1. General provisions

1.1. This Policy (the Policy) sets out the procedures for processing and protecting the personal data of users of https://abs-marketing.com and of clients and partners of Individual Entrepreneur Igor Andreevich Shalubin (the Operator, ABS-Marketing).

1.2. The Policy has been developed in accordance with:

– Federal Law No. 152-FZ On Personal Data;

– Federal Law No. 149-FZ On Information, Information Technologies and Information Protection;

– Resolutions of the Government of the Russian Federation No. 1119 and No. 687;

– applicable requirements for the protection of personal data, including FSTEC Order No. 21 where relevant;

– Roskomnadzor recommendations issued in 2024.

1.3. This Policy provides information about data processing. Viewing the Website does not replace separate consent where required. Optional analytics is described in section 8.

1.4. Declining optional analytics does not prevent access to the main pages or the submission of ordinary enquiries.

1.5. The Policy applies to all personal data received by the Operator in the course of providing services, communicating and working with partners.

2. Terms and definitions

Personal data means any information relating to a directly or indirectly identifiable individual.

Personal data processing means any action or operation involving personal data: collection, recording, organisation, storage, updating, use, transfer, dissemination, anonymisation, blocking and destruction.

Data subject means the individual to whom the personal data relates.

Operator means Individual Entrepreneur Igor Andreevich Shalubin.

Website means https://abs-marketing.com and its subdomains.

3. Purposes and legal grounds for processing

3.1. Personal data is processed for the following purposes:

• recording applications and enquiries;
  
  
• entering into and performing contracts, including public offers and partnership agreements;
  
  
• providing information about order status, new products and promotions;
  
  
• marketing and analytics where the data subject has given consent;
  
  
• complying with the legislation of the Russian Federation.
  
  

3.2. The legal grounds for processing are:

• the data subject’s consent;
  
  
• performance of a contract;
  
  
• fulfilment of statutory obligations;
  
  
• the Operator’s legitimate interests, including improving service quality and protecting rights.
  
  

3.3. In certain circumstances, processing without consent is permitted in the cases specified in Article 6 of Federal Law No. 152-FZ.

4. Categories of personal data processed

The Operator may process:

• surname, first name and patronymic;
  
  
• telephone number, email address and messenger contact details;
  
  
• organisation details, job title and taxpayer identification number (INN);
  
  
• IP address, cookies and technical information, including browser, device and geolocation;
  
  
• correspondence, enquiries and reviews.
  
  

The Operator does not process special categories of data, such as biometric or medical data, and does not use automated decision-making.

5. Processing principles and conditions

5.1. Processing follows the principles of lawfulness, data minimisation, accuracy and purpose limitation.

5.2. Processing operations must be documented to the extent required by the applicable purpose and legal obligations.

5.3. Personal data may be transferred to third parties only on a lawful basis and subject to confidentiality safeguards.

5.4. The data of Russian citizens is stored and processed on servers located in the Russian Federation, in accordance with the data localisation provisions of Article 18 of Federal Law No. 152-FZ.

5.5. The external analytics services are listed in section 8. Requests to Google may involve processing outside Russia. A cookie choice does not replace applicable requirements for the grounds, recipients and procedure for that processing.

6. Retention periods and destruction

6.1. Data is retained for no longer than necessary to achieve the purposes of processing.

6.2. Indicative retention periods are:

• applications and enquiries: 3 years;
  
  
• contractual and payment documents: 5 years;
  
  
• marketing data: 1 year after the relationship ends.
  
  

6.3. Once the applicable retention period has expired, the data must be destroyed or anonymised and the action documented as required.

7. Processors and delegated processing

7.1. To fulfil its obligations, the Operator may entrust personal data processing to third parties, including CRM platforms, hosting providers, payment systems and call centres.

7.2. Where processing is entrusted to a processor, the agreement or instruction must meet the applicable requirements, including confidentiality and security obligations.

7.3. The Operator is responsible for appropriate oversight of entrusted processing.

8. Cookies and optional analytics

Optional analytics starts only after a separate affirmative choice in Cookie preferences. Viewing or scrolling a page, closing a notice and sending an ordinary enquiry do not by themselves give that consent. Choosing Necessary only leaves the main pages and ordinary forms available.

With your separate analytics choice, this website uses Yandex Metrica (counter 88271607) and Google Analytics 4 (stream G-FFYKMP169R) to understand page visits and enquiries accepted by the website handler. The latter event records the handler result; it does not prove that a message reached an inbox or that a sale occurred.

