This is an informational English translation. The Russian version of the legal documents is legally binding.
Personal Data Processing Policy
Edition of 08.10.2026 · IP Kuznetsov R. A.
1. General provisions
1.1. This Personal Data Processing Policy (the "Policy") has been developed pursuant to Part 2 of Article 18.1 of Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" (the "Personal Data Law") and sets out the procedure for processing personal data and the security measures taken by the operator when the website https://medispa.pro and its subdomains (the "Website", the MEDISPA.PRO "Platform") are used.
1.2. Personal data operator: Sole proprietor (individual entrepreneur) Roman Alekseevich Kuznetsov, taxpayer number (INN) 772774368458, primary state registration number (OGRNIP) 322774600407632 (the "Operator"). E-mail for personal data matters: info@roman-kuznetsov.ru.
1.3. The Policy is a publicly available document published at https://medispa.pro/legal/privacy. It applies to all personal data the Operator receives through the use of the Website.
1.4. The Operator regards respect for human and civil rights and freedoms in the processing of personal data, including the rights to privacy and to personal and family secrets, as the most important condition of its activity.
2. Key terms
- Personal data — any information relating directly or indirectly to an identified or identifiable natural person (personal data subject).
- Processing of personal data — any action (operation) or set of actions with personal data, with or without automation, including collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), depersonalisation, blocking, deletion and destruction.
- User — any person visiting the Website.
- Cookie — a small piece of data that the Website or a third-party service stores in the User's browser.
- Other terms have the meaning given to them by the Personal Data Law.
3. Legal grounds for processing
The Operator processes personal data on the basis of: the Constitution of the Russian Federation; the Personal Data Law; Federal Law No. 149-FZ of 27 July 2006 "On Information, Information Technologies and Information Protection"; the Civil Code of the Russian Federation; consents of personal data subjects given as separate documents (consent to cookie and web analytics processing, consent when contacting us); the Terms of Use, to the extent necessary for their performance; and other grounds provided for by Article 6 of the Personal Data Law.
4. Purposes, categories and retention periods
The Operator processes only personal data that serves the stated purposes and does not allow processing incompatible with them. Special categories of personal data (health and others) and biometric personal data are not processed through the Website. The Website contains no personal data collection forms.
| Purpose | Data categories | Legal ground | Period |
|---|---|---|---|
| Operation and security of the Website (delivering pages, protection against attacks, troubleshooting) | IP address, browser and device information (User-Agent), date and time of the request, requested page address, cookies required for the Website to work | Clause 7, Part 1, Article 6 of the Personal Data Law (the Operator's legitimate interest, provided the subject's rights are not violated) | Server logs — no more than 6 months; technical cookies — as described in the Cookie Policy |
| Web analytics: traffic statistics and improvement of the Website (Yandex Metrica, including Webvisor) | Cookie identifiers, IP address, device and browser information, referral source, pages viewed, on-page actions (clicks, scrolling), Webvisor session recordings (without the contents of input fields) | The subject's consent (Clause 1, Part 1, Article 6 and Article 9 of the Personal Data Law), given with the "Accept" button in the cookie banner | Until consent is withdrawn, but no more than 12 months from the date it was given; after that, consent is requested again |
| Handling enquiries and correspondence | Name (if given), e-mail address, Telegram username, contents of the enquiry and attachments | The subject's consent (consent when contacting us) | Until the purpose is achieved, but no more than 1 year after the last message in the correspondence, or until consent is withdrawn |
| Access to the restricted area of the Platform with credentials issued by the Operator | Session identifier (cookie), technical request data | Clause 5, Part 1, Article 6 of the Personal Data Law (performance of an agreement with the user) | For the duration of the session, no more than 14 days |
The Operator does not take decisions that produce legal effects for the subject or otherwise affect their rights and legitimate interests solely on the basis of automated processing of personal data.
5. Procedure and conditions of processing
5.1. Processing is carried out with automation tools. The Operator performs the following actions: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access) to the persons listed in Section 6, blocking, deletion and destruction.
