Personal Data Processing Policy

Ekvator LLC · version dated 30 October 2026 · approved by Order No. 1-PD of the General Director of Ekvator LLC dated 29.10.2026

1. General provisions

1.1. This Policy sets out the procedure for processing and protecting personal data at Ekvator Limited Liability Company (hereinafter the “Controller”) and has been drawn up in accordance with Article 18.1(2) of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (hereinafter the “Law”).

1.2. Controller details:

Ekvator LLC, INN 2249010882, OGRN 1132208001848;
registered address: 127106, Moscow, Novovladykinsky Proyezd, 1, bldg. 3, apt. 173; office: 108811, Moscow, Kievskoye Shosse, 22nd km, Plot 4, Block E, Office 322;
website: https://ekviz.ru; email for personal data enquiries: zakaz@ekviz.ru; tel. +7 (993) 357-26-77.

1.3. This Policy applies to all personal data processed by the Controller: data of visitors to ekviz.ru and its subdomains (hereinafter the “Website”), clients and their representatives, contractors, employees and job applicants.

1.4. This Policy is publicly available at https://ekviz.ru/politika-konfidencialnosti. The version published on this page is in force; the revision date is shown at the top.

1.5. By submitting forms on the Website or contacting the Controller, the data subject confirms that they have read and understood this Policy.

2. Definitions

Personal data — any information relating directly or indirectly to an identified or identifiable natural person (data subject).
Data processing — any operation performed on personal data: collection, recording, systematisation, accumulation, storage, rectification, retrieval, use, transfer (provision, access), blocking, deletion, destruction.
Data Controller — Ekvator LLC, which independently organises data processing and determines its purposes, the scope of data and the operations performed on it.
Automated processing — processing using computing equipment; mixed — both with and without the use of automation tools.
Cookie — small text files that a website or connected service saves in a visitor's browser.

3. Principles and lawful bases

3.1. The Controller processes personal data lawfully and fairly, solely for specific, predetermined purposes and to the extent proportionate to those purposes, ensures data accuracy, retains data for no longer than required by the purposes of processing, and destroys it thereafter (Article 5 of the Law).

3.2. Lawful bases for processing (Article 6 of the Law):

consent of the data subject — for enquiries submitted via Website forms, for collecting visitor statistics (cookie notice) and for informational emails;
conclusion and performance of a contract to which the data subject is a party, beneficiary or guarantor;
compliance with statutory obligations imposed on the Operator by tax, accounting, employment, town planning and engineering survey legislation;
exercising the rights and legitimate interests of the Operator, provided this does not infringe the rights and freedoms of the data subject (business correspondence with representatives of organisations regarding cooperation).

3.3. The Controller does not process special categories of personal data (concerning health, beliefs, etc.) or biometric data, does not knowingly collect data of minors, and does not disseminate personal data or make it publicly available.

4. What data is processed, whose and for what purpose

Whose data	What data	Purpose	Subgrade	Retention period
Website visitors who submit a form (estimate request, quotation request)	Full name, job title, company name and INN, telephone number, email address, project and task details, contents of attached files (technical brief, site plan)	Reviewing the enquiry, calculating the cost of works, preparing and sending a quotation, and communicating with the applicant	Consent (checkbox in the form, text in appendix)	Until the purpose is achieved, but no longer than 1 year from the date of enquiry if no contract is concluded; if a contract is concluded — same as for clients
All Website visitors	IP address, cookies, browser and device information, pages viewed, referral source, on-page actions (click map, Session Replay — excluding form field contents)	Visitor statistics, advertising performance assessment, Website improvement	Consent: a cookie notice is displayed on your first visit; clicking 'OK' or continuing to use the Website after the notice constitutes consent. You may opt out by clicking 'Decline' or via your browser settings (section 6)	Yandex Metrica cookies — up to 1 year; anonymised statistics in Yandex Metrica — according to the service's terms
Individual clients; representatives and contact persons of corporate clients and counterparties	Full name, job title, telephone number, email address, place of work; for private individuals and sole traders — passport details, address, INN and bank details to the extent required for the contract	Contract execution, performance and administration, preparation of technical reports and submission for expert review, billing and claims management	Contract; accounting and tax legislation	Duration of the contract plus 5 years after its expiry (statutory retention period for primary accounting documents), followed by destruction
Representatives of organisations with which the Controller conducts or proposes business cooperation	Full name, job title, work telephone number and email address obtained through business correspondence or from public business sources	Business correspondence regarding cooperation; sending service information and proposals	Business correspondence — legitimate interests of the Operator; informational emails and proposals — consent. You may opt out at any time	Until opt-out or withdrawal of consent, but no longer than 3 years from the last contact
Employees and private individuals engaged under civil law contracts	Full name, date and place of birth, passport details, address, Taxpayer Identification Number (INN), Pension Insurance Number (SNILS), details of education, qualifications and length of service, military registration details (for employees), telephone number, email address, bank details, payroll records	HR and accounting records, performance of employment and civil-law contracts, payment of taxes and contributions, statutory reporting	Labour Code of the Russian Federation, Tax Code of the Russian Federation, accounting and individualised record-keeping legislation, contract	Duration of the contract; following its termination, HR records are retained for 50 years (75 years if created before 2003), and primary accounting documents for 5 years
Job applicants	Full name, telephone number, email address, details of education, work experience and qualifications from a CV	Candidate review	Consent	For the duration of the application review, and no longer than 30 days after a rejection decision; longer retention is subject to explicit consent to be included in our talent pool

