Personal Data Processing Policy
1. Terms and Definitions
A data subject’s personal data is any information that allows you to be identified, directly (for example, by your first name and surname) or indirectly (for example, by your phone number or email address), as a specific individual. When you fill in a form on our website, leave your phone number or write to us, you provide us with your personal data.
Processing of personal data is any action or series of actions that we perform with your data. This covers everything: from the moment you submit a request to us on the website (collection), to the moment we save your request in our internal system (recording and storage), contact you (use) and, in the future, if necessary, delete it (destruction).
Automated processing is the processing of your data using computer programs and systems that takes place without constant human intervention. For example, when you submit the “Consultation” form, its data is automatically entered into our CRM system (client management system). The use of cookies on the website is also part of automated processing.
The Operator’s Website is the totality of all web pages, graphic materials, program code and databases available on the Internet at: https://anvia.ru/ and its related addresses (subdomains). This is where you can learn about our services and submit a request.
Cookies are small pieces of data sent by a web server and stored on the user’s device, which the web client or web browser sends back to the web server in an HTTP request each time it attempts to open a page of the relevant website.
Web analytics is the automated collection and analysis of data on visitor behaviour on the Website for the purpose of improving its performance, carried out using technologies including cookies.
A CRM system (Customer Relationship Management system) is a special computer program that we use to organise the handling of requests. In it we store the history of our communication with you, your contact details and the details of your request, so that we can provide high-quality service and not lose important information.
The Operator is the organisation that independently determines for what purposes and in what manner your personal data will be processed. In our case, the Operator is Anvia Consulting Limited Liability Company (Anvia Consulting LLC, TIN (INN) 9 703 210 590, OGRN 1 257 700 192 177). We are responsible for the security and lawfulness of the processing of your data.
A personal data subject is an individual whose personal data we process. You become a data subject as soon as you submit a request on the website, call us or otherwise provide us with information about yourself.
Blocking of personal data is the temporary suspension of any processing of your data (for example, it cannot be changed, deleted or transferred), while the data itself is retained. We may apply blocking if we receive a relevant request from you or a request from an authorised government authority to conduct an inspection.
Destruction of personal data means actions as a result of which personal data is deleted from all our information systems (databases, CRM) with no possibility of recovery. We are obliged to destroy your data upon expiry of the established retention periods or upon your justified demand (withdrawal of consent), unless there are other lawful grounds for processing it.
Depersonalisation of personal data means special actions as a result of which we change your data in such a way that it is impossible to determine to whom it relates without the use of additional “key” information stored separately. For example, we may depersonalise data to produce statistical reports on website traffic.
Consent to the processing of personal data is your voluntary, specific, informed and unambiguous permission to process your personal data. On the website it is expressed by ticking the box next to the text “I agree with the privacy policy” before submitting the form. You may withdraw this consent at any time.
2. General Provisions
2.1. This Policy sets out the procedure for processing personal data at Anvia Consulting LLC in accordance with Federal Law No. 152-FZ “On Personal Data” of 27.07.2006 and other regulatory legal acts of the Russian Federation in the field of personal data.
2.2. The Policy applies to all personal data that the Operator receives from data subjects:
2.4. The Operator does not process special categories of personal data, biometric personal data or health-related data through the Website. Payment card data for paying for services is processed exclusively by payment operators (acquiring banks) via secure payment gateways in accordance with their privacy policies and PCI DSS security standards.
2.5. The Operator sets as its most important goal and condition of its activities the observance of the rights and freedoms of the individual and citizen in the processing of their personal data, including the protection of the rights to privacy and to personal and family secrets.
2.6. This Policy is subject to change in the event of amendments to the legislation of the Russian Federation or to the Operator’s internal procedures. A new version of the Policy comes into force from the moment it is published on the Website, unless otherwise provided by the new version of the Policy. The current version of the Policy is always available at: anvia.ru/privacy.
3. Purposes and Legal Grounds for Processing Personal Data
3.1. Processing of personal data received via the “Consultation” form on the Website.
3.2. Processing of clients’ personal data for the performance of a service agreement.
3.3. Processing of data for sending informational and advertising mailings.
3.4. Processing of data when using the Website (cookies and web analytics).
4. Transfer of Personal Data
4.1. The Operator ensures the confidentiality of personal data and does not disclose it to third parties, except in cases expressly provided for by this Policy and the legislation of the Russian Federation.
4.2. To achieve the stated purposes, the Operator may engage Processors and transfer personal data to counterparties. Agreements are concluded with all such persons obliging them to ensure the confidentiality and security of the personal data processed. Such persons include:
5. Rights of the Personal Data Subject
5.1. The personal data subject has the right to:
5.2. To exercise their rights, including to withdraw consent to the processing of personal data or to demand that processing cease, the data subject must send the Operator an official request:
6. Personal Data Protection Requirements
6.1. The Operator takes the necessary and sufficient legal, organisational and technical measures to protect data subjects’ personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination, and other unlawful actions in relation to personal data.
