1. General provisions
This Policy on personal data processing is drawn up in accordance with the requirements of Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (hereinafter — the Personal Data Law) and defines the procedure for personal data processing as well as measures to ensure personal data security taken by Aegis Reputation Lab (hereinafter — the Operator).
1.1. The Operator regards the observance of human and civil rights and freedoms in the processing of their personal data, including the right to privacy, personal and family secrets, as one of the most important objectives and prerequisites for its operations.
1.2. This Policy applies to all information that the Operator may obtain about visitors of the website https://aegisreputationlab.com.

2. Key definitions used in the Policy
2.1. Automated personal data processing — processing of personal data by means of computer technology.
2.2. Blocking of personal data — temporary suspension of personal data processing, except where processing is necessary to clarify personal data.
2.3. Website — a collection of graphic and informational materials, as well as computer programs and databases that ensure their availability on the Internet at the network address https://aegisreputationlab.com.
2.4. Personal data information system — a collection of personal data contained in databases and the information technologies and technical means that ensure their processing.
2.5. Depersonalization of personal data — actions as a result of which it becomes impossible to determine, without the use of additional information, the attribution of personal data to a specific User or other personal data subject.
2.6. Processing of personal data — any action (operation) or set of actions (operations) performed with or without the use of automation tools on personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), depersonalization, blocking, deletion, and destruction of personal data.
2.7. Operator — a legal entity, individual entrepreneur, or natural person who, independently or jointly with other persons, organizes and/or carries out personal data processing, as well as determines the purposes of personal data processing, the composition of personal data to be processed, and the actions (operations) performed on personal data.
2.8. Personal data — any information relating directly or indirectly to a specific or identifiable User of the website https://aegisreputationlab.com.
2.9. Personal data authorized by the personal data subject for distribution — personal data to which access by an unlimited number of persons has been granted by the personal data subject through consent in the manner prescribed by the legislation of the Russian Federation.
2.10. User — any visitor of the website https://aegisreputationlab.com.
2.11. Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific group of persons.
2.12. Distribution of personal data — any actions aimed at disclosing personal data to an indefinite number of persons, including publication on the Internet or providing access to personal data in any other way.
2.13. Cross-border transfer of personal data — transfer of personal data to the territory of a foreign state to a foreign government authority, a foreign natural person, or a foreign legal entity.
2.14. Destruction of personal data — any actions as a result of which personal data are irreversibly destroyed with no possibility of further recovery of their content.

3. Main rights and obligations of the Operator
3.1. The Operator has the right to:
— receive from the personal data subject reliable information and/or documents containing personal data;
— in the event that the personal data subject withdraws consent to personal data processing, as well as submits a request to cease personal data processing, continue processing personal data without the subject's consent where grounds exist under the legislation of the Russian Federation;
— independently determine the composition and list of measures necessary and sufficient to fulfil the obligations provided for by the legislation of the Russian Federation in the field of personal data.
3.2. The Operator is obliged to:
— provide the personal data subject, upon their request, with information concerning the processing of their personal data;
— organize personal data processing in the manner established by the current legislation of the Russian Federation;
— respond to inquiries and requests from personal data subjects and their representatives;
— publish or otherwise ensure unrestricted access to this Policy;
— take necessary legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution, as well as from other unlawful actions;
— cease processing and destroy personal data in cases and in the manner provided for by the legislation of the Russian Federation;
— fulfil other obligations provided for by the legislation of the Russian Federation.