For all purposes in the table: data category — other (general) personal data; processing method — mixed, with transmission over the Operator's internal network and the Internet; processing period equals the retention period; destruction procedure — Clause 5.6. Detailed rules for processing employee data are set out in the Operator's internal Regulation, with which employees have been familiarised.

5. How data is processed and where it is stored

5.1. Processing is mixed: both automated (the Controller’s work computers, email, cloud storage, the Website) and non-automated (paper contracts and other documents).

5.2. Data submitted via Website forms is sent by email to zakaz@ekviz.ru and is not stored on the Website server. Any attachment is used solely to send the email; the temporary uploaded file is deleted by the server once the request is complete.

5.3. All databases and storage facilities are located within the Russian Federation: the Website server is hosted by Beget LLC (St Petersburg); email and cloud storage are provided by Yandex 360 (Yandex LLC, Moscow); web analytics are provided by Yandex Metrica (Yandex LLC). No cross-border transfer of personal data takes place.

5.4. The Controller discloses personal data to third parties only:

to third parties that process data on behalf of the Operator or provide infrastructure under a contract with the Operator: Beget LLC (Website hosting), Yandex LLC (Yandex 360 email and cloud storage, Yandex Metrica web analytics);
to subcontractors (laboratories, specialist organisations) — to the extent necessary to perform the contract with the client, under contracts containing confidentiality clauses;
expert review bodies, state and municipal authorities — where required by law or contract (for example, when submitting documents on the client's behalf under a power of attorney);
upon lawful request by authorised bodies;
with the consent of the data subject.

The Data Controller does not sell personal data or pass it on for third-party marketing mailings.

5.5. Access to personal data is restricted to those employees of the Controller who need it to perform their duties and who have been familiarised with this Policy and bound by a confidentiality obligation.

5.6. Personal data is destroyed: once the purposes of processing have been achieved, upon expiry of the retention period, or upon withdrawal of consent — within 30 days, unless a different period is stipulated by contract or law; or if unlawful processing is identified following a request from the data subject or Roskomnadzor — within 7 working days (Article 21 of the Law). Emails and files are permanently deleted using the standard tools of the email service, cloud storage, Website server and work computers without the possibility of recovery, and paper records are shredded. Destruction is documented by a certificate of destruction and, for data processed in an information system, also by an extract from the event log (in accordance with Roskomnadzor Order No. 179 of 28 October 2022).

6.1. The Website itself does not set any cookies. Only your choice in the cookie banner (“Accept” or “Decline”) is saved in your browser’s local storage; this record does not identify anyone.

6.2. The Website uses Yandex Metrica (a service provided by Yandex LLC). It sets cookies _ym_uid, _ym_d, _ym_isad, _ym_visorc and collects the IP address, device and browser type, screen resolution, pages viewed, referral source, clicks and cursor movements (click map and Session Replay). The contents of form fields are not saved in Session Replay recordings. The data are used for visitor statistics and advertising evaluation. Yandex data processing terms: yandex.ru/legal/confidential.

