1. General Provisions
1.1. This Privacy Policy (the “Policy”) explains how personal data is collected, processed, stored, and protected through the Kuzminov Advisory website at https://kuzminov-advisory.ru (the “Website”).
1.2. The data controller is Sergey Aleksandrovich Kuzminov, an individual operating under the name Kuzminov Advisory (the “Controller”).
1.3. The Controller can be contacted regarding personal data protection matters at sergey.a.kuzminov@gmail.com.
1.4. Personal data is processed in accordance with the applicable legislation of the Russian Federation, including Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”. Where applicable, relevant requirements of other data protection legislation, including the EU General Data Protection Regulation (GDPR), are also observed.
1.5. This Policy applies to personal data voluntarily submitted through the Website's contact form and to technical information processed in connection with the Website's operation.
1.6. The current version of this Policy is available at https://kuzminov-advisory.ru/en/privacy.
2. Purposes of Personal Data Processing
2.1. Personal data is processed for the following purposes:

• Receiving, reviewing, and responding to inquiries from prospective clients.
• Contacting individuals who have submitted inquiries.
• Understanding prospective clients' needs and discussing potential cooperation.
• Preparing proposals relating to IT advisory services, IT audits, cybersecurity, project management, and corporate training.
• Maintaining records of inquiries and related communications.
• Ensuring the technical operation, reliability, and security of the Website.
• Analysing Website traffic and performance through Tilda's built-in analytics tools, subject to applicable cookie consent requirements.

2.2. Personal data submitted through the contact form will not be used for marketing emails or promotional communications without a separate appropriate legal basis, including consent where required.
3. Categories of Personal Data
3.1. The Controller processes personal data voluntarily provided by individuals submitting inquiries through the Website.
3.2. Depending on the information provided, such data may include:

• Name.
• Email address.
• Telephone number.
• Preferred contact method.
• Messenger username, telephone number, or other contact identifier.
• Information included in the inquiry, including a description of the individual's business needs or requirements.

3.3. Technical information processed through the Website may include IP addresses, browser and device information, cookies, Website usage statistics, and other information necessary for its operation, security, and analytics.
3.4. The contact form is not intended to collect sensitive personal data, biometric information, identity document details, or payment information.
3.5. Visitors are encouraged not to include unnecessary personal data, confidential information, or personal data relating to third parties in their messages.
4. Legal Bases for Processing
4.1. Personal data is processed on lawful grounds established by applicable data protection legislation.
4.2. Under Russian data protection law, personal data submitted through the contact form is processed on the basis of the individual's consent, expressed by actively selecting the relevant consent checkbox before submitting the form.
4.3. Consent is obtained separately from other documents and acknowledgements and must be specific, informed, and unambiguous.
4.4. Where permitted by applicable law, personal data may also be processed on other lawful grounds, including where processing is necessary to take steps at the individual's request before entering into a contract or to perform a contract.
4.5. Where the GDPR applies, the legal basis for each processing activity is determined according to its purpose and circumstances, in accordance with Article 6 of the GDPR. Depending on the circumstances, this may include consent, pre-contractual measures, contractual necessity, or legitimate interests.
4.6. Non-essential analytics cookies and similar technologies are used subject to the consent requirements of applicable legislation.
5. Processing and Disclosure of Personal Data
5.1. Personal data may be collected, recorded, organised, stored, updated, retrieved, used, accessed, restricted, deleted, or otherwise processed as necessary for the purposes described in this Policy.
5.2. Processing is primarily carried out using automated systems and may, where necessary, involve manual handling.
5.3. The Website uses the Tilda platform and Tilda CRM to receive, manage, and store inquiries.
5.4. Tilda processes personal data on behalf of the Controller under the applicable contractual terms and data processing arrangements.
5.5. According to Tilda's published documentation, where the account country is set to Russia, personal data collected through the platform is stored on servers located in the Russian Federation, using infrastructure provided by Selectel and Yandex Cloud.
5.6. Access to personal data is restricted to persons who require it for the purposes described in this Policy. Personal data submitted through the contact form is not made publicly available.
5.7. Personal data may be disclosed to service providers involved in operating the Website or where disclosure is required or permitted by applicable law.
5.8. Where applicable data protection legislation imposes requirements on international transfers of personal data, the Controller will assess the relevant processing arrangements and comply with those requirements.
6. Retention and Deletion
6.1. Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law.
6.2. Personal data relating to inquiries that do not result in a contractual relationship is retained for no longer than 12 months after the last substantive communication, unless an earlier deletion request is received or another lawful basis for retention applies.
6.3. When the relevant purposes have been fulfilled, or where a valid request for deletion or withdrawal of consent is received, the Controller will discontinue processing and delete or otherwise appropriately dispose of the relevant personal data in accordance with applicable legal requirements.
6.4. If an inquiry leads to a contractual relationship, personal data may be retained for the period necessary to perform the contract and comply with applicable legal obligations.
7. Personal Data Security
7.1. The Controller takes appropriate organisational and technical measures to protect personal data against unauthorised access, unlawful disclosure, alteration, loss, destruction, and other unauthorised processing.
7.2. These measures include:

