Version dated September 20, 2026
1. General Provisions
1.1. This Privacy and Personal Data Processing Policy (the “Policy”) sets out the procedures and conditions for the processing of personal data by Sabina Viktorovna Shchukina, who applies the special tax regime “Tax on Professional Income” (the “Operator”).
Operator: Sabina Viktorovna Shchukina
Taxpayer Identification Number (INN): 784803151340
Operator’s Website: parsabiks.com
Email for personal data inquiries: parsabiks@yandex.ru
1.2. This Policy has been developed in accordance with Federal Law No. 152-FZ of July 27, 2006 “On Personal Data” and other applicable regulatory legal acts of the Russian Federation governing personal data.
1.3. This Policy applies to personal data received and processed by the Operator:
- when visiting the Website;
- when submitting inquiries and applications through forms on the Website;
- when contacting the Operator by email;
- when the data subject independently contacts the Operator through messengers and social networks;
- when agreeing upon, entering into, and performing arrangements for the provision of photography services;
- during further interaction with the client concerning services provided.
1.4. This Policy is a publicly available document. The Operator provides unrestricted access to its current version by publishing it on the Website.
1.5. The use of cookies is governed by this Policy and by the separate Cookie Policy published on the Website.
1.6. This Policy does not constitute the data subject’s consent to the processing of personal data. Where the legislation of the Russian Federation requires the data subject’s consent for the processing of personal data, such consent shall be provided separately.
1.7. Matters relating to the publication and use of a person’s image are governed by a separate consent to the publication and use of the person’s image. Reviews and other information concerning the data subject are published where an appropriate legal basis exists in cases provided for by the legislation of the Russian Federation.
2. Definitions
2.1. Personal data means any information relating directly or indirectly to an identified or identifiable individual.
2.2. Processing of personal data means any action or set of actions performed with personal data, with or without the use of automated means, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), anonymization, blocking, deletion, and destruction of personal data.
2.3. Automated processing of personal data means the processing of personal data using computer technology.
2.4. Provision of personal data means actions aimed at disclosing personal data to a specific person or a specific group of persons.
2.5. Dissemination of personal data means actions aimed at disclosing personal data to an indefinite number of persons.
2.6. Blocking of personal data means the temporary suspension of personal data processing, except where processing is necessary to clarify personal data.
2.7. Destruction of personal data means actions resulting in the impossibility of restoring the content of personal data in a personal data information system and/or resulting in the destruction of physical media containing personal data.
2.8. Cross-border transfer of personal data means the transfer of personal data to the territory of a foreign state, to a foreign state authority, a foreign individual, or a foreign legal entity.
3. Principles of Personal Data Processing
3.1. The Operator processes personal data lawfully and fairly.
3.2. Personal data processing is limited to achieving specific, predetermined, and lawful purposes.
3.3. Processing of personal data that is incompatible with the purposes for which the personal data was collected is not permitted.
3.4. Only personal data relevant to the stated purposes of processing is processed.
3.5. The content and volume of personal data processed correspond to the stated purposes of processing. The Operator does not process excessive personal data.
3.6. The Operator takes the necessary measures to ensure the accuracy, sufficiency, and, where necessary, relevance of personal data.
3.7. Personal data is stored in a form that permits identification of the data subject for no longer than required for the purposes of processing, unless a different retention period is established by federal law, an agreement, or another applicable legal basis.
3.8. Upon achievement of the purposes of processing or termination of other lawful grounds for processing, personal data shall be destroyed or anonymized in accordance with the procedures and time limits established by the legislation of the Russian Federation and this Policy.
4. Categories of Data Subjects and Personal Data Processed4.1. Website Visitors
When using the Website, the following data may be processed automatically:
- IP address;
- browser and device information;
- date and time of access to the Website;
- technical information concerning interaction with the Website;
- data from strictly necessary cookies.
The Operator does not use web analytics systems, advertising pixels, or advertising profiling technologies.
