Personal data processing policy

The data controller is Sole proprietor Kseniia Pavlovna Guseva, INN 770378608818, OGRNIP 326774600485190, address: 37/5–230A Leningradsky Prospekt, Moscow, 125167, Russia. This policy is drawn up under Federal Law No. 152-FZ of 27 July 2006 on personal data.

This policy applies to data collected on https://arieteleone.ru (the "Site").

It covers buyers, order recipients, Site visitors, subscribers and persons who contact us. The controller processes only data matching the stated purposes and does not process special-category or biometric data.

For buyers and order recipients: first name, last name, phone, email, delivery address or pickup point, postcode, order contents and value, delivery and payment details, and any comment the user enters.

For newsletter subscribers: email. For persons who contact us: name, email or phone, message text and other data voluntarily provided. Do not include special-category data or third-party data without a lawful basis.

When visiting the Site, technical data may be processed: IP address, cookies and similar identifiers, visit date and time, requested page, referral source, browser, OS and device details, and interaction events. Analytics via Yandex.Metrica are collected only after the user accepts analytics cookies.

The controller does not receive or store card details: after online payment is enabled, they are entered on YooKassa's secure page. The controller receives only payment status and parameters needed to fulfil orders, refunds and receipts.

Purposes: accepting and fulfilling orders; coordinating requests before YooKassa is connected; taking payment, refunds and fiscal receipts; delivery; handling enquiries and claims; complying with accounting, tax and consumer law; marketing and informational emails with separate consent; analysing and improving the Site when analytics cookies are accepted.

Legal grounds are concluding and performing a contract with the data subject, steps at their request before a contract, the controller's legal duties, and separate consent — for marketing, analytics cookies and other cases where no other ground applies. Consent is given separately from the offer, this policy and other user confirmations.

For marketing, separate optional consent is requested to process email for direct marketing and separate prior consent to receive advertising. Declining marketing does not prevent ordering. The controller keeps proof of consent, including text version, date, time and a technical identifier.

Processing is limited to specific, predetermined and lawful purposes. For each purpose below: data subjects, data categories, legal grounds and retention periods.

5.1. Purpose: accepting, placing, coordinating and fulfilling buyer orders (including delivery, payment, refunds and fiscal receipts). Subjects: buyers and recipients. Data: name, phone, email, delivery address or pickup point, postcode, order contents and value, delivery and payment status, and optional comment. Ground: concluding and performing the public-offer contract to which the subject is a party or beneficiary, and pre-contract steps at their request. Retention: for the sale contract (order fulfilment) and then for mandatory Russian accounting and tax periods (at least 5 years after the calendar year of the transaction).

5.2. Purpose: handling enquiries, requests, reviews and claims. Subjects: persons who contact the controller. Data: name, email or phone, message text and other voluntarily provided data (without special-category or third-party data without a lawful basis). Ground: the controller's duties under consumer-protection and other Russian law. Retention: until the matter is resolved on the merits, then 3 years to protect the controller's legitimate interests in disputes.

5.3. Purpose: advertising, marketing and informational emails. Subjects: subscribers. Data: email. Ground: separate, specific, informed and conscious consent to receive advertising and to process data for direct marketing. Declining marketing does not prevent ordering. Retention: until consent is withdrawn (unsubscribe). Proof of consent (date, time, IP) is kept for 5 years after marketing ends to evidence advertising-law compliance.

5.4. Purpose: analysing use, improving and securing the Site. Subjects: visitors. Data: technical data (IP, cookies and similar identifiers, visit time, page, referral, browser, OS, device, interaction events). Analytics via Yandex.Metrica. Ground: separate consent to analytics cookies via the Site banner. Retention: until the user withdraws the choice, and no more than 24 months from collection.

To the extent needed for a purpose, data may be shared with the chosen carrier (Moscow courier, CDEK, Boxberry or Russian Post), NKO YooMoney LLC when using YooKassa, the cloud cash-register and fiscal-data operators, the hosting provider, and Yandex LLC (16 Leo Tolstoy St, Moscow, 119021) as the processor of Yandex.Metrica data for the controller. Exact legal entities for cash register, OFD, hosting and carriers are stated after the relevant contracts are signed.

The controller does not disseminate personal data. Disclosure to public authorities is allowed only on a lawful request. Processors acting for the controller must keep confidentiality and meet localisation and security requirements; contracts with them must include statutory terms.

Sharing a recipient's data other than the Buyer's is allowed only if the Buyer has a lawful basis to provide it. Recipients should be told in advance that their data will be passed to the controller.

When collecting personal data of Russian citizens, recording, organisation, accumulation, storage, updating and retrieval use databases in the Russian Federation. Cross-border transfer is not planned; before any such transfer, separate legal and technical review and statutory procedures will be completed.

Order, settlement and receipt data are kept for mandatory accounting and tax periods, generally at least 5 years after the year of the transaction; enquiries and claims until resolved then 3 years; marketing data until consent is withdrawn; analytics and cookies until the choice is withdrawn or for at most 24 months. After the purpose is achieved, data are destroyed or anonymised unless law requires longer retention. Access is limited to those who need it for their work.

Processing uses automated and non-automated means and includes collection, recording, organisation, accumulation, storage, updating, retrieval, use, disclosure, anonymisation, blocking, deletion and destruction. Decisions producing legal effects for the subject are not made solely by automated processing.

The controller applies legal, organisational and technical measures: access control, activity logging, backups, antivirus, secure connections, contractor oversight, training for staff with access, and incident response. Exact measures follow a threat and security-level assessment.

The Site uses essential cookies for the cart and language selection, and Yandex.Metrica analytics cookies. You may decline analytics cookies in the consent banner or disable cookies in your browser.

The data subject may obtain information about processing, access data, request correction, blocking or destruction of unlawfully processed or unnecessary data, withdraw consent, stop direct marketing, and complain to Roskomnadzor or a court. Withdrawal of consent does not affect processing required by law or contract.

Requests go to ariete.leone@yandex.ru, by phone +7 (906) 027-21-66, or to the controller's address and must allow identification of the applicant and their relationship with the controller. Information is provided within 10 working days, extendable by up to 5 working days with a reasoned notice. Correction or destruction of confirmed inaccurate or unlawfully obtained data is done within 7 working days where the law so requires.

The controller may update this policy when processes or law change. The new version is published on the Site and applies from the date stated in it; material changes do not retrospectively affect consents already obtained.