• Restricting access to stored inquiries.
• Using authentication mechanisms to access Tilda and Tilda CRM.
• Using HTTPS to protect communications with the Website.
• Using the security mechanisms provided by the Tilda platform.
• Deleting personal data when there is no longer a lawful reason to retain it.

7.3. Personal data security incidents are addressed in accordance with applicable legal requirements.
8. Your Data Protection Rights
8.1. Subject to applicable law, individuals may have the right to:

• Obtain information about the processing of their personal data.
• Request access to their personal data.
• Request correction of inaccurate or incomplete information.
• Request restriction, blocking, or deletion of personal data where legally justified.
• Withdraw consent previously given.
• Lodge a complaint with a competent data protection authority or seek judicial protection.

8.2. Where the GDPR applies, individuals may have additional rights, including data portability and the right to object to certain processing activities, subject to the conditions and limitations established by the GDPR.
8.3. Requests relating to personal data may be submitted to sergey.a.kuzminov@gmail.com.
8.4. Individuals should provide sufficient information to allow the Controller to identify the relevant personal data and verify the request. Additional information may be requested where legally necessary to establish the identity or authority of the person making the request.
8.5. Requests will be handled within the time limits established by applicable law.
8.6. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. Processing may continue where another applicable legal basis exists.
9. Cookies and Website Analytics
9.1. The Website uses cookies and technical mechanisms provided by the Tilda platform to support its operation, security, and analytics.
9.2. Essential cookies and similar technologies may be used where necessary for the Website to function properly and securely.
9.3. The Website uses Tilda's built-in analytics functionality to analyse Website traffic and performance. No third-party analytics services are currently connected by the Controller.
9.4. Where consent is required for non-essential analytics cookies or similar technologies, such technologies are used only after the visitor has provided the necessary consent.
9.5. The Website provides a cookie consent interface through which visitors can manage their preferences regarding non-essential cookies.
9.6. Visitors may also manage cookies through their browser settings. Restricting certain cookies may affect some Website functionality.
10. Changes to This Policy
10.1. This Policy may be updated to reflect changes in applicable legislation, the categories of personal data processed, technologies used, or the Controller's data processing practices.
10.2. The current version is published at https://kuzminov-advisory.ru/en/privacy.
10.3. Changes take effect upon publication unless otherwise stated or required by applicable law.
11. Controller Contact Details
Data Controller: Sergey Aleksandrovich Kuzminov
Legal Status: Individual
Operating Name: Kuzminov Advisory
Country of Operation: Russian Federation
Website: https://kuzminov-advisory.ru
Email: sergey.a.kuzminov@gmail.com