Personal Data Processing Policy

1 General provisions

This Policy sets out the purposes, legal bases, scope and procedures for processing personal data when using the ORELTA information website at https://orelta.ru and https://www.orelta.ru (the Website). The Controller is Individual Entrepreneur Chizhova Maria Viktorovna. This Policy has been prepared in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”.

The Website introduces the ORELTA AI system and provides a presentation and contact form. It does not offer registration, personal accounts, ordering or payments. This Policy covers the technical operation of the Website, analytics following consent and enquiries concerning personal data.

This Policy is not consent to data processing. Visitors provide analytics consent through a separate action. Data processing rules within the AI product and connected systems are defined separately; this Policy does not authorise disclosure of visitors’ data to language models.

2 Controller details

Individual Entrepreneur Chizhova Maria Viktorovna. INN 780721802000.

Registered and postal address: premises 4-N, building A, building 1, 55 Petergofskoye Highway, Saint Petersburg, 198206, Russia.

Protected form for personal data enquiries: orelta.ru/en/#contact. Phone: +7 (812) 611-11-15. You may also send an enquiry by post to the address above.

3 Key terms

Personal data means information relating directly or indirectly to an identified or identifiable individual. A Visitor is an individual who uses the Website.

Processing means operations performed on data: collection, recording, organisation, accumulation, storage, updating, retrieval, use, transfer, depersonalisation, restriction, deletion and destruction. Cookies and browser local storage allow small amounts of information to be saved on a visitor’s device.

4 Principles and legal bases

The Controller processes data lawfully, for predetermined purposes and only to the extent necessary. Data is not used for incompatible purposes or retained longer than necessary for the relevant purpose or compliance with the law.

Legal bases: consent for optional analytics; the exercise of the Controller’s rights and legitimate interests, subject to respect for visitors’ rights, for Website operation and security; compliance with legal requirements for handling requests from data subjects.

The Website does not request special categories of personal data or biometric data. Do not submit excessive information or documents unrelated to your enquiry.

5 Purposes, data categories and retention

Website operation and security. When pages are requested, the server processes the IP address, request time, page address, technical browser and device information, and information about errors and security events. The purposes are page delivery, diagnostics and Website protection. Technical logs are retained only for the period required for these tasks and as configured by the hosting provider. Incident data may be retained until the incident has been resolved where a legal basis exists.

Traffic analysis. Only after consent does Yandex Metrica receive technical browser and device information, IP address, cookie identifiers, pages visited, referring source, timing and actions on the Website. Session Replay records interface interactions, including clicks, scrolling and pointer movements. The purpose is to understand which content is useful and how to improve the Website. Names, phone numbers, email addresses and customer documents are not deliberately sent to the analytics counter.

The visitor’s choice is saved in the browser for 180 days, after which consent is requested again. Sending new analytics data stops when consent is withdrawn. Retention periods for individual Metrica cookies are listed in section 8. Deleting cookies does not automatically delete statistics already collected by the service; the Controller handles requests to stop processing and delete data in accordance with the law.

Contact form enquiries. We process the name, company if provided, phone number or email address, message content, consent confirmation and limited technical information needed to protect the form from automated submissions. The purposes are to receive the enquiry, contact the sender and discuss potential cooperation. Data is retained until the correspondence ends, and afterwards only for the period necessary to document business relationships, meet legal requirements or protect rights.

Personal data enquiries. We process the applicant’s name, reply contact details, request content and information needed to verify the grounds for the request and the applicant’s authority. The purposes are to exercise data subject rights and fulfil the Controller’s obligations. Data is retained until the request has been resolved and afterwards only where required by law or necessary to protect rights.

6 Obtaining consent

Metrica and Session Replay are not loaded before the visitor makes a choice. To consent, the visitor clicks “Allow analytics” in a notice linking to a separate consent text. No permissions are preselected. “No analytics” allows use of the Website without the counter.

The choice, date, validity period and consent version are saved in browser local storage. This technical record applies the selected setting on that device. If the record is deleted, the browser changes or the validity period expires, the visitor must choose again.

You can change your choice at any time using “Cookie settings” at the bottom of the page. Selecting “No analytics” stops the counter, clears Metrica identifiers on the Website’s domain that the Website can access, and reloads the page without analytics.

