Personal Data Processing Policy

You&Me · Edition 4, October 16, 2026

1. General provisions

1.1. This Personal Data Processing Policy (the "Policy") sets out the procedure for collecting, storing, transferring and otherwise processing personal data by Individual Entrepreneur Anna Vladimirovna Keller (the "Operator"), as well as information on the personal data protection requirements implemented.

Operator details:
Full name: Individual Entrepreneur Anna Vladimirovna Keller
TIN (INN): 661404240879
OGRNIP: 326965800259498
E-mail: kellerdimka@gmail.com

1.2. The Policy has been drawn up in accordance with the requirements of:

the Constitution of the Russian Federation;
Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (the "Personal Data Law");
the Tax Code of the Russian Federation;
other applicable regulatory legal acts of the Russian Federation.

1.3. This Policy applies to all information that the Operator may obtain through its websites, web forms and other digital services, as well as from clients, counterparties and representatives of counterparties in the course of preparing, concluding and performing civil law contracts.

1.4. Obtaining consent:

Consent to the processing of personal data is given by the data subject freely, of their own will and in their own interest. Consent to the processing of personal data must be specific, substantive, informed, conscious and unambiguous. Consent to the processing of personal data may be given in any form that allows the fact of its receipt to be confirmed, unless otherwise established by federal law.

Where personal data is processed in order to prepare, conclude and perform a civil law contract, or on other grounds provided for by the legislation of the Russian Federation, separate consent of the data subject is not required.

When the Operator's digital services are used, the Subject's consent to the processing of personal data is deemed to be the performance of actions that unambiguously indicate their intention to provide their data, including:

ticking the corresponding box ("checkbox") when filling in web forms on the website, landing pages and other internet resources owned by the Operator, accompanied by the text of consent to the processing of personal data.

By performing these actions, the Subject confirms that they have read the terms of this Policy and gives consent to the processing of their personal data for the purposes set out in it.

2. Basic terms used in the Policy

2.1. Personal data — any information relating to a directly or indirectly identified or identifiable natural person (personal data subject).

2.2. Personal data operator (Operator) — Individual Entrepreneur Anna Vladimirovna Keller, who, independently or jointly with other persons, organizes and (or) carries out the processing of personal data and determines the purposes of processing personal data, the composition of the personal data to be processed, and the actions (operations) performed with personal data.

2.3. Processing of personal data — any action (operation) or set of actions (operations) performed with or without automation tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, changing), retrieval, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion and destruction of personal data.

2.4. Automated processing of personal data — processing of personal data by means of computer technology.

2.5. Dissemination of personal data — actions aimed at disclosing personal data to an indefinite range of persons.

2.6. Provision of personal data — actions aimed at disclosing personal data to a certain person or a certain range of persons.

2.7. Blocking of personal data — temporary cessation of the processing of personal data, except where processing is necessary to clarify personal data.

2.8. Destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which the physical media of personal data are destroyed.

2.9. Depersonalization of personal data — actions as a result of which it becomes impossible, without using additional information, to determine whether personal data belongs to a specific personal data subject.

2.10. Cross-border transfer of personal data — transfer of personal data to the territory of a foreign state, to an authority of a foreign state, a foreign natural person or a foreign legal entity.

2.11. Website — a set of graphic and information materials, as well as computer programs and databases, ensuring their availability on the Internet. For the purposes of this Policy, the term "Website" also includes mobile applications, web applications, web forms and other digital services of the Operator through which personal data is processed.

2.12. User — any visitor to the Operator's Website.

3. Categories of personal data subjects

The Operator processes the personal data of the following categories of subjects:

Website visitors — persons who have accessed the Operator's Website and viewed its content, including without performing any targeted actions.
Application visitors.
Other categories of personal data subjects whose personal data is processed.
Clients — natural persons who have contacted the Operator for the purpose of preparing, concluding and performing a civil law contract.
Counterparties and their representatives — natural persons who are parties to civil law contracts with the Operator, as well as representatives of legal entities and individual entrepreneurs with whom the Operator has or intends to enter into contractual relations.

4. Purposes, legal grounds and procedure for processing personal data

4.1. Processing of personal data for the purpose of preparing, concluding and performing a civil law contract

Purposes of processing: preparation, conclusion and performance of a civil law contract.

