Personal Data Processing Policy
Revision dated 13.10.2026. Identifier: 2026-10-13-analytics-prepared-1.
Terms used in this document: INN — taxpayer identification number; OGRNIP — primary state registration number of an individual entrepreneur; OGRN — primary state registration number; OOO — limited liability company; IP address — the network address from which a request originates; cookies — small records that a website stores in the browser.
1. General provisions and information about the Controller
1.1. The personal data Controller is Individual Entrepreneur Andrei Viktorovich Svirin:
- INN: 772872317733;
- OGRNIP: 322774600176722;
- correspondence address: P.O. Box 15, Moscow, 117647;
- email for personal data matters: request@sql.moscow;
- website: https://sql.moscow/.
1.2. This Personal Data Processing Policy (hereinafter the Policy) defines the purposes, legal bases, categories, procedure and periods for personal data processing by Individual Entrepreneur Andrei Viktorovich Svirin (hereinafter the Controller) when using the website https://sql.moscow/ (hereinafter the Website), considering email inquiries and subsequent interaction concerning them. Inquiries through web forms are not accepted. If the parties enter into a separate contract, necessary processing is also governed by that contract and the law.
1.3. The Policy applies to the personal data of Website visitors, persons submitting inquiries (hereinafter Applicants), Clients, their representatives and other individuals whose personal data is lawfully processed by the Controller in connection with the provision of services. The Controller considers inquiries personally.
2. Legal grounds and principles of processing
2.1. Personal data is processed in accordance with Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (hereinafter the Personal Data Law) and other applicable regulatory legal acts of the Russian Federation. The terms "personal data", "personal data processing", "controller", "provision of personal data", "depersonalization of personal data" and "destruction of personal data" are used with the meanings established by Article 3 of that Law.
2.2. Personal data is processed on a lawful and fair basis and is limited to achieving specific, predetermined and lawful purposes. The content and volume of the personal data processed must correspond to the stated processing purposes; excessive processing and processing incompatible with the purposes of the initial collection are not permitted.
2.3. Visiting the Website, clicking the “Write an email” button and sending an ordinary email do not constitute universal consent to personal data processing. Consent, where necessary, is given separately and does not cover advertising mailings, advertising calls, publication of materials or optional analytics.
3. Purposes, scope of data and grounds for processing
3.1. Consideration of inquiries and feedback
3.1.1. Processing purposes: receiving and considering an inquiry, clarifying relevant circumstances, preparing and sending a reply, and subsequent interaction exclusively on that matter. For the Website, this means an initial review of the SQL task, clarification of requirements and preparation of a reply concerning query development, correction or optimization. The main inquiry channel is email at request@sql.moscow.
3.1.2. Categories of data: first name or surname, first name and patronymic to the extent provided by the applicant; email address; telephone number, if provided for a reply; email text; information about the task; the applicant's own personal data in necessary documents and attachments; information relevant to the matter in subsequent correspondence. Unrequested and excessive data is not used for other purposes.
3.1.3. The date and time of receipt, sender's address, subject, message identifier and necessary delivery service information are used to register the email and confirm the circumstances of the inquiry. Where separate consent is given, its content, date of receipt, method of expression and revision are retained. The Website does not create a web form submission record or attach information about visitor behavior to the email.
3.1.4. The legal basis is determined by the contents of the inquiry. Where the data subject takes the initiative to enter into a contract, and when performing a contract to which they are a party, beneficiary or guarantor, paragraph 5 of part 1 of Article 6 of the Personal Data Law applies, exclusively to the extent of necessary processing. For other inquiries, if there is no independent basis, separately obtained and confirmed consent applies under paragraph 1 of part 1 of Article 6. The contractual basis does not automatically cover any and all data in attachments or information about third parties.
Contact by email
To ask an ordinary question or enquire about a service, simply send an email. You do not need to prepare consent using a template in advance, send it in a separate email, or repeat your question.
For entering into a contract at the initiative of the data subject, and for performing a contract to which the data subject is a party or under which they are a beneficiary or guarantor, paragraph 5 of part 1 of Article 6 of Russian Federal Law No. 152-FZ on Personal Data applies, solely to the data necessary for that purpose.
For other ordinary enquiries sent voluntarily, paragraph 7 of part 1 of Article 6 of the same law applies only where minimal processing is necessary for the legitimate interest of considering the enquiry and replying, is consistent with its purpose and the sender's reasonable expectations, and does not infringe the sender's rights and freedoms. The necessity of processing, the scope of the data and the permitted retention period are assessed for the particular enquiry; this is not blanket permission to process correspondence for any purpose.
