Documents
Personal Data Policy
Version 2026-10-15 · effective from 2026-10-15
This is a convenience translation. The Russian version of this document is the legally binding one.
1. General provisions
1.1. This Policy sets out the procedure and conditions for the processing of personal data and the measures to ensure its security taken by the operator: Vladimir Vladimirovich Pavlunin, self-employed (Russian Federation), Taxpayer ID (INN) 732590641535, Ulyanovsk, Russia (the “Operator”).
1.2. This Policy has been developed in pursuance of Part 2 of Article 18.1 of Federal Law No. 152-FZ “On Personal Data” of 27 July 2006 (the “Law”) and applies to all personal data that the Operator receives from visitors to the website https://pavlunin.com (the “Site”).
1.3. This Policy is published on the Site and is accessible without restriction. Terms are used in the meanings established by the Law.
2. Categories of data subjects and data processed
2.1. The Operator processes data of the following categories of data subjects:
- visitors to the Site;
- visitors who have submitted a contact form or a form after completing the AI Engineering Assessment (“applicants”);
- visitors who have placed an order for a digital product (“buyers”).
2.2. Data of applicants that they provide in forms: name; company name; email address; phone number or Telegram username — optional; message text — optional; answers to the AI Engineering Assessment questions — if the form is submitted after completing it.
2.3. Before a form is submitted, Assessment answers are stored under a random identifier with no link to a specific individual and do not constitute personal data.
2.4. Data of visitors who have consented to web analytics: information about the visit collected by the Yandex Metrica service — browser identifier in a cookie, IP address, information about the browser, operating system and device, pages viewed, referral source, date and time of the visit.
2.5. Technical information without visitor identifiers: referral source (UTM tags, referring site) in a session cookie, depersonalized Site events (event name and technical parameters) — in accordance with the Cookie Policy.
2.6. Data of buyers: the email address provided when placing the order; order information — product, license, price, promo code, date, payment number and payment status. Bank card details and details of other means of payment are entered on the page of the Robokassa payment service and are not transferred to the Operator.
2.7. The Operator does not process special categories of personal data or biometric personal data and asks that they not be entered in the free-text fields of forms.
3. Purposes, legal grounds, periods
| Purpose | Data | Data subjects | Legal ground | Processing period |
|---|---|---|---|---|
| Responding to an inquiry, preparing an Assessment report, discussing cooperation | Clause 2.2 | applicants | consent of the data subject (Clause 1 of Part 1 of Article 6 of the Law), a separate document — Consent to Personal Data Processing | until the purpose is achieved, but no longer than 1095 days from receipt, or until consent is withdrawn |
| Conclusion and performance of a contract | Clause 2.2 | applicants who have become a party to a contract | contract (Clause 5 of Part 1 of Article 6 of the Law) | term of the contract and document retention periods under the legislation of the Russian Federation |
| Conclusion and performance of a contract under the Public Offer: providing the download link, updates, refunds | Clause 2.6 | buyers | contract (Clause 5 of Part 1 of Article 6 of the Law); consent of the data subject — Consent to Personal Data Processing | period of performance of the contract and document retention periods under the legislation of the Russian Federation |
| Statistical analysis of Site traffic | Clause 2.4 | visitors who have given consent | consent of the data subject (Clause 1 of Part 1 of Article 6 of the Law), a separate document — Consent to Data Processing by Yandex Metrica | 12 months from consent or until it is withdrawn |
The information under Clause 2.5 does not make it possible to identify the data subject and is used only in depersonalized statistics (about 13 months).
4. Procedure and conditions of processing
4.1. Actions with the data: collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, blocking, deletion, destruction. Method of processing — mixed: with and without the use of automated means.
4.2. The collection, recording, systematization, accumulation, storage and clarification of personal data of citizens of the Russian Federation are carried out using databases located in the territory of the Russian Federation (Part 5 of Article 18 of the Law). The Site's database is hosted on a server in the Russian Federation.
4.3. Database backups are encrypted by the Operator and stored in encrypted form in the Yandex Disk service (YANDEX LLC, Russian Federation). Only the Operator has the encryption key.
4.4. Processing on the Operator's instructions (Part 3 of Article 6 of the Law) is carried out by YANDEX LLC (Primary State Registration Number (OGRN) 1027700229193; 16 Lva Tolstogo Street, Moscow, 119021) — with respect to the data under Clause 2.4, in accordance with the terms of use of the Yandex Metrica service. A person processing data on the Operator's instructions is obliged to comply with the principles and rules of processing provided for by the Law and to ensure the confidentiality and security of the data.
4.5. The Operator does not transfer personal data to any other third parties, except in cases provided for by the legislation of the Russian Federation. Data from forms is not transferred to third-party CRMs, mailing or analytics services; the notifications of new applications received by the Operator do not contain personal data.
4.6. No cross-border transfer of personal data takes place.
4.7. The Operator does not make decisions that give rise to legal consequences for the data subject based solely on automated processing. Assessment results are an indicative self-diagnostic.
5. Termination of processing and destruction of data
5.1. The Operator stops processing and destroys personal data:
- upon achievement of the purpose of processing or upon expiry of the period specified in Section 3 — within 30 days;
- upon withdrawal of consent, if there are no other lawful grounds for processing — within 30 days from the date of receipt of the withdrawal (Part 5 of Article 21 of the Law);
- upon detection of unlawful processing, if it is impossible to ensure its lawfulness — within 10 business days from the date of detection (Part 3 of Article 21 of the Law).
5.2. Application data is destroyed automatically upon expiry of the retention period. Destruction is performed by deleting records from the database; the data disappears from backups during their scheduled rotation. Destruction at the request of the data subject is confirmed by the reply to the request.
5.3. Incomplete depersonalized Assessments are deleted after 30 days.
6. Rights of the personal data subject
6.1. The data subject has the right to:
- receive information about the processing of their personal data (Part 7 of Article 14 of the Law);
- demand clarification, blocking or destruction of the data if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose;
- withdraw consent to processing;
- appeal against actions or inaction of the Operator to Roskomnadzor (the Russian data protection authority) or in court.
6.2. A request can be sent via the request form or to vladimir@pavlunin.com. The request must make it possible to establish that it comes from the data subject (for example, it should be sent from the email address provided in the application).
6.3. The Operator responds to a request within 10 business days from the date of its receipt. This period may be extended by no more than 5 business days by sending a reasoned notice (Part 1 of Article 20 of the Law).
7. Security measures
7.1. The Operator takes the legal, organizational and technical measures provided for by Articles 18.1 and 19 of the Law, including:
- issuing this Policy and the consent documents, and recording in the log the version of the document that the data subject has read;
- connection encryption (TLS), encryption of backups;
- segregation and control of access to the administrative area, protection against password guessing;
- logging of security events without recording personal data in the application logs;
- minimization of the data collected and automatic deletion upon expiry of the periods.
7.2. Upon detection of an unlawful or accidental transfer (leak) of personal data, the Operator notifies Roskomnadzor of the incident within 24 hours and of the results of the internal investigation within 72 hours (Part 3.1 of Article 21 of the Law).
8. Final provisions
8.1. The Operator has the right to amend this Policy. The current version, with its version number and effective date, is always available on this page.
8.2. Matters not regulated by this Policy are resolved in accordance with the legislation of the Russian Federation.