6.2. If an information security incident resulting in unlawful access to personal data is detected, the Operator shall notify the authorised body (Roskomnadzor) within 24 (twenty-four) hours of its detection, in the manner established by the legislation of the Russian Federation.
7. Operator Contact Information
Anvia Consulting Limited Liability Company
TIN (INN): 9 703 210 590
OGRN: 1 257 700 192 177
Registered address: (125 047, Moscow, intra-city territory, Tverskoy municipal district, Fadeeva Street, building 4A, premises ½)
Email for enquiries regarding personal data processing: info@anvia.ru
Website: anvia.ru
A data subject’s personal data is any information that allows you to be identified, directly (for example, by your first name and surname) or indirectly (for example, by your phone number or email address), as a specific individual. When you fill in a form on our website, leave your phone number or write to us, you provide us with your personal data.
Processing of personal data is any action or series of actions that we perform with your data. This covers everything: from the moment you submit a request to us on the website (collection), to the moment we save your request in our internal system (recording and storage), contact you (use) and, in the future, if necessary, delete it (destruction).
Automated processing is the processing of your data using computer programs and systems that takes place without constant human intervention. For example, when you submit the “Consultation” form, its data is automatically entered into our CRM system (client management system). The use of cookies on the website is also part of automated processing.
The Operator’s Website is the totality of all web pages, graphic materials, program code and databases available on the Internet at: https://anvia.ru/ and its related addresses (subdomains). This is where you can learn about our services and submit a request.
Cookies are small pieces of data sent by a web server and stored on the user’s device, which the web client or web browser sends back to the web server in an HTTP request each time it attempts to open a page of the relevant website.
Web analytics is the automated collection and analysis of data on visitor behaviour on the Website for the purpose of improving its performance, carried out using technologies including cookies.
A CRM system (Customer Relationship Management system) is a special computer program that we use to organise the handling of requests. In it we store the history of our communication with you, your contact details and the details of your request, so that we can provide high-quality service and not lose important information.
The Operator is the organisation that independently determines for what purposes and in what manner your personal data will be processed. In our case, the Operator is Anvia Consulting Limited Liability Company (Anvia Consulting LLC, TIN (INN) 9 703 210 590, OGRN 1 257 700 192 177). We are responsible for the security and lawfulness of the processing of your data.
A personal data subject is an individual whose personal data we process. You become a data subject as soon as you submit a request on the website, call us or otherwise provide us with information about yourself.
Blocking of personal data is the temporary suspension of any processing of your data (for example, it cannot be changed, deleted or transferred), while the data itself is retained. We may apply blocking if we receive a relevant request from you or a request from an authorised government authority to conduct an inspection.
Destruction of personal data means actions as a result of which personal data is deleted from all our information systems (databases, CRM) with no possibility of recovery. We are obliged to destroy your data upon expiry of the established retention periods or upon your justified demand (withdrawal of consent), unless there are other lawful grounds for processing it.
Depersonalisation of personal data means special actions as a result of which we change your data in such a way that it is impossible to determine to whom it relates without the use of additional “key” information stored separately. For example, we may depersonalise data to produce statistical reports on website traffic.
Consent to the processing of personal data is your voluntary, specific, informed and unambiguous permission to process your personal data. On the website it is expressed by ticking the box next to the text “I agree with the privacy policy” before submitting the form. You may withdraw this consent at any time.
2. General Provisions
2.1. This Policy sets out the procedure for processing personal data at Anvia Consulting LLC in accordance with Federal Law No. 152-FZ “On Personal Data” of 27.07.2006 and other regulatory legal acts of the Russian Federation in the field of personal data.
2.2. The Policy applies to all personal data that the Operator receives from data subjects:
- When visiting and using the Website, including when filling in the “Consultation” web form.
- When contacting us by the phone, email or messengers indicated on the Website.
- When concluding and performing agreements for the provision of consulting services.
2.4. The Operator does not process special categories of personal data, biometric personal data or health-related data through the Website. Payment card data for paying for services is processed exclusively by payment operators (acquiring banks) via secure payment gateways in accordance with their privacy policies and PCI DSS security standards.
2.5. The Operator sets as its most important goal and condition of its activities the observance of the rights and freedoms of the individual and citizen in the processing of their personal data, including the protection of the rights to privacy and to personal and family secrets.
2.6. This Policy is subject to change in the event of amendments to the legislation of the Russian Federation or to the Operator’s internal procedures. A new version of the Policy comes into force from the moment it is published on the Website, unless otherwise provided by the new version of the Policy. The current version of the Policy is always available at: anvia.ru/privacy.
3. Purposes and Legal Grounds for Processing Personal Data
3.1. Processing of personal data received via the “Consultation” form on the Website.
- Purpose: Processing the data subject’s incoming request, establishing contact with them, providing initial information about services, preparing and sending a commercial proposal, concluding a service agreement.