The website sends a page address consisting only of its origin and path. It strips the query string and fragment and sends no referring-page address or page title. An enquiry event contains only the static page/form identifier and the event type. Names, telephone numbers, email addresses, messages, CVs, budgets and other form answers are not sent to these analytics events. The providers receive the network and device information needed to process their requests.

Google Analytics is loaded only after you allow analytics. Enhanced measurement, advertising personalisation and Google Signals are not enabled by this integration. It does not set up automatic form tracking, enhanced matching, customer-list imports, advertising audiences or CRM profiles. Google provides information about its processing at Google Privacy Policy. Requests to Google are external technical requests and may involve processing outside Russia; a cookie choice does not replace applicable requirements for such processing.

The privacy choice is stored under abs_privacy_choice for no more than 180 days and contains its version, categories and time, without contact details or enquiry text. Google analytics cookies set by this integration use the prefix absga4 and expire after no more than one year. Cookie lifetime does not determine the retention of data already held by a provider.

The persistent Cookie preferences control lets you change or withdraw your choice. Withdrawal stops new events under the website’s control; a network request already started may finish. Analytics cookies set by this integration are cleared where the website can access them. For data already transferred, contact the Operator about the applicable cessation and deletion procedure. The website cannot directly delete cookies belonging to another domain; browser settings can remove them.

9. Data subjects’ rights

A data subject has the right to:

• obtain information about the processing of their data;
  
  
• request that data be corrected, blocked or destroyed;
  
  
• withdraw consent;
  
  
• request the transfer or portability of data to another operator;
  
  
• permit or prohibit the dissemination of their data under Article 10.1 of Federal Law No. 152-FZ;
  
  
• challenge the Operator’s actions before Roskomnadzor or a court.
  
  

Information requested under Article 20(1) of Federal Law No. 152-FZ is provided within 10 working days. The period may be extended by up to five working days with the reasoned notice required by that provision.

10. Personal data security measures

10.1. The Operator must select organisational and technical safeguards appropriate to the applicable requirements, the processing and the relevant threats. These measures may include:

• differentiated employee access rights;
  
  
• use of certified security tools where required;
  
  
• encryption and backups;
  
  
• logging and access control;
  
  
• antivirus protection and firewalls;
  
  
• regular staff training.
  
  

10.2. Access must be restricted to authorised persons who have received appropriate instruction and are bound by applicable confidentiality obligations.

10.3. For an incident within Article 21(3.1) of Federal Law No. 152-FZ, the Operator must notify Roskomnadzor within 24 hours after identification and provide the internal investigation results within 72 hours. Other notifications are governed by the applicable requirements.

11. Withdrawing consent

11.1. A data subject may withdraw consent by sending a request to digital-abs@yandex.ru, by SMS or through messengers at +79952205590.

11.2. Processing stops within 3 business days after withdrawal is received, unless otherwise required by law.

11.3. Data is destroyed or anonymised and a record is prepared. A copy is provided to the data subject on request.

12. Cooperation with Roskomnadzor

12.1. The Operator must cooperate with Roskomnadzor where required and submit applicable notifications within the statutory periods.

12.2. The notification requirements and applicable exceptions in Article 22 of Federal Law No. 152-FZ must be assessed and fulfilled as required. This statement does not assert that a particular registration or notification has already been completed.

13. Person responsible for personal data processing

The person responsible for organising the processing and safeguarding of personal data at ABS-Marketing is

Igor Andreevich Shalubin

(contact: digital-abs@yandex.ru)

14. Changes to the Policy

14.1. The Operator may update the Policy by publishing a new version on the Website and indicating the date of the changes.

14.2. Material changes must be communicated in an appropriate manner. Changes do not retrospectively expand earlier consent; a new basis or choice is obtained where required.

14.3. A new version takes effect on its publication date unless the notice specifies otherwise.

15. Liability

15.1. The Operator is liable for breaches of personal data legislation within the limits established by the Russian Federation.

15.2. Employees and contractors responsible for a breach are subject to disciplinary and civil liability.

16. Contact details

Operator: Individual Entrepreneur Igor Andreevich Shalubin

INN 233602201699 OGRNIP 322237500103156

Website: abs-marketing.com

Telephone: +7 995 220-55-90 Email: digital-abs@yandex.ru

17. User consent

This Policy describes data processing and does not itself constitute consent to all listed operations. Optional analytics is chosen separately in Cookie preferences.