Privacy Policy
- A mandatory condition for the Operator’s activities is the observance of human and civil rights and freedoms during the processing of personal data, including the protection of the right to privacy, personal and family confidentiality.
- The Operator ensures the protection of processed personal data from unauthorized access and disclosure, unlawful use or loss, in accordance with the requirements of the Personal Data Law.
- The Operator has the right to make amendments to this Policy. The new version of the Policy enters into force upon approval by the Operator’s General Director, unless otherwise provided by the new version of the Policy.
- This Policy includes, among other things, provisions related to the processing of personal data using the Operator’s Website https://astarus.com/.
- The Constitution of the Russian Federation
- The Labour Code of the Russian Federation
- The Civil Code of the Russian Federation
- The Tax Code of the Russian Federation
- Federal Law No. 149‑FZ of 27 July 2006 "On Information, Information Technologies and Information Protection"
- Federal Law No. 27‑FZ of 01 April 1996 "On Individual (Personalized) Record‑Keeping in the System of Mandatory Pension Insurance"
- Federal Law No. 395‑1 of 02 December 1990 "On Banks and Banking Activities"
- Federal Law No. 402‑FZ of 06 December 2011 "On Accounting"
- The Operator’s Charter
- Agreements concluded between the Operator and personal data subjects
- Consents of personal data subjects to the processing of personal data
- Other federal laws that impose on the Operator the performance of functions, powers, and obligations.
Blocking of personal data — temporary suspension of personal data processing (except when processing is necessary to clarify personal data).
Website — a set of graphic and informational materials, as well as software and databases, ensuring their availability on the Internet at the network address https://astarus.com/.
Personal data information system — a set of personal data contained in databases, as well as information technologies and technical means that ensure their processing.
Depersonalization of personal data — actions that make it impossible, without additional information, to determine the affiliation of personal data to a specific User or another personal data subject.
Processing of personal data — any action (operation) or a set of actions (operations) performed with or without the use of automation tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.
Operator — a state body, municipal body, legal or natural person that independently or jointly with others organizes and/or carries out the processing of personal data, and determines the purposes of personal data processing, the composition of personal data to be processed, and the actions (operations) performed with personal data.
Personal data — any information relating directly or indirectly to an identified or identifiable User of the Website https://astarus.com/.
User — any visitor of the Website https://astarus.com/.
Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific group of persons.
Distribution of personal data — any actions aimed at disclosing personal data to an indefinite number of persons (transfer of personal data) or making personal data available to an unlimited number of persons, including publication in mass media, placement in information and telecommunication networks, or providing access to personal data in any other way.
Destruction of personal data — any actions resulting in the irreversible destruction of personal data, making it impossible to further restore the content of personal data in the personal data information system and/or resulting in the destruction of physical media containing personal data.
The processing of personal data permitted for distribution is carried out by the Operator only upon obtaining the data subject’s consent in accordance with the requirements of the legislation of the Russian Federation.
Using the Website, the Operator collects and stores only those personal data that are necessary to ensure feedback with the User, including for the purpose of further negotiations, entering into relations with the User, and subsequent performance of agreements and contracts, except in cases where mandatory storage of personal information for a period established by law is required.
If the Operator receives a notice from the User withdrawing their consent to the processing of personal data, the Website shall cease processing the User’s personal data within a period not exceeding 10 business days from the date of receipt. A notice of withdrawal of consent to personal data processing must be sent to the email address: info@astarus.ru, as well as by written communication to the Operator’s registered address.
The Website collects and processes user data (including cookies) using web‑analytics services: Yandex Metrica and top.mail.ru. User data collected through analytics services is used to gather information about User actions on the Website and to improve the quality of the Website and its content.
Cookies are used to improve the functionality of the Website, for example by saving visitor settings, and to enhance user experience by allowing the Website to remember visitors during their first or subsequent visits. In some cases, cookies are used to personalize Website content based on location.
The Operator uses cookies that are necessary for navigating the Website or enabling certain core functions. The Operator also uses cookies to improve Website performance and enhance user experience.
Personal data is processed with the consent of personal data subjects, as well as without such consent in cases provided for by the legislation of the Russian Federation.
When personal data is processed using the Operator’s Website, Users of the Website express their consent to such processing by filling in the fields of forms intended for entering personal data and/or by checking the corresponding box after reviewing the text of the consent to personal data processing under this Policy when submitting the form to the Operator.
