Privacy policy

Draft dated 8 November 2026, for marganets-cheki.ru.

1. Controller

Sole proprietor: ____________________
INN: ____________________
OGRNIP: ____________________
Registration authority and date: ____________________
Correspondence address: ____________________
Email: marganets_cheki@mail.ru
Support hours (Moscow): ____________________

The provider controls its own account and support data. Customer data uploaded by users is processed on their instructions.

2. Principles and legal bases

Processing is limited to specified lawful purposes and necessary proportionate data; accuracy and restricted access are maintained. Necessary contract processing relies on article 6 of Russian Law 152-FZ; statutory processing on the relevant duty; other processing on separate consent where required. Accepting service terms does not replace a separate data-processing consent.

3. Purposes and data

Accounts and security: email, user ID, protected password representation, verification status and technical session/request details for sign-in, recovery, access control and abuse prevention. Plaintext passwords are not stored.

Documents and history: directories, supplier organisation/farm/tax ID, recipients, addresses, phones, products, quantities, prices, currencies, dates, receipt numbers, preferences, saved orders and uploaded signature/stamp images, to perform the user's instructions. Images are not used for biometric identification. Business information may contain personal data, which is protected accordingly.

Access and payments: email, order identifiers, confirmations, access periods and accepted terms versions/times. The payment provider processes card details; our application does not receive them. Real financial records, when sales start, are retained for statutory periods independently of account deletion.

Support: contact information and voluntarily submitted messages, for replies, assistance, complaints and legal claims. The basis is contract performance, legal duty or separate consent where applicable.

4. Operations and recipients

Processing includes recording, organisation, storage, correction, retrieval, use, lawful disclosure, restriction and erasure. The primary application database and backups are hosted on a Russian Timeweb Cloud server. Localisation obligations apply to Russian citizens' data. Intentional cross-border transfer is not part of the application's operation; introducing it requires separate assessment and compliance.

Infrastructure uses Timeweb Cloud; service email uses Mail.ru SMTP; checkout uses Prodamus, currently testdemo1.payform.ru only. Only necessary email/message or account email/order/amount/access information is provided. Legal entities and addresses of processors must be completed from their contracts: ____________________. Staff access is limited to authorised confidential work.

5. Retention, deletion and protection

Data is kept only while necessary for its purpose and statutory duties. Trial expiry does not delete an account or history. Removing a history entry excludes it from display and totals and supports restoration. Request permanent data erasure from the controller. Request account closure or erasure by email. With no remaining lawful basis, processing stops and erasure occurs within applicable statutory deadlines, including thirty days where applicable. Backups cycle out within fourteen days after primary deletion; restoring a backup must not restore data that must remain erased.

Controls include HTTPS, password hashing, authentication, account isolation, backups and restricted administration. The controller must maintain organisational documents, incident procedures and access controls appropriate to processing. Absolute security is not promised.

6. Rights

Subjects can request processing information, access, correction, restriction or lawful erasure, withdraw consent and complain to the controller, Roskomnadzor or a court. Contact marganets_cheki@mail.ru or the controller address with sufficient identification and a description of the request. Passwords, CVV and excessive identification are not required.

Information requests are answered within statutory periods, normally ten working days, with a reasoned extension of up to five working days where permitted. Specific correction, restriction and deletion deadlines follow Law 152-FZ. Withdrawal does not end processing supported by a separate lawful basis.

7. Cookies and changes

Technical session/CSRF cookies and local language/theme preferences are used. Advertising trackers and optional analytics are not currently enabled. Registration and recovery messages are service emails, not advertising; marketing requires separate voluntary consent and is not enabled. Revised policies are dated; changes do not remove the need for a lawful basis or new consent. Business details, processor contracts, retention, Roskomnadzor notification and internal procedures must be completed before real launch.

Russian version