7 Processing conditions and data recipients

The Website is hosted by R01. The hosting provider processes technical requests necessary to serve pages. Access on the Controller’s side is limited to authorised persons and to the extent necessary for their duties.

The Website’s static pages are hosted by R01. A server function in Yandex Cloud, operated by YANDEX.CLOUD LLC, receives form submissions, verifies protection and sends an email over a secure connection to Google Workspace business email. Yandex Cloud receives the name, company if provided, phone or email, message, consent confirmation, IP address and technical request information. Google Workspace receives the enquiry content needed to reply. Authorised persons have access to enquiries.

Yandex SmartCaptcha, provided by YANDEX LLC, protects the form against automated submissions. The service receives a one-time verification token, IP address and technical HTTP request information. Enquiry fields are not included in the separate SmartCaptcha verification request.

Analytics following consent uses the service of YANDEX LLC, 16 Lva Tolstogo Street, Moscow, 119021, Russia. Processing takes place using Yandex Metrica in accordance with its terms and the configuration of counter No. 112517533.

The Controller does not sell data or publish it for an unrestricted audience. Disclosure to government authorities or other persons is permitted only where a legal basis exists and to the extent necessary.

When collecting personal data of Russian Federation citizens, requirements for the use of databases located in the Russian Federation must be observed. Adding new recipients or cross-border transfers requires a separate review of legal bases and completion of statutory procedures before processing begins.

8 Cookies and Yandex Metrica

The necessary local storage record orelta_analytics_consent_v1 remembers only the analytics choice, document version and validity period for 180 days. It is not used for advertising profiling.

Following consent, Metrica may store, among other things, _ym_uid and _ym_d for up to 1 year, _ym_isad for up to 20 hours, _ym_metrika_enabled for up to 60 minutes, _ym_visorc_* for up to 30 minutes, and technical records in localStorage. The exact set depends on the browser and service features. Yandex publishes the current list at: https://yandex.ru/support/metrica/ru/general/cookie-usage.

Service terms: https://yandex.ru/legal/metrica_termsofuse/ru/. Yandex Privacy Policy: https://yandex.ru/legal/confidential/ru/. Information about collected data: https://yandex.ru/support/metrica/ru/code/data-collected.

Browser settings allow you to delete cookies and local records, including those set on Yandex domains that the Website cannot control. Refusing analytics does not restrict browsing the Website or downloading the presentation.

9 Data subject rights

Visitors may obtain information about processing, request correction, restriction or destruction of data where grounds exist, withdraw consent, request that processing stop, and challenge the Controller’s actions before Roskomnadzor or a court.

Send your request through the protected form or to the postal address in section 2. Provide your name, reply contact details, the substance of your request and information that connects it to the data processing. For analytics, visit dates and an available browser identifier are useful; do not send unnecessary documents.

The Controller responds within statutory time limits: information about processing within 10 working days, with a justified extension of up to 5 working days. Following consent withdrawal, processing stops and data is destroyed within 30 days unless another legal basis applies. Specific statutory time limits apply to certain requests.

10 Data protection

The Controller must take necessary legal, organisational and technical safeguards, define access procedures, maintain confidentiality and supervise engaged processors. Connections to the Website are secured by HTTPS.

If a violation is identified, the Controller takes steps to stop it and address its consequences, and sends legally required notifications. Publishing this Policy does not itself replace the Controller’s organisational obligations.

11 Ending processing

Processing ends when its purpose is achieved, the retention period expires, consent is withdrawn or another statutory ground applies. If retention is required by law or another legal basis, data is used only for that purpose.

The Controller ensures deletion or destruction of data and documentation of these actions in accordance with established procedures. If immediate destruction is impossible, data is restricted until the obstacle is removed, within the statutory period.

12 Policy updates

The version dated 21 September 2026 takes effect when published on the Website. The current version is publicly available. Changes to Website functions or processing purposes require corresponding document updates; separate consent is requested for new purposes where consent is required.

13 Contact details

Individual Entrepreneur Chizhova Maria Viktorovna. For data processing enquiries: protected contact form; +7 (812) 611-11-15. Postal address: premises 4-N, building A, building 1, 55 Petergofskoye Highway, Saint Petersburg, 198206, Russia.