4. Main rights and obligations of personal data subjects
4.1. Personal data subjects have the right to:
— obtain information concerning the processing of their personal data in the manner and to the extent established by the legislation of the Russian Federation;
— require the Operator to clarify personal data, block or destroy it if the data is incomplete, outdated, inaccurate, unlawfully obtained, or is not necessary for the stated purpose of processing;
— withdraw consent to personal data processing;
— demand that personal data processing be terminated;
— appeal the actions or inaction of the Operator to the authorized body for the protection of personal data subjects' rights or in court;
— exercise other rights provided for by the legislation of the Russian Federation.
4.2. Personal data subjects are obliged to:
— provide the Operator with accurate data about themselves;
— promptly inform the Operator of changes to their personal data where this is necessary for the respective processing purpose.
4.3. Persons who have provided the Operator with false information about themselves or information about another personal data subject without their consent shall be liable in accordance with the legislation of the Russian Federation.

5. Principles of personal data processing
5.1. Personal data processing is carried out on a lawful and fair basis.
5.2. Personal data processing is limited to achieving specific, predetermined, and lawful purposes.
5.3. Processing of personal data that is incompatible with the purposes for which it was collected is not permitted.
5.4. Only personal data that meets the purposes of its processing shall be processed.
5.5. The content and volume of processed personal data correspond to the stated processing purposes. Redundancy of processed personal data is not permitted.
5.6. When processing personal data, accuracy, sufficiency, and, where necessary, relevance to the processing purposes are ensured.
5.7. Personal data is stored for no longer than required by the purposes of personal data processing, unless a different storage period is established by federal law or contract.

6. Purposes of personal data processing
The Operator may process the User's personal data for the following purposes:
6.1. Processing inquiries, applications, and requests received through the website
Personal data:
— surname, first name, and patronymic;
— email address;
— phone number;
— other information that the User provides in feedback forms or in a message.
Legal basis:
— Federal Law No. 152-FZ of 27.07.2006 "On Personal Data";
— consent of the personal data subject;
— necessity of processing for the conclusion and performance of a contract or provision of services at the User's request.
Types of processing:
— collection;
— recording;
— systematization;
— accumulation;
— storage;
— clarification (updating, modification);
— use;
— deletion;
— destruction.
6.2. User consultation and service provision
Personal data:
— surname, first name, and patronymic;
— email address;
— phone number;
— other data necessary for providing services or preparing a commercial proposal.
Legal basis:
— Federal Law No. 152-FZ of 27.07.2006 "On Personal Data";
— consent of the personal data subject;
— conclusion and performance of a contract.
Types of processing:
— collection;
— recording;
— systematization;
— accumulation;
— storage;
— use;
— clarification;
— deletion;
— destruction.
6.3. Sending informational and marketing messages
Personal data:
— name;
— email address;
— phone number.
Legal basis:
— consent of the personal data subject.
Types of processing:
— collection;
— recording;
— systematization;
— accumulation;
— storage;
— use;
— deletion;
— destruction;
— sending emails, messages via messengers, or other forms of informational communication where consent has been obtained.
6.4. Ensuring website operation, analytics, and service quality improvement
Personal data:
— IP address;
— cookies;
— browser, device, and operating system data;
— technical data about website visits, User actions on the site, referral source, and time of visit.
Legal basis:
— User consent expressed through the use of the website, cookie banner settings, or another method provided for by law;
— the Operator's legitimate interest in ensuring proper website operation and improving its functionality, where permissible under applicable law.
Types of processing:
— collection;
— recording;
— systematization;
— accumulation;
— storage;
— use;
— depersonalization;
— deletion.

7. Conditions for personal data processing
7.1. Personal data processing is carried out with the consent of the personal data subject, except in cases provided for by the legislation of the Russian Federation.
7.2. Personal data processing is necessary for achieving purposes provided for by law, as well as for exercising the Operator's rights and legitimate interests, provided that this does not violate the rights and freedoms of the personal data subject.
7.3. Personal data processing may be carried out in connection with the conclusion and performance of a contract to which the personal data subject is a party or which is concluded at the initiative of the personal data subject.
7.4. The Operator processes only the personal data necessary for achieving the stated processing purposes.