The Operator performs mixed personal data processing, both automated and non‑automated.
Access to personal data is granted to those employees of the Operator who require it in connection with the performance of their official duties. The procedure for granting access to personal data includes familiarizing the employee with the provisions of the applicable legislation of the Russian Federation on personal data, including requirements for personal data protection, with the Operator’s internal documents regulating the processing and protection of personal data, as well as obtaining a written non‑disclosure undertaking from the employee. Upon termination of employment of an employee who has access to personal data, documents and other media containing personal data are transferred to the employee’s immediate supervisor, and the employee’s access to personal data information systems is terminated.
Transfer of personal data to third parties and dissemination of personal data is carried out with the consent of the personal data subject, unless otherwise provided by federal law.
The Operator may disseminate personal data of personal data subjects by publishing information on the Operator’s official website and other publicly accessible information resources.
Personal data of personal data subjects is published and made available to an unlimited number of persons only if the Operator has obtained prior written consent from the respective personal data subject for the dissemination of their personal data, executed in accordance with the requirements of the legislation of the Russian Federation.
A personal data subject has the right to determine the list of personal data permitted for dissemination, as well as to establish conditions and restrictions regarding the processing of such personal data by an unlimited number of persons in cases and in the manner provided for by the legislation of the Russian Federation.
Transfer of personal data to authorized state bodies and organizations is carried out in accordance with the requirements of the legislation of the Russian Federation.
The Operator performs collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, and destruction of personal data using a mixed method of personal data processing.
When collecting personal data, including via the information and telecommunication network Internet, the Operator ensures recording, systematization, accumulation, storage, clarification (updating, modification), and retrieval of personal data using databases located within the territory of the Russian Federation.
The Operator ensures that the content and scope of processed personal data correspond to the stated purposes of processing and, when necessary, takes measures to eliminate excessive personal data in relation to the stated purposes of processing.
Personal data shall be stored in a form that allows identifying the personal data subject no longer than required for the purposes of processing, and must be destroyed once the purposes of processing have been achieved or when the need to achieve such purposes is lost.
Storage and placement of documents containing personal data shall be carried out in compliance with the requirements of the applicable legislation of the Russian Federation.
Personal data of subjects may be obtained, further processed, and transferred for storage both on paper and in electronic form.
Personal data recorded on paper shall be stored in locked cabinets or locked premises with restricted access.
Personal data of subjects processed using automation tools for different purposes shall be stored in separate folders.
Processed personal data shall be subject to destruction upon achieving the purposes of processing or when the need to achieve such purposes is lost, unless otherwise provided by applicable legislation.
Persons granted access to the processing of personal data must undertake a confidentiality obligation regarding such information.
The Operator takes all necessary and sufficient legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination, as well as from any other unlawful actions involving personal data.
- The subject has the right to access their personal data and the following information:
- confirmation of the fact that their personal data is being processed by the Operator;
- legal grounds and purposes of personal data processing;
- purposes and methods of personal data processing applied by the Operator;
- the name and location of the Operator, as well as information about persons (except for the Operator’s employees) who have access to personal data or to whom personal data may be disclosed under a contract with the Operator or under federal law;
- the timeframes for personal data processing, including storage periods;
- the procedure for exercising the rights of the personal data subject as provided by law;
- the name or full name and address of the person processing personal data on behalf of the Operator, if such processing is or will be entrusted to that person;
- information on the methods used by the Operator to fulfill its obligations established by Article 18.1 of the Personal Data Law;
- other information provided for by the Personal Data Law or other federal laws.
2. The subject has the right to contact the Operator and send requests.
3. The subject has the right to appeal actions or omissions of the Operator.
4. The personal data subject has the right to request the Operator to clarify, block, or destroy their personal data if such data is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing, as well as to take measures provided by law to protect their rights.
Obligations of the Operator
- When processing personal data, the Operator must provide the personal data subject with the information required by the Personal Data Law.
- If, under the Personal Data Law, the provision of personal data and/or obtaining the subject’s consent is mandatory, the Operator must explain the legal consequences of refusing to provide personal data and/or refusing to give consent.
