PERSONAL DATA PROCESSING POLICY

(DRAFT — for review by a qualified lawyer before use)

Prepared in accordance with Federal Law No. 152-FZ “On Personal Data” dated 27.07.2006 (Russian Federation), including the publication requirement of Article 18.1(2). This is an English-language working translation intended for website visitors and clients; the version relied upon for compliance purposes should be confirmed with a lawyer, typically in Russian or bilingual, and published at a permanent link on the website (e.g. russianroots.su/privacy-policy).

1. General provisionsThis Policy governs the processing of personal data by Elena Pavlovna Tepukhina, an individual providing services under Taxpayer Identification Number (INN) 421813397220, operating the website russianroots.su (hereinafter the “Operator”), in connection with the website russianroots.su (the “Website”) and the genealogical research services offered through it.
This Policy applies to personal data the Operator receives from visitors to the Website, from Clients who order services, and personal data about a Client’s relatives and ancestors that the Client provides for the purposes of the research.
2. Legal basis for processing
● Federal Law No. 152-FZ “On Personal Data” dated 27.07.2006;
● the consent of the Data Subject;
● performance of a service agreement to which the Data Subject is a party or which is concluded in the Data Subject’s interest.
3. Categories of personal data processed
● full name, contact details (email, phone);
● information submitted through the Website’s contact/order forms;
● genealogical information about the Client and the Client’s relatives/ancestors provided for the purposes of the research (names, dates and places of birth, residence, and similar historical/family data);
● identity document details and residential address, where required for issuing a power of attorney for archival requests;
● billing details necessary to issue invoices (the Operator does not itself process or store bank card numbers; payments are handled by a third-party payment provider, if used);
● [technical/website data — IP address, cookies, analytics identifiers, if and to the extent the Website uses analytics tools; to confirm and complete once the Website’s analytics/cookie setup is finalized].
4. Purposes of processing
● performing genealogical research service agreements with Clients;
● communicating with Clients and prospective clients regarding the services;
● issuing invoices and receiving payment;
● preparing and delivering research results, including any family history materials;
● [operating and improving the Website, including through analytics, if applicable].
5. Disclosure of personal data to third partiesFor the purposes listed in Section 4, personal data may be disclosed to:
● archival institutions, civil registry offices (ZAGS), and other organizations holding relevant historical records;
● a notary, for the purpose of issuing a power of attorney;
● a professional translator, where official or certified translation of documents is required;
● a research assistant engaged by the Operator to help carry out archival inquiries, acting under an obligation of confidentiality;
● [a payment provider, if online payment is offered through the Website].
Where required by law, disclosure of a Data Subject’s personal data to a specific third party is additionally confirmed through a separate Consent to the Transfer of Personal Data to Third Parties.
6. Cross-border transfer of personal data[TO CONFIRM WITH A LAWYER: If the Operator, or any third party listed in Section 5, is located or processes data outside the Russian Federation (including where the Operator is based abroad), this may constitute a cross-border transfer of personal data under Article 12 of Federal Law No. 152-FZ. Depending on the destination country and the specifics of processing, this can trigger separate notification obligations to Roskomnadzor and additional requirements. This section should be finalized once the Operator’s place of business/residence and the location of any assistants or service providers are confirmed.]
7. Processing methodsPersonal data is processed both with and without the use of automation tools (mixed processing), including storage in electronic form and, where applicable, on paper.
8. Data retention periodPersonal data is retained for as long as necessary to achieve the purposes listed in Section 4 — generally for the term of the relevant service agreement and for [3 (three)] years thereafter — unless a longer period is required by Russian law.
9. Data security measuresThe Operator takes organizational and technical measures required by Article 19 of Federal Law No. 152-FZ to protect personal data against unauthorized or accidental access, destruction, alteration, blocking, copying, disclosure, or distribution, including restricting access to personal data and storing documents securely.
10. Rights of the Data Subject
● to receive information concerning the processing of their personal data;
● to request access to, clarification, correction, blocking, or deletion of their personal data;
● to withdraw their consent to processing at any time, as described in the relevant Consent document;
● to lodge a complaint with the authorized body for the protection of the rights of personal data subjects (Roskomnadzor) or with a court.
11. Cookies and Website analytics[TO CONFIRM: describe here whether the Website uses cookies, analytics tools (e.g., a web analytics service), or similar technologies, and on what legal basis; add a short cookie notice/banner reference once the Website’s technical setup is finalized.]
12. Operator’s registration status[TO CONFIRM WITH A LAWYER: state here whether the Operator has submitted the notification of personal data processing to Roskomnadzor as required by Article 22 of Federal Law No. 152-FZ, or the applicable exemption relied upon, together with the relevant registration details.]
13. Amendments to this PolicyThe Operator may amend this Policy from time to time. The current version is always available on the Website. Material changes will be indicated by an updated effective date at the top of this document.
14. Contact detailsOperator: Elena Pavlovna Tepukhina
Website: russianroots.su
Email for requests concerning personal data: [insert contact email]
Postal address (if required for formal notices): [insert address, or omit if not to be published]
Effective date: [insert date]