Personal Data Processing Policy

This is a courtesy translation. The Russian version of this document is legally binding.

Edition No. 2 of October 14, 2026. The previous edition was in effect until that date.

1. General provisions

1.1. This Personal Data Processing Policy (hereinafter the Policy) has been drawn up in accordance with Federal Law No. 152-FZ "On Personal Data" of July 27, 2006 and defines which personal data sole proprietor Nikolaev Alexander Vladimirovich (hereinafter the Operator) collects, for what purpose, on what legal basis, for how long it is stored and how it is protected.

1.2. Operator details: sole proprietor Nikolaev Alexander Vladimirovich, TIN 614406298652, OGRNIP 316619600161443. Address for personal data enquiries: 23 Osenniy Boulevard (Krylatsky Business Center), Moscow. E-mail: hello@promolab.pro. Phone: +7 495 128‑82‑52.

1.3. The Policy applies to all personal data that the Operator receives through the website https://promolab.pro/ (hereinafter the Website) and its subdomains, by e-mail, in messengers, and when concluding and performing contracts.

1.4. By using the Website, sending an enquiry or subscribing to the newsletter, the user acknowledges this Policy. Consent to the processing of personal data is given separately — by ticking the corresponding box in the form — on the terms set out in the document "Consent to Personal Data Processing".

2. Key terms

2.1. Personal data — any information relating to a directly or indirectly identified or identifiable natural person (personal data subject).

2.2. Personal data processing — any operation performed on personal data: collection, recording, systematization, accumulation, storage, clarification, retrieval, use, transfer (provision, access), anonymization, blocking, deletion, destruction.

2.3. User — any visitor to the Website.

2.4. Cookie — a small piece of data that the Website or an analytics service stores in the user's browser and receives back on subsequent visits.

2.5. Cross-border transfer — the transfer of personal data to the territory of a foreign state.

3. Which personal data the Operator processes

3.1. Data from enquiry forms ("Discuss your project", "Get a free audit", "Cost estimate", forms on service pages): name, phone number, e-mail address, the user's website address, the service and plan of interest, preferred contact method, comment, and the page the enquiry was sent from.

3.2. Data provided when receiving the express check report and subscribing to the digest: e-mail address; at the user's option, a phone number or Telegram username for a walkthrough of the report; the address of the website checked and the check results.

3.3. Data of clients and their representatives when concluding and performing contracts: last name, first name, patronymic, job title, phone number, e-mail, and the details required for the contract and payments.

3.4. Data collected automatically: IP address, browser and device information, date and time of the visit, pages viewed, referral source and UTM parameters, cookie identifiers, and data about actions on the Website collected by analytics services (section 6).

3.5. Service data of forms: technical markers by which the Operator distinguishes human enquiries from automated spam submissions (time taken to fill in the form, activity on the page), and information about the consent given (date, time, IP address, text of the consent).

3.6. The Operator does not process special categories of personal data (health, race, political views, etc.) or biometric personal data. The Operator does not knowingly collect personal data of persons under 18 years of age; the Website is intended for business representatives.

4. Purposes and legal grounds for processing

4.1. Responding to an enquiry and consulting — contacting the user by the phone number, e-mail or messenger provided, preparing a proposal, an audit or a cost estimate. Legal basis: the consent of the personal data subject; the processing is necessary to conclude a contract at the subject's initiative (clause 5, part 1, Article 6 of Law No. 152-FZ).

4.2. Concluding and performing contracts for the Operator's services, payments, and exchange of documents. Legal basis: a contract to which the personal data subject or their representative is a party; requirements of accounting and tax legislation.

4.3. Providing the website express check report in PDF format to the specified e-mail address and, at the user's option, a walkthrough of the report with a specialist. Legal basis: the subject's consent.

4.4. Sending the weekly digest on digital marketing and artificial intelligence. Legal basis: the subject's separate consent to receive the newsletter (Article 18 of the Federal Law "On Advertising"). Subscription is voluntary and is not a condition for receiving the report or services. You can unsubscribe via the link in any e-mail or by writing to the Operator's e-mail address.

4.5. Analytics and improving the Website — studying how visitors use the Website with the help of web statistics services. Legal basis: the user's consent expressed through the cookie settings on the Website (section 6). Analytics services are not launched without consent.

4.6. Ensuring the operation and security of the Website — protecting forms from spam, preventing abuse, diagnosing errors, keeping server logs. Legal basis: the Operator's legitimate interests (clause 7, part 1, Article 6 of Law No. 152-FZ), provided that the users' rights are not violated.

4.7. The Operator does not make decisions that produce legal consequences for the user solely on the basis of automated processing. The plan selection in the calculator and the Growth Navigator suggestions work only on the answers the user enters and are not stored as personal data.

5. Processing principles

5.1. Processing is carried out lawfully and fairly, is limited to predefined purposes and does not go beyond them.

5.2. The Operator processes only the data needed for a specific purpose and does not merge databases created for incompatible purposes.

5.3. The Operator ensures the accuracy, sufficiency and relevance of the data and, once the purpose of processing is achieved, deletes or anonymizes it.