4.2. Persons Submitting Inquiries and Applications
The Operator may process:
- name;
- telephone number;
- email address;
- nickname, username, or other contact identifier in a messenger or social network, where provided by the data subject or available to the Operator through the communication channel selected by the data subject;
- information regarding the preferred method of communication;
- the content of the inquiry, comments, and subsequent correspondence to the extent necessary to review the inquiry and agree upon the possible provision of services.
4.3. Clients of the Operator
The Operator may process:
- name;
- surname and patronymic, where necessary for entering into and performing an agreement for the provision of photography services;
- telephone number;
- email address;
- nickname, username, or other contact identifier, where provided by the data subject or available to the Operator through the communication channel selected by the data subject;
- the content of correspondence and information concerning arrangements to the extent necessary to agree upon, organize, and confirm the provision of photography services;
- passport details, where necessary for entering into and performing an agreement for the provision of photography services.
4.4. The Operator does not intentionally collect special categories of personal data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, health, or intimate life.
4.5. The Operator does not process biometric personal data for the purpose of establishing the identity of a data subject.
4.6. The publication and further use of photographs and other materials depicting the client are carried out on the basis of a separate consent to the publication and use of the person’s image in accordance with Article 152.1 of the Civil Code of the Russian Federation.
4.7. The Operator does not create advertising mailing databases using the contact information received and does not use such information for advertising mailings without a separate legal basis as required by law.
4.8. The data subject should not provide the Operator with personal data that is not necessary for the relevant purpose of interaction.
5. Purposes, Legal Bases, Methods, and Retention Periods for Personal Data Processing5.1. Ensuring the Functionality and Security of the Website
Category of data subjects: Website visitors.
Purpose of processing: ensuring the proper and secure operation of the Website and its technical functions.
Personal data: IP address, browser and device information, date and time of access, technical information concerning interaction with the Website, and data from strictly necessary cookies.
Legal basis: the pursuit of the Operator’s rights and legitimate interests in ensuring the functionality and security of the Website, provided that the rights and freedoms of the data subject are not thereby infringed, as well as other grounds provided for by law where applicable.
Method of processing: automated.
Actions involving personal data: collection, recording, systematization, accumulation, storage, use, blocking, deletion, and destruction.
Processing period: for the period necessary to achieve the relevant technical purpose. The duration of the cookies used is specified in the Cookie Policy.
5.2. Receiving and Reviewing an Inquiry or Application from a Potential Client
Category of data subjects: persons contacting the Operator and potential clients.
Purposes of processing:
- receiving and reviewing an inquiry or application;
- establishing contact;
- providing information about services, prices, available dates, and photography session terms;
- determining and agreeing upon the possibility of providing photography services;
- conducting correspondence necessary for the above purposes.
Personal data:
- name;
- telephone number;
- email address;
- nickname, username, or other contact identifier in a messenger or social network, where provided by the data subject or available to the Operator through the communication channel selected by the data subject;
- information regarding the preferred method of communication;
- content of the inquiry, comments, and subsequent correspondence.
Legal basis: the consent of the data subject where such consent is required; processing necessary for entering into an agreement at the initiative of the data subject where such legal basis is applicable.
Method of processing: mixed, using automated and non-automated means.
Actions involving personal data: collection, recording, systematization, accumulation, storage, clarification, retrieval, use, provision, access, blocking, deletion, and destruction.
Processing and retention periods:
- an application submitted through a Website form and stored in Tilda’s standard submissions section is retained there for 1 month;
- personal data and correspondence with a potential client with whom no agreement to provide photography services has been reached are processed for no longer than 1 year from the date of the last interaction concerning the possible provision of photography services;
- if interaction concerning the possible provision of services resumes during this period, the period is calculated from the date of the most recent such interaction;
- if the data subject becomes a client of the Operator, the necessary personal data continues to be processed for the purposes of arranging and providing services under Section 5.3 of this Policy.
Upon expiry of the relevant period, the processing of personal data shall cease and the personal data shall be destroyed in accordance with the procedures and time limits set out in Section 16 of this Policy, unless another legal basis for further processing exists under the legislation of the Russian Federation.
