Personal Data Processing Policy
Version of 10 November 2026 (version 1)
1. General provisions
This personal data processing policy has been drawn up in accordance with Federal Law of 27 July 2006 No. 152-FZ “On Personal Data” (the Personal Data Law) and sets out the procedure for processing personal data and the measures to protect it taken by sole proprietor Daria Vladimirovna Mironova (INN 772629931139, OGRNIP 324774600077690; the Controller).
The Controller is listed in the register of personal data controllers under registration number 77-25-460259.
1.1. Respect for human and civil rights and freedoms when processing personal data, including privacy and personal and family confidentiality, is a key objective and condition of the Controller’s activities.
1.2. This Personal Data Processing Policy (the Policy) applies to all information the Controller may obtain about visitors to https://дарьямиронова.рф/ and people who contact the Controller using the telephone number, email address or messaging services listed on the website.
2. Key terms used in the Policy
2.1. Automated processing of personal data means processing using computing equipment.
2.2. Blocking personal data means temporarily stopping its processing, except where processing is necessary to rectify the data.
2.3. Website means the collection of graphic and informational materials, software and databases that makes them available online at https://дарьямиронова.рф/.
2.4. Personal data information system means the personal data held in databases together with the information technology and technical means used to process it.
2.5. Depersonalisation means actions that make it impossible to identify the data subject without additional information.
2.6. Processing means any action or set of actions with personal data, automated or otherwise, including collection, recording, organisation, accumulation, storage, rectification (updating or amendment), retrieval, use, transfer (dissemination, provision or access), depersonalisation, blocking, deletion and destruction.
2.7. Controller means a public or municipal authority, legal entity or individual that, alone or jointly, organises or carries out processing and determines its purposes, the personal data to be processed and the operations performed on it.
2.8. Personal data means any information relating directly or indirectly to an identified or identifiable individual (the data subject).
2.9. User means any visitor to https://дарьямиронова.рф/.
2.10. Provision of personal data means actions intended to disclose personal data to a specific person or group of persons.
2.11. Dissemination of personal data means actions intended to disclose personal data to an unspecified group of persons.
2.12. Cross-border transfer means transferring personal data to a foreign state’s territory, to a foreign public authority, individual or legal entity.
2.13. Destruction means actions that make it impossible to restore the content of personal data in an information system and/or destroy the physical media containing it.
2.14. Cookies are small pieces of data stored in the User’s browser by a website or its connected services and used on subsequent visits.
3. Main rights and obligations of the Controller
3.1. The Controller may:
— obtain accurate information and/or documents containing personal data from the data subject;
— continue processing without consent after the data subject withdraws consent or requests that processing stop, where grounds provided by the Personal Data Law apply;
— independently determine the measures necessary and sufficient to meet its obligations under the Personal Data Law and regulations adopted pursuant to it, unless that Law or other federal laws provide otherwise.
3.2. The Controller must:
— provide the data subject, on request, with information about the processing of their personal data;
— organise processing in accordance with the legislation of the Russian Federation;
— respond to enquiries and requests from data subjects and their legal representatives as required by the Personal Data Law, including providing requested information within 10 working days of the request; this may be extended by up to 5 working days in cases provided by the Law;
— provide the competent personal data protection authority with requested information within 10 working days of receipt of its request; this may be extended by up to 5 working days in cases provided by the Personal Data Law;
— publish this Policy or otherwise provide unrestricted access to it;
— take legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful actions;
— notify the competent personal data protection authority, in the manner and within the deadlines set by the Personal Data Law, of unlawful or accidental transfer (provision, dissemination or access) that infringes data subjects’ rights;
— stop the transfer (dissemination, provision or access) and processing of personal data and destroy it in the manner and circumstances required by the Personal Data Law;
— fulfil other obligations under the Personal Data Law.
4. Main rights and obligations of data subjects
4.1. Data subjects have the right to:
— receive information about the processing of their personal data, except as provided by federal law. The Controller must provide it in an accessible form, excluding other people’s personal data unless disclosure has a lawful basis. The information and procedure for obtaining it are defined by the Personal Data Law;
— require rectification, blocking or destruction of incomplete, outdated, inaccurate, unlawfully obtained or unnecessary personal data, and take lawful measures to protect their rights;
— require prior consent for processing for the promotion of goods, works and services;
— withdraw consent and request that processing stop;
— challenge unlawful acts or omissions by the Controller before the competent personal data protection authority or a court;
— exercise other rights provided by Russian law.
4.2. Data subjects must:
— provide accurate information about themselves;
— notify the Controller of corrections, updates or changes to their personal data.
