Privacy policy

1. Scope

This policy explains how ООО «БЛЦ» (BLC LLC, the Controller, we) processes personal data of visitors to the Hayrat Digital website and people contacting us through its forms. It is prepared with reference to Russian Federal Law No. 152-FZ of 27 July 2006 on Personal Data.

This policy covers the agency website. Individual ecosystem applications and processing under client contracts may be governed by separate documents. External websites linked from the portfolio have their own policies.

Browsing this website or reading this policy does not in itself constitute consent to all processing. Where consent is the legal basis, we request it separately.

2. Enquiry data and purposes

Data subjects include website visitors, prospective clients and representatives of organisations contacting us. Forms collect your name, phone number, email address and message. We also store the form language, the time the enquiry and consent were received, and a technical record identifier.

Purpose: to review your request, contact you using the details supplied, clarify your requirements and prepare a proposal. Providing contact details is voluntary, but required fields must be completed to submit a form. If an enquiry leads to a contract, necessary data may subsequently be processed to prepare and perform that contract and meet legal obligations.

Legal bases include your separately expressed consent; steps taken at your request before a contract and contract performance where provided by law; and statutory obligations. Contact details submitted through a form are not used for advertising mailings without a separate legal basis.

Do not include passwords, payment card details, health information, religious beliefs or other special categories of personal data in your message. These forms are not intended for such information. Only provide another person's data where you have a lawful basis.

3. Administrator access through UmmaID

The private admin workspace uses UmmaID for sign-in. We receive an account identifier, email address and email verification status. Only authorised administrators may access enquiries. The purpose is access control and protection of enquiry data. The bases are the Controller’s legitimate interest in access security while respecting users’ rights, and contractual relationships with authorised personnel where applicable.

An administrator session remains valid for up to 8 hours or until sign-out. Its cookie is necessary for authentication and is not used for advertising. Expired login records are removed during periodic cleanup. The lead change log contains the administrator identifier, enquiry identifier, action type and time; entries are retained for up to 90 days and removed during periodic cleanup. Internal enquiry notes are retained with the enquiry and accessible only to administrators.

Hayrat Digital does not receive your UmmaID password. Identity verification and the UmmaID account are governed by that service’s documents. For data processing requests concerning our admin workspace, contact info@hayrat.digital.

4. Technical data and spam prevention

Website operation and form protection may involve processing an IP address, browser and device characteristics, the page URL, request time and technical verification result. These data support page delivery, rate limiting, detection of automated requests and security, rather than advertising. The basis is the Controller’s legitimate interest in website security, provided that users’ rights and freedoms are not infringed.

The current website does not include our own advertising trackers or web analytics systems. Embedded SmartCaptcha processes technical data as described below. Blocking third-party scripts or browser storage may prevent CAPTCHA verification and form submission.

5. Yandex SmartCaptcha

Pages containing forms load Yandex SmartCaptcha to verify requests and block bots. When the widget loads, Yandex.Cloud LLC processes technical information about the device and its activity, browser features, referring page, time zone and digital fingerprint. This processing starts when a page with the widget loads, rather than only when a form is submitted.

According to Yandex's notice, the service retains technical data on servers in Russia for 60 days after collection and then deletes them. Yandex uses those data to operate and maintain the service and to improve it on the grounds described in its notice. Our application does not include the name, phone number, email address or enquiry text in CAPTCHA validation requests.

When you submit a form, our server sends a single-use verification token to SmartCaptcha. The token is not stored in the enquiries database. See the SmartCaptcha notice and Yandex privacy policy linked below for further details.

• SmartCaptcha data processing notice (Russian)
• Yandex privacy policy

6. Processing methods and access

Processing includes collection, recording, organisation, accumulation, storage, correction, retrieval, use, disclosure where necessary, restriction, erasure and destruction. Enquiries are processed automatically by the website and database and by staff or authorised representatives responding to requests.

Access must be limited to people who need the data to handle an enquiry, maintain infrastructure or meet legal duties. Service providers may be engaged on a lawful basis and subject to confidentiality, security and processing limitations. SmartCaptcha receives technical data as described above. Information may be disclosed to public authorities where required on a lawful basis.

We do not sell enquiries or publish the personal data they contain. Submitting an enquiry does not authorise public disclosure of your data. Cross-border transfers are not a purpose of processing; if a transfer is necessary, applicable legal requirements must be met before it begins.

7. Retention and deletion

Enquiry data are retained while the request and related discussions are being handled. Once that purpose has been achieved or consent withdrawn, data with no other lawful retention basis must be erased or destroyed within 30 days, unless a different statutory period applies.

Data needed for contract performance, accounting, tax compliance, legal claims or another statutory duty may be retained for the duration of that basis. This does not authorise indefinite retention of every enquiry.

Erasure covers the active database and other copies in use. Where immediate destruction is technically impossible, access is restricted and destruction takes place within statutory deadlines. Anonymous information may be kept only if it can no longer identify an individual. Yandex determines retention periods for SmartCaptcha technical data.

8. Data protection

Technical safeguards include restricted access to the database and server configuration, separation of server secrets from public code, input validation, request size and rate limits, and protection against automated form submissions. The Controller determines organisational measures and authorised access in accordance with applicable law.

These measures seek to prevent unlawful access, alteration, disclosure or loss. This policy is not a guarantee of absolute information system security. If a breach is identified, the Controller takes remedial steps and makes notifications required by law.

9. Your rights and requests

You may request information about the processing of your data, seek correction, restriction or destruction where grounds exist, withdraw consent and request cessation of processing in the cases provided by law. You may also complain to Roskomnadzor or a court.

Write to info@hayrat.digital with the subject 'Personal data'. Tell us how to contact you, which enquiry you previously submitted and what action you request. Clearly stating your intention is sufficient to request withdrawal of consent. Where necessary, we may ask for information reasonably needed to verify identity or authority; do not send a passport scan without a separately justified request.

Requests are handled within statutory deadlines. Information about processing is generally supplied within 10 working days, with a reasoned extension of no more than 5 working days where permitted. Withdrawal does not affect the lawfulness of prior processing or processing supported by an independent lawful basis.

10. Policy updates

The current version is published on this page with its date. Changes to processing purposes or data categories require corresponding document updates and, where needed, new consent. Russian is the source version; this English translation is provided for convenience.