Personal data processing policy

1. General provisions

This personal data processing policy (the “Policy”) sets out how personal data is processed and the measures taken to keep it secure by the sole proprietor trading under the brand Cortex IT (the “Operator”).

The Policy identifies the categories of personal data the Operator processes, along with the principles and legal grounds for processing them.

It applies to information the Operator receives about users of the website https://cortexit.ru (including subdomains) and about the Operator’s clients.

2. Definitions

“Automated processing of personal data”

— processing of personal data by means of computing equipment.

“Blocking of personal data”

— temporary suspension of processing (except where processing is required in order to correct the data).

“Operator’s website”

— https://cortexit.ru, including its subdomains.

“Personal data information system”

— the set of personal data held in databases together with the information technology and technical means that process it.

“Depersonalisation of personal data”

— actions after which it becomes impossible, without additional information, to attribute personal data to a specific subject.

“Processing of personal data”

— any action or set of actions performed on personal data, including: collection, recording, systematisation, accumulation, storage, correction, retrieval, use, transfer, depersonalisation, blocking, deletion and destruction.

“Operator”

— a sole proprietor who organises the processing of personal data alone or jointly with others and determines the purposes and composition of the data processed. For the purposes of this Policy — the sole proprietor trading under the Cortex IT brand.

“Personal data”

— any information relating directly or indirectly to an identified or identifiable User of the Operator’s website.

“User”

— any visitor to the Operator’s website.

“Client”

— a natural or legal person with whom the Operator has concluded, or is concluding, a contract.

“Provision of personal data”

— actions aimed at disclosing personal data to a specific person or group of persons, including by completing a form on the Operator’s website.

“Consent to the processing of personal data”

— actions confirming the subject’s consent. It may be given, among other ways, by ticking a box in a data collection form on the Operator’s website.

“Cross-border transfer of personal data”

— transfer of personal data to the territory of a foreign state, to a foreign authority, or to a foreign natural or legal person.

“Destruction of personal data”

— actions after which personal data is irreversibly destroyed and cannot be recovered.

3. Principal rights and obligations of the Operator

3.1. The Operator has the right to:

• obtain accurate information and/or documents containing personal data from the data subject;
• continue processing after the subject withdraws consent, where another ground under 152-FZ applies;
• determine independently the composition and list of measures needed to protect personal data, unless legislation provides otherwise.

3.2. The Operator is obliged to:

• provide the data subject, on request, with information concerning the processing of their data;
• organise the processing of personal data in the manner established by Russian legislation;
• respond to enquiries and requests from subjects and their legal representatives in accordance with 152-FZ;
• provide the authorised body (Roskomnadzor) with the information it requests within the prescribed period;
• publish this Policy or otherwise provide unrestricted access to it;
• take legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying and distribution;
• cease processing and destroy personal data in the manner and in the cases provided for by 152-FZ;
• fulfil any other obligations provided for by legislation.

4. Principal rights and obligations of data subjects

4.1. Data subjects have the right to:

• receive information concerning the processing of their personal data;
• require the Operator to correct, block or destroy data that is incomplete, out of date, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing;
• require prior consent as a condition of processing personal data for the purpose of promoting goods, works and services;
• withdraw consent to the processing of personal data;
• appeal against the Operator’s acts or omissions to Roskomnadzor or before the courts.

4.2. Data subjects are obliged to:

• provide the Operator with accurate information about themselves;
• notify the Operator when their personal data is corrected, updated or changed.

4.3. Persons who provide the Operator with inaccurate information, or with information about another subject without that person’s consent, bear liability in accordance with Russian legislation.

5. Purposes, categories of subjects and legal grounds for processing

The Operator processes the following categories of personal data for the purposes stated:

The website collects and processes depersonalised data about visitors (including cookies) using internet analytics services.

5.1. The Operator does not process special categories of personal data (art. 10(1) of 152-FZ).

5.2. A subject may decline to provide personal data. In that case the Operator cannot fulfil the purposes for which the subject would have provided it.

6. Principles of processing

• Processing is carried out lawfully and on a fair basis.
• Processing is limited to achieving specific purposes defined in advance. Processing incompatible with the purposes of collection is not permitted.
• Databases containing personal data processed for incompatible purposes may not be combined.
• Only data that serves the purposes of processing is processed; excessive data is not permitted.
• The accuracy and currency of personal data is maintained; incomplete or inaccurate data is deleted or corrected.
• Data is stored no longer than the purposes of processing require, unless another period is set by law or contract.

