Privacy Policy

1.1. This Privacy Policy (the "Policy") is the Operator's policy on personal data processing under Article 18.1 of Federal Law No. 152-FZ of 27 July 2006 "On Personal Data". It describes what data is processed on the website alexforge.org (the "Site"), for what purposes, how long it is kept, to whom it is disclosed and how you can manage it.

1.2. The Policy applies to the Site in all its language versions and to requests sent through the Site's forms, by e-mail and in the messengers whose addresses are listed on the Site.

1.3. By submitting a request through the Site you confirm that you have read this Policy and give your consent to personal data processing on the terms of a separate document — the Consent to Personal Data Processing published at https://alexforge.org/en/legal/consent/. Browsing the Site without submitting a form requires no consent.

1.4. Personal data is processed in accordance with Federal Law No. 152-FZ of 27 July 2006 "On Personal Data".

• Personal data — any information relating to a directly or indirectly identified natural person.
• Processing — any operation on data: collection, recording, storage, alteration, use, disclosure, deletion.
• Operator — the person who organises the processing; named in section 3.
• Visitor — anyone who opens the Site.
• Applicant — a person who sent a request for a task review or a callback request through the Site, or contacted the Operator through the contacts listed on the Site.
• Request — the information an Applicant entered into a form on the Site, together with the attached files and the subsequent correspondence about it.
• Client — an Applicant, or the person the Applicant represents, with whom the Operator has concluded a contract.

The personal data operator is the individual entrepreneur Alexander Sergeevich Seednov (INN 165052587213, OGRNIP 325508100468244), Bobrovo, Leninsky urban district, Moscow Region, Russia. The e-mail address for all personal data matters is hello@alexforge.org.

The Operator processes data personally: the Operator has no employees or contractors with access to personal data.

4.1. Request for a task review. In the form you provide:

• your name — how to address you;
• a way to reach you — a phone number, an e-mail address or a messenger username, at your choice;
• a description of the task — what the product is, who it is for, what it should do;
• optionally — what exactly you need, an indicative budget and timeline;
• optionally — up to five files of up to 10 MB each (a specification, mockups, documents, images) or a link to an existing product.

4.2. Callback request: your name, phone number and a convenient time to call.

4.3. Together with the request the Site automatically stores information that proves the fact and the terms of your consent and shows where the request came from: the date and time of submission, the version of the Consent in force at that moment, the IP address, the section of the Site the form was opened from, and the campaign tags in the page address (UTM parameters) if you came through a link that carried them.

4.4. Correspondence. Replies to the request and the further discussion of the task go through the contact you gave and are kept together with the request. If you write to hello@alexforge.org directly, the sender address and the content of the letter are processed.

4.5. Contract. If the discussion leads to a contract, the data needed to conclude, perform and account for it is processed in addition: the full name of the signatory, their position, the details of the contracting party including its tax number and bank details, and the content of the contract, acts, invoices and the correspondence about performance.

4.6. Web server logs. Like any website, on every page request the Site records in its log the IP address, the time of the request, the address of the requested page, the address of the page you came from and information about the browser. These records are needed for the Site to work and for the form to be protected from automated submissions; they are not used to identify a Visitor.

4.7. Files attached to a request are processed only to assess the task. Please do not attach documents containing personal data of third parties without their consent — if that data is not needed for the assessment, remove it from the file beforehand.

5.1. The Site sets no cookies and stores nothing in the browser storage. No visitor counters, advertising or social widgets are placed on the Site. Fonts, scripts and images are loaded from the Site's own server, not from third-party resources.

5.2. The Operator does not process special categories of personal data (health, beliefs and the like) or biometric data. No profiling is carried out, no automated decisions with legal consequences are made, no marketing mailings are sent.

5.3. The Operator does not ask for identity document details unless they are required to conclude a contract.

Data is processed in order to:

• reply to your request or call you back, clarify the task and prepare a proposal on the scope of work, timeline and cost;
• conclude and perform a contract if you decide to work with the Operator, and settle payments under it;
• fulfil the Operator's obligations under tax and accounting legislation;
• keep the Site operational and secure and protect its forms from automated submissions and abuse;
• respond to requests concerning personal data processing and prove that consent was given.

Data is not used for any other purpose, including advertising.

