Privacy Policy

This English text is a translation provided for convenience. In the event of any discrepancy, the Russian version prevails.

This Personal Data Processing Policy (the “Policy”) has been developed in accordance with Federal Law No. 152-FZ of 27.07.2006 “On Personal Data”, Roskomnadzor Order No. 19 of 27.02.2024 and other regulations of the Russian Federation on personal data protection.

1. The personal data operator is the individual entrepreneur Mikael Vladimirovich Sagirov (TIN 616 706 129 306, OGRN 315 619 600 070 840, e-mail hello@sagirov.com, tel. +7 (863) 270-33-45).
2. The Operator’s most important goal and condition of its activity is to respect human and civil rights and freedoms when processing personal data, including the protection of the rights to privacy and to personal and family secrets.
3. This Policy applies to all information the Operator may receive about website visitors, prospective and existing clients, partners and job applicants when they make contact through:
   • the website https://sagirov.com (including the request form on the website’s pages);
   • the contact telephone number;
   • the e-mail address and other communication channels initiated by the user;
   • job applications sent as messages to the HR e-mail address.
4. When embedded video (Vimeo, Kinescope, etc.) and analytics (Yandex.Metrica) are used, technical data may be processed by these services in accordance with their rules; where necessary, such processing may include the cross-border transfer of technical data to the extent determined by the operator of the service concerned.

1. Automated processing of personal data means the processing of personal data using computer technology.
2. Blocking of personal data means the temporary suspension of personal data processing (except where processing is necessary to correct the personal data).
3. The Operator’s internet resources means the collection of graphic and information materials, computer programs and databases that make them available on the internet at https://sagirov.com, including the feedback and request forms on the website.
4. Personal data information system means the personal data contained in databases together with the information technologies and technical means that provide for their processing.
5. Depersonalization of personal data means actions as a result of which it is impossible, without additional information, to determine which specific data subject the personal data belong to.
6. Processing of personal data means any action (operation) or set of actions (operations) performed with or without automation, including the collection, recording, systematization, accumulation, storage, correction (updating, modification), retrieval, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion and destruction of personal data.
7. Operator means the individual entrepreneur Mikael Vladimirovich Sagirov (also “IE Sagirov M.V.”), who independently determines the purposes and composition of the personal data processed and the actions performed with them.
8. Personal data means any information relating directly or indirectly to an identified or identifiable personal data subject, including website visitors, clients, partners and job applicants.
9. Personal data authorized by the subject for dissemination means personal data to which the subject has given access to an unlimited number of persons by expressing separate consent under Article 10.1 of Law No. 152-FZ.
10. Personal data subject (User) means an individual who provides their personal data to the Operator through internet resources or by other means of communication.
11. Provision of personal data means actions aimed at disclosing personal data to a specific person or a specific group of persons.
12. Dissemination of personal data means actions aimed at disclosing personal data to an indefinite group of persons or giving access to them.
13. Cross-border transfer of personal data means the transfer of personal data to the territory of a foreign state, to a foreign individual or legal entity, or to a foreign state authority.
14. Destruction of personal data means actions as a result of which personal data are irreversibly destroyed and cannot be restored.

1. The Operator has the right to:
   • request from the personal data subject accurate information and/or documents necessary to achieve the purposes of processing;
   • if consent is withdrawn, continue processing personal data without the subject’s consent in the cases provided for by Articles 6 and 10.1 of Federal Law No. 152-FZ;
   • independently determine the organizational and technical measures sufficient to meet the requirements of Russian personal data legislation;
   • entrust the processing of personal data to another person under a contract, provided that this person guarantees confidentiality and security (Article 6, part 3 of Law No. 152-FZ);
   • amend this Policy by publishing a new version on the website at https://sagirov.com/en/privacy-policy.
2. The Operator is obliged to:
   • ensure that personal data are processed lawfully and fairly;
   • process only data that correspond to the stated purposes and not exceed the amount necessary to achieve them (the data minimization principle);
   • publish this Policy and provide unrestricted access to it;
   • provide the personal data subject, on request, with information about processing in the manner established by Article 14 of Law No. 152-FZ;
   • respond to requests from personal data subjects within 10 working days;
   • notify Roskomnadzor and personal data subjects of a security breach resulting in unauthorized access to personal data within 72 hours (Article 22, part 1.1 of Law No. 152-FZ, Roskomnadzor Order No. 19);
   • take legal, organizational and technical protective measures: separation of access rights, HTTPS channel encryption, backups as needed, and logging of access to the Operator’s work mail and other accounts;
   • keep records of requests from subjects and of internal events related to personal data processing;
   • appoint a person responsible for organizing personal data processing and instruct employees admitted to personal data;
   • stop processing or destroy personal data in the cases provided for by Russian legislation;
   • fulfil other obligations established by Federal Law No. 152-FZ and by-laws.

