Personal Data Processing Policy

1. General provisions

1.1. This Personal Data Processing Policy (the "Policy") defines how personal data is processed and the security measures taken by the Operator in connection with the use of the website https://www.wearesolid.ru (the "Site").

1.2. The Policy is drawn up in accordance with Russian Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" ("152-FZ"), Federal Law No. 149-FZ of 27.07.2006 "On Information, Information Technologies and Protection of Information", and other regulations of the Russian Federation.

1.3. The Policy applies to all personal data the Operator may obtain from visitors of the Site (the "User", "data subject").

1.4. By using the Site - including filling in the express-audit form and/or contacting the Operator - the User confirms that they have read this Policy. Data collected by web-analytics tools is processed on the terms set out in the Policy and with the User's consent expressed via the cookie banner.

1.5. The current version of the Policy is permanently available at https://www.wearesolid.ru/en/privacy.

2. Terms and definitions

• Personal data - any information relating, directly or indirectly, to an identified or identifiable individual (the data subject).
• Processing of personal data - any action (operation) with personal data (collection, recording, structuring, accumulation, storage, use, transfer, anonymization, deletion, etc.).
• Operator - the person who organizes and carries out the processing of personal data and determines the purposes and scope of the data processed (section 3).
• Cross-border transfer of personal data - transfer of personal data to the territory of a foreign state to a foreign individual or legal entity.
• Cookie - a small piece of data stored on the User's device when visiting the Site.

3. Operator details

Operator: an individual applying the special "Professional Income Tax" tax regime (self-employed), operating under the commercial designation "Solid".

• Full name: Miftakhov Ratmir Maratovich
• INN (taxpayer ID): 165051410326
• Email: hello@wearesolid.ru

The Operator personally organizes the processing of personal data and acts as the person responsible for organizing such processing. For any questions - hello@wearesolid.ru.

4. Categories of data processed

4.1. Data entered into the express-audit form. The User voluntarily provides business information in the form:

• business name (free-text field);
• field of activity (niche) - selected from a list;
• city - selected from a list;
• business website address (optional).

This information relates to the activity of a business (a legal entity or entrepreneur) and, as a rule, is not personal data. At the same time, the free-text "business name" field may contain data allowing an individual to be identified (e.g., a name in the title - "Olga's Salon"). To the extent such information relates to an identified or identifiable individual, it is processed as personal data under this Policy.

The entered information is used to automatically generate the express-audit result, including via the Claude service and a search of public sources on the Internet (see section 10).

4.2. Contacting the Operator. The Site does not contain a sign-up form that collects a visitor's contact details. When choosing a contact option, the User is shown the Operator's contact details (email, phone, messenger), via which the User may reach out on their own initiative. The User's data is not collected by the Site at this stage. If the User contacts the Operator themselves, only the data they provide is processed (e.g., sender address and message text).

4.3. Data collected automatically. When visiting the Site, the following is processed automatically:

• IP address;
• cookie data;
• browser, operating system, and device information;
• referral source (referer), campaign parameters;
• information about the User's actions on the Site, collected by web-analytics tools;
• technical data processed by the anti-bot protection service (Yandex SmartCaptcha).

In line with the position of Roskomnadzor and case law, the above information (IP address, cookie and device identifiers) qualifies as personal data. This is the primary scope of personal data processed via the Site.

4.4. Data the Operator does not process. The Operator does not request and does not intentionally process via the Site:

• visitors' contact details (the Site has no forms collecting phone/email and no free-text chat with arbitrary input);
• special categories of personal data (health, beliefs, etc.);
• biometric personal data;
• payment data. No payments are made on the Site.

5. Purposes of processing

The Operator does not make decisions producing legal consequences for the User solely on the basis of automated processing. The Operator does not send advertising without the User's separate consent (Art. 18 of the Federal Law "On Advertising").

6. Legal grounds for processing

• the Operator's pursuit of legitimate interests (Site functionality, analytics, and security), provided the subject's rights are not infringed (clause 7, part 1, Art. 6 of 152-FZ);
• the subject's consent to process data collected via cookies/web analytics (clause 1, part 1, Art. 6 of 152-FZ), expressed via the cookie banner;
• processing necessary to perform actions initiated by the subject (generating the express audit from entered data, replying to an inquiry) (clause 5, part 1, Art. 6 of 152-FZ);
• fulfilling obligations imposed on the Operator by the laws of the Russian Federation.

