Privacy Policy

Version dated 6 August 2026

This Policy sets out how personal data is processed by Individual Entrepreneur Ilham Fatykhovich Khabibullov, TIN 564101695894, PSRNIE 325565800099402 (the Operator), in connection with the use of the websites affario.ru and affario.com (together — the Website).

The Policy has been drawn up in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (152-FZ) and other regulations of the Russian Federation, which govern the Operator’s activities.

1. General provisions

1.1. The Policy applies to all personal data processed by the Operator in connection with the use of the Website.

1.2. The Operator processes personal data in line with the principles of lawfulness, fairness, specific purposes, proportionality of the processing to those purposes, limited retention, accuracy and sufficiency of the data.

1.3. Using the Website requires no registration. There are no accounts, no personal dashboards and no payments on the Website. The Operator receives personal data only when a visitor submits it via the contact form or reaches out through the contacts published on the Website.

1.4. The current version of the Policy is always available at affario.com/privacy (affario.ru/privacy). The Operator announces material changes by publishing a new version at least 15 (fifteen) calendar days before it takes effect.

2. Operator details

• Name: Individual Entrepreneur Ilham Fatykhovich Khabibullov
• TIN: 564101695894
• PSRNIE: 325565800099402
• Address: 38 Kazanskaya St., Nauruzovo, Ponomaryovsky District, Orenburg Region, 461790, Russia
• Email for personal data enquiries: info@affario.ru

3. Categories of data subjects

3.1. The Operator processes personal data of the following categories of data subjects:

• Visitors who submitted an enquiry — individuals who filled in the contact form on the Website or contacted the Operator through the contacts published on the Website;
• Client representatives — individuals acting on behalf of companies and entrepreneurs the Operator provides services to, as well as people named by a client as contact persons;
• Visitors who submitted no enquiry — with respect to the anonymised visit data collected by the web analytics service (section 13).

4. Purposes of processing

4.1. The Operator processes personal data for the following purposes:

• receiving and reviewing enquiries submitted through the Website forms, preparing and sending a reply;
• contacting the data subject by email, phone and messengers about their enquiry;
• holding talks, clarifying the task, preparing a commercial proposal and entering into a service agreement;
• performing the agreement: aligning the scope, delivering the results, providing support and further development;
• keeping accounting, tax and other mandatory records as required by the legislation of the Russian Federation;
• keeping the Website operational and secure, preventing spam and automated form submissions, investigating incidents;
• collecting anonymised traffic statistics to assess and improve the Website;
• sending marketing messages about the Operator’s services — only where a separate consent to such messages has been given.

5. Personal data processed

5.1. Data submitted through the contact forms:

• the contact provided by the data subject: email address, phone number or messenger handle;
• name (in the form on the Contacts page, and where the data subject provides it on their own initiative);
• the service of interest (where selected in the form on the Contacts page);
• the text of the enquiry and any information the data subject chose to include in it;
• the date and time of the submission and the section of the Website it was sent from;
• records of the consents given and the date they were given.

5.2. Data arising from further interaction: the content of correspondence and talks, the position and role of a client representative, and the details required to enter into and perform the agreement.

5.3. Data collected automatically during a visit: IP address, browser and operating system type and version, screen resolution, referral source, pages viewed, visit duration — to the extent collected by the web analytics service (section 13).

5.4. No payment data is processed. The Website accepts no payments; settlements under agreements are made by bank transfer outside the Website. The Operator does not request, receive or store bank card details.

5.5. Special categories of personal data (Article 10 of 152-FZ) and biometric personal data (Article 11 of 152-FZ) are not processed. The Operator asks that such information is not included in the text of an enquiry.

5.6. The Website is not addressed to persons under 18. The Operator does not knowingly collect personal data of minors; any such data found is deleted.

6. Legal grounds for processing

6.1. Clause 1, part 1, Article 6 of 152-FZ — the consent of the data subject. Consent is given by a separate checkbox when a contact form is submitted; the text of the consent is published on the Consent to the processing of personal data page.

6.2. Clause 5, part 1, Article 6 of 152-FZ — processing is necessary to perform an agreement to which the data subject is a party, or to take steps required to enter into an agreement at the data subject’s initiative.

6.3. Clause 2, part 1, Article 6 of 152-FZ — processing to comply with obligations imposed by federal law: accounting and tax records, responses to requests from public authorities.

6.4. A separate consent — for sending marketing messages. That consent is standalone, is given by a separate action of the data subject and may be withdrawn independently of the consent to the processing of personal data.

7. Operations performed on personal data

7.1. The Operator performs the following operations: collection, recording, systematisation, accumulation, storage, updating (refreshing, amending), retrieval, use, transfer (provision, access), anonymisation, blocking, deletion and destruction.