8. Procedure for collection, storage, transfer, and other types of personal data processing
8.1. Personal data security is ensured through the implementation of legal, organizational, and technical measures necessary to comply with the requirements of the legislation of the Russian Federation.
8.2. The Operator takes necessary measures to prevent unauthorized access to personal data, as well as their loss, modification, disclosure, or destruction.
8.3. The User's personal data is not transferred to third parties, except in the following cases:
— where such transfer is necessary to fulfil obligations to the User;
— where transfer is provided for by the legislation of the Russian Federation;
— where the User has given separate consent to such transfer;
— where transfer is made to persons engaged by the Operator to ensure website operation, communication with the User, analytics, hosting, CRM, email distribution, and other related services, subject to compliance with personal data legislation requirements.
8.4. The User may update their personal data or withdraw consent to its processing by sending a request to the Operator's email address: info@aegisreputationlab.com
Recommended subject lines:
— "Update of personal data";
— "Withdrawal of consent to personal data processing";
— "Personal data request".
8.5. The duration of personal data processing is determined by the achievement of the processing purposes, unless a different period is established by the legislation of the Russian Federation, a contract, or the consent of the personal data subject.
8.6. Personal data processing may be terminated upon:
— achievement of the processing purposes;
— withdrawal of consent by the personal data subject;
— expiration of the consent period;
— detection of unlawful personal data processing;
— cessation of the Operator's activities;
— other grounds provided for by the legislation of the Russian Federation.
8.7. Information collected by third-party services, including but not limited to web analytics systems, feedback services, email providers, hosting providers, and other technical contractors, is processed by such parties in accordance with their own privacy policies. The Operator shall not be held liable for the actions of third parties, unless otherwise provided for by the legislation of the Russian Federation.
8.8. The Operator ensures the confidentiality of personal data and does not disclose it to third parties without lawful grounds.

9. List of actions performed by the Operator on personal data
9.1. The Operator performs the following actions on personal data:
— collection;
— recording;
— systematization;
— accumulation;
— storage;
— clarification (updating, modification);
— retrieval;
— use;
— transfer (provision, access) in cases provided for by law or with the consent of the personal data subject;
— depersonalization;
— blocking;
— deletion;
— destruction.
9.2. The Operator may carry out both automated and non-automated personal data processing.

10. Cross-border transfer of personal data
10.1. The Operator is entitled to carry out cross-border transfer of personal data only in compliance with the requirements of the legislation of the Russian Federation.
10.2. Prior to commencing cross-border transfer of personal data, the Operator shall ensure that the foreign state to which the personal data is to be transferred provides reliable protection of the rights of personal data subjects, or that such transfer is permitted on other grounds provided for by the legislation of the Russian Federation.
10.3. If the website uses foreign analytics services, CRM platforms, email services, advertising accounts, cloud storage, or other overseas services, such transfer may be considered cross-border. In such cases, the Operator arranges data processing in compliance with applicable legislation requirements.

11. Confidentiality of personal data
The Operator and other persons who have gained access to personal data are obliged not to disclose or distribute personal data without the consent of the personal data subject, unless otherwise provided for by the legislation of the Russian Federation.

12. Use of cookies
12.1. The website may use cookies and other similar technologies to ensure proper website operation, analyze user activity, improve user experience, and personalize content.
12.2. Cookies may contain technical information that is automatically transmitted by the User's device when visiting the website, including IP address, browser information, device information, access time, addresses of requested pages, and other similar information.
12.3. The User may change cookie settings in their browser. Disabling cookies may cause certain website features to function improperly.

13. Final provisions
13.1. The User may obtain any clarifications on matters related to the processing of their personal data by sending a request to the Operator's email address: [insert email].
13.2. The Operator reserves the right to make changes to this Policy without prior notice to the User. The new version of the Policy takes effect from the moment it is published on the website, unless otherwise provided for by the new version of the Policy.
13.3. The current version of the Policy is freely available on the Internet at: https://aegisreputationlab.com/politika-konfidencialnosti/