- If personal data was obtained not from the personal data subject, the Operator must provide the subject with the following information (except in cases provided for by the Personal Data Law):
- the name or full name and address of the Operator or its representative;
- the purpose of personal data processing and its legal basis;
- the list of personal data being processed;
- the intended users of the personal data;
- the rights of the personal data subject established by the Personal Data Law;
- the source of the personal data.
4. Publish or otherwise ensure unrestricted access to the document defining its personal data processing policy and to information on the implemented personal data protection requirements.
5. Take necessary legal, organizational, and technical measures (or ensure their adoption) to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination, as well as other unlawful actions involving personal data.
6. Respond to requests and inquiries from personal data subjects, their representatives, and the authorized body for the protection of personal data subjects’ rights within the procedure and timeframes established by the Personal Data Law.
7. Fulfill other obligations established by the Personal Data Law.
Before commencing activities involving the cross‑border transfer of personal data, the Operator shall submit a notification of its intention to carry out such cross‑border transfer to the authorized body responsible for the protection of personal data subjects’ rights, in cases where such notification is required by the legislation of the Russian Federation.
Purpose of personal data processing | Categories of personal data subjects | Category and list of personal data | List of actions performed during personal data processing | Methods of personal data processing | Period of personal data processing and storage |
1. Carrying out and promoting the Operator’s statutory activities related to the provision of services in the field of computer software development, consulting services in this field, and other related services (promotion of goods, works, and services on the market). | 1.Individuals: website visitors; the Operator’s counterparties, including sole proprietors and individuals applying the special tax regime "Tax on Professional Income" (self‑employed persons); contractors under civil‑law contracts; representatives and contact persons of counterparties that are legal entities. 2.Employees of the Operator. | 1.Other categories: last name, first name, patronymic; job title; contact details (phone number, email address). 2.Other categories: last name, first name, patronymic; job title; education; work experience; email address; phone number; photo and video image. | Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction. | Mixed processing of personal data with transmission via the Operator’s internal network and via the Internet. | Until the achievement of the purpose of processing, subject to compliance with the requirements, including the conditions for personal data processing established by the legislation of the Russian Federation, and/or in accordance with the provisions of the contract under which the personal data subject acts as a party, beneficiary, or guarantor, and/or the consent of the personal data subject to the processing of their personal data, unless otherwise established by the legislation of the Russian Federation. |
2. Personnel record‑keeping and regulation of employment relations with the Operator’s employees, including training, career advancement, provision of various types of benefits and compensation, ensuring employees’ personal safety, monitoring the quantity and quality of work performed, and safeguarding property. | 1. Employees of the Operator 2. Family members of the Operator’s employees. 3.Former employees of the Operator. | 1.Other categories: last name, first name, patronymic (including previous last name, first name, patronymic in case of changes); date of birth (day, month, year); gender; place of birth; passport details (series, number, issuing authority code, name of issuing authority, date of issue); details of an identity document valid outside the Russian Federation; information on citizenship; residential address (registration address, actual place of residence); profession; job title; information on education, professional retraining and/or advanced training (name of educational institution, year of graduation, qualification, specialty, details of the education document); information on foreign language proficiency; mobile phone number; email address; individual insurance account number (if available); details of the compulsory medical insurance policy (if available); taxpayer identification number (TIN); details of civil status registration documents; marital status; image (photograph, video recordings); family composition and information about family members (close relatives); information on employment history and details of the employment record book; information on military registration (reserve category, military rank, fitness category for military service, information on removal from military registration) and details of military registration documents; information contained in employment contracts, agreements and supplementary agreements; information on temporary disability, disability status, leave information; income data; bank account number and bank card number; information on employment history (length of service); information on business trips. 2.Other categories: last name, first name, patronymic; year of birth; date of birth; degree of kinship. 