Personal Data Processing Policy

Version dated 20.10.2026. Identifier: 2026-10-13-email-1.

Terms used in this document: INN — taxpayer identification number; OGRNIP — primary state registration number of an individual entrepreneur; OGRN — primary state registration number; OOO — limited liability company; IP address — the network address from which a request originates; cookies — small records that a website stores in the browser.

1. General provisions and information about the Controller

1.1. The personal data Controller is Individual Entrepreneur Andrei Viktorovich Svirin:

• INN: 772872317733;
• OGRNIP: 322774600176722;
• correspondence address: P.O. Box 15, Moscow, 117647;
• email for personal data matters: zapros@svirinprobono.ru;
• website: https://svirinprobono.ru/.

1.2. This Personal Data Processing Policy (the Policy) determines the purposes, legal grounds, categories, procedure and periods for processing personal data by Individual Entrepreneur Andrei Viktorovich Svirin (the Operator) when using https://svirinprobono.ru/ (the Website), considering inquiries by email and communicating about them subsequently. Inquiries through web forms are not accepted. If the parties separately enter into a contract, necessary processing is also governed by that contract and the law.

1.3. The Policy applies to the personal data of Website visitors, persons submitting inquiries (hereinafter Applicants), Clients, their representatives and other individuals whose personal data is lawfully processed by the Controller in connection with the provision of services. The Controller considers inquiries personally.

2. Legal grounds and principles of processing

2.1. Personal data is processed in accordance with Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (hereinafter the Personal Data Law) and other applicable regulatory legal acts of the Russian Federation. The terms "personal data", "personal data processing", "controller", "provision of personal data", "depersonalization of personal data" and "destruction of personal data" are used with the meanings established by Article 3 of that Law.

2.2. Personal data is processed on a lawful and fair basis and is limited to achieving specific, predetermined and lawful purposes. The content and volume of the personal data processed must correspond to the stated processing purposes; excessive processing and processing incompatible with the purposes of the initial collection are not permitted.

2.3. Visiting the Website, clicking “Write an email” and sending an ordinary email do not constitute universal consent to personal data processing. Consent, where necessary, is provided separately and does not extend to promotional mailings, advertising calls, publication of materials or optional analytics.

3. Purposes, scope of data and grounds for processing

3.1. Consideration of inquiries and feedback

3.1.1. Processing purposes: receiving and considering an inquiry, clarifying relevant circumstances, preparing and sending a response, and subsequent communication exclusively on that issue. For the Website, this means preliminary consideration of the legal question, determination of the possibility of free assistance and preparation of a legal response. The main inquiry channel is email: zapros@svirinprobono.ru.

3.1.2. Data processed: first name or surname, first name and patronymic to the extent provided by the applicant; email address; telephone number if provided for a response; email text; task information; the applicant's own personal data in necessary documents and attachments; and information relevant to the issue in subsequent correspondence. Unrequested and excessive data is not used for other purposes.

3.1.3. The receipt date and time, sender's address, subject, message identifier and necessary technical delivery information are used to register the email and confirm the circumstances of the inquiry. For separate consent, its content, receipt date, method of expression and version are retained. The Website does not create a web form submission record or attach visitor behaviour information to the email.

3.1.4. The legal ground is determined by the inquiry's content. Where the data subject initiates a contract and when performing a contract to which they are a party, beneficiary or guarantor, clause 5 of Part 1 of Article 6 of the Personal Data Law applies — strictly to the extent of necessary processing. For other inquiries, if no independent ground exists, separately obtained and confirmed consent applies under clause 1 of Part 1 of Article 6. A contractual ground does not automatically extend to any and all data in attachments or information about third parties.

3.1.5. A response is sent using the contact details provided by the applicant and agreed channels. A telephone number provided for communication on the issue is not used for advertising. During telephone clarification, only information necessary for the inquiry is processed; this description does not provide for audio recording of conversations.

