Personal Data Processing Policy

Individual Entrepreneur Gurianov Andrei Vladimirovich
Websites: rivertime.ru, rental.rivertime.ru
Effective date: 11.11.2026

1. General Provisions

1.1. This Policy defines the procedure for the processing and protection of personal data of visitors and clients of the website rivertime.ru, including its English-language version rivertime.ru/en, as well as of the photography equipment rental website rental.rivertime.ru (hereinafter together, the “Website”, and separately, the main website and the rental website).

1.2. The personal data operator is Individual Entrepreneur Gurianov Andrei Vladimirovich (hereinafter, the “Operator”):

• INN: 434522607108;
• OGRNIP: 309434519500091;
• date of state registration: 14.07.2009;
• address (location / registered address): 610020, Kirov, ul. Truda, 71;
• entry in the register of operators that process personal data: 43-23-007187;
• email address for requests by personal data subjects: rivertime@mail.ru;
• telephone for requests: +7 922 995-75-75.

1.3. This Policy has been prepared in accordance with Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” (hereinafter, “152-FZ”), other regulatory acts of the Russian Federation, and clarifications issued by the authorized body for the protection of the rights of personal data subjects. Federal Law No. 152-FZ applies to the processing of personal data under this Policy.

1.4. Use of the Website, the submission of an inquiry through the Website forms, or the placement of an order means that the personal data subject has familiarized himself or herself with this Policy. Consent to the processing of data for specific purposes (including advertising tracking by means of cookies and the VK pixel) is given separately, in the ways specified in Sections 4 and 10.

1.5. The Operator does not process special categories of personal data (Article 10 of 152-FZ) or biometric personal data (Article 11 of 152-FZ) through the Website, unless the subject, on his or her own initiative, communicates such information in the text of an inquiry. The Operator asks that such information not be submitted through the Website forms.

1.6. In the event of any discrepancy between the Russian and English versions of this Policy, the Russian version shall prevail.

2. Key Terms

In this Policy, the terms “personal data”, “operator”, “processing of personal data”, “personal data subject”, “automated processing”, “provision”, “entrustment of processing”, and “cross-border transfer” are used in the meanings established by Article 3 of 152-FZ.

Cookie — a small fragment of data that is stored in the visitor’s browser and may be used for the operation of the Website, the recording of consent, traffic analysis, and (where consent has been given) advertising tracking.

3. Categories of Data Processed, Sources, and Methods

3.1. The Operator processes personal data that the subject communicates himself or herself, as well as data that are collected automatically when the Website is visited (if this is provided for by the Website settings and, for certain tools, by the visitor’s consent).

3.2. Through the feedback form on the home page of the Website and its English-language version (form fields: name; a contact telephone number or email address in a single field; message text), the Operator may receive:

• name;
• telephone number and/or email address;
• message text (information about a project or other request communicated by the visitor).

3.3. Through the order window in the Website shop (the /shop page, the “Order” button; fields of the confirmed order form: name and email address; payment method — online payment via the Robokassa payment service), the Operator may receive:

• name;
• email address;
• order information: the name and identifier of the product (service), price, quantity (if selected), date and status of the order, and the selected payment method;
• other information that the subject may specify when placing an order if the relevant fields are added to the form later.

3.4. If a visitor uses the Bitrix24 widgets placed on the Website (website button widgets), the Operator (and the processor engaged by the Operator) may receive data that the visitor himself or herself enters in such a widget (for example, name, telephone number, inquiry text), as well as technical data necessary for the widget to function.

3.4.1. Through the rental website rental.rivertime.ru the Operator may receive:

• when a booking (rental) is placed: last name, first name, patronymic, email address, mobile telephone number, rental start and end dates, information about the selected equipment, and the amount and status of the order;
• through the “Ask us a question” form: name, telephone number, and comment text.

3.5. When the Website is visited, the following may be processed automatically:

• cookie data and similar technologies necessary for the operation of the Website and for recording the visitor’s choice regarding analytical and advertising tools (including the tracking-consent and tracking-updated-at files);
• data of the Yandex Metrica counter (counter identifier 92523198 on the main website and 96158566 on the rental website): information on page visits, the referral source, the device and browser, technical identifiers, and data on actions on the Website to the extent transmitted by the counter;
• data of the VK / VK Ads pixel (identifier VK-RTRG-251821-bGCqF), including the fact of visits to Website pages and related technical identifiers, — only if the visitor has given consent to advertising tracking;
• IP address, date and time of the request, and web-server (hosting platform) log data, to the extent necessary for the operation and protection of the Website.

3.6. The Operator does not use Google Analytics on the Website.

3.7. The Operator does not aim to process, through the Website, the personal data of persons under 18 years of age.

4. Purposes and Legal Grounds for Processing

4.1. Inquiries through the Website forms and correspondence regarding a request:

• purpose: receiving and considering inquiries, preparing a response, and clarifying the details of a possible order for services (photography and video shooting, training, and other services of the Operator);
• legal ground: clause 5 of part 1 of Article 6 of 152-FZ — processing is necessary for the performance of a contract to which the subject is a party, or in order to enter into a contract at the initiative of the personal data subject;
• categories of data: name, telephone number and/or email address, message text, and information necessary to provide a response.