3. Other categories: last name, first name, patronymic (including previous last name, first name, patronymic in case of changes); date of birth (day, month, year); gender; place of birth; passport details (series, number, issuing authority code, name of issuing authority, date of issue); details of an identity document valid outside the Russian Federation; information on citizenship; residential address (registration address, actual place of residence); profession; job title; information on education, professional retraining and/or advanced training (name of educational institution, year of graduation, qualification, specialty, details of the education document); information on foreign language proficiency; mobile phone number; email address; individual insurance account number (if available); details of compulsory/voluntary medical insurance policies (if available); taxpayer identification number (TIN); details of civil status registration documents; marital status; image (photograph, video recordings); family composition and information about family members (close relatives); information on employment history and details of the employment record book; information on military registration (reserve category, military rank, fitness category for military service, information on temporary disability, information on removal from military registration) and details of military registration documents; information contained in employment contracts, agreements and supplementary agreements; information on temporary disability, disability status, leave information; income data; bank account number and bank card number; information on employment history (length of service); information on business trips. | Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction. | Mixed processing of personal data with transmission via the Operator’s internal network and via the Internet. | Until the achievement of the purpose of processing, subject to compliance with the requirements, including the conditions for personal data processing established by the legislation of the Russian Federation, and/or in accordance with the provisions of the contract under which the personal data subject acts as a party, beneficiary, or guarantor, and/or the consent of the personal data subject to the processing of their personal data, unless otherwise established by the legislation of the Russian Federation. |
3. Voluntary medical insurance | 1. Employees of the Operator. 2. Family members of the Operator’s employees. | 1. Other categories: last name, first name, patronymic; year of birth; date of birth; passport details; phone number; details of the voluntary medical insurance policy of the insured person (if available). 2. Other categories: last name, first name, patronymic; year of birth; date of birth; passport details; details of children’s birth certificates; phone number; details of the voluntary medical insurance policy of the insured person (if available). | Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction. | Mixed processing of personal data with transmission via the Operator’s internal network and via the Internet. | Until the achievement of the purpose of processing, subject to compliance with the requirements, including the conditions for personal data processing established by the legislation of the Russian Federation, and/or in accordance with the provisions of the contract under which the personal data subject acts as a party, beneficiary, or guarantor, and/or the consent of the personal data subject to the processing of their personal data, unless otherwise established by the legislation of the Russian Federation. |
4.Accounting and tax record‑keeping | 1. Employees of the Operator. 2. Former employees of the Operator. 3. Individuals: the Operator’s counterparties (including potential counterparties), including sole proprietors and individuals applying the special tax regime "Tax on Professional Income" (self‑employed persons); contractors under civil‑law contracts; representatives and contact persons of counterparties (including potential counterparties) that are legal entities. | 1. Other categories: last name, first name, patronymic (including previous last name, first name, patronymic in case of changes); date of birth (day, month, year); gender; place of birth; passport details (series, number, issuing authority code, name of issuing authority, date of issue); details of an identity document valid outside the Russian Federation; information on citizenship; residential address (registration address, actual place of residence); profession; job title; information on education, professional retraining and/or advanced training (name of educational institution, year of graduation, qualification, specialty, details of the education document); information on foreign language proficiency; mobile phone number; email address; individual insurance account number (if available); details of compulsory/voluntary medical insurance policies (if available); taxpayer identification number (TIN); details of civil status registration documents; marital status; image (photograph, video recordings); family composition and information about family members (close relatives); information on employment history and details of the employment record book; information on military registration (reserve category, military rank, fitness category for military service, information on removal from military registration) and details of military registration documents; information contained in employment contracts, agreements and supplementary agreements; information on temporary disability, disability status, leave information; income data; bank account number and bank card number; information on employment history (length of service); information on business trips. 2. Other categories: last name, first name, patronymic (including previous last name, first name, patronymic in case of changes); date of birth (day, month, year); gender; place of birth; passport details (series, number, issuing authority code, name of issuing authority, date of issue); details of an identity document valid outside the Russian Federation; information on citizenship; residential address (registration address, actual place of residence); profession; job title; information on education, professional retraining and/or advanced training (name of educational institution, year of graduation, qualification, specialty, details of the education document); information on foreign language proficiency; mobile phone number; email address; individual insurance account number (if available); details of compulsory/voluntary medical insurance policies (if available); taxpayer identification number (TIN); details of civil status registration documents; marital status; image (photograph, video recordings); family composition and information about family members (close relatives); information on employment history and details of the employment record book; information on military registration (reserve category, military rank, fitness category for military service, information on temporary disability, information on removal from military registration) and details of military registration documents; information contained in employment contracts, agreements and supplementary agreements; leave information; income data; bank account number and bank card number; information on employment history (length of service); information on business trips. 