Personal Data Processing & Privacy Policy

1. General provisions

This Policy describes how personal data of visitors to verno-dev.com (the "Site") and of persons submitting the contact form is processed and protected. It is issued in accordance with Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" ("152-FZ"), including cl. 2 p. 1 art. 18.1.

The Policy is a public informational document. Reading it does not require any act of "acceptance"; consent to personal data processing when submitting the contact form is given via a separate document — the Data Processing Consent.

2. Operator details

Personal data operator: Georgy Igorevich Pavlov-Kosov, an individual providing web development services (the "Operator"). Location: Republic of Armenia. Email for personal data matters: pafuluofu@atomicmail.io.

3. Terms

Terms used in this Policy ("personal data", "processing", "operator", "provision", "cross-border transfer" and others) have the meanings defined in art. 3 of 152-FZ.

4. Data subjects

Site visitors; persons who submitted an inquiry via the contact form; persons whose personal data is contained in files voluntarily uploaded by the sender (see section 10).

5. Personal data processed

Contact form data (provided voluntarily): name; email address; message text; files voluntarily uploaded by the user (up to 5 files, 8 MB each), as well as any personal data such files or their names may contain.

Technical inquiry data: an attribution string composed by the user's browser — the page the inquiry was sent from, ad campaign tags (UTM) if present and, only where the user consented to analytics cookies, the Yandex Metrica counter identifier (ClientID); the time elapsed between opening the form and submitting it (used solely for spam protection).

Web analytics data (only with consent to analytics cookies, see section 13): data collected by Yandex Metrica — pages visited, on-site actions, device, browser, approximate region, including session recordings (Webvisor). Contact form fields are excluded from Webvisor recording; text typed into them is not transmitted to Metrica.

Hosting infrastructure logs: IP address, request date/time, URL, user-agent and other standard web server log records (see section 14).

The Operator does not purposefully request or collect special categories of personal data (art. 10 of 152-FZ), biometric data (art. 11) or third parties' data. See section 10.

6. Purposes of processing

Receiving and reviewing a visitor's inquiry; contacting the visitor and replying. Discussing and evaluating a potential project / business engagement, including exchanging working materials. Technical operation and security of the Site, including spam and abuse protection. Web analytics of Site traffic (only with consent to analytics cookies).

Processing for marketing purposes (mailings, advertising), profiling, and decisions based solely on automated processing (art. 16 of 152-FZ) are not carried out.

7. Legal bases

For the inquiry and project purposes — the data subject's consent (cl. 1 p. 1 art. 6, art. 9 of 152-FZ) given via the separate Data Processing Consent, and, to the extent necessary for concluding a contract at the subject's initiative, cl. 5 p. 1 art. 6 of 152-FZ. For Site security — cl. 7 p. 1 art. 6 of 152-FZ (legitimate interests of the Operator: keeping the Site operational and secure). For web analytics — the consent expressed via the cookie banner (section 13).

8. How processing is performed

Processing is mixed: receiving and forwarding the inquiry is automated by the Site's software; subsequent review and correspondence are performed by the Operator manually.

Operations performed: collection, recording, use, transfer (provision to the Operator via the Telegram service, see section 11), storage (within the limits described in sections 11–12 and 18), clarification (in follow-up correspondence), blocking, deletion, destruction. The Operator does not systematize or accumulate data in a separate client database or CRM.

The Operator does not maintain a separate database of contact form submissions. Once submitted, the data is automatically delivered to the Operator via the Telegram Bot API; the delivered messages and files are stored on the Telegram service's infrastructure and remain available to the Operator in his Telegram chat (section 11).

9. Contact form

The Name, Email and Message fields are required; attaching files is voluntary.

The form can only be submitted after ticking a separate personal data consent checkbox. The checkbox is not pre-ticked; the Consent text is available via the link next to it and on the Data Processing Consent page.

Spam protection uses a hidden technical field and completion-time measurement; inquiries recognized as spam are not forwarded to the Operator and are not stored.

10. Uploaded files

Files are transferred and processed together with the message text (sections 8, 11, 12). Personal data contained in files is processed for the same purposes and on the same bases.

Please do not upload documents containing special categories of personal data (health, beliefs, etc.), biometric data, or third parties' personal data unless it is genuinely required for your inquiry and you have a lawful basis to share it.

If such data is nevertheless received and is not required, the Operator deletes the relevant messages and files on his own initiative or at the subject's request (sections 19–20).

11. Telegram and message delivery via Telegram Bot API

Inquiries are delivered to the Operator through the Telegram Bot API: the Site's server automatically sends the message text and attached files to the Operator's chat in the Telegram service (Telegram Messenger Inc.).

Telegram processes the delivered messages and files as an independent information service under its own privacy policy (https://telegram.org/privacy). Telegram's infrastructure is located outside the Russian Federation; specific storage locations are determined by the Telegram service.

Delivery of data to Telegram's infrastructure constitutes a cross-border transfer of personal data (section 16). Only the Operator has access to the Telegram chat receiving the inquiries.

12. Hosting and technical infrastructure

The Site is hosted on Hostinger infrastructure; the contact form's server side (receiving and forwarding inquiries) runs on the same hosting. Server region: Germany, European Union (outside the Russian Federation). When forwarding attachments, the server briefly writes each file to temporary storage and deletes it immediately after delivery to Telegram.

The hosting provider's content delivery network and bot protection may show individual visitors a verification page using Google reCAPTCHA. Site fonts are loaded from Google Fonts servers (fonts.googleapis.com, fonts.gstatic.com); when fonts load, Google receives standard technical request data (IP address, user-agent).