7.2. Processing is carried out both with automation tools (the software and hardware behind the Website) and without them (when a reply to an enquiry is prepared).

7.3. The Operator makes no decisions producing legal effects for the data subject solely on the basis of automated processing.

8. Transfer of personal data to third parties

8.1. The Operator transfers personal data to third parties only in the following cases:

• Hosting provider Beget LLC (TIN 7813348421) — hosting of the server, the database and the mail server of the Website; enquiries are stored and email notifications are delivered on its infrastructure;
• YANDEX LLC (TIN 7736207543) — the Yandex.Metrica service enabled on affario.ru; anonymised visit data is transferred (section 13);
• specialists and contractors engaged by the Operator — to the extent needed to perform an agreement with a client, subject to a confidentiality undertaking;
• public authorities upon their request in the manner prescribed by law.

8.2. Data is transferred only to the extent needed to achieve the purposes set out in section 4, and only to the parties listed in clause 8.1.

8.3. The Operator does not sell personal data and does not provide it to third parties for their own marketing.

9. Retention periods

9.1. Personal data is processed for as long as needed to achieve the purposes of processing.

9.2. Enquiries received through the Website forms — 3 (three) years from the date of receipt, or until the data subject withdraws their consent, whichever comes first.

9.3. Agreements, acts, invoices and the related correspondence — 5 (five) years from the date of the transaction, under Federal Law No. 402-FZ “On Accounting”.

9.4. Tax documents — 4 (four) years, under Article 23 of the Tax Code of the Russian Federation.

9.5. Web analytics data — for the periods set by the terms of the Yandex.Metrica service; the Operator works with it in an anonymised and aggregated form only.

9.6. Once the relevant period expires, personal data is deleted or anonymised.

10. Security measures

10.1. The Operator applies the following measures:

• data is transferred between the browser and the Website over HTTPS with a valid SSL certificate;
• access to the Website’s admin panel is password-protected, and passwords are stored as cryptographic hashes;
• secrets (tokens and API keys for external services) are kept outside the source code repository and are not reachable from the public part of the Website;
• access to the server infrastructure is restricted and granted to authorised persons only;
• database backups are created regularly;
• system operations and actions in the admin panel are logged;
• software is updated promptly to close known vulnerabilities.

11. Rights of the data subject

11.1. The data subject has the right to:

• obtain information on whether the Operator holds their personal data, on the purposes and methods of processing, the operations performed, the retention periods and the persons with access to it;
• request that their personal data be corrected, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;
• withdraw their consent to the processing of personal data at any time;
• appeal against the Operator’s acts or omissions to the authority for the protection of data subjects’ rights (Roskomnadzor) or to a court;
• protect their rights and lawful interests, including recovery of losses and compensation for moral harm through the courts.

11.2. To exercise these rights, the data subject sends a request to info@affario.ru or by post to the address given in section 2 of this Policy. The request must contain details identifying the data subject: their name and the contact used when the form was submitted.

11.3. A request is answered within 10 (ten) business days of its receipt.

12. Withdrawal of consent

12.1. Consent to the processing of personal data is withdrawn by sending a notice to info@affario.ru with the subject “Withdrawal of consent to the processing of personal data”, or by post to the Operator’s address. Once consent is withdrawn, the Operator stops processing, except where processing continues on another legal ground (for example, obligations under 402-FZ and the Tax Code of the Russian Federation).

12.2. Consent to receive marketing messages is withdrawn separately — by replying with a request to stop the mailing or via the unsubscribe link in the message. Withdrawing it does not affect the handling of an enquiry already submitted.

12.3. Data with no other legal ground for processing is deleted within 30 (thirty) calendar days of the withdrawal being received.

13. Cookies and web analytics

13.1. The public part of the Website requires no sign-in and uses no cookies to identify visitors. Technical cookies are set only in the Website’s admin panel (the session of an authorised person of the Operator) and are required for it to work.

13.2. The affario.ru website runs the Yandex.Metrica web analytics service (counter 108498969) operated by YANDEX LLC. The service sets its own cookies and collects anonymised visit data: IP address, browser and device details, referral source, pages viewed and on-page activity. The Operator uses this data in an anonymised and aggregated form only, to assess how the Website performs.

13.3. Collection by Yandex.Metrica can be refused by disabling cookies in the browser settings, installing a blocker or using the official opt-out add-on published by YANDEX LLC. Opting out affects neither the availability of the Website nor the contact forms.

13.4. No web analytics service is enabled on affario.com.

14. Contact details

14.1. For any question about the processing of personal data, the data subject may contact the Operator at info@affario.ru or by post to the address given in section 2.

14.2. Complaints about the Operator’s actions may be filed with the authority for the protection of data subjects’ rights — the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor), rkn.gov.ru.

This version of the Policy takes effect on 6 August 2026