Categories of personal data: last name, first name, patronymic; date of birth; email address; phone number; TIN; bank account number; position.

Categories of subjects: counterparties; representatives of counterparties; clients.

List of actions: collection; recording; systematization; accumulation; storage; clarification (updating, changing); retrieval; use; transfer (provision, access); blocking; deletion; destruction.

Methods of processing: mixed; without transfer over a legal entity's internal network; with transfer over the Internet.

Legal ground: the processing of personal data is necessary for the performance of a contract to which the personal data subject is a party, beneficiary or guarantor, as well as for the conclusion of a contract at the initiative of the personal data subject or a contract under which the personal data subject will be a beneficiary or guarantor. A contract concluded with the personal data subject may not contain provisions restricting the rights and freedoms of the personal data subject, establishing cases of processing the personal data of minors, unless otherwise provided by the legislation of the Russian Federation, or provisions allowing the inaction of the personal data subject as a condition for concluding the contract.

4.2. Processing of personal data for the purpose of handling incoming requests from feedback forms

Purposes of processing: handling incoming requests from feedback forms.

Categories of personal data: last name, first name, patronymic; email address; phone number.

Categories of subjects: Website visitors; Other categories of personal data subjects whose personal data is processed; Application visitors.

List of actions: collection; recording; systematization; accumulation; storage; clarification (updating, changing); retrieval; use; transfer (provision, access); blocking; deletion; destruction.

Methods of processing: mixed; without transfer over a legal entity's internal network; with transfer over the Internet.

Legal ground: personal data is processed with the consent of the personal data subject to the processing of their personal data.

5. Procedure for collecting, storing, transferring and otherwise processing personal data

5.1. Processing and storage periods:

The processing of personal data begins from the moment it is received from the personal data subject or their legal representative and is carried out:

until the purposes of processing personal data are achieved;
until the personal data subject withdraws consent (where processing is based on consent);
until the Operator ceases its activities;
for the periods established by the legislation of the Russian Federation.

Special storage periods by category of subject:

Data of clients, counterparties and representatives of counterparties is stored for the period of preparation, conclusion and performance of the contract and the period of rendering services, as well as for the periods established by the legislation of the Russian Federation on accounting and taxation, and within the general limitation period.
Data of website visitors (requests, feedback forms) is stored until the request is processed, a contract is concluded or the personal data subject withdraws consent.

Upon expiry of these periods, achievement of the purposes of processing or withdrawal of consent by the subject (if there are no other legal grounds for processing), personal data is subject to destruction within 30 (thirty) days, unless otherwise provided by the legislation of the Russian Federation.

5.2. Location of databases (localization):

Databases containing personal data of citizens of the Russian Federation are located on the territory of the Russian Federation:

Database No. 1 (the Operator's own data processing center):
Physical location: Karpinsk, Sverdlovsk Region.

Database No. 2 (Hosting / Yandex.Cloud LLC):
Provider: Yandex.Cloud LLC (ООО «Яндекс.Облако»).
Physical location of servers (data center): 19 Silikatnaya St., Mytishchi, Moscow Region.
TIN (INN): 7704458262. OGRN: 1187746678580. Address: 16 Lva Tolstogo St., premises 528, Moscow.

5.3. Transfer of personal data to third parties

5.3.1. Transfer of data to third parties:
The Operator transfers personal data to third parties and (or) entrusts them with its processing in the cases and to the extent necessary to achieve the stated purposes of processing, on the basis of contracts containing personal data protection terms, or in cases expressly provided for by the legislation of the Russian Federation.

5.3.2. Transfer of data to tax and other authorized bodies:
In cases provided for by the legislation of the Russian Federation, the Operator transfers the necessary information to the Federal Tax Service of the Russian Federation, and also provides the necessary information to other authorized bodies in order to comply with the requirements of the legislation of the Russian Federation.

5.3.3. Legal grounds for transfer:

consent of the personal data subject;
the need to perform a contract to which the personal data subject is a party, beneficiary or guarantor;
performance of obligations imposed on the Operator by the legislation of the Russian Federation.

5.4. Cross-border transfer:
The Operator does not carry out cross-border transfer of personal data.

6. Updating, correcting, deleting and destroying personal data

6.1. Rights of the personal data subject:

The personal data subject has the right to:

receive information concerning the processing of their personal data;
demand that the Operator clarify, block or destroy their personal data in cases provided for by law;
withdraw consent to the processing of personal data;
appeal against the actions or inaction of the Operator to Roskomnadzor or in court;
exercise other rights provided for by Federal Law No. 152-FZ "On Personal Data".