7.1. The request, the callback request, the correspondence and the information stored together with the request (clauses 4.1–4.4) are processed on the basis of your consent, expressed by ticking the box in the Site's form before submitting it, and for the purpose of concluding a contract on your initiative.

7.2. Contract data (clause 4.5) is processed to perform a contract to which you are a party or which you represent, and to fulfil the Operator's obligations under the Tax Code of the Russian Federation and accounting legislation.

7.3. Web server logs (clause 4.6) are processed in the Operator's legitimate interests — keeping the Site operational and secure — and are kept briefly (section 10).

8.1. The Operator does not sell personal data and does not disclose it for marketing purposes.

8.2. Data may be processed on the Operator's instructions by the following parties — only to the extent necessary to provide the respective service and without the right to use it for their own purposes:

• JSC "IOT" (FirstVDS hosting) — hosting of the Site, the request database and the attached files on a server located in Moscow;
• LLC "YANDEX" (Yandex 360) — the e-mail address hello@alexforge.org, through which the Operator receives notifications about requests and conducts correspondence, and the storage of contract documents. Servers in the Russian Federation.

8.3. Data may be disclosed to authorised state bodies in the cases expressly provided for by law.

8.4. No cross-border transfer of personal data takes place: the Site, the request database, the e-mail and the documents are hosted in the Russian Federation.

9.1. The Site contains a link to the Operator's Telegram. The Site sends nothing to Telegram: form data is not forwarded there and there are no bots. Following the link opens an ordinary personal chat.

9.2. If you write to the Operator in a messenger, the content of the conversation is also processed by the operator of that messenger under its own rules and on its own servers — that is your choice of a communication channel. For its part, the Operator does not move Clients' contracts, bank details or files into messengers: e-mail is used for those.

Data	Retention period
A request and the correspondence about it, if no contract was concluded	12 months from the last message about the request from either side
Files attached to a request	6 months from receipt
A callback request	3 months from receipt
The contract, acts, invoices and the correspondence about its performance	for the periods set by accounting and tax legislation — at least five years after the end of the year in which the contract was performed
Web server logs	14 days
Records of consent withdrawals and of replies to data subjects' requests	3 years — the limitation period

When the period expires, the data is deleted automatically or anonymised. Backups of the request database are overwritten in rotation, and deleted data disappears from them as the rotation proceeds.

11.1. The request database and the attached files are hosted on the Operator's server in Russia. Data between your browser and the Site travels over the secure HTTPS protocol.

11.2. Only the Operator has access to the request database and the mailbox; the access is protected by two-factor authentication. The server is accessed with SSH keys, runs a firewall, keeps access logs and is backed up.

11.3. The form accepts files of certain types and sizes only; every file is checked on upload.

11.4. Absolute protection cannot be guaranteed. The Operator applies organisational and technical measures proportionate to the nature of the data processed and, in the event of an incident, notifies the supervisory authority within the period set by law.

12.1. You have the right to:

• learn which of your data is processed, for what purposes and for how long;
• demand that the data be corrected, blocked or deleted;
• withdraw your consent to processing;
• appeal against the Operator's actions to the supervisory authority for personal data protection — Roskomnadzor — or to a court.

12.2. To exercise your rights, write to hello@alexforge.org from the address or contact you gave in the request, or in any other way that makes it possible to establish that the request comes from you. A reply is sent within 10 working days; where necessary the period may be extended by no more than 5 working days, of which you will be notified.

12.3. Withdrawal of consent does not affect the processing necessary to perform a contract already concluded and to fulfil the Operator's obligations under law.

13.1. To have your request, attached files and correspondence deleted earlier than the period in section 10, write to hello@alexforge.org. The data is deleted within 10 working days of receiving the request, and you will receive a confirmation.

13.2. Data under a concluded contract is deleted when the retention periods set by law expire; until then it is blocked and used only to fulfil the Operator's obligations.

The Site and its forms are intended for persons aged 18 and over and for representatives of organisations. The Operator does not knowingly collect data of minors. If you become aware that a minor's data has been sent through the Site, report it to hello@alexforge.org so that it can be deleted.

The Operator may update this Policy. The current version is always available at https://alexforge.org/en/legal/privacy/; the date of the last update is stated at the beginning of the document. Changes affecting the scope of data or the purposes of its processing are communicated to Applicants with whom correspondence is in progress through the contact they gave.