Personal Data Processing Policy
1. General provisions
1.1. This policy (the “Policy”) sets out how personal data of users of the website https://scilibai.ru (the “Site”) is processed and protected, in accordance with Russian Federal Law No. 152-FZ of 27.07.2006 “On Personal Data”.
1.2. The personal data operator is Olga Muratovna Ataeva (the “Operator”). Contact for requests: info@scilibai.ru.
1.3. The Policy applies to all personal data the Operator receives from users of the Site and is publicly available at https://scilibai.ru/privacy/.
2. What personal data is processed
2.1. When registering and using an account: email address; first and last name as entered by the user; the password — only as an irreversible hash; dates of registration and last sign-in.
2.2. Technical data: the IP address — only to limit the number of sign-in, registration and password-recovery attempts; the Site’s cookies: sessionid (signed-in session), csrftoken (form protection), django_language (selected language).
2.3. Yandex Metrica data: Metrica cookies, browser and device information, addresses of visited pages and actions on them (Webvisor, click map). Input into account forms and the data of the personal account are excluded from Webvisor recordings.
2.4. Special categories of personal data and biometric personal data are not processed.
3. Purposes of processing
3.1. Registering the user and running the account: sign-in, password recovery and change.
3.2. Sending service emails: email address confirmation, password recovery.
3.3. Showing the user’s name next to materials they publish on the Site (comments, reviews of solutions).
3.4. Protecting the Site from abuse: password guessing and mass registrations.
3.5. Analysing traffic and improving the Site (Yandex Metrica).
4. Legal grounds
4.1. The user’s consent to the processing of personal data, given at registration by ticking the corresponding box (Art. 6(1)(1) of Law No. 152-FZ).
4.2. For technical data (item 2.2) — the need to ensure the operation and security of the Site (Art. 6(1)(7) of Law No. 152-FZ).
4.3. For Yandex Metrica data — the user’s consent expressed by continuing to use the Site; the user can opt out by disabling cookies in the browser.
5. Procedure and conditions of processing
5.1. Processing is automated and includes collection, recording, systematisation, storage, clarification, use, deletion and destruction of personal data.
5.2. Personal data is stored on servers located in the Russian Federation.
5.3. To send emails and analyse traffic, the Operator uses services of YANDEX LLC (Yandex 360 for Business, Yandex Metrica), which process data on the Operator’s behalf to the extent necessary for these purposes. Personal data is not transferred to other third parties except as required by the laws of the Russian Federation. No cross-border transfer of personal data takes place.
5.4. The user’s name is published next to their comments and reviews of solutions; the email address is not published.
5.5. Retention periods:
- account data — until the account is deleted or consent is withdrawn;
- unconfirmed registrations (the link from the email was not followed) — no more than 7 days;
- attempt counters per IP address — no more than 1 hour;
- cookies:
sessionid— up to 2 weeks,csrftoken— up to 1 year,django_language— until the browser is closed; - Yandex Metrica data — under the terms of the service.
5.6. When consent is withdrawn or the account is deleted, personal data is destroyed within 30 days unless otherwise required by law.
6. User rights
6.1. The user has the right to:
- receive information about the processing of their personal data;
- demand that personal data be clarified, blocked or destroyed if it is incomplete, outdated, inaccurate or processed unlawfully;
- withdraw consent to the processing of personal data;
- appeal against actions or inaction of the Operator to Roskomnadzor or in court.
6.2. Requests and withdrawal of consent are sent to info@scilibai.ru from the email address of the account. The Operator replies within 10 working days of receiving the request.
6.3. Withdrawal of consent means deletion of the account.
7. Protection measures
7.1. The Operator takes legal, organisational and technical measures to protect personal data against unauthorised access, alteration, disclosure and destruction, including:
- data is transmitted only over the secure HTTPS protocol;
- passwords are stored only as a hash (PBKDF2-SHA256) and are never stored or transmitted in plain text;
- an account is activated only after the email address is confirmed;
- the number of sign-in, registration and password-recovery attempts is limited;
- access to the servers and the database is restricted.
8. Final provisions
8.1. The Operator may amend the Policy. A new version takes effect when published on this page.
8.2. Questions about the Policy: info@scilibai.ru.