5.4. The collection, recording, systematization, accumulation, storage, clarification and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the territory of the Russian Federation: the Website, its databases and the Operator's CRM system are hosted on servers in Moscow.

6. Cookies and analytics services

6.1. The Website uses two types of cookies.

• Essential — without them the Website does not work correctly: the session identifier, your choice in the cookie settings, technical anti-spam markers for forms, and the ticks you have saved in interactive checklists and the calculator in your browser. This data is not shared with third parties and is not used for analytics.
• Analytics — set by web statistics services; they help us understand which pages are read, where visitors come from and where they run into problems. They are enabled only after you click "Accept all" in the cookie notice.

6.2. Analytics services used by the Operator:

• Yandex Metrica (Yandex LLC, Russia) — a visitor counter, click maps and the Webvisor technology, which records actions on pages in anonymized form. Webvisor does not record form fields in which personal data is entered. Terms: yandex.ru/legal/confidential.
• Top.Mail.Ru (VK LLC, Russia) — a visitor counter. Terms: help.mail.ru/legal/terms/common/privacy.

6.3. You can change your choice at any time via the "Cookie settings" link in the Website footer or by deleting cookies in your browser settings. Declining analytics cookies does not restrict access to the Website or its features.

6.4. Google services (Google Analytics, Google Fonts and others) are not used on the Website; users' personal data is not transferred outside the Russian Federation.

7. To whom the Operator transfers personal data

7.1. The Operator does not sell personal data and does not transfer it to third parties for their own purposes.

7.2. To operate the Website and fulfil its obligations, the Operator engages organizations that process data on its instructions and on its terms:

• the hosting provider Fornex (servers in Moscow) — hosting of the Website, its databases and the Operator's CRM system;
• Yandex LLC — the Yandex 360 e-mail service, through which the Operator receives enquiry notifications and conducts correspondence, and the Yandex Metrica service (with the user's consent);
• VK LLC — the Top.Mail.Ru service (with the user's consent);
• the e-mail marketing service through which the digest is sent (its details will be added to the Policy before the newsletter starts).

7.3. To contact the user at their choice, the Operator may use messengers (Telegram, MAX, WhatsApp): in this case, the data is also processed on the terms of the chosen messenger.

7.4. Personal data may be transferred to state authorities in cases expressly provided for by law.

8. Retention periods

• Enquiries from the Website and related correspondence — 3 years from the user's last enquiry, unless a contract is concluded during that time.
• Contract data — for the term of the contract and 5 years after it ends (accounting and tax requirements).
• The e-mail address for the digest and the consent record — until consent is withdrawn, and after withdrawal — 3 years as an opt-out record, so that no further e-mails are sent.
• Website express check results — 180 days.
• Web server logs with IP addresses and the anti-spam log — 30 days.
• Cookies — according to the lifetime of each cookie: the cookie settings choice — 1 year; analytics service cookies — under the rules of those services (up to 1 year).

When the period expires, the data is deleted or anonymized. Deletion from backup copies takes place as they are rotated, but no later than 90 days.

9. Rights of the personal data subject

9.1. The user has the right to obtain information about the processing of their personal data; to demand its clarification, blocking or destruction if it is incomplete, outdated, inaccurate or processed unlawfully; to withdraw consent; to unsubscribe from the newsletter; and to appeal against the Operator's actions to Roskomnadzor or in court.

9.2. To exercise these rights, it is sufficient to write to hello@promolab.pro from the address specified in the enquiry or subscription, or to send a letter to the Operator's address. So that the Operator can find your data, please specify the phone number or e-mail you provided.

9.3. The Operator responds to a request within 10 business days. If additional information is needed for the response, the period may be extended by no more than 5 business days, with notice to the applicant.

9.4. After consent is withdrawn, the Operator stops processing and destroys the data within 30 days, except where processing may continue without consent on a legal basis (for example, under an existing contract or to retain accounting records).

10. How the Operator protects personal data

• The Website and CRM operate only over the secure HTTPS protocol; the server's service directories are closed to external access.
• Access to enquiries and the subscriber database is granted only to the Operator's employees who need it for their work, under individual accounts.
• Forms are protected against automated submissions, and a log of blocked attempts is kept.
• Regular backups, software updates and access rights reviews are carried out.
• The fact and terms of each consent are recorded (date, time, IP address, text of the consent).
• Employees who work with personal data have been made familiar with this Policy and the requirements of the law.

11. Cross-border transfer

11.1. The Operator does not carry out cross-border transfers of personal data. All services involved in the processing are located in the territory of the Russian Federation.

11.2. Should such a transfer become necessary, the Operator will notify Roskomnadzor before it begins, in accordance with Article 12 of Law No. 152-FZ, and will amend this Policy.

12. Personal data permitted for dissemination

12.1. The Operator publishes client reviews and case studies naming the company and its representative only with the representative's separate written consent, which specifies exactly which information may be published and where. Such consent may be withdrawn at any time, after which the publication is removed.

13. Final provisions

13.1. The Operator may amend the Policy. A new edition is published on this page with its date and takes effect upon publication. The current version is always available at https://promolab.pro/gdpr.

13.2. Questions about the processing of personal data may be sent by e-mail to hello@promolab.pro.