6.3. You can opt out of analytics collection by:

by clicking the 'Decline' button in the banner at the bottom of the page — the tag will not load on this device and its cookies will be deleted;
in your browser settings: block cookies or delete site data;
via the Yandex Metrica opt-out add-on: yandex.ru/support/metrica/general/opt-out.html.

To change your selection, delete the site data in your browser — the notice will appear again. Refusal does not restrict the operation of the Website.

7. Rights of the data subject

7.1. The data subject has the right to:

obtain information regarding the processing of their personal data (Article 14 of the Law);
request the rectification, blocking or erasure of data if it is incomplete, outdated, inaccurate, unlawfully obtained or no longer needed for the stated purpose;
withdraw consent to processing;
opt out of informational emails;
lodge a complaint against the actions or omissions of the Operator with Roskomnadzor (rkn.gov.ru) or to a court.

7.2. Requests should be sent to zakaz@ekviz.ru or by post to the Operator's address. The Operator responds within 10 working days of receipt; this period may be extended by no more than 5 working days with a reasoned notice to the applicant. A request for information on data processing must contain the details required under Article 14(3) of the Law: details of the identity document of the data subject or their representative, information confirming the relationship with the Operator (date of enquiry, contract number, telephone number or email address provided in the form), and a signature. Passport details are not required to withdraw consent or unsubscribe from informational emails: an email from the address or stating the telephone number previously provided to the Operator is sufficient.

7.3. Withdrawal of consent does not affect processing carried out on the basis of a contract or statutory requirements.

7.4. The Controller rectifies confirmed inaccurate data within 7 working days. Upon a data subject’s request to cease processing (Article 21(5.1) of the Law), the Controller ceases processing within 10 working days (which may be extended by up to 5 working days with a reasoned notice), except where the Law permits processing to continue without consent.

8. Security measures

a person responsible for organising personal data processing has been appointed;
internal policies have been adopted: Personal Data Processing and Protection Policy, schedule of processed data and authorised personnel, data destruction procedure, incident response procedure;
the security level of information systems has been determined and security measures implemented in accordance with Russian Government Decree No. 1119 of 01.11.2012 and FSTEC of Russia Order No. 21 of 18.02.2013;
access is restricted: individual user accounts and passwords, two-factor authentication for email and cloud storage, antivirus protection, regular backups; connection to the Website is encrypted (HTTPS);
employees have been briefed on statutory requirements and internal policies; internal compliance audits are conducted at least once a year; an assessment of potential harm to data subjects has been carried out;
in the event of a personal data breach, the Operator notifies Roskomnadzor within the time limits set by Article 21 of the Law.

9. Final provisions

9.1. This Policy remains in force indefinitely until replaced by a new version.

9.2. Amendments are published on this page with the new revision date. If the scope of data collected on the Website or the purposes of its processing change, the Operator updates the Policy and the personal data processing notification with Roskomnadzor.

9.3. For enquiries regarding this Policy and personal data processing — zakaz@ekviz.ru.

Consent to personal data processing for website forms

By submitting a form on the website ekviz.ru (request for a cost estimate, request for a quotation), I freely, of my own will and in my own interest give my consent to Ekvator Limited Liability Company (INN 2249010882, OGRN 1132208001848; 127106, Moscow, Novovladykinsky Proyezd, 1, bldg. 3, apt. 173) for the processing of my personal data:

surname, first name, patronymic, job title, name and Taxpayer Identification Number (INN) of the organisation I represent;
telephone number, email address;
information about the project and task, as well as data contained in the files I have attached —

for the purpose of reviewing my enquiry, calculating the cost of works, preparing and sending a quotation, and contacting me using the details provided.

Consent is given for the collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access) to parties that support the operation of the Website and email under a contract with the Operator (Beget LLC — Website hosting; Yandex LLC — email and Yandex 360 cloud storage), blocking, deletion and destruction of personal data by mixed means (both automated and non-automated). Data is not transferred to other third parties except as required by law.

Consent remains valid until the processing purposes are achieved, but for no longer than 1 year from the date of enquiry, or until it is withdrawn. Consent may be withdrawn by emailing zakaz@ekviz.ru; following withdrawal, data are destroyed within 30 days unless retention is required by law or contract.

I confirm that the personal data provided in the form belong to me personally and are accurate, and that I have read the Personal Data Processing Policy.