- Legal basis: The data subject’s consent to the processing of their personal data, expressed by ticking the relevant box in the web form before submitting it; as well as actions taken at the data subject’s request aimed at concluding an agreement. Data categories: Name, contact phone number, email address, free-text request (“Describe your question”).
- Retention period: If a service agreement is not concluded — 30 (thirty) calendar days from the end of communication on the request. If an agreement is concluded — the data is further processed under purpose 3.2.
3.2. Processing of clients’ personal data for the performance of a service agreement.
- Purpose: Conclusion, performance, amendment and termination of agreements for the provision of tax, legal and consulting services, including international tax planning, asset unblocking, currency regulation, marital and succession planning, services in the UAE and other services listed on the Website.
- Document management, interaction with government authorities (including, but not limited to, the Federal Tax Service of Russia), preparation of reporting, settlements.
- Legal basis: Performance of an agreement to which the personal data subject is a party (clause 5, part 1, article 6 of Federal Law No. 152-FZ).
- Data categories: Surname, first name, patronymic; passport details; certificate details (TIN (INN), SNILS); contact details (addresses, phone numbers, email); data required to provide a specific service (information on income, assets, accounts, ownership structures, family composition and other financial and legal information).
- Retention period: For the term of the agreement and 5 (five) years after its termination, in accordance with the requirements of article 29 of the Tax Code of the Russian Federation and other applicable legislation, for tax and accounting purposes and the settlement of possible claims.
3.3. Processing of data for sending informational and advertising mailings.
- Purpose: Informing clients and other interested persons about the Operator’s new services, legislative changes, special offers, promotions and events.
- Legal basis: The data subject’s explicit prior consent to receive mailings and to the processing of personal data for this purpose.
- Data categories: Name, email address, phone number.
- Retention period: Until the data subject withdraws consent to the mailings. Data used exclusively for this purpose is deleted within 30 (thirty) business days of receipt of the withdrawal.
3.4. Processing of data when using the Website (cookies and web analytics).
- Purpose: Ensuring the technical operability and security of the Website; analysing user behaviour on the Website to improve its functionality, usability and content; content personalisation.
- Legal basis: The Operator’s legitimate interest — for technically necessary cookies (session support, security). For analytics cookies — the data subject’s consent obtained via the pop-up window (banner) on the Website on the first visit.
- Data categories: Data collected automatically: IP address (in depersonalised form), browser and device data, history of visits to Website pages, referral sources, information contained in cookies.
- Retention period: For the lifetime of the cookies (as a rule, from one session to 12 months) or until consent is withdrawn via the browser settings or the Website interface.
4. Transfer of Personal Data
4.1. The Operator ensures the confidentiality of personal data and does not disclose it to third parties, except in cases expressly provided for by this Policy and the legislation of the Russian Federation.
4.2. To achieve the stated purposes, the Operator may engage Processors and transfer personal data to counterparties. Agreements are concluded with all such persons obliging them to ensure the confidentiality and security of the personal data processed. Such persons include:
- Hosting and cloud service providers — for hosting and operating the Website and related systems within the Russian Federation.
- Payment operators (acquiring banks) — for cashless settlements.
- Government authorities (the Federal Tax Service of Russia, Roskomnadzor, courts and law enforcement agencies) — exclusively upon their reasoned request, in the manner established by the legislation of the Russian Federation.
- Professional partners (notaries, foreign lawyers, trust companies, banks in the UAE and other jurisdictions) — only with the data subject’s separate, informed consent and exclusively to the extent and for the purposes necessary to perform a specific agreement.
5. Rights of the Personal Data Subject
5.1. The personal data subject has the right to:
- Receive information concerning the processing of their personal data.
- Demand the rectification, blocking or destruction of their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing. Withdraw their consent to the processing of personal data.
- Appeal against the actions or inaction of the Operator to the authorised body for the protection of the rights of personal data subjects (Roskomnadzor) or in court.
- Protection of their rights and legitimate interests, including compensation for damages and/or moral harm in court.
5.2. To exercise their rights, including to withdraw consent to the processing of personal data or to demand that processing cease, the data subject must send the Operator an official request:
- By email to: info@anvia.ru marked “Personal data subject request”.
- By post to the Operator’s registered address specified in section 7.
6. Personal Data Protection Requirements
6.1. The Operator takes the necessary and sufficient legal, organisational and technical measures to protect data subjects’ personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination, and other unlawful actions in relation to personal data.
6.2. If an information security incident resulting in unlawful access to personal data is detected, the Operator shall notify the authorised body (Roskomnadzor) within 24 (twenty-four) hours of its detection, in the manner established by the legislation of the Russian Federation.
7. Operator Contact Information
Anvia Consulting Limited Liability Company
TIN (INN): 9 703 210 590
OGRN: 1 257 700 192 177
Registered address: (125 047, Moscow, intra-city territory, Tverskoy municipal district, Fadeeva Street, building 4A, premises ½)
Email for enquiries regarding personal data processing: info@anvia.ru
Website: anvia.ru