1. The personal data subject has the right to:
   1. receive from the Operator information about the processing of their personal data: its composition, source, purposes, legal grounds and retention periods, as well as information about transfers (Article 14 of Law No. 152-FZ); a response is sent within 10 working days;
   2. demand the correction, blocking or destruction of their personal data if they are incomplete, outdated, inaccurate, unlawfully obtained or not required for the stated purposes;
   3. withdraw consent to personal data processing at any time by sending a notice to hello@sagirov.com; the Operator stops processing (except in the cases provided for by Article 6 of Law No. 152-FZ) and, in the absence of legal grounds, destroys the data within 30 days;
   4. give prior consent to the use of personal data for the promotion of goods, works and services;
   5. appeal against the actions (or inaction) of the Operator to Roskomnadzor or in court;
   6. receive copies of any records containing their personal data, or a statement that no such data exist;
   7. demand the restriction of data processing if the subject has objected to the processing (Article 5, part 7, clause 1 of Law No. 152-FZ);
   8. exercise other rights provided for by the legislation of the Russian Federation.
2. The personal data subject is obliged to:
   1. provide the Operator with accurate and up-to-date information about themselves;
   2. notify the Operator in good time of any change (update) to their personal data.
3. A person who gives the Operator false information about themselves, or information about another subject without that subject’s consent, is liable in accordance with Russian legislation.

1. Lawfulness and fairness. Personal data are processed on the basis of the Constitution of the Russian Federation, Federal Law No. 152-FZ and other regulations, exclusively by lawful means and in good faith.
2. Purpose limitation. Processing is limited to achieving specific, predetermined and lawful purposes (business correspondence and client consulting, concluding contracts, recruitment and hiring). Processing incompatible with these purposes is not permitted.
3. Separation of processing purposes. Data collected for different purposes (website requests, correspondence with clients, job applications) are processed with separate access rights and taking into account the corresponding retention periods.
4. Data minimization. The Operator processes only the data objectively necessary to achieve the purposes of processing; excessive data are neither requested nor stored.
5. Relevance and accuracy. The Operator takes measures to keep data up to date; at the subject’s request, inaccurate or incomplete data are corrected or deleted within the period established by law.
6. Limited retention periods.
   • Client data are stored for 5 years after the end of the contract or until consent is withdrawn.
   • Data of applicants who were not hired are stored for up to 2 years if consent has been given, or are deleted (depersonalized) 30 days after consent is withdrawn or when this period expires.
   • Once the purposes have been achieved, data are destroyed or depersonalized within 30 days.
7. Localization of storage. The main information received through the website and the Operator’s work mail is processed and stored using infrastructure located in the Russian Federation (website hosting and mail services of the Operator’s choice). Certain technical data may be processed in accordance with the rules of the operators concerned when external services (analytics, video hosting) are used.
8. Integrity and confidentiality. When processing personal data, the Operator applies legal, organizational and technical protective measures (HTTPS channel, 2FA, separation of access rights, logging, backups) to prevent leakage, loss, unauthorized access, destruction or alteration of data.
9. Transparency and accountability. The Operator keeps records of operations with personal data and provides subjects, Roskomnadzor and other authorized bodies with confirmation of compliance with these principles.
10. Cross-border transfer and external services. Personal data entered into forms on the website are processed primarily on the infrastructure of the Operator and its authorized recipients in the Russian Federation. When external services are used (including Yandex.Metrica analytics and embedded video), technical data may be transferred to the operators of these services, including outside the Russian Federation, to the extent and on the terms determined by those services and applicable law.

