Personal data processing policy

1. Terms and definitions

The Policy follows the definitions from art. 3 of Federal Law No. 152-FZ: “personal data” (PD) means any information relating directly or indirectly to an identified or identifiable natural person (the data subject); “operator” is a person organising the processing of PD; “processing” is any action with PD (collection, recording, organisation, storage, modification, use, transfer, erasure). “Website” means the internet resource citrus.team together with all its subdomains.

2. Data we process

Through contact forms we receive the data voluntarily provided by the user: name; phone and/or e-mail; description of the task and any other information left in free text fields. Technical data is collected automatically: IP address, browser type and version, operating system, referring page, date and time of the visit, cookie identifiers and web analytics tags.

3. Purposes

To contact the user about the matter described in the form; to prepare and send commercial offers; to perform contractual obligations; to improve the Website and services; to comply with applicable laws; to maintain management and tax accounting; to protect the lawful interests of the Operator.

4. Legal grounds

Consent of the data subject (art. 6 § 1 of Federal Law No. 152-FZ), given by submitting a form or ticking the consent checkbox; conclusion and performance of a contract to which the subject is a party (art. 6 § 5); exercise of the Operator’s legitimate interests provided this does not infringe the subject’s rights.

5. Methods of processing

Processing is carried out both with and without the use of automation tools. Actions include collection, recording, organisation, storage, modification, retrieval, use, transfer (provision, access), anonymisation, blocking, deletion and destruction. The Operator does not take decisions affecting the user’s rights solely on the basis of automated processing.

6. Storage and security

Databases are stored on servers physically located in the territory of the Russian Federation. Access to PD is limited and granted only to the Operator’s employees who need it for their duties. Organisational and technical safeguards are applied: role-based access control, channel encryption (HTTPS/TLS), regular backups, monitoring of suspicious activity, least-privilege principle.

7. Transfer to third parties

The Operator does not sell or transfer PD to third parties except in cases expressly provided for by Russian law (e.g. on a justified request of authorised state bodies), and for the performance of contracts with engaged contractors (hosting provider, e-mail and messenger services) — under confidentiality obligations. Cross-border transfer is performed only with the user’s prior consent and to countries providing an adequate level of protection.

8. Cookies and web analytics

The Website uses cookies — small text files stored in the user’s browser — to remember preferences (interface language), enable forms and collect anonymised statistics. Third-party analytics services are integrated: Google Analytics (Google LLC, policy: policies.google.com/privacy). The user may disable cookies in browser settings — in that case some features of the Website may not work correctly.

9. Rights of the data subject

Pursuant to art. 14 of Federal Law No. 152-FZ the user has the right to: receive information about the processing of their PD; request rectification, blocking or destruction of PD that are incomplete, outdated, inaccurate or unlawfully obtained; withdraw consent; appeal against the Operator’s actions to Roskomnadzor or in court. Requests are submitted in free form to team@citrus.team with identity confirmation. Response time — 10 business days.

10. Retention period

PD received through the contact form is stored no longer than required for processing purposes and in any case no longer than 5 (five) years from the date of the last interaction with the user — or until the consent is withdrawn (whichever comes first). After processing is terminated the data is destroyed or anonymised.

11. Consent, withdrawal and changes

By submitting a form or ticking the consent checkbox the user confirms that they have read this Policy and consents to the processing of the PD they provided on the terms set out herein. Consent may be withdrawn at any time by a written request to the Operator’s e-mail. The Operator may amend the Policy; the current revision is always available at citrus.team/privacy.

12. Contacts for requests

For any questions about personal data processing: e-mail team@citrus.team, phone +7 (962) 200-98-45, postal address — 150049, Yaroslavl, Lisitsyna st. 2v, room 1, floor 3.