3.1.6. Attachments are used for familiarisation, clarification of the circumstances and preparation of a response. The initial submission does not authorise publication, advertising use or transfer of files to analytics. Transfer rules are set out in the Terms for the Transfer and Use of Materials.

3.2. Entering into and performing a separate contract

3.2.1. If the parties enter into a contract, the processing purposes are agreeing its terms, performing obligations, exchanging documents and delivering the result. The data scope is determined by the contract's subject matter, rather than the mere fact of contacting us through the Website.

3.2.2. Data processed: necessary surname, first name and patronymic, contact details, addresses, task information, documents and materials; information about a representative and their authority. Identification and payment information is requested only where necessary for a specific action. This provision does not mean that pro bono assistance is chargeable or that payments are available on the Website.

3.2.3. Grounds: clause 5 of Part 1 of Article 6 — for the data of a party, beneficiary or guarantor and the data subject's own initiative to enter into a contract; clause 2 of Part 1 of Article 6 — for statutory duties. A separate applicable ground is determined for representatives and other persons.

3.3. Fulfilment of statutory duties

3.3.1. The purposes are mandatory recordkeeping where required, and compliance with lawful demands and requests from competent authorities. The data scope is limited to the content of the relevant duty. The ground is clause 2 of Part 1 of Article 6 and the provisions establishing that duty.

3.4. Handling claims and protecting rights

3.4.1. The purposes are considering claims, settling disputes, protecting rights and legitimate interests, and confirming the content of communications and lawfulness of processing.

3.4.2. Data processed: documents and correspondence relevant to the specific dispute, necessary communication information and a minimal consent record. The grounds are legal requirements and clause 7 of Part 1 of Article 6, subject to respect for the data subject's rights and freedoms. This provision does not authorise indefinite retention of all inquiries and attachments.

3.5. Website operation and security

3.5.1. The purposes are delivering pages, detecting errors and protection against unlawful requests and technical abuse. Data processed: the IP address, request date and time, page address, request processing result and necessary browser information transmitted when connecting to the server.

3.5.2. The ground is clause 7 of Part 1 of Article 6: ensuring Website operation and security while respecting the visitor's rights and freedoms. This information is not used on that ground for optional analytics or advertising.

3.6. Analytics and advertising

3.6.1. Separate Yandex Metrica analytics with counter 110490104 has been prepared for the Website. No advertising subscription is provided; an inquiry does not add the visitor to a mailing list. Analytics does not run until retention periods have been checked and separate consent saved. A new version of the Policy does not extend consent previously given.

4. Processing procedure and data recipients

4.1. Within the purposes and legal grounds, operations include collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer (provision, access), blocking, deletion and destruction. Processing is automated, non-automated or a combination.

4.2. The Operator considers the inquiry personally. Access is limited to the extent necessary for the relevant function; inquiry content and attachments are not made publicly available.

4.3. Technical hosting and data delivery are provided by the hosting and email infrastructure used by the Operator. The Operator identifies the actual technical recipients, access conditions and hosting location before entrusting processing to them. The engagement is documented under Part 3 of Article 6 of the Personal Data Law and does not release the Operator from duties to the data subject. Information about actual recipients is provided at the data subject's request under the statutory procedure. This Policy does not authorise transfer to an unspecified group of persons.

4.4. Under a separate contract, materials may be provided to agreed participants in performance only to the necessary extent and on an applicable lawful ground. An inquiry does not in itself authorise forwarding materials to any specialist.

4.5. Data is provided to courts and state authorities in the cases and manner prescribed by law. Contact details may not be transferred to third parties for their independent advertising without a separate lawful ground.

4.6. When collecting personal data of citizens of the Russian Federation, the Operator ensures compliance with Part 5 of Article 18 of the Personal Data Law on the use of databases in the Russian Federation. The applicant's choice of email service does not remove the Operator's duties.