1. Business correspondence and client consulting
   • responding to requests, preparing commercial proposals, supporting projects, communicating in messengers;
   • legal basis: Article 6, part 1, clause 5 of Law No. 152-FZ (performance of a contract or steps towards concluding one).
2. Concluding, performing and terminating civil-law contracts
   • drawing up work contracts, acceptance certificates, invoices and mutual settlements;
   • legal basis: the Civil Code of the Russian Federation, the Law “On Accounting”, the Tax Code of the Russian Federation.
3. Recruitment and hiring
   • receiving CVs, conducting interviews, building a talent pool, drawing up employment or civil-law contracts;
   • legal basis: the Labour Code of the Russian Federation, Article 6, part 1, clause 2 of Law No. 152-FZ; a written “Applicant’s consent to personal data processing”.
4. Newsletters
   • mass advertising mailings through the website are not currently carried out; should such processing arise, the Operator will request the subject’s separate consent.
5. Web analytics and improving the website
   • collecting depersonalized data from cookies, access times and URL transitions for statistics;
   • legal basis: Article 6, part 1, clause 1 of Law No. 152-FZ (the subject’s consent; information on cookies and Metrica is given in the cookie policy and the information banner).
6. Categories of personal data
   • name or full name, contact telephone number, e-mail address;
   • the text of the request and accompanying messages;
   • attachments to the request and materials sent to the HR address when applying for a job (including CVs);
   • technical data when using the website (cookies, IP address, etc.), when analytics and embedded video are used, to the extent determined by the services concerned.
7. Types of operations with personal data
   • collection, recording, systematization, accumulation, storage, correction (updating, modification);
   • retrieval, use, transfer (provision, access) within the Russian Federation;
   • depersonalization, blocking, deletion and destruction once the purposes have been achieved or consent has been withdrawn.

1. Personal data are processed with the consent of the personal data subject to the processing of their personal data.
2. The processing of personal data is necessary to achieve the purposes provided for by an international treaty of the Russian Federation or by law, and to perform the functions, powers and duties imposed on the operator by the legislation of the Russian Federation.
3. The processing of personal data is necessary for the administration of justice and the enforcement of a court decision or an act of another body or official subject to enforcement under the legislation of the Russian Federation on enforcement proceedings.
4. The processing of personal data is necessary for the performance of a contract to which the personal data subject is a party, beneficiary or guarantor, and for concluding a contract on the initiative of the personal data subject or a contract under which the personal data subject will be a beneficiary or guarantor.
5. The processing of personal data is necessary to exercise the rights and legitimate interests of the operator or third parties, or to achieve socially significant goals, provided that the rights and freedoms of the personal data subject are not violated.
6. Personal data are processed to which the personal data subject has given access to an unlimited number of persons, or which have been made accessible at the subject’s request (publicly available personal data).
7. Personal data are processed that are subject to publication or mandatory disclosure in accordance with federal law.

1. Data collection.
   • through forms on the website https://sagirov.com (HTTPS), followed by transfer to the Operator’s server and delivery to the e-mail address specified in the settings;
   • in the course of e-mail and telephone correspondence initiated by the user;
   • when applying for a job, by sending e-mails to the HR address.
2. Storage.
   Data are stored on the Operator’s facilities (including mailboxes and local and cloud storage of the Operator’s choice) using organizational and technical protective measures.
3. Technical and organizational protective measures.
   • end-to-end TLS 1.3 encryption;
   • two-factor authentication for employees;
   • separation of access rights to work accounts and data carriers;
   • logging of actions;
   • daily backups, with copies kept for 30 days;
   • an annual information security audit using the FSTEC “Basic level” checklist.
4. Transfer to third parties.
   Personal data may be transferred:
   • to state authorities, on a reasoned request (the Tax Code and the Code of Administrative Offences of the Russian Federation);
   • to contractors/processors under a personal data processing agreement containing confidentiality and security requirements;
   • to other persons, only with the subject’s separate written consent.
   Certain technical data may be processed by the operators of external services (analytics, video) when these are used, including outside the Russian Federation, in accordance with their documentation.
5. The right to correction and withdrawal.
   The subject may at any time send a request for correction or withdrawal of consent to hello@sagirov.com. The Operator corrects or deletes the data within 30 calendar days.
6. Retention periods.
   • data on completed contracts: 5 years (accounting archive);
   • requests/leads without a deal: up to 3 years or until consent is withdrawn;
   • questionnaires of applicants who were not hired: up to 2 years (if consent has been given);
   • employment documents of employees: in accordance with Order No. 558 of the Ministry of Culture;
   • web analytics (cookies): 14 months.
   When these periods expire, data are depersonalized or destroyed within 30 days.
7. Incident response.
   When a personal data security breach is identified, the Operator:
   1. blocks the unauthorized access;
   2. notifies Roskomnadzor and the subjects within 72 hours;
   3. eliminates the cause, restores the data and carries out an investigation;
   4. makes corrective changes to the information security policy.
8. Confidentiality.
   Only employees who have been instructed and have signed a confidentiality undertaking have access to personal data.
9. Termination of processing.
   Grounds: achievement of the purpose, expiry of the period, withdrawal of consent, a lawful demand from the subject or Roskomnadzor, identification of unlawful processing. Destruction is recorded in a certificate kept for 5 years.