4.2. Placement and performance of orders in the Website shop and of bookings on the rental website, and acceptance of payment:

• purpose: accepting the order or booking, communicating with the client, entering into and performing a photography equipment rental contract, rendering the service / delivering a digital or other product, accepting payment, bookkeeping and tax accounting, and considering claims;
• legal ground: clause 5 of part 1 of Article 6 of 152-FZ;
• categories of data: last name, first name, patronymic, telephone number, email address, rental dates, order data, and payment information to the extent necessary for the payment service and the Operator.

4.3. Ensuring the operation and security of the Website (technical and strictly necessary cookies, logs, and recording of the choice in the cookie banner):

• purpose: correct display of pages, protection against abuse, and storing the visitor’s choice (“Accept” / “Reject”);
• legal ground: clause 5 of part 1 of Article 6 of 152-FZ — insofar as necessary to provide the functionality of the Website at the visitor’s request; recording of a refusal or of consent — in order to comply with the requirements of personal data legislation.

4.4. Analysis of Website traffic (Yandex Metrica):

• purpose: understanding how the Website is used, and improving its content and usability;
• legal ground: the consent of the personal data subject (clause 1 of part 1 of Article 6 and Article 9 of 152-FZ), which is given by clicking “Accept” in the cookie notice. The counter is not launched until consent is given. A refusal (the “Reject” button) means that analytical cookies and the counter are not launched.

4.5. Advertising tracking (the VK / VK Ads pixel):

• purpose: building audiences of Website visitors and displaying the Operator’s advertising in VK advertising systems;
• legal ground: the consent of the personal data subject (clause 1 of part 1 of Article 6 and Article 9 of 152-FZ), which is given by clicking “Accept” in the cookie notice. The pixel and the accompanying request to vk.com/rtrg are launched only after such consent. A refusal means that advertising tracking is not launched.
• consent may be withdrawn in accordance with Section 7.

4.6. The Operator does not use data obtained through the Website to send advertising by telephone, SMS, or email unless separate consent to such mailings has been obtained.

5. Persons to Whom Data May Be Provided. Entrustment of Processing

5.1. The Operator does not sell personal data.

5.2. For the operation of the Website and the achievement of the purposes specified in Section 4, the following may be engaged in the processing (to the extent necessary for the relevant service):

• Wfolio — the Website platform and hosting, content storage, and the receipt and transmission to the Operator of feedback-form and order data (wfolio.pro / wfolio.ru and the related platform infrastructure);
• 1 °C-Bitrix LLC / the Bitrix24 service — the rental website platform and hosting, the receipt and storage of orders, bookings, and CRM inquiries, and the operation of the feedback widgets on the main website (loaders from the domain cdn-ru.bitrix24.ru);
• YANDEX LLC — the Yandex Metrica service (counters 92523198 and 96158566), subject to the visitor’s consent to traffic analysis;
• VK / VK Ads (including vk.com) — the VK retargeting pixel VK-RTRG-251821-bGCqF, subject to the visitor’s consent to advertising tracking;
• PJSC Sberbank (payment gateway) — acceptance of online payment for bookings on the rental website (the amount and identifier of the order, and information necessary to process the payment; bank card data are entered on the bank’s side and are not transmitted to the Operator);
• the Robokassa payment service — acceptance of online payment for orders placed in the Website shop (the buyer’s name and email address, the amount and identifier of the order, and information necessary to process the payment).

5.3. The persons listed above process data under an entrustment from the Operator and/or independently under their own policies and contracts, including the offer agreements of the respective services. The current text of such documents is published on the websites of these services.

5.4. The Operator may provide personal data to state authorities in the cases and in the manner provided for by the legislation of the Russian Federation.

5.5. Google Analytics is not used on the Website. No transfer of data to Google LLC is made in connection with the operation of the Website.

6. Retention Periods

6.1. Personal data are processed no longer than required by the purposes of processing, unless a different period is established by federal law.

6.2. Data from inquiries submitted through the Website forms are stored for the period of consideration of the inquiry and further interaction and, after completion thereof, for 3 years from the date of the last inquiry, unless there is another lawful ground to store them longer.

6.3. Data of orders, services rendered, and settlements are stored for the periods established by accounting and tax legislation: 5 years after the end of the year in which the relevant operations were completed, unless a special provision establishes a different period.

6.4. Information about the visitor’s cookie choice (the tracking-consent and tracking-updated-at files) is stored in the visitor’s browser for up to 365 days or until deleted by the visitor, after which the notice may be shown again.

6.5. The retention periods for data in Yandex Metrica and in VK Ads are determined by the settings of the respective accounts and by the rules of these services.

