Personal Data Processing Policy

Version of 16 October 2026

This is a translation. In case of any discrepancy, the Russian version of the Policy prevails.

1. General provisions

1.1. This Personal Data Processing Policy (the Policy) is drawn up in accordance with Federal Law No. 152-FZ of 27.07.2006 «On Personal Data» (the Law) and sets out how personal data is processed and protected by Sole Proprietor Natalin Pavel Mikhailovich (TIN 667010333704, OGRNIP 320665800138821), trading as «Via Profit» (the Operator).

1.2. The Policy applies to personal data the Operator receives from visitors of the website https://via-profit.ru (the Website) and from persons who contact the Operator by phone, email or messengers.

1.3. The Policy is publicly available on the Website. The use of cookies is described in a separate document, the Cookie Policy; the text of the consent is in the Consent to the Processing of Personal Data.

2. Definitions

Personal data — any information relating directly or indirectly to an identified or identifiable individual (the data subject).
Processing — any operation performed on personal data, with or without automation: collection, recording, organisation, accumulation, storage, adaptation, retrieval, use, transfer, anonymisation, blocking, deletion, destruction.
Visitor — an individual using the Website.
Request — a callback request the Visitor sends through the contact form of the Website.
Cookie — a small piece of data the Website or an analytics service stores in the Visitor’s browser.

3. Principles

The Operator processes personal data lawfully and fairly, only for the specific purposes listed in section 4. The Operator does not collect data that is not needed for these purposes, does not merge databases with incompatible purposes, keeps the data accurate and stores it no longer than the purposes require.

4. Purposes, data, legal grounds and retention

4.1. Handling callback requests

Data subjects: Visitors who sent a Request.
Data: phone number; name (if given). Together with the Request the Website sends the time zone of the browser (to call back during working hours in the Visitor’s local time), the address of the page the Request was sent from and of the landing page, campaign tags (UTM), the device type (computer, tablet, phone), the chosen colour theme and language of the Website.
Purpose: to contact the Visitor about the Request, consult on the Operator’s services and prepare an offer.
Legal ground: the Visitor’s consent (art. 6(1)(1) of the Law), given by ticking the box in the form before sending the Request; if the Visitor decides to sign a contract — steps taken at their request before entering into it (art. 6(1)(5)).
Operations: collection, recording, storage, use, access by the Operator’s employee, deletion, destruction. Processing is mixed: automated and manual.
Retention: 6 months from receipt of the Request, or until the consent is withdrawn if earlier.

4.2. Answering calls, emails and messages

Data subjects: persons who contacted the Operator themselves.
Data: name, phone number, email address or messenger username, contents of the message.
Purpose: to answer and consult on the Operator’s services.
Legal ground: consent expressed by contacting the Operator (art. 6(1)(1)); steps at the person’s request before entering into a contract (art. 6(1)(5)).
Retention: 6 months from the last message, or until the consent is withdrawn.

4.3. Web analytics

Data subjects: Visitors who allowed analytics cookies.
Data: cookie identifiers, IP address, browser and device details, referrer, pages viewed and time spent on them, actions on pages (navigation, clicks, scrolling).
Purpose: to get visit statistics and improve the Website.
Legal ground: the Visitor’s consent (art. 6(1)(1)), given with the «Accept all» button of the cookie notice.
How: by the Yandex Metrica service (Yandex LLC, Russia) on the Operator’s behalf, see clause 5.4. The Operator sees only aggregated statistics and does not match it with Requests. See the Cookie Policy for details.
Retention: until the consent is withdrawn; cookie lifetimes are listed in the Cookie Policy.

4.4. Operation and security of the Website

Data subjects: all Visitors.
Data: IP address, date and time of the request, requested page, browser details (User-Agent) in the web server logs; necessary cookies with the Website settings.
Purpose: to keep the Website running, protect it from attacks and find errors.
Legal ground: the Operator’s legitimate interest in a working and secure Website (art. 6(1)(7)).
Retention: server logs are kept for no more than 30 days.

4.5. The Operator does not process special categories of personal data (health, political or religious views, etc.) or biometric data, and makes no decisions with legal effect based solely on automated processing. The Website is not intended for persons under 18.

5. How the data is processed

5.1. The Website and all data collected through it are hosted on servers in the Russian Federation. Personal data of Russian citizens is recorded, organised, accumulated, stored, adapted and retrieved using databases located in Russia (art. 18(5) of the Law). The Operator does not transfer personal data across borders.

5.2. A Request from the Website is delivered to the Operator as a message in the Russian messenger MAX. Only the Operator and an authorised employee, who processes the data as part of their job duties and must keep it confidential, have access to Requests and messages.

5.3. The Operator does not sell personal data and does not transfer it to third parties, except where Russian law expressly requires it (for example, a reasoned request of a court or a public authority). The Operator does not transfer Requests and messages to anyone else and does not entrust their processing to others.

5.4. Web analytics data (clause 4.3) is processed on the Operator’s behalf by Yandex LLC (the Yandex Metrica service, databases in Russia) under the Yandex Metrica terms of use — only if the Visitor allowed analytics cookies. Yandex LLC must keep this data confidential and take the protection measures required by art. 19 of the Law.

5.5. If a Visitor writes to the Operator in Telegram or another messenger, the Visitor chooses that service, and the rules of the service also apply to the conversation. The Operator does not move such messages to other systems.

5.6. When the retention period ends or the consent is withdrawn, the Operator destroys the personal data: copies of Requests on the Website server are deleted automatically, messages in the messenger — manually. The data is destroyed within 30 days from the date the purpose is achieved or the consent is withdrawn, unless the law provides otherwise.

6. Rights of the data subject

The data subject has the right to:

receive information about the processing of their data: whether it is processed, the purposes, methods and periods, the list of data and details of the Operator;
demand that their data be corrected, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not needed for the stated purpose;
withdraw the consent at any time;
appeal against the Operator’s actions to Roskomnadzor (the Russian data protection authority) or to court.

To exercise these rights, send a request or a withdrawal of consent to x@xxx.xx or by post to the address in section 9. Please include your name and phone number (or other details that help find your Request) and what you ask for. The Operator answers within 10 working days of receipt; the period may be extended by no more than 5 working days with a notice of the reasons.

Analytics cookies can be turned off at any time without a request — with the «Cookie settings» button at the bottom of the page or on the Cookie Policy page.

7. Obligations of the Operator and security measures

To protect personal data the Operator:

is personally responsible for organising the processing and has approved this Policy;
gives access to personal data only to the employee who needs it for work and familiarises them with the law and this Policy;
transfers data between the browser and the Website only over HTTPS and protects the form from forged requests;
restricts access to the server and messenger accounts with passwords and access keys;
does not write the contents of Requests to the Website logs and deletes copies of Requests automatically when the retention period ends;
notifies Roskomnadzor of any unlawful transfer (leak) of personal data within 24 hours and reports the results of the investigation within 72 hours.

8. Final provisions

8.1. The Operator may change the Policy. A new version takes effect when published on the Website unless it states otherwise. The date of the current version is given at the top.

8.2. Matters not covered by the Policy are governed by Russian law.

9. Operator details

Sole Proprietor Natalin Pavel Mikhailovich
TIN 667010333704, OGRNIP 320665800138821
Registration number in the register of personal data operators: 66-23-025140
Address for requests: Yekaterinburg, Blucher st., 58, 4th floor, office 422
Email: x@xxx.xx
Phone: +7 (343) 201-98-80