Personal data processing policy

1. General

1.1. This Personal Data Processing Policy (the "Policy") is drawn up under Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" (the "Law") and sets out how personal data is processed and protected by Sole proprietor Egor A. Filimonov (the "Operator").

1.2. The Policy applies to all personal data the Operator receives from users of the SOTRIX website (the "Site") through its forms, and in correspondence and negotiations started through the Site.

1.3. The Policy is published openly on the Site at /privacy as required by Article 18.1(2) of the Law. It is linked from every form on the Site and from the Site footer.

1.4. By submitting a form on the Site with the consent box ticked, the user confirms that they have read the Policy, accept its terms and consent to the processing of their personal data for the purposes and to the extent described below. A user who does not agree with the Policy should refrain from submitting data through the Site and contact the Operator another way.

1.5. The terms "personal data", "operator", "processing", "automated processing", "provision", "blocking", "destruction" and "anonymisation" have the meanings given in Article 3 of the Law.

2. Operator

2.1. The personal data operator is Sole proprietor Egor A. Filimonov, OGRNIP 321774600342371, INN 770174723202. Address: 13 Brigadirsky Lane, Moscow, 105005, Russia.

2.2. Requests about personal data are accepted by email at hello@sotrix.tech and by post at the Operator's address. The person responsible for organising personal data processing is the Operator personally (Article 22.1 of the Law).

3. Legal grounds for processing

3.1. The Operator processes personal data on the following grounds:

• the consent of the data subject (Article 6(1)(1) of the Law), given by ticking the box in a Site form before submitting it;
• the need to conclude and perform a contract to which the data subject or the company they represent is a party or beneficiary (Article 6(1)(5) of the Law) — when preparing a commercial proposal and concluding a contract;
• the need to exercise the Operator's rights and legitimate interests (Article 6(1)(7) of the Law) — to protect the Site from automated submissions and abuse;
• the Civil Code of the Russian Federation and Federal Law No. 38-FZ of 13 March 2006 "On Advertising" (Article 18) — for newsletters that the user has separately agreed to receive;
• the Operator's registration record (EGRIP) and other documents governing its activity.

3.2. Consent to receive newsletters about the Operator's solutions is given by a separate tick box, independently of consent to personal data processing, and is not a condition of getting a reply. Without that tick the user receives no emails other than a reply to their request.

4. What data is processed

4.1. Categories of data subjects: Site users who submitted the contact form or completed the free business process diagnostic (the "Checkup"); representatives of companies that are clients or prospective clients of the Operator.

4.2. Data the user provides themselves when filling in Site forms:

• name (how to address you);
• phone number and/or email address; Telegram handle, if the user gave one;
• company name and/or its website address, industry, company size, the user's role (position) in the company;
• the content of the request: the chosen topic, message text, answers to the Checkup questions (what holds the business back, where deals are tracked, where leads come from) and free-form comments;
• the fact and time of consent to the Policy and the version of its text; the fact of consent to the newsletter, if given.

4.3. Data transmitted automatically when a form is submitted:

• an irreversible hash (one-way fingerprint) of the IP address, computed with a secret salt. The IP address itself is not stored by the Operator; the hash is used only to limit how often forms can be sent from one address and to protect against automated submissions, and it cannot be reversed to recover the address;
• the browser string (User-Agent);
• the Site page the form was sent from, the address the user came from (referrer) and advertising tags in the page address (utm_source, utm_medium, utm_campaign and similar);
• date and time of submission.

4.4. The Operator does not process special categories of personal data (race or ethnicity, political opinions, religious or philosophical beliefs, health, intimate life) or biometric data. Please do not enter such information in free-text fields.

4.5. The Site is intended for business representatives. The Operator does not knowingly collect data from persons under 18.

4.6. The user is responsible for the accuracy of the information given. By providing data of third parties (for example, colleagues) the user confirms that they are entitled to pass it to the Operator.

5. Purposes of processing

5.1. Personal data is processed for the following purposes:

• replying to the request, consulting and discussing the user's task;
• running the free business process diagnostic (Checkup) and preparing its results;
• preparing a commercial proposal, concluding and performing a contract;
• keeping records of requests in the Operator's internal system: interaction history, request status, assigned employee, notes;
• protecting the Site from spam and automated submissions, rate-limiting requests;
• aggregate analysis of which channels and advertising campaigns bring requests;
• sending newsletters about the Operator's solutions — only with separate consent;
• fulfilling obligations imposed on the Operator by the legislation of the Russian Federation.

5.2. The Operator does not make decisions based solely on automated processing of personal data that produce legal effects for the data subject or otherwise affect their rights and legitimate interests (Article 16 of the Law).

5.3. Personal data is not used for purposes incompatible with those listed above.

6. How data is processed

6.1. Processing is carried out with automation tools (the Site software and the Operator's internal request tracking system) and without them — in correspondence and negotiations.

6.2. The following operations are performed on personal data: collection, recording, systematisation, accumulation, storage, updating (refinement, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction.

6.3. Recording, systematisation, accumulation, storage, updating and retrieval of personal data of citizens of the Russian Federation is carried out using databases located in the Russian Federation (Article 18(5) of the Law).

6.4. Only the Operator's employees who need personal data to perform their duties have access to it, and only to the extent required. The internal system can be entered only with individual accounts; actions on requests are logged.