5.2. Localisation. When collecting personal data of citizens of the Russian Federation, the Operator ensures that its recording, systematisation, accumulation, storage, clarification and retrieval are carried out using databases located in the territory of the Russian Federation (Part 5, Article 18 of the Personal Data Law): the Website servers, data storage, e-mail service and web analytics service are located in the territory of the Russian Federation.
5.3. The Operator does not carry out cross-border transfer of personal data. If a User, on their own initiative, sends an enquiry via the Telegram messenger, the information is transferred by the User directly to the messenger operator (a foreign entity) under its own policy; the Operator does not use Telegram to collect personal data and recommends sending enquiries containing personal data by e-mail.
5.4. Website pages load certain technical resources (fonts, styles, software libraries, map services) from third-party servers, including servers outside the Russian Federation. In doing so, the User's browser itself transmits the technical request data (IP address, User-Agent) to the respective provider. The Operator does not receive, store or process this data. The list is given in the Cookie Policy.
5.5. The Operator does not disseminate Users' personal data.
6. Transfer and commissioning of processing
6.1. The Operator may commission third parties to process personal data under an agreement (Part 3, Article 6 of the Personal Data Law) with an obligation to comply with the principles and rules of processing and with the confidentiality of personal data:
- YANDEX LLC (INN 7736207543) — the Yandex Metrica web analytics service (only with the User's consent) and the e-mail service for the Operator's e-mail domain;
- a hosting and cloud storage provider with data centres in the territory of the Russian Federation — hosting of the Website and data.
6.2. Personal data may be provided to state authorities in the cases and in the manner provided for by the legislation of the Russian Federation.
7. Rights of the personal data subject
The personal data subject has the right to:
- receive information about the processing of their personal data (Part 7, Article 14 of the Personal Data Law);
- demand that their personal data be clarified, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose;
- withdraw consent to the processing of personal data at any time: for web analytics — with the "" button, in other cases — by writing to info@roman-kuznetsov.ru;
- demand that the processing of personal data be stopped;
- appeal against the actions or inaction of the Operator to the authorised body for the protection of the rights of personal data subjects (Roskomnadzor) or in court.
8. Handling of requests
8.1. Requests from personal data subjects are sent to info@roman-kuznetsov.ru with the subject line "Personal data". The request must contain information that identifies the subject and confirms their relationship with the Operator (for example, the e-mail address used in the correspondence or a cookie identifier), and the signature of the subject or their representative in accordance with the legislation on electronic signatures.
8.2. The Operator responds within 10 working days of receiving the request. The period may be extended by no more than 5 working days with a reasoned notice.
8.3. When consent is withdrawn or the purpose of processing is achieved, the Operator stops processing and destroys the personal data within the periods established by Article 21 of the Personal Data Law, unless otherwise provided by federal law.
9. Security measures
The Operator takes the legal, organisational and technical measures provided for by Articles 18.1 and 19 of the Personal Data Law, including:
- the Operator personally performs the duties of the person responsible for organising personal data processing;
- issuing this Policy and internal documents on personal data processing;
- encryption of the connection to the Website (HTTPS/TLS);
- restricted access to servers and data, unique credentials;
- data minimisation (no data collection forms on the Website, web analytics only after consent);
- integrity control of the Website software when updates are deployed (checksums);
- assessment of the harm that may be caused to subjects and control of the measures taken.
If an unlawful or accidental transfer (provision, dissemination, access) of personal data is detected, the Operator notifies Roskomnadzor within the time limits and in the manner established by Part 3.1, Article 21 of the Personal Data Law.
10. Cookies
The use of cookies and third-party services is described in the Cookie Policy. Optional cookies (web analytics) are used only after the User has given consent.
11. Final provisions
11.1. The Operator may amend the Policy. A new version takes effect when published on the Website, unless the new version provides otherwise. Previous versions are kept by the Operator and provided on request.
11.2. Relations connected with the processing of personal data are governed by the legislation of the Russian Federation.
11.3. Operator contacts: info@roman-kuznetsov.ru; contacts page.