5.3. Arranging, Providing, and Confirming the Provision of Photography Services
Category of data subjects: clients of the Operator and persons with whom the provision of photography services is being arranged.
Purposes of processing:
- agreeing upon the terms of the services;
- agreeing upon the date, time, location, and other organizational details;
- entering into and performing arrangements for the provision of photography services;
- communicating with the client in the course of providing the services;
- delivering the results of the services provided;
- confirming the content of the arrangements and the fact of their performance;
- considering claims and other matters relating to the services provided;
- protecting the rights and legitimate interests of the Operator and the client in connection with the contractual relationship.
Personal data:
- name;
- surname and patronymic, where necessary for entering into and performing an agreement for the provision of photography services;
- telephone number;
- email address;
- nickname, username, or other contact identifier, where provided by the data subject or available to the Operator through the communication channel selected by the data subject;
- content of correspondence and information concerning arrangements relating to the provision of the service;
- passport details, where necessary for entering into and performing an agreement for the provision of photography services.
Legal basis: processing necessary for entering into an agreement at the initiative of the data subject and/or for performing an agreement to which the data subject is a party, beneficiary, or guarantor; exercising the rights and legitimate interests of the Operator within the limits provided by law; consent of the data subject where required by the legislation of the Russian Federation.
Method of processing: mixed.
Actions involving personal data: collection, recording, systematization, accumulation, storage, clarification, retrieval, use, provision, access, blocking, deletion, and destruction.
Processing and retention period: personal data and correspondence relating to arranging and providing photography services are retained for the duration of the services and for 3 years after completion of the relevant service for the purposes of confirming arrangements and performance of obligations, considering possible claims, and protecting the rights and legitimate interests of the parties.
After expiry of this period, the processing of personal data shall cease and the personal data shall be destroyed in accordance with the procedures and time limits set out in Section 16 of this Policy, unless the legislation of the Russian Federation imposes an obligation or provides another lawful basis for further processing.
5.4. Publication and Further Use of the Client’s Image
The publication and further use of photographs and other visual materials depicting the client for the purposes of creating and presenting the Operator’s professional portfolio, demonstrating results and examples of work, providing information about professional activities, and advertising and promoting the Operator’s own photography services are carried out on the basis of a separate consent to the publication and use of the person’s image in accordance with Article 152.1 of the Civil Code of the Russian Federation and within the limits established by such consent.
6. Sources of Personal Data
6.1. The Operator primarily obtains personal data directly from the data subject.
6.2. Personal data may be obtained:
- through a form on the Website;
- by email;
- when the data subject independently contacts the Operator through a messenger;
- when the data subject independently contacts the Operator through a social network;
- directly from the data subject when arranging and providing services.
6.3. If the data subject independently contacts the Operator by email, messenger, or social network, the data subject independently selects the relevant communication channel and transmits information through the selected service.
6.4. The Operator processes information obtained in this manner only to the extent necessary to review the inquiry, arrange and provide services, or achieve another stated purpose of the interaction.
6.5. If the data subject provides the Operator with personal data relating to another person, the data subject must have a lawful basis for such transfer.
7. Processing of Applications Through the Website and the Tilda Platform
7.1. The Website is created and operated using the Tilda platform.
7.2. The Operator is the personal data operator with respect to personal data collected through the Website forms. Processing of data using the functionality of the Tilda platform is carried out in accordance with the platform’s terms of use and the documents applicable to such processing.
7.3. Only information necessary to review an inquiry and establish contact with a potential client is collected through the Website forms.
7.4. Before submitting a form, the data subject is given the opportunity to review this Policy, the separate consent to personal data processing, and the separate consent to the publication and use of the person’s image.
7.5. The consents referred to in Section 7.4 of this Policy are provided by the data subject by taking separate affirmative actions when completing and submitting the application form on the Website.
7.6. When collecting personal data of citizens of the Russian Federation through the Website, the Operator ensures compliance with the requirements of the legislation of the Russian Federation regarding the localization of personal data.