6.5. The Operator does not place users' personal data in publicly accessible sources.

7. Transfer of data to third parties

7.1. The Operator does not sell personal data and does not pass it to third parties for their own purposes.

7.2. To run the Site and handle requests the Operator entrusts certain data operations (Article 6(3) of the Law) to the following parties, which see data only to the extent necessary and are bound to keep it confidential:

• the hosting provider whose servers host the Site, the request database and the internal tracking system (servers in the Russian Federation);
• the Telegram messenger (Telegram FZ-LLC / Telegram Messenger Inc.): a notification about a new request — name, company, contact, topic and content of the request — is sent to the Operator's employees in a work chat so they can reply faster. Telegram's servers are outside the Russian Federation, so this is a cross-border transfer (Article 12 of the Law). By submitting a form the user consents to it. A user who does not want their data sent this way can write to the Operator by email — in that case no messenger notification is sent;
• an email service — for correspondence with the user and, with separate consent, newsletters;
• the Yandex Metrica web analytics service (Yandex LLC, Russian Federation) — anonymised visit statistics, see section 10. Form data is not passed to it.

7.3. Personal data may be provided to authorised state bodies on the grounds and in the manner established by the legislation of the Russian Federation.

7.4. No cross-border transfer of personal data other than that described in clause 7.2 takes place.

8. Processing and retention periods

8.1. Personal data is processed no longer than the purposes require: for the time the request is handled and negotiations last, and when a contract is concluded — for its term and three years after the obligations are performed (the general limitation period), unless the law sets a longer retention period for particular documents (for example, five years for primary accounting documents).

8.2. Data from requests that did not lead to a contract is kept for no more than three years from the last interaction with the user, after which it is destroyed or anonymised.

8.3. When the purposes are achieved, consent is withdrawn or the data subject so requires, personal data is destroyed within thirty days (Article 21(4) and (5) of the Law) unless a different period is set by contract or law. After destruction the request record is kept in anonymised form — without name, contacts or content — for statistics only.

8.4. Technical data (IP hash, browser string, referral tags) is stored together with the request and destroyed together with it.

8.5. Newsletter consent is valid until withdrawn. After withdrawal the address is removed from the recipient list within three business days.

9. Rights of the data subject and how to exercise them

9.1. The user has the right to:

• learn whether the Operator processes their personal data, which data, for what purposes, to whom it was passed and for how long it is processed (Article 14 of the Law);
• demand that data be updated, blocked or destroyed if it is incomplete, outdated, inaccurate, obtained unlawfully or not needed for the stated purpose;
• withdraw consent to processing and, separately, consent to the newsletter;
• appeal against the Operator's actions or inaction to the authorised body for the protection of data subjects' rights (Roskomnadzor) or to a court (Article 17 of the Law).

9.2. To exercise these rights, send a request to hello@sotrix.tech with the subject "Personal data" or by post to the Operator's address. State: the name and contact you left on the Site; the substance of your demand; information confirming your relationship with the Operator (for example, the date of the request and the company) — it is needed so that your data is not disclosed to a stranger (Article 14(3) of the Law).

9.3. The Operator reviews the request and reports the measures taken within ten business days of receipt. This period may be extended by no more than five business days, of which the data subject is notified with reasons (Article 20(1) of the Law).

9.4. On withdrawal of consent the Operator stops processing and destroys the data within thirty days of receiving the withdrawal (Article 21(5) of the Law), except where processing may continue without consent on grounds provided by the Law (for example, keeping documents under a concluded contract).

9.5. You can unsubscribe from the newsletter via the link in any email or by writing to the Operator.

10. Cookies, local storage and analytics

10.1. The Site uses no advertising or third-party trackers and sets no cookies to identify the user.

10.2. While the Checkup is being completed, interim answers are saved in the browser's session storage (sessionStorage) so they are not lost on page reload. This information does not leave the user's device until the form is submitted and is deleted when the tab is closed.

10.3. To count visits and assess the usability of the Site the Operator uses the Yandex Metrica web analytics service. It collects anonymised technical information: pages, time of visit, device and browser type, referral source, approximate region by IP address. The Operator does not match this information with form data and it does not allow the Operator to identify the user. The service's own terms: yandex.ru/legal/confidential. You can stop Metrica collecting data in your browser settings or with the Yandex Metrica blocker. A cookie notice is shown when you visit the Site.

11. Personal data protection measures

11.1. The Operator takes legal, organisational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination and other unlawful actions (Articles 18.1 and 19 of the Law), including:

• data between the user's browser, the Site and the internal system travels only over an encrypted connection (HTTPS/TLS);
• instead of the IP address, only its irreversible salted hash is stored;
• rate limiting and protection of forms against automated submissions;
• access control: individual accounts, roles, access to the internal system for the Operator's employees only, logging of actions on requests;
• employee passwords stored only as irreversible hashes; secrets and access keys kept outside the source code;
• database backups with a limited retention period;
• appointment of a person responsible for organising processing; employees familiarised with the Policy and the requirements of the Law;
• internal control of compliance with the Law and this Policy.

11.2. If an unlawful or accidental transfer (provision, dissemination, access) of personal data is discovered, the Operator notifies the authorised body within the periods set by Article 21(3.1) of the Law and takes measures to remedy the consequences.

12. Changes to the Policy

12.1. The Operator may amend the Policy. A new edition takes effect when published on the Site unless it says otherwise. The edition date is given at the top of the document; the consent text version is stored with every request, so it is always possible to establish which edition the user agreed to.

12.2. Material changes — new purposes of processing, new recipients of data — do not apply to data obtained earlier without the user's fresh consent, unless the Law allows otherwise.

13. Final provisions

13.1. Questions about the Policy and personal data processing should be sent to hello@sotrix.tech. The Operator replies on business days within the period set in section 9.

13.2. Relations connected with personal data processing are governed by the law of the Russian Federation.

13.3. This English text is a translation provided for convenience. In case of any discrepancy the Russian version at /privacy prevails.