Personal data processing policy

1. Controller and website

The controller is Andrei Viktorovich Svirin, a citizen of the Russian Federation and owner of the personal website arbitr.law. Contact for data and content matters: andrei.svirin@arbitr.law. This policy covers the Russian and English versions of arbitr.law.

The website has no enquiry form, file uploader, visitor registration, payment or email newsletter subscription. An email link opens an email application; the sender sends a message through their chosen email service. Material searches run in the browser.

2. Purposes and legal grounds

Processing is limited to a specific purpose and the data necessary for it. Law 152-FZ applies, including Articles 5–7, 9, 14, 18.1 and 19–21. An ordinary voluntary enquiry is handled without separate consent: data necessary to reply is processed on the basis of the owner’s legitimate interest in corresponding with the enquirer under Article 6(1)(7), provided their rights and freedoms are respected. Data necessary to enter a contract at the sender’s initiative or perform a contract with them is processed under Article 6(1)(5). Optional analytics requires separate prior consent.

Visiting the website, sending an email or accepting licence terms does not constitute consent to analytics, advertising or publication of personal data. Where a particular processing operation needs consent, it is obtained separately. Consent to public dissemination, where required by Article 10.1, is not replaced by general correspondence consent.

3. Correspondence, submissions and rights requests

To consider a question, reply, check a correction or arrange author collaboration, the owner processes the sender’s email, any supplied name or pseudonym, subject, message and necessary attachments, date and email delivery metadata. A phone number, role or representative’s details are used only when supplied and relevant. Rights requests may require proportionate verification of identity and authority; excessive document copies are not requested.

Do not send health information, biometrics for identification, passport or financial details, other people’s contacts or legally protected secrets unless necessary and arranged on an appropriate basis. A sender does not consent for other persons. Publishing a submission requires a separate assessment of copyright, images, private life and personal data: see the submission rules.

4. Serving pages and optional analytics

When a page is opened, the browser sends the website server technical information: IP address, request time, requested URL and browser information. This is needed to deliver pages and operate the website. Such processing differs from optional visit analytics. Messages are sent through the sender’s chosen email service to the stated email address; message contents do not pass through the website’s pages.

Following separate permission, Yandex Metrica processes technical information about visits, page views, browser, device, IP address and identifiers for statistics and improving the materials. The processor is YANDEX LLC, 16 Leo Tolstoy Street, Moscow. Session Replay, click maps and dedicated link tracking are disabled. The counter does not run on contact or legal-document pages. See the analytics consent and technical-data notice.

5. Processing operations and recipients

Within the relevant purpose, operations include collection, recording, organisation, storage, correction, retrieval, use, necessary access, restriction, deletion and destruction. Correspondence is handled through email software and the owner’s review; analytics is automated. Ordinary handling of an enquiry does not include publishing contacts or the message.

Necessary technical access concerns hosting, email delivery and storage, and permitted analytics. Disclosure to others needs its own lawful ground, for example a lawful court or authority request. Enquiry data is not sold or disclosed for third parties’ independent advertising. Engaging a processor does not remove the controller’s duties. Cross-border transfers are subject to the separate requirements of Article 12; analytics or correspondence consent is not universal permission for any overseas transfer.

6. Retention periods

Ordinary enquiries, correspondence and submissions not accepted for publication have a maximum retention period of one year from receipt of the relevant enquiry. Data is retained only while needed for consideration and a reply; a new email does not automatically extend all earlier records. If the purpose is achieved earlier and there is no independent ground, processing ends and data is destroyed within 30 days. This is the owner’s correspondence-handling policy, not an automatic website deletion feature.

Necessary evidence of an agreed licence and its use is retained during the permission and for no more than three years after the relevant use ends where needed to protect rights. A specific dispute or mandatory statutory period requires its own ground and a limited record. A licence term does not justify retaining every original email or excess attachment. The analytics choice is stored in the browser for 180 days; this is not Yandex’s retention period for all data. Individual cookie lifetimes and handling of previously transmitted statistics are addressed separately.

7. Rights and requests

You may request processing information and access, correction, restriction or destruction where the law provides, withdraw consent and request cessation of processing. Write to andrei.svirin@arbitr.law with the request and information identifying the correspondence or processing. Identity and authority are verified proportionately where needed. An ordinary email can begin the process; Article 14 of Law 152-FZ governs a formal request.

A proper information request is answered within ten working days, with a reasoned extension of up to five working days. A cessation request is fulfilled within ten working days, with a possible reasoned extension of up to five working days, except where Article 21 permits continuation. After consent is withdrawn, data is destroyed within 30 days where no other ground remains. A refusal needs a legal basis; the controller’s actions may be challenged before Roskomnadzor or a court. This policy does not limit applicable mandatory visitor rights.

8. Protection and cessation

Access to correspondence and materials is limited to their purpose. Safeguards include account and device security, software updates, limiting unnecessary copies and checking the lawfulness of disclosure. Inaccurate or unlawfully processed data is restricted, corrected or removed within statutory periods. Incidents are addressed with notification where required by law. No internet transmission is guaranteed absolutely secure.

9. Changes and related documents

A revised policy carries a date and does not broaden earlier limited consent. New consent is obtained where changed processing requires it. Related documents: consent for a particular enquiry, analytics consent, technical data and cookies, and submissions.