6.2. Procedure for exercising rights:

To exercise their rights, the personal data subject sends a written request to the Operator at the email address kellerdimka@gmail.com or to the Operator's address.

The request must contain the information provided for by Article 14 of Federal Law No. 152-FZ "On Personal Data".

The Operator undertakes to consider the request and provide a response within a period not exceeding 10 (ten) working days from the date of receipt of the request. This period may be extended by no more than 5 (five) working days, provided that the personal data subject is sent a reasoned notice stating the reasons for the extension.

6.3. Destruction of personal data:

6.3.1. The Operator ceases processing, blocks, clarifies and destroys personal data in the manner and within the periods provided for by Article 21 of Federal Law No. 152-FZ "On Personal Data":

when the purpose of processing is achieved — ceases processing and destroys the personal data within a period not exceeding 30 calendar days, unless there are other legal grounds for further processing;
when the subject withdraws consent — ceases processing and destroys the personal data within a period not exceeding 30 calendar days, if its retention is not required for the purposes of processing and there are no other legal grounds;
upon receipt of the subject's demand to cease processing — ceases processing within a period not exceeding 10 working days; this period may be extended by no more than 5 working days by sending the subject a reasoned notice;
upon receipt of a complaint about unlawful or inaccurate processing — blocks the relevant personal data from the moment of the complaint for the period of verification;
upon confirmation that the personal data is inaccurate — clarifies it within 7 working days and lifts the blocking;
upon detection of unlawful processing — ceases it within a period not exceeding 3 working days, and if it is impossible to ensure lawful processing, destroys the personal data within a period not exceeding 10 working days;
if destruction within the established period is impossible — blocks the personal data and ensures its destruction within no more than 6 months, unless another period is established by federal law.

6.3.2. Confirmation of the destruction of personal data is:

for processing without automation tools — a certificate of destruction of personal data;
for automated processing — a certificate of destruction of personal data together with an extract from the event log of the personal data information system.

6.3.3. These documents (certificates of destruction and event log extracts) are kept by the Operator for 3 (three) years from the moment the personal data is destroyed, in accordance with the requirements of regulatory legal acts of the Russian Federation, including Roskomnadzor Order No. 179 of 28.10.2022.

7. Measures to ensure the security of personal data

7.1. In order to protect personal data, the Operator takes the necessary and sufficient legal, organizational and technical measures provided for by Articles 18.1 and 19 of Federal Law No. 152-FZ "On Personal Data".

Legal measures include:

adoption and publication of this Policy;
issuance of internal documents defining the procedure for processing personal data;
inclusion in contracts with third parties of terms on maintaining confidentiality and ensuring the security of personal data.

Organizational measures include:

appointment of a person responsible for organizing the processing of personal data;
internal control over compliance of personal data processing with the requirements of the legislation of the Russian Federation;
restricting access to personal data to persons who need such access;
restricting physical access of unauthorized persons to processing equipment and paper media.

Technical measures include:

use of licensed antivirus software;
password protection of access to computers;
use of a secure data transfer protocol (HTTPS/TLS) on the website;
regular software updates;
creation of database backups.

8. Final provisions

8.1. The personal data subject may obtain clarifications on matters of personal data processing by sending a request to the Operator at the email address kellerdimka@gmail.com.

8.2. Changes to the Policy: the Operator has the right to make changes to this Policy. A new edition of the Policy enters into force from the moment it is posted on the Website, unless otherwise provided by the new edition of the Policy.

8.3. Current version: the current version of the Policy is freely available on the Operator's Website.

8.4. Control of compliance: compliance with the requirements of this Policy is monitored by the authorized person responsible for organizing the processing of personal data, appointed by order of the Operator.

8.5. Dispute resolution: all disputes arising in connection with the processing of personal data are resolved through pre-trial claim procedure, and if no agreement is reached, in the manner established by the legislation of the Russian Federation.

Operator details

Personal data operator:
Individual Entrepreneur Anna Vladimirovna Keller
TIN (INN): 661404240879
OGRNIP: 326965800259498
E-mail: kellerdimka@gmail.com

Date of the latest edition: 16.10.2026