Only the contact details, message and related information necessary for the enquiry are used. This procedure does not automatically authorise the processing of any and all data in attachments, information about third parties, special categories of personal data or biometric data. Advertising, optional analytics and publication of materials require their own applicable legal grounds and any necessary separate consents.
If consent is genuinely required for particular processing, a separate request specifying the purpose, categories of data, processing operations and duration will be sent before that processing begins. You do not need to send consent on your own initiative with every ordinary email.
3.1.5. The reply is sent using the contact details specified by the applicant and agreed channels. A telephone number provided for contact on the matter is not used for advertising. During telephone clarification, only information necessary for the inquiry is processed; this description does not provide for audio recording of conversations.
3.1.6. Attachments are used for review, clarification of the circumstances and preparation of a reply. The initial submission does not authorize publication, advertising use or transmission of files to analytics. Submission rules are set out in the Terms for the Transfer and Use of Materials.
3.2. Conclusion and performance of a separate contract
3.2.1. If the parties enter into a contract, the processing purposes are agreeing its terms, performing obligations, exchanging documents and delivering the result. The scope of data is determined by the subject matter of the contract, rather than by the mere fact of an inquiry through the Website.
3.2.2. Categories of data: necessary surname, first name and patronymic, contact details, addresses, information about the task, documents and materials; information about a representative and their authority. Identification and payment information is requested only where necessary for a specific action. This provision does not mean that pro bono assistance is charged for or that payment is available on the Website.
3.2.3. Bases: paragraph 5 of part 1 of Article 6 for data of a party, beneficiary or guarantor and for the data subject's own initiative to enter into a contract; paragraph 2 of part 1 of Article 6 for obligations established by law. A separate applicable basis is determined for representatives and other persons.
3.3. Compliance with obligations established by law
3.3.1. The purposes are maintaining mandatory records where necessary and complying with lawful demands and requests from authorized bodies. The categories of data are limited by the contents of the relevant obligation. The basis is paragraph 2 of part 1 of Article 6 and the provisions establishing that obligation.
3.4. Considering claims and protecting rights
3.4.1. The purposes are considering claims, resolving disputes, protecting rights and legitimate interests, and confirming the contents of interactions and lawfulness of processing.
3.4.2. The data consists of documents and correspondence relating to a specific dispute, necessary information about interactions and a minimal consent record. The bases are statutory requirements and paragraph 7 of part 1 of Article 6, subject to respect for the data subject's rights and freedoms. This provision does not authorize indefinite retention of all inquiries and attachments.
3.5. Website operation and security
3.5.1. The purposes are delivering pages, detecting errors, and protecting against unlawful requests and technical abuse. The data consists of the IP address, request date and time, page address, result of processing the request and necessary browser information transmitted when connecting to the server.
3.5.2. The basis is paragraph 7 of part 1 of Article 6: ensuring the Website's operation and security while respecting the visitor's rights and freedoms. This information is not used on that basis for optional analytics or advertising.
3.6. Analytics and advertising
3.6.1. A separate choice interface for Yandex Metrica is ready on the Website. The counter is currently disabled. For the future active arrangements, the purpose is to assess traffic, page use and Website usability; the data consists of the IP address when the service receives a request, browser and visit identifiers, technical device information, page addresses without query parameters or fragments, and visit time and events. The basis is separate consent under paragraph 1 of part 1 of Article 6. Consent is requested again when the active revision is launched. An advertising subscription is not provided for; analytics consent does not include advertising or inquiries.
4. Processing procedure and data recipients
4.1. Within the purposes and legal bases, collection, recording, systematization, accumulation, storage, clarification, retrieval, use, transfer (provision, access), blocking, deletion and destruction are carried out. Processing takes place using automated means, without them or by a combination of methods.
4.2. The inquiry is considered personally by the Controller. Access is limited to the extent necessary for the relevant function; inquiry contents and attachments are not made publicly available.
4.3. Technical hosting and delivery of inquiries are provided by the hosting and email infrastructure used by the Controller. Where processing is entrusted to another party, the requirements of part 3 of Article 6 apply. Actual recipients are disclosed to the data subject in the manner established by law. The prepared analytics arrangements provide for YANDEX LLC, address: Moscow, 16 Lev Tolstoy Street; data is transmitted to this entity only after separate permission and actual activation of the counter. There is currently no transmission to Yandex Metrica. Engaging recipients does not relieve the Controller of obligations to the data subject.