3. Other categories: last name, first name, patronymic; taxpayer identification number (TIN); individual insurance account number (SNILS); passport details (series, number, issuing authority, date of issue, authority code); residential address (registration address, actual place of residence); job title; contact details (phone number, email address); payment details; bank card number. | Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction. | Mixed processing of personal data with transmission via the Operator’s internal network and via the Internet. | Until the achievement of the purpose of processing, subject to compliance with the requirements, including the conditions for personal data processing established by the legislation of the Russian Federation, and/or in accordance with the provisions of the contract under which the personal data subject acts as a party, beneficiary, or guarantor, and/or the consent of the personal data subject to the processing of their personal data, unless otherwise established by the legislation of the Russian Federation. |
5. Recruitment and selection of candidates (job applicants) for employment with the Operator. | Candidates (job applicants) for employment with the Operator. | Other categories: last name, first name, patronymic (including previous last name, first name, patronymic in case of changes); date of birth (day, month, year); taxpayer identification number (TIN); city of residence; mobile phone number; email address; information on education, professional retraining and/or advanced training (name of educational institution, year of graduation, qualification, specialty); information on work experience; information on citizenship; marital status; gender; information on foreign language proficiency; profession; job title. | Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction. | Mixed processing of personal data with transmission via the Operator’s internal network and via the Internet. | Until the achievement of the purpose of processing, subject to compliance with the requirements, including the conditions for personal data processing established by the legislation of the Russian Federation, and/or in accordance with the provisions of the contract under which the personal data subject acts as a party, beneficiary, or guarantor, and/or the consent of the personal data subject to the processing of their personal data, unless otherwise established by the legislation of the Russian Federation. |
6.Preparation for the conclusion, conclusion, performance, and termination of contracts with counterparties within the scope of the Operator’s activities. | Individuals: the Operator’s counterparties (including potential counterparties), including sole proprietors and individuals applying the special tax regime ‘Tax on Professional Income’ (self‑employed persons); contractors under civil‑law contracts; representatives and contact persons of counterparties (including potential counterparties) that are legal entities. | Other categories: last name, first name, patronymic; taxpayer identification number (TIN); individual insurance account number (SNILS); date of birth; information on employment history; passport details (series, number, issuing authority, date of issue, authority code); residential address (registration address, actual place of residence); job title; contact details (phone number, email address); payment details. | Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction. | Mixed processing of personal data with transmission via the Operator’s internal network and via the Internet. | Until the achievement of the purpose of processing, subject to compliance with the requirements, including the conditions for personal data processing established by the legislation of the Russian Federation, and/or in accordance with the provisions of the contract under which the personal data subject acts as a party, beneficiary, or guarantor, and/or the consent of the personal data subject to the processing of their personal data, unless otherwise established by the legislation of the Russian Federation. |
7. Interaction with the Operator through the Operator’s websites, including collecting feedback, processing requests and inquiries, and collecting and analyzing statistical information. | Users of the Operator’s website. | Other categories: first name, last name, patronymic; age; phone number; email address; electronic user data (cookies; location information; name and version of the user’s browser or other software used to access the website; device type; browsing and navigation history; IP address; access time; address of the requested webpage; address of the previously visited webpage on the Internet). | Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction. | Mixed processing of personal data with transmission via the Operator’s internal network and via the Internet. | Until the achievement of the purpose of processing, subject to compliance with the requirements, including the conditions for personal data processing established by the legislation of the Russian Federation, and/or in accordance with the provisions of the contract under which the personal data subject acts as a party, beneficiary, or guarantor, and/or the consent of the personal data subject to the processing of their personal data, unless otherwise established by the legislation of the Russian Federation. |
8. Implementation of access control procedures within the Operator’s premises. | 1. Visitors of the Operator’s premises. 2. Employees of the Operator. | 1. Other categories: last name, first name, patronymic; place of work or study; number and date of issue of a service ID or another identity document. 2. Other categories: last name, first name, patronymic; job title; personal electronic identifier. | Collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction. | Mixed processing of personal data with transmission via the Operator’s internal network and via the Internet. | Until the achievement of the purpose of processing, subject to compliance with the requirements, including the conditions for personal data processing established by the legislation of the Russian Federation, and/or in accordance with the provisions of the contract under which the personal data subject acts as a party, beneficiary, or guarantor, and/or the consent of the personal data subject to the processing of their personal data, unless otherwise established by the legislation of the Russian Federation. |