Policy of LLC Anton Suhanov on the Processing of Personal Data Collected through the Website

Revision dated 21 July 2026.

This English-language version is a translation of the approved Russian-language Policy and is provided for information. In the event of any discrepancy, the Russian-language version shall prevail.

1. General Provisions

1.1. This Policy determines the procedures and conditions governing the processing of Personal Data collected by Limited Liability Company ANTON SUHANOV through the website https://anton-suhanov.com/ (the "Website"), as well as the measures taken to protect such Personal Data.

1.2. This Policy has been developed in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ dated 27 July 2006 "On Personal Data", as amended, and other regulatory legal acts of the Russian Federation.

1.3. This Policy is an informational document. Merely visiting the Website or reviewing this Policy does not replace consent to the processing of Personal Data where such consent is required by law. Consent is requested separately, in a specific and unambiguous form.

1.4. The Website is for information purposes. Orders cannot be placed, goods cannot be paid for, and delivery cannot be arranged through the Website. Submitting an enquiry through the contact form does not constitute the conclusion of a contract, an offer or an acceptance; it is used to establish contact and conduct negotiations.

1.5. This Policy applies to the Personal Data of Website visitors and of persons who submit applications, enquiries or requests to the Operator through the Website.

1.6. This Policy does not govern the processing of Personal Data relating to employees, applicants or counterparties outside the Website. For such processing activities, the Operator adopts separate internal policies and documents in accordance with Article 18.1 of Federal Law No. 152-FZ.

1.7. The Operator does not request through the Website any special categories of Personal Data, biometric Personal Data, health information, identity documents, banking details or information about minors. Users should not include such information in any free-text fields of the form.

2. Details of the Operator

2.1. Personal Data Operator: Limited Liability Company ANTON SUHANOV (ООО «АНТОН СУХАНОВ»).
2.2. Taxpayer Identification Number (INN): 9731027460. Primary State Registration Number (OGRN): 1197746094215. Tax Registration Reason Code (KPP): 783901001.
2.3. Registered address: Office 328, Premises 8-N, Litera A, 1/44 Lermontovsky Prospekt, Kolomna Municipal District, St Petersburg 190121, Russian Federation.
2.4. Email address for enquiries concerning the processing of Personal Data: info@anton-suhanov.com.
2.5. Website address: https://anton-suhanov.com/.

3. Key Terms

3.1. Personal Data means any information relating directly or indirectly to an identified or identifiable natural person.

3.2. Processing of Personal Data means any operation or set of operations performed on Personal Data, including collection, recording, systematisation, accumulation, storage, clarification (updating and modification), retrieval, use, transfer, anonymisation, blocking, deletion and destruction.

3.3. Automated Processing means the processing of Personal Data by means of computer technology.

3.4. User means a natural person who visits the Website or submits an application, enquiry or request to the Operator through the Website.

3.5. Cookies means small data files stored by the browser on the User's device that enable the Website to function, support its security, remember settings and, where consent has been given, perform analytics.

3.6. Cross-border Transfer means the transfer of Personal Data to the territory of a foreign state, to an authority of a foreign state, or to a foreign natural or legal person.

3.7. Destruction of Personal Data means actions as a result of which the content of Personal Data can no longer be restored in the relevant information system and/or the physical media containing Personal Data are destroyed.

4. Principles Governing the Processing of Personal Data

4.1. The Operator processes Personal Data in accordance with the following principles:

• lawfulness and fairness of Processing;
• Processing only for specific, predetermined and lawful purposes;
• prohibition of Processing that is incompatible with the purposes for which the data were collected;
• ensuring that the nature and volume of Personal Data are proportionate to the stated purposes and are not excessive;
• ensuring the accuracy, sufficiency and relevance of Personal Data;
• retaining Personal Data for no longer than required by the purposes of Processing or by law;
• destroying or anonymising Personal Data once the purposes of Processing have been achieved, unless otherwise required by law; and
• maintaining the confidentiality and security of Personal Data.

5. Purposes, Categories and Conditions of Personal Data Processing

5.1. For each purpose, the Operator determines the categories of Data Subjects, the categories of Personal Data, the legal basis, the methods of Processing and the applicable Processing and retention periods. Personal Data are not used for purposes incompatible with those set out below.

Purpose: 1. Receiving and handling applications, enquiries and requests; providing information; responding to Users Data Subjects: Website visitors, prospective customers and other persons who submit an enquiry Personal Data: Name; telephone number; email address; enquiry text; preferred method of contact; technical evidence of consent (date, time, IP address and version of the consent text) Legal Basis: Consent of the Data Subject; steps taken at the Data Subject's request prior to entering into a contract Processing and Retention Period: Mixed Processing. Until the enquiry has been completed and for no longer than one year after the last substantive interaction, unless a contract is concluded. Thereafter: destruction or anonymisation within 30 days.