7. Purposes of processing

• responding to a subject’s enquiry (mini-audit, intro call, commercial proposal);
• preparing and agreeing contractual documentation;
• sending the lead magnet (AI automation readiness checklist) and one accompanying email at the subject’s request;
• analysing website traffic in depersonalised form using internet analytics services.

7.1. The Operator does not send marketing communications without the subject’s explicit consent. A subject may opt out of informational messages at any time by writing to hello@cortexit.ru with the subject line “Opt out of informational emails”.

8. Legal grounds for processing

• consent of the data subject (152-FZ art. 6(1)(1));
• necessity of performing a contract to which the subject is a party or a beneficiary (152-FZ art. 6(1)(5));
• the Civil Code of the Russian Federation — pre-contractual communication;
• other federal laws and regulations governing the protection of personal data.

8.1. The Operator processes a User’s personal data only where the subject has provided it themselves, through a form on the website or by email. By completing a form and/or submitting data, the User agrees to this Policy.

8.2. The Operator processes depersonalised data about the User (cookies) where the User’s browser settings permit it.

8.3. The data subject decides independently whether to provide data, and gives consent freely, unambiguously, of their own will and in their own interest.

9. Conditions for processing

• with the data subject’s consent to the processing of their personal data;
• to achieve purposes provided for by an international treaty or by a law of the Russian Federation;
• to give effect to a judicial act or an act of another authorised body;
• to perform a contract to which the subject is a party, or to conclude a contract at the subject’s initiative;
• to exercise the rights and legitimate interests of the Operator, provided the subject’s rights and freedoms are not infringed;
• where the subject has made the data publicly available themselves.

10. Collection, storage, transfer and other processing

Personal data is kept secure through legal, organisational and technical measures in accordance with applicable legislation.

• 10.1. The Operator keeps personal data safe and takes measures to prevent access by unauthorised persons.
• 10.2. Personal data may be transferred to third parties where required to comply with Russian legislation or where the subject has consented (see section 11).
• 10.3. Where inaccuracies are found, the subject may update their data by writing to hello@cortexit.ru with the subject line “Update of personal data”.
• 10.4. The processing period is determined by the achievement of the purposes of processing, unless another period is provided for by contract or applicable legislation.
• 10.5. The subject may withdraw consent at any time by writing to hello@cortexit.ru with the subject line “Withdrawal of consent to the processing of personal data”.
• 10.6. The Operator maintains the confidentiality of personal data.
• 10.7. Personal data is stored no longer than the purposes of processing require, unless another period is set by law or contract.
• 10.8. Processing ends when: the purpose is achieved; the subject withdraws consent; or unlawful processing is identified.

11. Transfer to third parties and cross-border transfer

11.1. Personal data may be transferred to third parties solely to the extent needed to fulfil the purposes set out in section 7. Data is not transferred for any other purpose, and is never sold.

11.2. No cross-border transfer of personal data takes place.

12. Security measures

• data transmitted over HTTPS;
• rate limiting on form submissions;
• restricted access to the data store;
• validation and sanitisation of incoming data before it is stored or displayed.

13. Confidentiality of personal data

The Operator and any other person who gains access to personal data must not disclose it to third parties or distribute it without the subject’s consent, unless federal law provides otherwise.

14. Subject rights and how to exercise them

Under 152-FZ the subject has the right to:

• receive information about the processing of their personal data;
• require correction, blocking or destruction of data that is inaccurate, out of date, or obtained in breach of the law;
• withdraw consent to the processing of personal data;
• appeal against the Operator’s acts or omissions to Roskomnadzor or before the courts.

To exercise these rights, send a written request to hello@cortexit.ru. State your name, contact details and what you are asking for. A response is sent within 30 days of receipt.

15. Final provisions

For any question about the processing of personal data, contact the Operator by email at hello@cortexit.ru.

The current version of the Policy is published at cortexit.ru/privacy. The Policy applies indefinitely until replaced by a new version, which takes effect when published. If individual provisions cease to apply, the remaining terms stay in force.