4.3. Persons who provide false information about themselves or another person’s data without that person’s consent are liable under Russian law.
5. Principles of personal data processing
5.1. Personal data is processed lawfully and fairly.
5.2. Processing is limited to specific, predetermined and lawful purposes. Processing incompatible with the purposes of collection is not permitted.
5.3. Databases containing personal data processed for incompatible purposes must not be combined.
5.4. Only personal data relevant to the purposes of processing may be processed.
5.5. The content and volume of data processed must correspond to the stated purposes. Excessive processing in relation to those purposes is not permitted.
5.6. Accuracy, sufficiency and, where necessary, currency of data are ensured in relation to the purposes of processing. The Controller takes or ensures the necessary measures to delete or rectify incomplete or inaccurate data.
5.7. Data is kept in an identifiable form no longer than necessary for processing purposes, unless a retention period is established by federal law or a contract to which the data subject is a party, beneficiary or guarantor. Data is destroyed or depersonalised when the purposes are achieved or no longer necessary, unless federal law provides otherwise.
6. Purposes of processing personal data
6.1. Preparing, concluding and performing civil-law contracts with clients
Purpose: Responding to enquiries about consultations and other services on the website; booking, providing services, payments and refunds, and handling complaints, including under service contracts based on the public offer at https://дарьямиронова.рф/oferta/.
Categories of data subjects and personal data:
— individual clients, including sole proprietors purchasing for personal needs, and people enquiring about services: surname and first name (patronymic only if volunteered); phone number; email; messenger username; booking details (service, date, time, format); payment and refund details (date, amount, payment method, transaction number, sender’s name as shown in the bank transaction; account details for refunds); transaction receipt information if supplied by the client (offer clause 4.6): sender’s name, date, amount, transaction number, masked card or account number; enquiries and complaints; date of birth only if needed for the selected service format;
— sole proprietors purchasing for business purposes and representatives of corporate clients: surname, first name and patronymic; position (for representatives); phone number; email; for sole proprietors, also INN, OGRNIP and bank account details.
The Controller does not request or record screenshots of banking apps, bank statements, balances or details of the client’s other transactions.
Legal grounds: Performance of a contract with the data subject and entering into one at their initiative (Article 6(1)(5) of the Personal Data Law); for corporate representatives, the legitimate rights and interests of the Controller and client (Article 6(1)(7)); the Controller’s obligations under tax and cash register legislation (Article 6(1)(2)).
Operations with personal data: Collection, recording, organisation, accumulation, storage, rectification (updating or amendment), retrieval, use, transfer (provision or access), blocking, deletion and destruction. Processing is mixed, automated and non-automated, with transmission over the Internet.
6.2. Collecting website visit statistics
Analysing how visitors use the website to improve its operation and content.
Categories of data subjects: Website visitors.
Personal data: Cookies and identifiers assigned through them; IP address; browser, device and operating system information; visit date and time; visited and referring page URLs; actions on the website (clicks, scrolling and cursor movements).
Legal ground: The User’s consent (Article 6(1)(1) of the Personal Data Law), given by selecting “Accept” in the website’s cookie notice.
Operations with personal data: Collection, recording, storage, use, transfer (provision or access) to YANDEX LLC as owner of Yandex Metrica, deletion and destruction. Processing is automated, with transmission over the Internet.
6.3. Performing contracts with individual service providers
Categories of data subjects: Individuals who provide or have provided services to the Controller under civil-law contracts.
Personal data: Surname, first name and patronymic; date and place of birth; identity document details; registered address; INN; SNILS; phone number; email; bank account details. For self-employed persons: INN and account details, without passport details or SNILS.
Legal grounds: Performance of a contract (Article 6(1)(5) of the Personal Data Law); the Controller’s obligations under tax law (Article 6(1)(2)).
6.4. Performing employment contracts
Purpose: Personnel records, performance of employment contracts, payroll calculation and payment, and employer obligations under labour, tax and compulsory social insurance law.
Categories of data subjects: Current and former employees of the Controller.
Personal data: Surname, first name and patronymic; date and place of birth; identity document details; registered and residential addresses; phone number; INN; SNILS; education and employment history; military registration information where applicable; bank account details; salary information.
Legal grounds: Performance of the employment contract (Article 6(1)(5) of the Personal Data Law); statutory employer obligations (Article 6(1)(2)), including Chapter 14 of the Labour Code of the Russian Federation.