7.7. Applications received through Website forms are stored in Tilda’s standard submissions section for 1 month.
7.8. The Operator does not use Tilda’s standard submissions section as a permanent client database.
7.9. The Operator uses the Yandex Mail email service to receive applications from the Website.
7.10. The Operator does not connect the Website forms to automatic transfers of personal data contained in applications to foreign messengers, foreign email services, foreign CRM systems, or foreign spreadsheet services.
7.11. Deletion of an application from Tilda’s standard submissions section does not necessarily result in the simultaneous destruction of the data subject’s personal data in other places where it is processed, provided that further processing is carried out on a legal basis established by this Policy and the legislation of the Russian Federation.
8. Email, Messengers, and Social Networks
8.1. The data subject may independently contact the Operator through available email services, messengers, and social networks.
8.2. When independently contacting the Operator through a messenger or social network, the data subject independently selects the relevant service and initiates the use of that communication channel.
8.3. In such cases, the Operator may have access to the data subject’s name, nickname, username, telephone number where available to the Operator through the relevant service, as well as the content of messages sent by the data subject.
8.4. The Operator uses the information received exclusively to the extent necessary to review the inquiry, arrange the possible provision of services, provide services, or protect rights and legitimate interests in connection with an existing contractual relationship.
8.5. Personal data and correspondence relating to a person who does not become a client of the Operator are processed for no longer than 1 year from the date of the last interaction concerning the possible provision of photography services.
8.6. Personal data and correspondence relating to a client that are necessary to confirm arrangements, provide services, consider possible claims, and protect the rights and legitimate interests of the parties are processed for the duration of the services and for 3 years after their completion.
8.7. Upon expiry of the relevant period, the Operator ceases processing and deletes personal data under its control in the relevant communication channel in accordance with Section 16 of this Policy, unless another lawful basis for further processing exists.
8.8. The deletion of personal data in a messenger, social network, or other communication service is carried out by the Operator to the extent permitted by the management tools available for the relevant account. The processing and storage of information by the owner of the relevant service are also governed by the terms of that service and applicable law.
8.9. The existence of a separate copy of the correspondence held by the data subject does not mean that the Operator continues to store such copy.
8.10. The Operator does not use contact information received through inquiries for mass advertising or informational mailings without a separate legal basis as required by law.
9. Email
9.1. The Operator uses Yandex Mail to receive applications from the Website and conduct email correspondence.
9.2. Personal data processed in email may include the data subject’s name, email address, telephone number where included in an application or email, and the content of the relevant inquiry or correspondence.
9.3. The processing period for correspondence depends on the relevant purpose:
- for a potential client to whom services were not provided — no longer than 1 year from the date of the last interaction concerning the possible provision of photography services;
- for an existing client — for the duration of the services and for 3 years after completion of the relevant service.
9.4. Upon expiry of the relevant period, the Operator ceases processing and deletes personal data under its control from the email account used by the Operator in accordance with Section 16 of this Policy, unless another lawful basis for further processing exists.
10. Delivery of the Results of Services Provided
10.1. The Operator uses Yandex Disk to deliver the results of photography services to the client.
10.2. Materials intended for delivery to a specific client are uploaded by the Operator to the Yandex Disk storage used by the Operator, after which the client is provided with a link to access the results.
10.3. A copy of the results uploaded by the Operator to Yandex Disk for delivery to the client is retained for 1 month, after which the Operator deletes it from the storage location used by the Operator within the service.
10.4. This Section governs the use of Yandex Disk solely as a technical means of delivering the results of the services provided to the client and does not govern the publication, public use, or dissemination of photographs.
11. Transfer of Personal Data and Engagement of Third Parties
11.1. The Operator maintains the confidentiality of personal data and does not disclose personal data to third parties or disseminate it without a legal basis provided for by the legislation of the Russian Federation.
11.2. The Operator may engage third parties and/or use information services in connection with the processing of personal data where an appropriate legal basis exists and subject to compliance with the requirements of the legislation of the Russian Federation.