4.7. Before cross-border transfer begins, the Operator fulfils Article 12 of the Personal Data Law, identifies recipients and provides data subjects with the necessary information. Consent to an inquiry does not waive localisation or cross-border transfer requirements. Identifying Russian hosting does not in itself confirm the location of all email systems.

5. Processing, retention and deletion periods

5.1. Ordinary inquiries for which no contract has been concluded, including correspondence and attachments, are retained for the period necessary to consider them, but no more than 90 calendar days from the last substantive message or agreed telephone clarification. If there is no continuation, the period runs from receipt of the inquiry. Automatic replies and service notifications do not extend the period.

5.2. Data under a separate contract is retained during performance and for the statutory retention periods of the relevant documents. An independent ground is required afterwards. Mandatory retention of particular documents does not authorise keeping all excessive attachments.

5.3. Ordinary technical security logs are retained for no more than 30 calendar days. Information about a specific incident may be retained longer only on an independent ground, for the period necessary to investigate or protect rights.

5.4. A minimal consent record may be retained on an independent ground for no more than three years from expression of consent, if needed to confirm the lawfulness of processing or protect rights while respecting the data subject's rights and freedoms. It contains: name, if stated; contact information linking consent to the inquiry; the separate consent text; date and time; message identifier; and document version. The full original inquiry, contents and names of its attachments, and excessive technical headers are not included. This limit does not impose a duty to retain the record for the full three years.

5.5. Information necessary for a particular claim or dispute is retained to the necessary extent on an independent ground. The reason and period are determined separately; ordinary correspondence does not automatically become an archive for protecting rights.

5.6. When the purpose is achieved, the period expires or the ground ceases to exist, data is deleted or destroyed unless an independent lawful ground requires continued retention. On achievement of the purpose, the periods in Part 4 of Article 21 of the Personal Data Law apply. Deletion covers email, attachments, local copies, information systems used and copies held by processors. Keeping data in “Sent”, “Archive” and “Trash” folders counts as retention.

5.7. Withdrawal stops processing based on consent. If the data is no longer needed and no other ground exists, destruction is ensured under Part 5 of Article 21: generally within no more than 30 days from withdrawal, subject to statutory exceptions.

5.8. A request to stop processing is governed by Part 5.1 of Article 21: processing generally stops within no more than 10 working days; on statutory grounds, the period may be extended by no more than five working days with a reasoned notice. Lawful exceptions are considered separately.

5.9. If destruction within the statutory period is impossible, the data is blocked and destroyed under Part 6 of Article 21, generally no later than six months unless federal law establishes another period. A backup copy does not in itself authorise further use of the data.

6. Cookies and technical tools

6.1. Cookies are small records saved by the browser while a website operates; local storage (localStorage) saves entries on the device between visits and does not transmit them automatically to the server.

6.2. Web inquiry forms are disabled; the FORMSESSID cookie is not used. The applicant sends the inquiry themselves by ordinary email. The analytics choice is stored in a server-signed site_analytics_choice_v2 cookie and localStorage site-analytics-choice-v2 for 180 days. The minimal choice record contains the result, date, version and random identifier; it is not linked to an email, name, telephone number or documents. Analytics is permitted only with separate consent after compliance with retention periods has been checked.

6.3. The server may receive the IP address and connection information without cookies; this is processed within the security purpose under clauses 3.5 and 5.3. The absence of analytics does not mean that no technical data is processed.

6.4. Additional information and the conditions for changes to the technical setup are set out in the Cookie and Technical Data Policy. For any future optional technologies, data, periods and grounds are determined before launch; separate consent is requested where necessary.

6.5. Visitors may delete Website data or block cookies in browser settings. Deleting browser records does not delete previously sent emails from the Operator's systems: requests should be sent using the Policy's contact details.

7. Rights of the personal data subject

7.1. The personal data subject has the right to receive information about the processing of their personal data, to demand its correction, blocking or destruction in the cases provided for by law, to withdraw consent to processing, and to appeal against the Controller's actions or omissions in the manner prescribed by law.

