1. General provisions
1.1.
This Personal Data Processing and Protection Policy (the Policy) describes the procedures and conditions for processing personal data by Prudnikov Igor Evgenyevich, an individual applying the Professional Income Tax (NPD) regime in Russia (the Operator) in connection with the use of FACTOR11.studio, enquiries, project brief submissions, project discussions and delivery, and other interactions with the Operator.
The Policy has been prepared in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” and other applicable laws and regulations of the Russian Federation.
1.2.
The Policy applies to visitors to the website, people submitting enquiries or completing a project brief, clients, and representatives of organisations interacting with the Operator.
It covers https://factor11.studio/ and its pages and subdomains where a link to this Policy is provided.
1.3.
Visiting the website does not, by itself, constitute consent to all forms of personal data processing. Where consent is required, it is requested separately in a manner that allows the Operator to demonstrate that it was given.
Users decide independently whether to provide their personal data, freely and in their own interests.
1.4.
The Operator processes personal data only for specific, predetermined and lawful purposes. The amount of information collected must not be excessive in relation to those purposes.
1.5.
The Operator may update the Policy following changes in the law, website functionality, communication channels or data processing practices.
The current version is published at https://factor11.studio/en/privacy-policy/.
2. Purposes and categories of personal data processing
2.1. Enquiries, consultations and project discussions
Personal data may be processed to:
- receive and review enquiries and project requests;
- discuss websites, landing pages, online shops, member portals, web services and other digital products;
- identify project needs, objectives, requirements and features;
- prepare proposals and preliminary estimates of cost and delivery time;
- agree on cooperation terms, enter into and perform contracts;
- contact clients, answer questions, and address feedback and complaints;
- discuss subsequent support, maintenance and further development of completed projects.
Depending on the enquiry, the following data may be processed:
- first name, surname or another name supplied by the user;
- telephone number;
- email address;
- username or account identifier in Telegram or other messaging services;
- organisation name, job title and business contact details where provided;
- project type, requirements and preferences concerning functionality and design;
- details of an existing website, domain, services and proposed integrations;
- project brief choices, indicative budget and desired schedule;
- enquiry text, comments and correspondence;
- documents, images, mock-ups, links and other materials provided voluntarily for project discussions.
The Operator does not require data unnecessary for reviewing an enquiry or delivering agreed work.
Categories of data subjects: website visitors; prospective and existing clients; client and partner representatives; other individuals contacting the Operator.
Processing methods and operations: processing may be automated or manual and may include collection, recording, organisation, accumulation, storage, updating, retrieval, use, disclosure where necessary, restriction, deletion and destruction of data.
Legal grounds: a data subject's consent, steps taken at the data subject's request before entering into a contract, performance of a contract, compliance with legal obligations or other grounds provided for by Russian law. The applicable legal ground depends on the processing purpose.
2.2. Project briefs and website forms
The website may provide an interactive project brief through which users describe proposed work. It may request the project type, required features, materials, indicative budget, deadlines, contact details and additional preferences.
Submitted form data may be stored within the website content management system and communicated to the Operator using configured notification channels, including email. Access to submissions must be limited to persons who need it to handle the request.
Submitting a project brief does not authorise publication of a user's name, contact details, materials or submission contents.
A user providing information about another person must have a lawful basis for doing so.
2.3. Website operation and security
When the website is used, certain technical information may be processed automatically, including:
- IP address;
- date and time of a request;
- the URL of the requested page;
- User-Agent and browser/operating system information;
- referrer information;
- technical HTTP request parameters;
- error and security event information;
- web server log entries;
- essential technical cookies.
This information may be used to operate the website, identify malfunctions, prevent spam and automated abuse, protect against unauthorised access and maintain information security.
2.4. Cookies and third-party components
The website may use essential and functional cookies to operate pages, remember necessary settings, support forms and protect the website.
Users can restrict or delete cookies in their browser settings, although certain website features may then not function correctly.
Where optional analytics, advertising or other third-party technologies require consent, their use must respect the user's choice. The particular third-party services and cookie categories in use depend on the website's actual configuration.
2.5. Telephone, email and messaging services
Users may contact the Operator by telephone, email or the messaging links provided on the website. The Operator processes information voluntarily supplied for replying to enquiries, discussing projects, agreeing terms and continuing cooperation.
When a user opens an external messaging service, they also interact with that service's own operator under its terms and privacy policy. The Operator takes applicable legal requirements into account before transferring personal data through third-party services.
2.6. Portfolio, case studies and reviews
The website may display project descriptions, interface screenshots, photographs, website links, logos and other illustrative content.
Displaying a completed project does not, by itself, involve publication of the personal data of clients or the users of their systems. Where a review, name, photograph of an identifiable person, correspondence, screenshot or other material contains personal data, public disclosure requires a valid legal ground.
Where the law requires separate consent for making personal data publicly available, such consent is obtained separately. Supplying materials for a development project does not automatically authorise their publication in the portfolio.
2.7. Payments, receipts and tax compliance
When providing services under Russia's Professional Income Tax (NPD) regime, the Operator may process information about clients and payments as necessary to arrange payment, document the services provided, generate and deliver payment receipts, keep income records, and comply with obligations imposed by Russian law.
Depending on the transaction, the following information may be processed:
- the client's name and contact details provided for communication and delivery of a receipt;
- the services provided, their price, and the date and method of payment;
- information included in contracts, invoices or payment-related correspondence, where such documents are used;
- the tax identification number (INN) of an individual entrepreneur acting as a client, where required by law to issue a receipt;
- other information strictly necessary to document the transaction.
