Revision dated July 23, 2026

1. General provisions

This Personal Data Processing Policy (hereinafter referred to as the Policy) determines the procedure and conditions for the processing of personal data by individual entrepreneur Anastasia Sergeevna Ayupova and measures to ensure the security of personal data.

The Policy was developed in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ dated 27.07.2006 “On Personal Data,” Federal Law No. 149-FZ dated 27.07.2006 “On Information, Information Technologies and Information Protection,” and other applicable laws and regulations of the Russian Federation.

The policy applies to the processing of site visitor data https://www.ayu.group/, users of forms and calculators, customers, potential customers, representatives of contractors, candidates, performers and contractors.

2. Information about the Operator

• Operator: Individual entrepreneur Ayupova Anastasia Sergeevna.
• Taxpayer Identification Number: 380404036805.
• OGRNIP: 318547600090170.
• Address: 630102, Novosibirsk region, Novosibirsk, st. Bolshevistskaya, 35, floor 3, office 316.
• Postal address: 630102, Novosibirsk, post office box 75.
• Email for questions regarding personal data: info@ayu.group.
• Phone: +7 (383) 375-74-77.

3. Categories of subjects and processed data

The operator may process the following categories of personal data depending on the method of interaction with the site:

• site visitors: IP address, date and time of visit, address of the requested page, referral source, information about the browser, operating system and device, technical identifiers, cookies;
• users of forms, calculators and customers: first name, last name and patronymic (if indicated), telephone number, email address or contact in MAX, city and region, organization and position, enquiry text, object and project parameters, information contained in the attached files, other data voluntarily provided by the user;
• candidates, performers and contractors: name, contact details, city, information about professional experience, qualifications, education, specialization and legal status, resume and portfolio data;
• representatives of counterparties: name, position, contact and contract information to the extent necessary for the conclusion and execution of the contract.

The operator does not request special categories of personal data and biometric personal data through publicly available forms. You should not include such information in free fields or attachments.

4. Purposes and legal grounds of processing

Advertising and information mailings are carried out only with separate prior consent. Consent obtained by submitting a regular site form does not in itself constitute consent to advertising.

5. Processing procedure and methods

The operator collects, records, systematizes, accumulates, stores, refines, extracts, uses, provides to authorized processors, blocks, deletes and destroys personal data using or without automation tools.

When collecting personal data via the Internet, the Operator ensures recording, systematization, accumulation, storage, clarification and retrieval of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except for cases provided for by law.

6. Recipients and services

For the operation of the site and the execution of requests, the Operator may entrust data processing to persons providing hosting, technical support, mail communications, CRM and form protection, subject to the grounds provided by law and contractual obligations for confidentiality and security.

The site uses:

• 1C-Bitrix - website management system and processing of applications on the Operator’s server;
• Beget - hosting the website and databases on a server infrastructure;
• Yandex SmartCaptcha - protection of forms from automatic requests; connects when using the form;
• ReviewLab (IP Verevkin Roman Andreevich, OGRNIP 319246800038032) - display of published reviews. The widget code automatically accesses the app.reviewlab.ru domain on the pages where the widget is located. The provider may obtain the IP address and technical information about the browser, device and connection. The supplier's processing conditions are given in ReviewLab policy;
• Yandex.Maps - displaying the location of offices on map pages; When connecting, the provider may receive technical information about the connection and browser.

Providers of external functional services can independently determine the composition and terms of processing of technical data in accordance with their documents and applicable legislation. The user may limit such connections by browser settings; in this case, the corresponding function of the site may not work correctly.

7. Cookie

The site uses technically necessary cookies for session operation, form security, saving technical settings and displaying notifications.

On pages with external functional services, their providers can obtain technical information and use cookies in accordance with their rules. The standard Aspro window is an informational notification: the “I Accept” button closes it and confirms that you have read it, but it is not a manager of individual cookie categories and does not manage external services.

Detailed information about cookie categories, services and management procedures is provided in Cookie Policy.

8. Processing and storage times

• requests that did not result in the conclusion of an agreement - until the purpose of processing is achieved, but no more than 12 months after the last interaction;
• data of candidates, performers and contractors in the absence of a contract - no more than 6 months, unless the subject has separately agreed on a longer period;
• contractual, accounting and tax documents - within the time limits established by the legislation of the Russian Federation;
• technical security logs - for the period necessary to protect the site, investigate incidents and protect the rights of the Operator;
• information confirming receipt of consent - during the processing period and the period necessary to protect the rights of the Operator.

The timing of data processing by external functional services is determined by their documents and applicable legislation. Once the objectives have been achieved, deadlines have expired or a justified request has been received, the data is deleted or destroyed unless further storage is required by law.

9. Rights of the subject of personal data

The subject has the right to receive information about the processing of his data, demand clarification, blocking or destruction, withdraw consent, demand termination of processing, and also appeal the actions of the Operator to Roskomnadzor or the court.

To exercise your rights, send a letter to info@ayu.group with the subject “Personal Data” or a written request to the Operator’s postal address. The appeal should include information that allows you to identify the applicant and find the relevant data.

10. Data protection

The operator applies the necessary legal, organizational and technical measures: access control, use of a secure connection, backup, control of data actions, software updates, contractual requirements for processors and incident response.

11. Cross-border transfer

The operator does not carry out cross-border transfer of personal data through the site without first fulfilling the requirements of Article 12 of Federal Law No. 152-FZ. Services that could result in such a transfer should not be connected until the necessary assessment and notification procedures have been completed.

12. Final provisions

The policy is valid until replaced by a new edition. The current version is always available at https://www.ayu.group/en/privacy/.

The Operator revises the Policy if legislation, data composition, purposes of processing or services used change.