1. The Operator performs the following actions: collection, recording, systematization, accumulation, storage, correction (updating, modification), retrieval, use, transfer (provision, access) within the Russian Federation, depersonalization, blocking, deletion and destruction of personal data.
2. Automated processing.
   • includes the processing of requests received through the website form and the recording of enquiries in the work mail;
   • depersonalized visit statistics using Yandex.Metrica;
   • data are transmitted over secure channels (HTTPS/TLS) between the user’s browser, the website server and mail services.
3. Segmentation.
   Targeted marketing mailings are not carried out without separate consent; grouping enquiries by project is not automated decision-making about the subject’s rights.
4. No decisions based solely on automated processing.
   The Operator does not make decisions that have legal consequences for the subject or affect their rights and legitimate interests solely on the basis of automated processing of personal data (Article 16 of Law No. 152-FZ).
5. Logging.
   The Operator keeps records of enquiries from subjects and, where possible, records key operations with personal data in accordance with internal regulations.

1. General provisions. Personal data entered by the user into forms on the website and sent to the Operator’s e-mail are processed primarily on infrastructure in the Russian Federation. When services with foreign infrastructure are used (including video embedded from external platforms), technical data may be transferred to the operators of these services in accordance with their rules.
2. Exceptions may be cases expressly provided for by Russian legislation (interstate requests from courts and law enforcement agencies). In such cases, data are transferred only on an official request and in the manner established by international treaties and the laws of the Russian Federation.
3. If regular cross-border transfer is planned in the future (for example, a project with a foreign client), the Operator:
   1. assesses in advance the level of personal data protection in the recipient country;
   2. obtains the recipient’s written guarantees of compliance with personal data confidentiality and security;
   3. notifies Roskomnadzor of the intention to carry out cross-border transfer by sending a separate notification in accordance with Article 12 of Federal Law No. 152-FZ (before the transfer begins).
4. Transfer is permitted only to countries that provide adequate protection of the rights of personal data subjects, or with the subject’s written consent (Article 12, part 4 of Law No. 152-FZ).

1. Only the Operator’s employees and authorized processors have access to personal data, where such access is necessary for the performance of their duties.
2. Each employee/processor signs a non-disclosure agreement (NDA) and is instructed in personal data protection.
3. The Operator and persons who have gained access to personal data are obliged not to disclose them to third parties and not to disseminate them without the subject’s consent, unless otherwise provided by federal law or a court decision.
4. When data are transferred to a contractor, a personal data processing agreement applies, containing confidentiality and security requirements in line with Article 6, part 3 of Law No. 152-FZ.
5. A breach of confidentiality is treated as an information security incident and is investigated in the manner established by the internal regulations of IE Sagirov M.V.

1. The subject may send a request or withdrawal of consent:
   • e-mail: hello@sagirov.com;
   • postal address: office 216, 2 Budennovsky Ave, Rostov-on-Don, 344000, Russia;
   • telephone: +7 (863) 270-33-45.
   A response is sent within 10 working days.
2. This Policy was approved by Order No. 1-PD of 26.05.2025 and takes effect on the date of publication on the website at https://sagirov.com/en/privacy-policy.
3. If material changes are made to the Policy (changes to the purposes, composition of data or processing methods), the Operator publishes the new version at least 10 calendar days before the changes take effect.
4. The Policy remains in force indefinitely until a new version is approved. The current version is available at https://sagirov.com/en/privacy-policy.