11.3. The Tilda platform is used for the operation of the Website and receipt of applications.
11.4. Yandex Mail is used for electronic correspondence and receipt of applications.
11.5. Yandex Disk is used to deliver the results of services provided.
11.6. In cases provided for by the legislation of the Russian Federation, personal data may be provided to state authorities, courts, and other authorized persons.
12. Localization and Cross-Border Transfer of Personal Data
12.1. When collecting personal data of citizens of the Russian Federation through the Internet, the Operator ensures compliance with the requirements of the legislation of the Russian Federation concerning the recording, systematization, accumulation, storage, clarification, and retrieval of personal data using databases located within the territory of the Russian Federation, where such requirements apply.
12.2. Personal data obtained through Website forms is not automatically transferred by the Operator to connected foreign messengers, foreign email services, foreign CRM systems, or foreign spreadsheet services.
12.3. The data subject may, on their own initiative, contact the Operator through an available messenger or social network. In such a case, the data subject independently selects the relevant service and initiates the use of that communication channel.
12.4. Processing of information by the owner of the relevant messenger or social network is also carried out in accordance with the terms of the relevant service and applicable law.
13. Storage of Personal Data
13.1. The Operator stores personal data only for the period necessary for the relevant purpose of processing, unless another retention period is established by the legislation of the Russian Federation, an agreement, or another lawful basis.
13.2. Depending on the source and purpose of processing, personal data may be processed and stored:
- in Tilda’s standard submissions section;
- in the Operator’s email account;
- in the Operator’s accounts in messengers and social networks where the data subject uses the relevant communication channel;
- on the Operator’s devices to the extent necessary for the relevant purpose;
- in Yandex Disk for the purpose of delivering the results of photography services to the client.
13.3. The principal processing and retention periods are:
- applications in Tilda’s standard submissions section — 1 month;
- data and correspondence relating to a potential client to whom services were not provided — no longer than 1 year from the date of the last interaction concerning the possible provision of photography services;
- data and correspondence relating to an existing client and concerning the provision of services, confirmation of arrangements, consideration of possible claims, and protection of the parties’ rights — for the duration of the service and for 3 years after its completion;
- a copy of the results of photography services uploaded to Yandex Disk for delivery to the client — 1 month.
13.4. Where another retention period for personal data is established by federal law or an agreement to which the data subject is a party, beneficiary, or guarantor, the applicable retention period shall apply.
14. Cookies
14.1. When visiting the Website, technical information may be processed and strictly necessary cookies may be used to ensure the proper and secure operation of the Website.
14.2. The Operator does not use Yandex Metrica, Google Analytics, advertising pixels, or other systems for advertising or analytical profiling of Website visitors.
14.3. The types of cookies used, the purposes for which they are used, their duration, and the methods available for managing them are set out in the separate Cookie Policy published on the Website.
15. Measures to Ensure the Security of Personal Data
15.1. The Operator takes necessary and sufficient legal, organizational, and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination, and other unlawful actions.
15.2. Taking into account the nature of the processing carried out, the Operator, in particular:
- restricts access by unauthorized persons to devices and accounts used for personal data processing;
- uses authentication measures and passwords;
- takes measures to protect accounts used with relevant services;
- keeps the software used up to date;
- limits the personal data processed to that required for the stated purposes;
- monitors personal data processing and retention periods;
- ceases processing and destroys personal data when lawful grounds for processing cease to exist;
- takes measures to detect unauthorized access to personal data and remedy its consequences;
- monitors whether the personal data processing actually carried out complies with this Policy and the requirements of the legislation of the Russian Federation.
16. Termination of Processing and Destruction of Personal Data
16.1. Grounds for terminating the processing of personal data include, in particular:
- achievement of the purpose of processing;
- expiry of the established processing or retention period;
- loss of the need to achieve the purpose of processing;
- expiry of consent, where processing is based on consent;
- withdrawal of consent by the data subject, where no other lawful basis for continuing the processing exists;
- a request from the data subject to terminate processing in cases provided for by law;
- identification of unlawful processing;
- termination of another legal basis for processing.