4.4. Under a separate contract, materials may be provided to agreed participants in performance only to the extent necessary and on an applicable lawful basis. An inquiry does not in itself authorize forwarding materials to any specialist.
4.5. Data is provided to courts and state authorities in the cases and manner established by law. Contact details may not be transferred to third parties for their independent advertising without a separate lawful basis.
4.6. When collecting personal data of citizens of the Russian Federation, the Controller ensures compliance with part 5 of Article 18 of the Personal Data Law concerning the use of databases in the Russian Federation. The applicant's choice of email service does not remove the Controller's obligations.
4.7. Before starting a cross-border transfer, the Controller complies with Article 12 of the Personal Data Law, identifies recipients and provides necessary information to data subjects. Consent relating to an inquiry does not override localization and cross-border transfer requirements. Naming a Russian hosting provider does not in itself confirm the geography of all email systems.
5. Processing, retention and deletion periods
5.1. Ordinary inquiries that do not lead to a contract, including correspondence and attachments, are retained for the period necessary for consideration, but for no more than 90 calendar days from the last substantive message or agreed telephone clarification. If there was no follow-up, the period runs from receipt of the inquiry. Automatic replies and service notifications do not extend the period.
5.2. Data relating to a separate contract is retained for the duration of its performance and the statutory retention periods for the relevant documents. An independent basis is required thereafter. Mandatory retention of certain documents does not authorize retention of all excessive attachments.
5.3. Ordinary technical security logs are retained for no more than 30 calendar days. Information about a specific incident may be retained for longer only on an independent basis for the period necessary for investigation or protection of rights.
5.4. A minimal consent record may be retained on an independent basis for no more than three years from the date consent was expressed, if necessary to confirm the lawfulness of processing or protect rights, while respecting the data subject's rights and freedoms. Contents: name, if provided, contact details allowing the consent to be matched to the inquiry, the separate consent text, date and time, message identifier and document revision. The full original inquiry, the contents and names of its attachments, and excessive technical headers are not included. This limit does not imply an obligation to retain the record for all three years.
5.5. Information necessary for a specific claim or dispute is retained to the extent necessary on an independent basis. The reason and period for such retention are determined separately; ordinary correspondence does not automatically become an archive for protecting rights.
5.6. Upon achievement of the purpose, expiry of the period or cessation of the basis, data is deleted or destroyed unless an independent lawful basis requires continued retention. Upon achievement of the purpose, the periods under part 4 of Article 21 of the Personal Data Law apply. Deletion covers email, attachments, local copies, information systems used and copies held by processors. Retention in “Sent”, “Archive” and “Trash” folders counts as storage.
5.7. Upon withdrawal, processing based on consent ceases. If the data is no longer necessary and there is no other basis, destruction is ensured under part 5 of Article 21: as a general rule, within no more than 30 days from withdrawal, taking account of statutory exceptions.
5.8. When cessation of processing is requested, part 5.1 of Article 21 applies: as a general rule, processing ceases within no more than 10 working days; where statutory grounds exist, the period may be extended by no more than five working days with a reasoned notification. Lawful exceptions are considered separately.
5.9. If destruction within the statutory period is impossible, the data is blocked and destroyed under the procedure in part 6 of Article 21, as a general rule within no more than six months, unless a different period is established by federal law. The existence of a backup does not in itself authorize continued use of the data.
6. Cookies, saving choices and analytics
6.1. Cookies are small browser records; localStorage consists of records on the device without a built-in deletion deadline. Inquiry submission through a form remains disabled: the button opens an email application.
6.2. The necessary server-signed cookie site_analytics_choice_v2 (HttpOnly, Secure, SameSite=Lax) and localStorage entry site-analytics-choice-v2 are used to save and enforce the choice. The choice lasts for 180 days from saving. These records contain the choice, technical identifier, revision and expiry; they are not used to analyze behavior. An expired local entry is deleted at the next visit or expiry check on an open page. When the Website is closed, its code cannot remotely delete local storage.
6.3. The minimal server confirmation of the choice contains a random identifier, result, date and time, revision, document address and deletion deadline. It is not linked to contact details, emails or files. On an independent basis, where necessary to confirm the lawfulness of processing or protect rights, it may be retained for up to three years from the date of the choice. Expired records are deleted when the log is accessed and during daily maintenance; data is deleted earlier if the basis ceases to apply. Ordinary technical logs remain subject to the period in paragraph 5.3.
