7. Retention periods

• requests — as long as needed to answer and work on the request, but no longer than 3 years after the last contact;
• Yandex Metrica data — kept by Yandex LLC under its own rules; the operator sees it only in aggregated reports;
• server logs — no longer than 30 days.

When the period expires or the purpose is achieved, the data is destroyed. If consent is withdrawn, the data is destroyed within 30 days (part 5, Article 21 of the Law), unless the operator has other legal grounds to process it.

8. Cookies and Yandex Metrica

Cookies are small files that a site or a third-party service stores in the browser.

• The site itself does not set cookies for visitors. The note that you have closed the cookie notice is kept in the browser’s storage and is not sent to the server. A service login cookie is set only for employees in the site’s control panel.
• Yandex Metrica sets cookies (their names start with _ym) to tell a new visit from a repeat one and to count statistics. Metrica includes Webvisor, which records actions on the page. Webvisor does not record the text you type into the form fields.
• The map on the “Contacts” page is loaded from a Yandex server and may set Yandex cookies.

On your first visit a cookie notice appears at the bottom of the page. You can refuse cookies in your browser settings by blocking or deleting them, and opt out of Yandex Metrica with the Yandex blocker: https://yandex.ru/support/metrica/general/opt-out.html. The main functions of the site will keep working.

9. Visitor’s rights

A visitor has the right to:

• receive information about the processing of their personal data (Article 14 of the Law);
• demand that the data be clarified, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not needed for the stated purpose;
• withdraw consent to the processing of personal data;
• appeal against the operator’s actions to Roskomnadzor or in court.

To do so, write to info@salyut.su or send a letter to the operator’s address. To help us find your data, give the name and phone or e-mail you entered in the form. The operator replies within 10 business days of receiving the request. The period may be extended by no more than 5 business days, and the operator will explain why (part 1, Article 20 of the Law).

10. Data protection

The operator takes legal, organisational and technical measures to protect personal data (Articles 18.1 and 19 of the Law):

• connections to the site are encrypted (HTTPS);
• only employees who need requests for their work have access to them;
• the site’s control panel is password-protected, and passwords are stored as irreversible hashes;
• server logs are deleted automatically.

11. Changes to the policy

The operator may change this policy. A new version takes effect when published on this page; the version date is shown at the top of the page.

The text of the consent to the processing of personal data for the request forms: consent to the processing of personal data.