13. Cookies

The Site sets no cookies of its own for its operation; theme and language preferences and your cookie choice are stored locally in your browser (localStorage) and are not sent to any server.

Yandex Metrica analytics cookies (including _ym_uid and similar identifiers) are set only after you click "Accept all" in the cookie banner. If you choose "Essential only", the Yandex Metrica counter does not load and no analytics cookies are set. Until a choice is made, analytics does not start.

Yandex Metrica is operated by YANDEX LLC (Russian Federation); service terms: https://yandex.ru/legal/metrica_termsofuse/.

14. Technical data and logs

The web server and hosting infrastructure automatically keep standard technical logs (IP address, request date/time, URL, user-agent, response code), used solely to keep the Site operational and secure and not combined with inquiry data. Submitted form contents are not written to standard access logs; error logs may record technical details of failed requests. Log retention periods are defined by the hosting provider.

15. Transfers to third parties

Personal data is not sold or shared with third parties for their own purposes. Services actually involved in processing: Telegram (section 11), Hostinger (section 12), Yandex Metrica (section 13, only with consent), Google Fonts and Google reCAPTCHA (section 12, technical browser requests). No other services are used to process inquiries. Data may be disclosed to authorized state bodies in cases directly required by applicable law.

16. Cross-border transfer

Because the Site's server infrastructure and the Telegram service are located outside the Russian Federation, submitting an inquiry entails a cross-border transfer of personal data within the meaning of art. 12 of 152-FZ. Destination states: Germany (Hostinger server); for Telegram — the states where the Telegram service's infrastructure is located.

17. Localization of Russian citizens' data

P. 5 art. 18 of 152-FZ requires that, when collecting personal data of Russian citizens (including online), their recording, systematization, accumulation, storage, clarification and extraction be performed using databases located in the Russian Federation. The Operator discloses in full where inquiries are processed and stored: the infrastructure actually involved is listed in sections 11–12 (Hostinger, Germany; the Telegram service). Questions relating to this requirement can be sent to pafuluofu@atomicmail.io.

18. Retention periods

Inquiries that did not lead to a contract: messages and files in the Telegram chat are kept for no longer than 12 months from the last communication on the inquiry, then deleted by the Operator. The period reflects the typical decision cycle for web projects and the possibility of a repeat inquiry.

If a contract is concluded, project-related information and correspondence are further processed within the contractual relationship and kept for as long as required to perform the contract and comply with applicable law.

Upon withdrawal of consent, processing stops and the data is destroyed within 30 days of receiving the withdrawal (p. 5 art. 21 of 152-FZ), except for data processed on another lawful basis (e.g. performance of a concluded contract). Hosting logs are kept for the periods set by the provider (section 14).

19. Termination of processing and destruction

When the purposes are achieved, the periods of section 18 expire, or consent is withdrawn, the Operator deletes the relevant messages and files from the Telegram chat (using "delete for everyone" where technically available) and destroys any other copies he holds.

The Operator cannot guarantee deletion of backup and service copies created by the Telegram service's and hosting provider's infrastructure under their own rules; such copies are handled under the policies of the respective services.

20. Withdrawing consent

Consent may be withdrawn at any time by emailing pafuluofu@atomicmail.io with the subject "Withdrawal of personal data processing consent". Stating the name and the email address the inquiry was sent from is sufficient for the Operator to locate the messages. Consequences of withdrawal are described in section 18. Withdrawal does not affect the lawfulness of processing performed before it was received.

21. Data subject rights

Under arts. 14, 20, 21 of 152-FZ the data subject may: obtain confirmation that his data is processed and the information listed in p. 7 art. 14 of 152-FZ, including information on any performed or intended cross-border transfer; demand clarification (correction) of his data; demand blocking or destruction of data that is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated purpose; withdraw consent (section 20); appeal the Operator's actions or inaction to the authorized personal data protection body (Roskomnadzor) or in court (art. 17 of 152-FZ).

Requests are sent to pafuluofu@atomicmail.io. The Operator replies within 10 business days; the period may be extended by no more than 5 business days with notice to the requester (art. 20 of 152-FZ).

22. Operator obligations

The Operator undertakes to: process data only for the stated purposes and to the necessary extent; not disclose data to third parties except as described in this Policy; apply the protection measures of section 23; handle data subject requests within the statutory periods; cease processing and destroy data in the cases and within the periods provided by 152-FZ.

23. Data protection measures

Measures applied: HTTPS connection to the Site; the Telegram bot access key is stored only in server-side configuration, outside public access and client code; access to the Telegram chat, the hosting server and the Operator's accounts is restricted (authentication); server-side validation and filtering of incoming form data; immediate deletion of temporary files after forwarding; keeping the Site's software components up to date; deleting data when retention periods expire. The set of measures is maintained with regard to arts. 18.1 and 19 of 152-FZ, considering the nature of processing (contact form inquiries, no client database).

24. Requests regarding this Policy

All requests regarding this Policy and personal data processing are sent to pafuluofu@atomicmail.io. Procedure and timelines — per section 21.

25. Changes to this Policy

The Operator may update this Policy; the new version is published on this page with its date. Material changes to processing terms that require new consent entail an update of the Data Processing Consent document and its version. Previous versions are retained by the Operator and provided on request.

26. Final provisions

Matters not covered by this Policy are governed by applicable law, including 152-FZ with respect to the processing of personal data of citizens of the Russian Federation. The invalidity of any single provision does not invalidate the remaining provisions.