7. Principles and conditions of processing

7.1. Processing is carried out on a lawful and fair basis and is limited to predefined lawful purposes.

7.2. Only data appropriate to the purposes of processing is processed; its volume is not excessive (data minimization).

7.3. Processing is carried out both with and without the use of automation tools.

7.4. The Operator does not disclose or distribute personal data without the subject's consent, except as provided by law.

8. Storage, localization, and retention

8.1. Localization (part 5, Art. 18 of 152-FZ). Collection, recording, structuring, accumulation, storage, refinement, and retrieval of personal data of Russian citizens is carried out using databases located in the Russian Federation (Russian cloud-infrastructure providers - Selectel / Yandex Cloud).

8.2. Retention. Data is stored no longer than the purposes of processing require: information about submitted requests/inquiries - until the purpose is achieved, but no longer than 1 (one) year from the last interaction, unless a different period is set by law; web-analytics data - for the period set by the respective service. Once the purposes are achieved or consent is withdrawn, data is deleted or anonymized.

9. Transfer of personal data to third parties

To achieve the purposes in section 5, the Operator engages the following parties while ensuring confidentiality and security (Art. 6 of 152-FZ):

The Operator does not sell personal data. Disclosure at the request of authorized state bodies is carried out in the manner established by law.

10. Cross-border data transfer

10.1. To generate the express-audit result, the information entered by the User into the form (business name, niche, city, website address) is transferred to the Claude service, operated by Anthropic PBC (United States of America); the service also uses public Internet sources.

10.2. The transferred information relates primarily to business activity (business data) and, as such, is not personal data. To the extent the free-text "business name" field contains data about an individual, and insofar as such data is personal, its cross-border transfer to the USA is carried out:

• with the data subject's consent (clause 1, part 4, Art. 12 of 152-FZ);
• subject to the Operator notifying Roskomnadzor of its intent to carry out cross-border transfer (part 3, Art. 12 of 152-FZ) - separately from the processing notification.

10.3. The United States of America is not on the list of states providing adequate protection of data subjects' rights.

10.4. Minimization measures. The Operator does not request contact details in the form. Users are advised not to enter personal data into the "business name" field. If the User does not agree to the cross-border transfer, they may refrain from using the express-audit form and contact the Operator at hello@wearesolid.ru.

11. Cookies and web analytics

11.1. The Site uses cookies and similar technologies to operate the Site, for web analytics, and for protection from automated requests. Some data collected via cookies (IP address, unique identifiers) qualifies as personal data and is processed under this Policy.

11.2. Cookie categories used:

The Site does not use advertising cookies of third-party ad networks and does not transfer cookie data outside the Russian Federation.

11.3. Consent. On the first visit, the User is shown a cookie banner. Essential cookies are required for the Site to work and are always applied. Analytics cookies are applied after the User's consent.

11.4. How to opt out. The User may change cookie settings in their browser at any time (block or delete cookies) or use the opt-out tools of the Yandex Metrica service. Disabling essential cookies may break certain Site features.

12. Data subject's rights

12.1. The data subject has the right to:

• obtain information about the processing of their personal data (Art. 14 of 152-FZ);
• demand the refinement, blocking, or deletion of data if it is incomplete, outdated, inaccurate, unlawfully obtained, or no longer needed for the processing purpose;
• withdraw consent to processing;
• appeal the Operator's actions to Roskomnadzor or in court.

12.2. Requests are sent to hello@wearesolid.ru and must contain information allowing the subject to be identified. The Operator responds within the time frames set by 152-FZ; upon withdrawal of consent, it stops processing and deletes the data within no more than 30 days, unless otherwise required by law.

13. Data protection measures

The Operator takes legal, organizational, and technical measures (Art. 19 of 152-FZ): storage on infrastructure in the Russian Federation; access control; encryption in storage and transit; logging and backups; regular review of processing conditions and updates to the Policy.

14. Processing of minors' data

The Site is intended for persons over 18 (business owners and representatives). The Operator does not intentionally collect minors' data; if discovered, such data is deleted.

15. Actions in case of security incidents

In the event of unlawful or accidental transfer of personal data resulting in infringement of subjects' rights, the Operator notifies Roskomnadzor in the manner and within the time frames of part 3.1, Art. 21 of 152-FZ: the initial notification within 24 hours, and the results of the internal investigation within 72 hours.

16. Changes to the Policy

The Operator may amend the Policy. The current version is posted at https://www.wearesolid.ru/en/privacy with the effective date indicated. Continued use of the Site means you have reviewed the changes.

17. Contacts

Email: hello@wearesolid.ru