Personal Data Processing Policy

01General provisions

This Personal Data Processing Policy (the Policy) sets out the procedure for processing personal data and the measures taken to ensure its security at the Vhod Place yoga and ballet studio (the Operator) on the website vhod-place.ru and related resources.

The Policy has been developed in accordance with Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" and other regulatory acts of the Russian Federation in the field of personal data protection.

Use of the website constitutes the visitor's unconditional consent to this Policy and to the personal data processing terms set out herein. If you do not agree with these terms, please refrain from using the website.

02Operator and contacts

Operator: Sole Proprietor (Individual Entrepreneur) Margarita Aleksandrovna Tarasova

INN (taxpayer number): 771393428579

OGRN/OGRNIP (registration number): 325784700354589

Mailing address: 110 Nevsky Prospekt, St Petersburg, Russia

Physical address: 110 Nevsky Prospekt, St Petersburg, Russia

Email for personal data requests: privacy@vhod-place.ru

Phone: +7 921 422-81-43

Person responsible for organising personal data processing: Sole Proprietor (Individual Entrepreneur) Margarita Aleksandrovna Tarasova

03Terms and definitions

Personal data - any information relating directly or indirectly to an identified or identifiable natural person (the data subject).

Processing of personal data - any action or set of actions performed on personal data, with or without the use of automation, including collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer, anonymisation, blocking, deletion and destruction.

Data subject - the natural person whose personal data is processed. In the context of this Policy - visitors to the website, clients and prospective clients of the studio.

Cookies - small text files stored by the website in the visitor's browser to remember technical settings, the visitor's choices and statistics.

04What data we collect

Data the visitor provides voluntarily

When a visitor books a class, submits a request or contacts us:

• Name
• Mobile phone number
• Email address (if provided)
• The content of the message (where applicable)
• Information about preferences for class types, time and instructor

Data collected automatically

When the website is visited, the following may be collected automatically:

• IP address
• Browser type and version, operating system, device
• Referrer (the page from which the visit originated)
• Time of visit, sequence of pages viewed
• Cookie identifiers

The collection of automatic data is described in the "Cookies and analytics" section.

05Purposes of processing

The Operator processes personal data solely for the following purposes:

• Booking classes, individual practices, special events (including retreats) and providing the corresponding services
• Responding to the visitor's requests and enquiries
• Informing about the schedule, changes, promotions and special offers (only with explicit consent)
• Analysing traffic and improving the website
• Complying with the requirements of the legislation of the Russian Federation

Principle of minimisation: the Operator collects only the data necessary for the specific stated purpose.

06Legal grounds

The Operator processes personal data on the following legal grounds (Articles 6 and 9 of Federal Law No. 152-FZ):

• Consent of the data subject, expressed by an affirmative action when filling in a form or accepting this Policy
• Conclusion and performance of a service agreement (including via the online booking system)
• Fulfilment of obligations imposed on the Operator by the legislation of the Russian Federation

07Methods and retention periods

Personal data is processed both with the use of automation (on the side of the Operator and of processor services) and without it.

Personal data is stored:

• On the server that powers the website, located in the data centre of Selectel LLC in St Petersburg (Russian Federation)
• In the Yclients online booking system (servers in the Russian Federation)
• On the local working devices of the Operator's staff

Data retention periods:

• Clients' contact data - for the duration of the relationship with the client and 3 years after its termination, or until consent is withdrawn
• Data of website visitors who submitted a request without subsequently booking a class - 1 year from the date of last contact
• Cookies - in accordance with the settings specified when they were created; no longer than 1 year

Upon expiry of the retention period or withdrawal of consent, personal data is destroyed or anonymised.

08Cookies and analytics

The website uses cookies for correct operation and to improve the user experience. On the first visit, the visitor is offered a choice:

• "Accept" - all cookies, including statistical ones
• "Decline" - only technically necessary cookies, without which the website cannot operate correctly

Until one of the buttons in the cookie-consent banner is clicked, optional counters and trackers on the website are not activated.

Cookie categories:

• Technically necessary - ensure the basic operation of the website (remembering the cookie-consent choice, the state of modal windows). The website does not function without them. Consent is not required.
• Statistical - collect anonymised information about visitor behaviour (if used). As of the current version of the Policy, they are not used.
• Marketing - track users to display relevant advertising. As of the current version of the Policy, they are not used.

The visitor may change their cookie choice at any time by clearing the website's cookies in the browser settings or by visiting the page again.

09Transfer to third parties

The Operator does not transfer personal data to third parties, except in the following cases:

• Yclients online booking service (Yclients LLC, INN 7705935687) - data processor for the purpose of managing bookings. Servers are located in the Russian Federation. The processing terms are governed by the Yclients user agreement.
• Selectel LLC (INN 7842393933) - website hosting. Servers are located in the Russian Federation (St Petersburg). No cross-border data transfer takes place.
• Payment system operators - in the case of online payment for services, in order to process the payment.
• State authorities - in cases expressly provided for by the legislation of the Russian Federation.

The Operator requires all processors to maintain confidentiality and ensure the security of personal data.

10Cross-border transfer

Cross-border transfer of personal data does not take place. All personal data is processed and stored on servers located within the territory of the Russian Federation (hosting - Selectel LLC, St Petersburg; online booking - Yclients, servers in the Russian Federation).

If in the future the Operator begins to use services that involve transferring data outside the Russian Federation, the corresponding amendments will be made to this Policy, and cross-border transfer will be carried out in compliance with the requirements of Chapter 12 of the Federal Law "On Personal Data".

11Protection measures

The Operator takes the necessary legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, distribution, and other unlawful actions:

• A person responsible for organising personal data processing has been appointed
• Up-to-date information protection measures are applied (TLS encryption, restricted access to data)
• Access to data is granted only to the Operator's staff who need it to perform their duties
• Up-to-date password policies and two-factor authentication are used for access to administrative interfaces
• Processing risks are assessed regularly

12Rights of the data subject

In accordance with Federal Law No. 152-FZ, the data subject has the right to:

• Obtain information about the processing of their personal data, including the purposes, methods, periods and other details
• Demand the updating, blocking or destruction of their personal data if it is incomplete, outdated, inaccurate or excessive
• Withdraw previously given consent to the processing of personal data
• Appeal the Operator's actions to Roskomnadzor or in court
• Protect their rights and legitimate interests

To exercise these rights, the data subject must send a written request to privacy@vhod-place.ru. The Operator responds within a period not exceeding 10 business days from the date of receipt of the request.

13How to contact us

For all questions related to the processing of personal data:

• Email: privacy@vhod-place.ru
• Phone: +7 921 422-81-43
• Address for written correspondence: 110 Nevsky Prospekt, St Petersburg, Russia

Supervisory authority: Roskomnadzor (Federal Service for Supervision of Communications, Information Technology and Mass Media). Website: rkn.gov.ru.

14Changes to the policy

The Operator reserves the right to make changes to this Policy. The current version is published at vhod-place.ru/en/privacy. Changes take effect upon publication, unless otherwise provided by the new version of the Policy.

In the event of material changes (for example, changes to the purposes of processing or to the categories of data transferred), the Operator notifies the data subjects whose contacts are known to it and requests cookie consent again via the banner.