7.2. Inquiries and requests from personal data subjects are accepted at the email address zapros@svirinprobono.ru or at the correspondence address specified in section 1 of the Policy.

7.3. To identify the inquiry, it is recommended to specify the contact details used when submitting it, the approximate submission date and the inquiry identifier, if available. The Controller may request proportionate verification of the subject's identity or their representative's authority. Requests provided for in Article 14 of the Personal Data Law are subject to the requirements for request contents established by that Article.

7.4. Information about the processing of personal data is provided to the subject or their representative within 10 working days from the date of the inquiry or receipt of the request. Where grounds provided for by law exist, this period may be extended by no more than five working days, with a reasoned notification stating the reasons for the extension being sent.

7.5. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal was received. If the processing of certain data continues on an independent lawful basis, the Controller informs the subject of such processing and its legal basis.

7.6. The subject may seek protection of their rights from the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) or in court.

8. Processing of third parties' personal data

8.1. Documents and information provided by email must be limited to what is necessary to consider the inquiry. Before sending materials, it is advisable to remove or redact excessive passport, financial, medical and other personal data.

8.2. The Applicant's consent applies to their personal data and does not constitute the consent of other persons whose personal data is contained in the submitted materials.

8.3. Where materials are sent by a representative or third parties' personal data is provided, the Controller checks that the relevant authority and legal basis for processing exist. In the absence of a sufficient legal basis, the data is not used to provide services and must be blocked and deleted within the periods provided for by law.

8.4. Special categories of personal data and biometric personal data are processed in compliance with Articles 10 and 11 of the Personal Data Law. Consent expressed in an ordinary email does not replace written consent where the law expressly requires that form.

8.5. When sending files, the applicant ensures they were obtained lawfully and that they have the right to transfer them to the Operator for consideration of the inquiry. The following apply: Terms for Transferring and Using Materials. The email itself is not treated as consent from everyone named in the documents and does not release the Operator from duties. If there are doubts, authority and transfer grounds are requested, access is restricted and use of the materials is suspended.

9. Personal data protection and final provisions

9.1. The Controller takes the necessary legal, organizational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful acts. Such measures include restricting access, ensuring secure data transmission, monitoring retention periods and monitoring compliance with requirements by engaged processors.

9.2. Personal data is destroyed by methods that preclude restoration of its contents in the information system and/or provide for the destruction of physical media containing personal data. The Controller ensures documentary confirmation of destruction in the cases and manner established by legislation.

9.3. The current version of the Policy is posted on the Website with its revision date. Changes to the Policy do not change the scope of consent previously given. If subsequent processing requires new consent, such consent is obtained separately before the relevant processing begins.

Counter and connection status

A dedicated Yandex Metrica counter No. 110490104 is specified for svirinprobono.ru. The number was provided by the Operator. Analytics collection is disabled until compliance with the established data retention periods has been checked. Saving a visitor's choice does not itself enable the counter. After the check, it may run only with separate saved consent; following refusal, no loading or new analytics requests occur. Webvisor is disabled.

Separate analytics terms

The purpose is to assess visits, referral sources and page use. When the service runs, YANDEX LLC receives the connection IP address, cookie and visit identifiers, technical browser and device information, cleaned page addresses, date, time and visit events. Email content, email addresses, telephone numbers and files are not sent to analytics. Webvisor is disabled. The ground is the visitor's separate consent, rather than an inquiry by email.

The choice is valid for 180 days. Minimal confirmation of the choice and analytics data are retained within the purposes for no more than three years; if the purpose is achieved earlier or consent withdrawn, the rules for early termination of processing and deletion apply. The retention limit relates to the Operator's rules and does not itself change Yandex's service settings or terms. Analytics is not enabled if this limit cannot be ensured.

Detailed terms, data categories, withdrawal of consent and periods are set out in the separate analytics consent and Cookie Policy. You can change your choice using “Analytics settings” in the website footer. Refusal does not prevent reading the website or sending inquiries by email.