Personal Data Processing Policy

1. General provisions

This Policy sets out the procedures and conditions for processing the personal data of users of the GOSTER website and web application (the Service).

The personal data operator is ИП Болтенкова Вероника Валерьевна, Taxpayer ID (INN) 781601881108, Sole Proprietor Registration Number (OGRNIP) 326470400069082, address: Ленинградская область, город Кингисепп, Большая Советская, 40, email: ceo.goster@yandex.ru (the Operator).

The Operator processes personal data in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”, other applicable laws of the Russian Federation and this Policy.

By using the Service, creating an account, sending a request or uploading a document, the User confirms that they have read this Policy.

2. Data processed

• email address and password when registering and signing in;
• technical data required for authentication and Service security, including a server session identifier in a secure HttpOnly cookie;
• name, job title, organisation name, contact details, document volume and task description provided in business enquiries;
• file name, technical attributes, content and metadata of the document uploaded for checking or formatting;
• payment data required to confirm payment and provide the service. The Operator does not receive or store bank card details;
• technical information required to operate and protect the Service, including request date and time, IP address, browser details and error messages.
• on public marketing pages, anonymised information about page views and interface interactions, unless the User has disabled analytics;

The Service is intended to process documents containing ordinary personal data, such as names in theses or business documents. Users must not upload documents containing special categories of personal data, biometric personal data, state secrets, or third-party data without a lawful basis for transferring it to the Operator.

3. Purposes of processing

• to register and maintain an account;
• to check and fully format a document according to the selected rules;
• to provide downloadable results and processing history;
• to receive and process business enquiries;
• to accept and confirm payments and issue fiscal receipts through YooKassa;
• to respond to enquiries and complaints;
• to maintain security, prevent abuse and keep the Service operational;
• to fulfil obligations under the laws of the Russian Federation.
• to assess interest in public materials and improve marketing page interfaces without recording form fields or transmitting their contents.

4. Legal grounds

The Operator processes personal data with the User’s consent, to enter into and perform the User Agreement, and where necessary to comply with the Operator’s legal obligations.

Consent to personal data processing is given separately from acceptance of the User Agreement, by selecting a checkbox that is not preselected in the Service interface. Consent is specific, informed and deliberate.

5. Processing operations and storage

The Operator may collect, record, organise, store, update, use, transfer as provided in this Policy, restrict and delete personal data.

Uploaded documents and processing results are stored in Cloud.ru within the Russian Federation for no longer than one month after processing, unless longer storage is required by law or selected by the User through an available Service feature.

Account data is stored until the User or Operator deletes the account, unless further retention is required by law. Payment records are retained for the periods required by accounting, tax and fiscal receipt legislation.

6. Disclosure to third parties

The Operator does not sell or provide personal data to third parties for their own marketing purposes.

• Cloud.ru, for hosting and storing data within the Russian Federation;
• YooKassa, for processing payments and issuing fiscal receipts;
• Yandex LLC (Yandex Metrica), for analytics on public marketing pages; the analytics counter is not enabled in workspaces, on authentication pages or on document pages;
• other contractors where their involvement is necessary to fulfil obligations to the User or legal requirements.

The Operator does not transfer personal data across national borders. If this changes, the Policy will be updated before such transfers begin.

7. User rights

The User may obtain information about the processing of their personal data, request its correction, restriction or deletion, withdraw consent, and challenge the Operator’s actions before Roskomnadzor or a court.

Send requests to ceo.goster@yandex.ru with the subject “Personal data”. The Operator may request information needed to verify the requester’s identity. A response will be provided within the time limits set by the laws of the Russian Federation.

Withdrawal of consent does not affect the lawfulness of prior processing. Following withdrawal, the Operator stops processing and deletes the data unless there is a lawful basis to continue processing it.

8. Security and browser storage

The Operator takes organisational and technical measures to protect data against unlawful or accidental access, modification, restriction, copying, distribution and destruction.

Authentication uses a secure HttpOnly cookie containing a server session identifier; JavaScript cannot read it. Users can end their session using the Sign out function.

Public marketing pages may use Yandex Metrica. It receives technical information about the browser, device, IP address, timing and page interactions. Session replay, form recording and visitor parameter transmission are disabled; form contents, contact details, organisation names and calculator inputs are not sent to Metrica.

Metrica may store its own cookies, while the Service stores the analytics opt-out preference and notice state in the browser’s localStorage. Analytics cookies are retained for no longer than 12 months or removed earlier through browser settings; the opt-out preference remains until deleted by the User. Further collection can be disabled in the website notice or by clearing cookies and localStorage in browser settings.

9. Changes to this Policy

The Operator may update this Policy when the Service, data processing methods or legislation change. The current version is always published in the Service with its last update date.