Purpose: 2. Conducting negotiations and entering into a contract at the Data Subject's request outside the Website Data Subjects: Prospective customers who have submitted an application Personal Data: Name; telephone number; email address; information contained in correspondence that is necessary to prepare an offer and a contract Legal Basis: Necessity to enter into a contract at the Data Subject's request; performance of a contract Processing and Retention Period: Until negotiations are completed. If a contract is concluded: throughout the term of the contract and for the retention periods required by civil, tax, accounting and archival legislation.

Purpose: 3. Ensuring the operation and security of the Website and protecting it against misuse Data Subjects: All Website visitors Personal Data: IP address; browser, operating system and device information; date and time of access; requested page address; referring source; technical session identifiers; strictly necessary Cookies; error and security-event information Legal Basis: The Operator's legitimate interests in operating and protecting the Website, provided the rights of the Data Subject are not infringed; compliance with security obligations Processing and Retention Period: Session data: until the session ends. Security logs: no longer than 12 months, unless a longer period is required to investigate an incident or protect the Operator's rights.

Purpose: 4. Analysing Website traffic and improving the Website Data Subjects: Visitors who have consented to analytics Cookies Personal Data: IP address to the extent transmitted to the analytics service; Cookie identifiers; browser, device and Website interaction information; time and duration of the visit; approximate region inferred from the IP address Legal Basis: The User's separate consent to analytics Cookies Processing and Retention Period: No longer than 12 months from the date of collection, unless the service settings prescribe a shorter period. Further collection ceases when consent is withdrawn.

Purpose: 5. Handling requests from Data Subjects and complying with legal requirements Data Subjects: Data Subjects and their representatives Personal Data: Surname, first name and patronymic (if applicable); contact details; information necessary by law to verify identity and the representative's authority; request content; correspondence; information about the fulfilment of the request Legal Basis: Compliance with the Operator's obligations under Federal Law No. 152-FZ Processing and Retention Period: For the time required to handle the request and for three years thereafter as evidence of compliance, unless another period is prescribed by law.

Purpose: 6. Sending advertising and informational communications Data Subjects: Persons who have separately consented to receive communications Personal Data: Name; telephone number; email address; selected communication channel; information about the giving and withdrawal of consent Legal Basis: Separate prior consent under Article 15 of Federal Law No. 152-FZ and Article 18 of Federal Law No. 38-FZ "On Advertising" Processing and Retention Period: Until consent is withdrawn, but for no longer than two years from the date on which it was given unless consent is renewed.

5.2. Processing for advertising and informational communications is not a condition for handling an application. Refusal to provide marketing consent does not restrict the ability to submit an enquiry and receive a response.

5.3. The Operator does not make decisions that produce legal consequences for a User solely on the basis of Automated Processing of Personal Data.

5.4. The Operator does not intentionally disseminate Personal Data to an unlimited number of persons or include such Personal Data in publicly available sources without separate consent given in accordance with Article 10.1 of Federal Law No. 152-FZ.

6. Processing Procedures and Methods

6.1. Processing is carried out both with and without the use of automated means, including by receiving Personal Data through web forms, email and communication services.

6.2. The Operator may perform the following operations: collection, recording, systematisation, accumulation, storage, clarification (updating and modification), retrieval, use, making available to persons acting on the Operator's instructions, blocking, deletion, anonymisation and destruction.

6.3. The Operator obtains Personal Data directly from the Data Subject, from the Data Subject's duly authorised representative, and automatically when the Website is visited, within the limits set out in this Policy.

6.4. The Operator retains evidence of consent, including the date and time, IP address, content and version of the consent text, and information about the User action by which consent was given.

6.5. Withdrawal of consent does not affect the lawfulness of Processing carried out before the withdrawal was received and does not prevent Processing where another legal basis prescribed by law applies.

7. Data Transfers and Persons Involved in Processing

7.1. The Operator does not sell Personal Data or transfer Personal Data to third parties for their independent use for purposes unrelated to those set out in this Policy.

7.2. Within the stated purposes, the Operator may engage persons providing hosting, email and communications, technical support, Website development and maintenance, information security and web analytics services to process Personal Data on the Operator's behalf.

7.3. An agreement with a person processing Personal Data on the Operator's behalf defines the categories of Personal Data and processing operations, the purposes of Processing, and the requirements relating to confidentiality, security, localisation, destruction of Personal Data, incident notification and assistance to the Operator in responding to Data Subject requests.

7.4. Where Yandex Metrica is used, analytical data are processed with the involvement of YANDEX LLC after consent to analytics Cookies has been obtained. The data actually transmitted must correspond to the Website settings and the terms of the service.

7.5. Personal Data may be disclosed to public authorities and other authorised persons in the cases and in the manner prescribed by the laws of the Russian Federation.

7.6. Up-to-date information about the categories of persons involved in Processing may be provided to a Data Subject upon request to the extent required by law.

8. Localisation and Cross-border Transfers

8.1. When collecting Personal Data of citizens of the Russian Federation, including through the Website, the Operator records, organises, accumulates, stores, updates and retrieves such Personal Data using databases located in the Russian Federation, except where expressly permitted by law.