16.2. Withdrawal of consent by the data subject does not necessarily require the termination of processing where the Operator is entitled or required to continue processing personal data without the data subject’s consent on the basis of the legislation of the Russian Federation.
16.3. Upon achievement of the purpose of personal data processing, the Operator shall cease processing or ensure that processing is ceased and shall destroy the personal data or ensure its destruction within a period not exceeding 30 days from the date on which the purpose is achieved, unless otherwise provided by an agreement to which the data subject is a party, beneficiary, or guarantor, another agreement between the Operator and the data subject, or where the Operator is entitled to continue processing personal data without consent on grounds provided for by the legislation of the Russian Federation.
16.4. If the data subject withdraws consent to personal data processing, the Operator shall cease processing or ensure that processing is ceased and, where retention of the personal data is no longer required for the purposes of processing and no other lawful basis for further processing exists, shall destroy the personal data or ensure its destruction within a period not exceeding 30 days from receipt of the withdrawal, unless otherwise provided by the legislation of the Russian Federation, an agreement, or another arrangement between the Operator and the data subject.
16.5. Upon receipt of a request from the data subject to terminate personal data processing, the Operator shall cease processing or ensure that processing is ceased within a period not exceeding 10 business days from receipt of the relevant request, except where the Operator is entitled to continue processing on grounds provided for by law.
This period may be extended by no more than 5 business days if the data subject is sent a reasoned notice specifying the grounds for the extension.
16.6. Where it is not possible to destroy personal data within the period established by the legislation of the Russian Federation, the Operator shall block such personal data or ensure that it is blocked and shall ensure its destruction within a period not exceeding six months, unless another period is established by federal law.
16.7. Personal data in electronic form is deleted from accounts, files, devices, and other processing and storage locations under the Operator’s control, taking into account the technical characteristics of the relevant information system or service.
16.8. When using a third-party service, the Operator takes steps to terminate processing and delete personal data to the extent permitted by the management tools available to the Operator for the relevant account and data.
16.9. The destruction of personal data is documented by the Operator in accordance with the requirements established by the authority responsible for protecting the rights of personal data subjects.
16.10. In the cases and in the manner required by applicable rules, the destruction of personal data is documented by a personal data destruction record and, where processing is carried out using automated means, also by an extract from the event log of the personal data information system.
16.11. A single record may document the destruction of personal data relating to several data subjects, provided that it contains the information required by applicable rules.
16.12. Documents confirming the destruction of personal data are retained by the Operator for 3 years from the date of destruction of the personal data, unless another period is established by applicable law.
17. Clarification, Blocking, and Unlawful Processing of Personal Data
17.1. Where the inaccuracy of personal data is confirmed, the Operator shall clarify such data in accordance with the procedures and time limits established by law.
17.2. Where unlawful processing is identified, the Operator shall block the relevant personal data in cases provided for by the legislation of the Russian Federation.
17.3. Where unlawful processing of personal data is identified, the Operator shall cease such processing or ensure that it is ceased in accordance with the procedures and time limits established by the legislation of the Russian Federation.
17.4. If it is not possible to ensure that the processing is lawful, the Operator shall destroy the relevant personal data or ensure its destruction in accordance with the procedures and time limits established by the legislation of the Russian Federation.
18. Rights of the Data Subject
18.1. The data subject has the right to obtain information concerning the processing of their personal data in the cases and in accordance with the procedures established by law.
18.2. The data subject has the right to request the clarification, blocking, or destruction of their personal data where the personal data is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated purpose of processing.
18.3. The data subject has the right to withdraw previously provided consent to the processing of personal data.
18.4. The data subject has the right to request the termination of personal data processing in cases provided for by law.
18.5. The data subject has the right to challenge the Operator’s actions or omissions before the authority responsible for protecting the rights of personal data subjects or before a court.