6.5. Managing messaging permissions and marketing
The Operator records clients’ choices about messages concerning enquiries and orders, agreed calls and marketing. No marketing campaigns are running as of this version; permissions for future lawful campaigns are collected separately and voluntarily.
Data subjects: clients and people enquiring about services. Data: account identifier or phone number in the chosen messenger, preferences, date, source and content of consent or withdrawal, the confirmed text version, IP address and browser information when confirming on the website. Operations: collection, recording, organisation, storage, updating, retrieval, use, restriction, deletion and destruction, with and without automation. Contact details are not published for these purposes.
Data processing for marketing is based on the data subject’s separate consent (Article 6(1)(1) and Article 15 of the Personal Data Law); consent to receive advertising is given separately under Article 18 of the Advertising Law. Contract-related processing retains the grounds in clause 6.1. Withdrawals and necessary evidence are recorded to fulfil the Operator’s obligations and protect lawful rights while respecting the data subject’s rights (Article 6(1)(2) and (7)).
Marketing and related data permissions last until withdrawal, for no longer than 3 years after confirmation. Marketing stops immediately upon withdrawal. A minimal opt-out record is retained as long as needed to prevent unwanted repeat messages; necessary evidence of consent and withdrawal is retained where an independent lawful basis exists. Otherwise, clause 8.4 governs retention and deletion; an entire chat does not become evidence of marketing consent.
7. Conditions for processing personal data
7.1. The Controller processes data on at least one of these grounds: the data subject’s consent; entering into or performing a contract with them; statutory obligations under Russian law; or the rights and legitimate interests of the Controller or third parties, provided the data subject’s rights and freedoms are not infringed. Section 6 specifies the ground for each purpose.
7.2. Where processing relies on consent, that consent is documented separately from other information and documents accepted or signed by the data subject.
7.3. Special categories of data and information unnecessary for services. The Controller does not request health, intimate life, religious or philosophical belief information or other special categories of data, does not record them in client records or notes, and does not make audio or video recordings of consultations. Information shared orally during consultations is not recorded.
If a client voluntarily sends such information by messaging or email, or sends third-party documents or information unnecessary for booking or providing the service, the Controller does not use or forward it, tells the client not to send it, and deletes its copies, including correspondence on the Controller’s devices, within 3 working days of receipt.
If a specific service requires special-category data, the Controller processes it only with the client’s written consent obtained before collecting it (Article 10(2)(1) of the Personal Data Law).
8. Collection, storage, transfer and other processing procedures
The Controller protects personal data through the legal, organisational and technical measures needed to meet all applicable data protection requirements.
8.1. The Controller safeguards personal data and takes all possible measures to prevent unauthorised access.
8.2. Personal data is not transferred to third parties except:
— where Russian law provides for it;
— to persons entrusted with processing, such as a manager who is not an employee, under a contract containing the terms required by Article 6(3) of the Personal Data Law; the Controller remains responsible to the data subject for their actions;
— to the Controller’s bank and card payment service for payments and refunds;
— to YANDEX LLC through Yandex Metrica with the User’s consent (section 9);
— storage of website files and technical visit logs on the servers of the Russian hosting provider Timeweb;
— where the data subject has consented to transfer to a third party.
Employees access data only as necessary for their duties and must keep it confidential; such access is not a transfer to third parties.
8.3. To correct inaccurate data, the data subject may email salonld@mail.ru with the subject “Personal data update”.
8.4. Unless law or contract establishes another period, data is processed for the following periods:
— enquiries that do not result in a booking and related correspondence: 6 months from the last enquiry;
— bookings, services provided, related correspondence and complaints: 3 years from service provision or cancellation; unresolved complaints or disputes: until final resolution;
— payment and refund documents and fiscal receipts: the statutory retention period for tax documents, at least 5 years (Article 23(1)(8) of the Tax Code of the Russian Federation);
— transaction receipts sent by clients: until payment is reconciled, but no longer than 30 days from receipt;
— individual contractors’ data (clause 6.3): for the contract term and the tax document retention period afterwards;
— employee data (clause 6.4): for periods set by labour and archive legislation;
— special-category data and other information unnecessary for services: as set out in clause 7.3;
— Yandex Metrica data: within retention periods set by the service terms and counter settings; the Controller does not move it to other databases.
On expiry of the period or achievement of the purpose, data is destroyed within 30 days; following withdrawal of consent, within 30 days of receipt, unless law provides otherwise (Article 21(4)–(5) of the Personal Data Law). Unlawful processing stops within 3 working days of discovery; if it cannot be made lawful, data is destroyed within 10 working days of discovery (Article 21(3)). Data is removed from all the Controller’s storage locations, including email, correspondence on devices and backups; destruction is documented as required by Roskomnadzor. Consent may be withdrawn at any time by emailing salonld@mail.ru with the subject “Withdrawal of consent to personal data processing”.