6.6. Upon achievement of the purposes of processing or upon withdrawal of consent, if there are no other lawful grounds, personal data are destroyed or depersonalized within the period provided for by 152-FZ.

7. Rights of the Personal Data Subject and the Procedure for Making Requests

7.1. A personal data subject has the rights provided for by 152-FZ, including the rights:

• to obtain information about the processing of his or her personal data (Article 14 of 152-FZ);
• to request the rectification, blocking, or destruction of data if they are incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose;
• to withdraw consent to the processing of personal data;
• to appeal against acts or omissions of the Operator to Roskomnadzor or to a court;
• to compensation for losses and/or compensation for moral harm in the manner established by law.

7.2. To exercise these rights or to withdraw consent, the subject shall send a request to the Operator:

• by email: rivertime@mail.ru;
• or in writing to the address: 610020, Kirov, ul. Truda, 71.

The request should specify the last name, first name, and patronymic (if any), the substance of the request, and information allowing the applicant to be identified. The Operator may request additional information necessary for identification, within the limits permitted by law.

7.3. The Operator considers the request within the time limits established by Articles 14 and 21 of 152-FZ (as a rule, 10 working days, with a possible extension of a further 5 working days in the cases provided for by law, unless other time limits are expressly established).

7.4. Withdrawal of consent to advertising tracking and analytical cookies may additionally be effected by clearing the Website cookies in the browser settings and, when the notice is shown again, clicking “Reject”. This does not affect processing carried out on other lawful grounds (for example, performance of a contract already entered into).

7.5. To protect his or her rights, the subject may also apply to the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor): rkn.gov.ru/.

8. Measures to Ensure the Security of Personal Data

8.1. The Operator takes legal, organizational, and technical measures aimed at protecting personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, and dissemination, and against other unlawful acts, in accordance with Articles 18.1 and 19 of 152-FZ and the requirements for the protection of personal data when they are processed in information systems.

8.2. Such measures include, in particular: limiting the circle of persons who have access to personal data; using the protection means provided by the Website hosting platform (Wfolio), including the transmission of data over protected channels (HTTPS); recording of requests by data subjects; and monitoring of the actions of engaged processors within the framework of contracts and service settings.

8.3. The specific set of measures is determined taking into account current threats, the level of protection, and the nature of the data processed. In particular, the Operator: has appointed a person responsible for organizing the processing of personal data; has determined the places of storage of personal data and the list of persons who have access to them; has ensured the separate storage of personal data processed for different purposes; has ensured the recording and safekeeping of tangible media; has excluded uncontrolled access by unauthorized persons to premises where work with personal data is conducted; and carries out internal control of the compliance of processing with the requirements of legislation.

9. Place of Processing. Localization. Cross-Border Transfer

9.1. The Operator ensures the recording, systematization, accumulation, storage, clarification (updating, alteration), and retrieval of personal data of citizens of the Russian Federation using databases located in the territory of the Russian Federation, in accordance with part 5 of Article 18 of 152-FZ, including when the Website is hosted on the Russian platform Wfolio.

9.2. After Google Analytics has been disabled, cross-border transfer of personal data (transfer to the territory of a foreign state) is not carried out.

9.3. Processing in the Yandex Metrica, VK, Bitrix24 and Robokassa services, and PJSC Sberbank, is conducted on the terms of those services. The Operator proceeds from the premise that the tools specified in Section 5 and used on the Website do not entail a cross-border transfer; if the terms of any service change, the Operator will update this Policy.

10. Cookies, Analytics, and the VK Pixel

10.1. A notice on the use of cookies is displayed on the Website, with the “Accept” and “Reject” buttons (in the Russian-language version — “Принять” and “Отклонить”).

10.2. Until the visitor gives consent, only the means necessary for the operation of the Website and for storing the choice itself in the notice are launched.

10.3. After “Accept” is clicked, the following may be launched:

• Yandex Metrica — for traffic analysis;
• the VK pixel (the script vk.com/js/api/openapi.js and a request to vk.com/rtrg, identifier VK-RTRG-251821-bGCqF) — for advertising tracking and the building of audiences in VK Ads.

10.4. Clicking “Reject” means a refusal of analytical and advertising cookies and pixels: the relevant tools are not launched. The choice is stored in the browser (see clause 6.4).

10.5. Further details of the composition of the data and the rules of the services may be read in the policies of Yandex and VK published by those organizations.

11. Changes to the Policy

11.1. The Operator may update this Policy. A new version enters into force from the moment it is posted on the Website, unless otherwise stated in the version itself. Continued use of the Website after the publication of changes means familiarization with the new version.

11.2. The current version is always available at: rivertime.ru/legal-privacy.

12. Operator Contacts

For questions regarding the processing of personal data, the rectification or deletion of data, and the withdrawal of consent, please contact:

• Individual Entrepreneur Gurianov Andrei Vladimirovich;
• e-mail: rivertime@mail.ru;
• postal address: 610020, Kirov, ul. Truda, 71;
• telephone: +7 922 995-75-75.