8.2. As at the date on which this revision of the Policy was approved, the Operator does not envisage any Cross-border Transfer of Personal Data collected through the Website forms.

8.3. Before connecting any foreign service to which Personal Data or User identifiers may be transferred, the Operator must assess the actual data flow, ensure initial Processing in the Russian Federation, comply with Article 12 of Federal Law No. 152-FZ as amended, submit a separate notification to Roskomnadzor and update this Policy.

9. Cookies

9.1. The Operator uses strictly necessary Cookies required to load pages, store technical settings, protect forms and maintain security. Disabling such Cookies may make some Website functions unavailable.

9.2. Analytics Cookies are set only after the User has actively given consent. Analytics and marketing scripts must not load before the User makes a selection.

9.3. On the first visit to the Website, the User is shown a Cookie notice with an "Accept" button. By clicking it, the User consents to the use of analytics Cookies. Analytics Cookies are not set until the button is clicked; continuing to browse the Website or taking no action does not constitute consent to them.

9.4. The User may withdraw consent at any time by deleting or blocking Cookies in their browser settings. Withdrawal of consent stops further collection but does not automatically erase information that was previously processed lawfully; such information is deleted within the periods specified in this Policy.

9.5. Information about the name, purpose, provider and lifetime of each Cookie must reflect the Website's actual settings and be kept up to date.

Cookies used on the Website

10. Termination of Processing and Destruction of Personal Data

10.1. The Operator ceases Processing and destroys or anonymises Personal Data once the purpose of Processing has been achieved, the need to achieve it has ceased, consent has been withdrawn or a request to cease Processing has been received, unless another legal basis applies.

10.2. Unless another period is prescribed by law or contract, Personal Data are destroyed within no more than 30 days after the purpose is achieved or the withdrawal of consent is received.

10.3. If unlawful Processing is identified, the Operator ceases such Processing within no more than three business days and, where it is impossible to ensure lawful Processing, destroys the Personal Data within no more than ten business days.

10.4. If destruction cannot be completed within the prescribed period, the Personal Data are blocked and destroyed within no more than six months, unless another period is prescribed by federal law.

10.5. Destruction is documented by a certificate or an extract from the information system event log in accordance with applicable regulatory requirements.

11. Rights of Data Subjects

11.1. A Data Subject has the right to:

• obtain information about the fact, purposes, legal bases, methods and periods of Processing;
• obtain information about the categories of Personal Data processed, the sources from which they were obtained, the persons who have access to them and any envisaged Cross-border Transfer;
• request the rectification, blocking or destruction of Personal Data that are incomplete, inaccurate, outdated, unlawfully obtained or excessive;
• withdraw consent and request that Processing cease where no other legal basis applies;
• require the immediate cessation of Processing for the direct promotion of goods, works and services;
• challenge the Operator's acts or omissions before Roskomnadzor or a court; and
• claim compensation for losses and non-pecuniary damage in the cases prescribed by law.

11.2. A request may be sent to info@anton-suhanov.com or to the Operator's registered address. To protect Personal Data, the Operator may request information sufficient to verify the applicant's identity and their relationship with the Operator, to the extent permitted by law.

11.3. Information requested by a Data Subject is provided within ten business days. This period may be extended by no more than five business days if a reasoned notice is sent.

11.4. Inaccurate Personal Data are corrected within seven business days after supporting information is received.

11.5. A request to cease Processing is fulfilled within ten business days unless an exception prescribed by law applies. This period may be extended by no more than five business days by means of a reasoned notice.

12. Personal Data Protection Measures

12.1. The Operator takes, among other things, the following measures:

• appointing a person responsible for organising the Processing of Personal Data;
• adopting internal policies and procedures that define the purposes of Processing, the categories of Personal Data, retention periods, access rules, destruction procedures and incident-response arrangements;
• restricting employee and contractor access on a need-to-know basis;
• identifying and authenticating information-system users and segregating access rights;
• using antivirus protection, firewalls, backups, logging and software updates to the extent necessary;
• using secure communication channels and HTTPS;
• monitoring contractors and including Personal Data protection requirements in agreements;
• performing internal controls, assessing potential harm, training employees and periodically reviewing security measures; and
• detecting and responding to incidents, including notifying Roskomnadzor within the time limits prescribed by law.

12.2. The specific technical measures applied are determined with regard to the nature of Processing, current threats, the categories of Personal Data and the potential harm to Data Subjects.

12.3. In the event of an incident resulting in an infringement of Data Subjects' rights, the Operator notifies Roskomnadzor of the initial circumstances within 24 hours and of the results of the internal investigation within 72 hours.

13. Final Provisions

13.1. This Policy takes effect on the date of approval and remains in force until replaced by a new revision.

13.2. The Operator may amend this Policy where the law, the services used, or the purposes or methods of Processing change. A new revision is published on the Website before Processing under the revised rules begins.

13.3. To identify the applicable revision, the Website states the approval date and version number.

13.4. Questions and requests concerning this Policy should be sent to info@anton-suhanov.com.

APPENDIX 1

APPENDIX 2