8.5. Messaging services, social networks, banks and payment services process information submitted through them as independent controllers under their own terms and policies. Through messengers the Controller requests only booking information: name, contact, selected service, date and time. Documents, questionnaires and payment receipts are not requested through messengers; if needed, they are sent to salonld@mail.ru.
8.6. When collecting data, including online, the Controller ensures that Russian citizens’ data is recorded, organised, accumulated, stored, rectified (updated or amended) and retrieved using databases located in the Russian Federation.
8.7. The Controller ensures confidentiality during processing.
8.8. Processing may stop when its purposes are achieved, consent expires or is withdrawn, a request to stop is received, or unlawful processing is identified.
8.9. When discussing relatives or other people, clients need not provide surnames, contacts or other identifying details. The Controller does not record third-party information in client records or notes; unnecessary third-party information sent in correspondence is deleted under clause 7.3.
8.10. Enquiry and order messages relate to a specific enquiry or order: answers, payment information, bookings, reminders, schedule changes, cancellations, refunds and complaints. They contain no promotional offers. Permissions for further messages on the chosen channel and agreed calls are recorded separately. Replying to a new question does not subscribe the client to further proactive messages or marketing.
8.11. The Operator may send marketing about its services, events and special offers only with the recipient’s prior separate consent and through channels where such advertising is lawful. An enquiry, payment, acceptance of the offer, reading the privacy policy or previous correspondence is not marketing consent. Opting out of marketing does not affect access to services.
8.12. Preferences can be changed or withdrawn on the personal Messages and calls page, by messaging the administrator in the relevant chat, or by emailing salonld@mail.ru. No special keyword or subject line is required: a clear request is sufficient. A marketing opt-out stops marketing; a request not to message or call on a channel stops proactive contact there. Necessary communication about an existing order continues through another agreed channel. Opting out does not itself cancel an order or request deletion of all contractual records.
8.13. Current permissions and withdrawals are checked before CRM messages are sent. Sending is suspended if the journal is unavailable. Administrators observe the same restrictions when using the phone manually and record withdrawals received through other channels. Imported correspondence is not treated as marketing consent; identified refusals must be honoured before sending messages.
9. Cookies and Yandex services
9.1. The website uses technical cookies necessary for its operation and protection against automated requests.
9.2. The website uses Yandex Metrica (YANDEX LLC, Russia), including Click Map and Webvisor. Webvisor records visitors’ actions (clicks, scrolling and cursor movements) to assess usability. The Controller uses this information as statistics, not to identify Users. The service loads only after the User selects “Accept” in the cookie notice. If the User selects “Decline”, it does not load.
9.3. Some pages contain a Yandex Maps map (YANDEX LLC). When it loads, the service receives technical information about the User’s browser.
9.4. Information collected by Yandex services is processed by YANDEX LLC under those services’ terms and Yandex’s privacy policy.
9.5. The User may change their decision at any time by selecting , and can also block or delete cookies in their browser settings. This may affect some website features.
9.6. The website links to third-party sites and services, including messengers, social networks, video platforms and marketplaces. This Policy does not cover them: their owners’ documents govern processing there.
10. Operations performed on personal data
10.1. The Controller collects, records, organises, accumulates, stores, rectifies (updates or amends), retrieves, uses, transfers (provides access to), blocks, deletes and destroys personal data.
10.2. Processing is mixed, automated and non-automated, with transmission over the Internet.
11. Cross-border transfers of personal data
11.1. The Controller does not carry out cross-border transfers of personal data.
11.2. Before starting any cross-border transfer, the Controller will notify the competent authority as required by the Personal Data Law and update this Policy accordingly.
12. Confidentiality of personal data
The Controller and others with access to personal data must not disclose or disseminate it to third parties without the data subject’s consent, unless federal law provides otherwise.
13. Final provisions
13.1. Data subjects may request explanations about processing by contacting the Controller at salonld@mail.ru.
13.2. Changes to the Controller’s processing policy will be reflected in this document. This Policy remains in force until replaced by a new version.
13.3. The current Policy is freely available at https://дарьямиронова.рф/privacy-policy/.
Controller details
Sole proprietor Daria Vladimirovna Mironova
INN (Tax ID): 772629931139
OGRNIP (Registration No.): 324774600077690
Registration number in the register of personal data controllers: 77-25-460259
Email: salonld@mail.ru