6.4. Yandex Metrica is currently disabled even if a visitor has chosen to allow it. Before the counter begins operating, an active revision is published and a new choice requested. Under the active arrangements, the counter starts only after positive server confirmation. No requests are sent to Metrica before permission, after refusal, in the event of a confirmation error, on legal pages or when the configuration is disabled. No noscript pixel is installed.
6.5. The choice may be changed or permission withdrawn using the “Analytics settings” button. Refusal immediately blocks the counter in the browser, including if saving on the server fails; the change also applies to other open tabs. First-party _ym records in cookies and localStorage are cleared upon stopping. This action does not automatically delete previously transmitted data in Yandex systems; requests concerning such data are sent to the Controller.
6.6. For the future active arrangements, the main Metrica cookies are: _ym_uid and _ym_d — up to one year; _ym_isad — 20 hours; _ym_metrika_enabled — 60 minutes; _ym_visorc_* — 30 minutes when Webvisor is enabled. Additional records and their purposes are listed in Yandex documentation. Cookie lifetimes do not determine data retention periods on the server.
6.7. The maximum retention period for analytics data attributable to a visitor or browser is up to three years from collection, with early termination upon achievement of the purpose or withdrawal if there is no other basis. The limit must be ensured through settings and actual deletion or anonymization; the banner code does not change retention in Yandex. Webvisor is disabled in the current configuration. If it is subsequently lawfully enabled, its recordings are limited to the service period of 15 days, including the current day.
6.8. The full terms are set out in the Analytics Consent and Cookie Policy. Deleting browser data does not delete emails or server logs. Technical refusal and analytics permission do not replace consent for other purposes.
7. Rights of the personal data subject
7.1. The personal data subject has the right to receive information about the processing of their personal data, to demand its correction, blocking or destruction in the cases provided for by law, to withdraw consent to processing, and to appeal against the Controller's actions or omissions in the manner prescribed by law.
7.2. Inquiries and requests from personal data subjects are accepted at the email address request@sql.moscow or at the correspondence address specified in section 1 of the Policy.
7.3. To identify the inquiry, it is recommended to specify the contact details used when submitting it, the approximate submission date and the inquiry identifier, if available. The Controller may request proportionate verification of the subject's identity or their representative's authority. Requests provided for in Article 14 of the Personal Data Law are subject to the requirements for request contents established by that Article.
7.4. Information about the processing of personal data is provided to the subject or their representative within 10 working days from the date of the inquiry or receipt of the request. Where grounds provided for by law exist, this period may be extended by no more than five working days, with a reasoned notification stating the reasons for the extension being sent.
7.5. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal was received. If the processing of certain data continues on an independent lawful basis, the Controller informs the subject of such processing and its legal basis.
7.6. The subject may seek protection of their rights from the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) or in court.
8. Processing of third parties' personal data
8.1. Documents and information provided by email must be limited to what is necessary to consider the inquiry. Before sending materials, it is recommended to remove or conceal excessive passport, financial, medical and other personal data.
8.2. The Applicant's consent applies to their personal data and does not constitute the consent of other persons whose personal data is contained in the submitted materials.
8.3. Where materials are sent by a representative or third parties' personal data is provided, the Controller checks that the relevant authority and legal basis for processing exist. In the absence of a sufficient legal basis, the data is not used to provide services and must be blocked and deleted within the periods provided for by law.
8.4. Special categories of personal data and biometric personal data are processed in compliance with Articles 10 and 11 of the Personal Data Law. Expressing consent through an ordinary email does not replace consent in written form where that form is expressly required by law.
8.5. When submitting files, the applicant ensures they were obtained lawfully and that the applicant has the right to submit them to the Controller for considering the inquiry. The following apply: Material Transfer and Use Terms. The email itself does not constitute consent by all persons in the documents and does not relieve the Controller of obligations. Where there is doubt, authority and the bases for submission are requested, access is restricted and use of the materials is suspended.
9. Personal data protection and final provisions
9.1. The Controller takes the necessary legal, organizational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful acts. Such measures include restricting access, ensuring secure data transmission, monitoring retention periods and monitoring compliance with requirements by engaged processors.
9.2. Personal data is destroyed by methods that preclude restoration of its contents in the information system and/or provide for the destruction of physical media containing personal data. The Controller ensures documentary confirmation of destruction in the cases and manner established by legislation.
9.3. The current version of the Policy is posted on the Website with its revision date. Changes to the Policy do not change the scope of consent previously given. If subsequent processing requires new consent, such consent is obtained separately before the relevant processing begins.