Receipts may be generated using the Russian Federal Tax Service's 'My Tax' (Moy Nalog) service or other lawful methods. Transaction information is submitted to the tax authorities as required by law. Processing is based on entering into or performing a contract and complying with legal obligations. The Operator does not request complete bank card details or payment verification codes through website forms.
3. Sensitive and biometric personal data
The Operator does not intentionally collect sensitive categories of personal data concerning race or ethnic origin, political opinions, religious or philosophical beliefs, health or intimate life. The Operator does not process biometric data for the purpose of identifying website visitors.
Users should avoid including such information in free-text project briefs or enquiries unless necessary. If they provide it voluntarily, it may be processed only where a lawful basis exists.
4. Principles of personal data processing
The Operator follows the principles of lawfulness and fairness, purpose limitation, data minimisation, accuracy, storage limitation, confidentiality and security.
5. Retention of personal data
Personal data is retained no longer than necessary for the relevant processing purpose, unless another period is required by Russian law or a contract.
Enquiries and business correspondence may be retained during the consideration of a request and delivery of a project, and afterwards for as long as necessary to comply with legal obligations, resolve disputes or protect the Operator's legitimate interests.
If consent is the only legal ground, processing ceases once the purpose is achieved or the consent is withdrawn, unless another lawful ground permits continued processing.
Information about payments and receipts is processed and retained to the extent required to meet tax and other legal obligations.
Data is deleted or destroyed once the relevant purposes have been fulfilled, in accordance with applicable law.
6. Localisation of personal data
When collecting the personal data of citizens of the Russian Federation, including through the website, the Operator complies with the localisation requirements of Russian law.
The recording, organisation, accumulation, storage, updating and retrieval of such data are carried out in accordance with Article 18(5) of Federal Law No. 152-FZ, including its restrictions on the use of databases located outside Russia.
7. Disclosure to third parties
The Operator does not sell users' personal data or provide it to third parties for their independent advertising campaigns.
To the extent necessary to operate the website or deliver projects, certain data may be made available to providers responsible for hosting, website maintenance, email delivery, communications, technical support and agreed supporting services.
Disclosure and outsourced processing are permitted only where there is a lawful basis and relevant legal requirements are satisfied. Data may also be disclosed to competent public authorities where required by law.
8. Cross-border transfers
The Operator complies with Russian legal requirements governing transfers of personal data to other countries.
Where foreign platforms, messaging services or other tools involve a cross-border data transfer, the Operator complies with applicable requirements before initiating such transfers, including notifying the competent authority where required by law.
A user's independent use of a foreign service is also subject to that service's own terms and policies.
9. Personal data security
The Operator takes legal, organisational and technical measures required by law to protect personal data from unlawful or accidental access, destruction, alteration, restriction, copying, disclosure, distribution and other unlawful actions.
In particular, access to enquiries and business correspondence is limited on a need-to-know basis; website and account security measures are used; and data is processed for the stated purposes.
10. Data subject rights
Users may:
- request information about how their personal data is processed;
- request rectification, restriction or deletion where the law permits;
- withdraw previously given consent;
- request the cessation of processing or public dissemination in the circumstances provided by law;
- challenge the Operator's actions or omissions before the competent authority or in court;
- exercise other rights provided by Russian law.
Withdrawal of consent does not invalidate processing lawfully performed before the withdrawal. Certain information may continue to be processed on other lawful grounds where permitted by law.
11. Contacting the Operator
To enquire about processing, request rectification, restriction or deletion of data, or withdraw consent, users may contact:
Email: hello@factor11.studio
Telephone: +7 910 643 02 97
Requests should contain enough information to identify the requester and the relevant data, without providing excessive personal information.
Requests are reviewed and valid legal requirements are met within the time limits prescribed by Russian law.
12. Deletion and destruction of personal data
Data is deleted or destroyed when processing purposes have been achieved, when further processing is unnecessary, when consent is withdrawn and no other lawful ground exists, when unlawful processing is identified, or in other cases prescribed by law.
Destruction is carried out using methods intended to prevent unauthorised recovery, subject to any statutory retention requirements.
13. Third-party personal data
When submitting project briefs, documents, mock-ups, links, databases, screenshots or account access information, users must not disclose other individuals' personal data without a valid lawful basis.
This includes employees' and customers' contact details, information about users of existing systems, and personal information contained in files, screenshots or correspondence.
If a project requires the Operator to access personal data processed by a client, the parties' roles, legal grounds, scope of access and security arrangements are established separately, including in contractual documents where appropriate.
14. Personal data of minors
The website is not intended to collect personal data from minors. If the Operator becomes aware that such information was collected without the required legal basis, the Operator takes steps to cease unlawful processing and delete the information in accordance with applicable law.
15. Responsibility
The Operator takes measures to comply with personal data laws and is responsible where provided by law.
Users are responsible for the accuracy of the information they provide and for having a lawful basis to disclose third parties' personal data.
When users disclose personal data publicly or through third-party services, it may be processed independently by the operators of those services.
16. Changes to this Policy
The Operator may revise this Policy. The date of each new version will be stated.
A new version takes effect when published on the website unless otherwise specified in that version. Users are encouraged to review the Policy periodically.
17. Operator contact details
Operator: Prudnikov Igor Evgenyevich — an individual applying the Professional Income Tax (NPD) regime in Russia
Location: Ryazan, Russian Federation
Email: hello@factor11.studio
Telephone: +7 910 643 02 97
Website: https://factor11.studio/
Policy page: https://factor11.studio/en/privacy-policy/
