Personal data processing policy

1. Who the operator is

The operator is Corexy — a self-employed contractor registered under the Russian professional-income tax regime. Contact details are at the foot of this document; registration details will appear there once a legal entity is incorporated. The policy covers all personal data received from visitors to corexy.io and its subdomains, including the client area at app.corexy.io.

• It applies to data collected both before and after this version was published.
• Using the site means you have had the chance to read this policy. It does not replace your consent to processing, which is given separately.
• If you disagree with it, do not submit the forms — email and Telegram are both open channels.

2. Terms

Terms carry the meanings given in article 3 of Federal Law No. 152-FZ.

• Personal data — any information relating to a directly or indirectly identified or identifiable natural person.
• Operator — the party that organises and carries out processing and determines its purposes and the categories of data involved.
• Processing — any operation on personal data: collection, recording, structuring, accumulation, storage, rectification, retrieval, use, transfer, anonymisation, blocking, erasure, destruction.
• Data subject — the individual the data relates to: a site visitor, someone who submits the form, a client-area user.

3. Principles

Processing is lawful and fair, and is confined to specific purposes that were defined in advance (article 5 of Federal Law No. 152-FZ).

• No processing that is incompatible with the stated purposes.
• Only data that serves those purposes is collected — the forms ask for the minimum that works.
• The volume and content of the data match the purpose it was collected for.
• Data is not kept longer than the purpose requires, and is destroyed once that purpose is met.
• Reasonable steps are taken to keep data accurate and to correct it when a subject asks.

4. Legal grounds

Each purpose rests on its own ground from article 6(1) of Federal Law No. 152-FZ.

• Handling an enquiry submitted through the site — the subject's consent (article 6(1)(1)), given by a separate deliberate act when the form is sent.
• Entering into and performing a services contract to which the subject is a party — article 6(1)(5); no separate consent is needed for this.
• Running a client-area account at app.corexy.io — performance of the contract together with the consent given at registration.
• Sending news and promotional messages — a separate consent, plus the prior recipient consent required by article 18(1) of Federal Law No. 38-FZ «On Advertising».
• Keeping the site available and secure (server logs) — the operator's legitimate interests, where they do not override the subject's rights.

5. Whose data, and what data

The operator processes data of site visitors, people who submit enquiries, current and prospective clients, and client-area users. No special categories of personal data and no biometric data are processed. Children's data is not collected deliberately.

• Contact form: your name, an email address and/or phone number and/or Telegram username, and the free-text description of your task.
• Client area at app.corexy.io: email address, name, hashed password, account data, and project and ticket correspondence.
• Collected automatically: IP address, browser and device information (user agent), request date and time, requested page, referring page.
• Anything you choose to type into the free-text field — please do not put information there that your enquiry does not need.
• Information about your visit collected by Yandex Metrica where you have consented: a de-identified visitor identifier, the page address, the referring source, device and browser type.

6. Purposes

The list is exhaustive. Data collected for one purpose is not repurposed for another without a fresh legal ground.

• Reviewing your enquiry, scoping the work and replying.
• Negotiating, signing and performing a development or maintenance contract.
• Providing access to the client area and running project communication.
• Internal record-keeping of enquiries and clients.
• Sending news and promotional messages — only where a separate consent exists.
• Keeping the site secure: rate limiting, spam and abuse prevention, fault diagnosis.

7. What is done with the data

Processing is mixed — partly automated, partly manual. No decision producing legal effects for a subject is taken on the basis of automated processing alone (article 16 of Federal Law No. 152-FZ).

• Operations performed: collection, recording, structuring, accumulation, storage, rectification, retrieval, use, blocking, erasure, destruction.
• Data is never disseminated to an indefinite range of people and is never published.
• Data is not used for advertising profiling and is not passed to ad networks.

8. Retention and destruction

Data is kept no longer than the purpose requires. Once the purpose is met, or on withdrawal of consent, data is erased or anonymised within 30 days unless a statute sets a different period.

• Enquiries that did not lead to a contract — up to 24 months from the date of the enquiry.
• Client data under an active contract — for the term of the contract plus 3 years (the general limitation period, article 196 of the Russian Civil Code).
• Server logs — up to 12 months.
• Marketing consent stands until you withdraw it.

9. Information on the data protection measures in place

The operator applies the legal, organisational and technical measures required by article 19 of Federal Law No. 152-FZ to protect data against unlawful access, destruction, alteration, copying and dissemination.

• Traffic between the browser and the server runs over HTTPS with forced redirection and HSTS.
• Database access is restricted, accounts are individually attributable, and passwords are stored as irreversible hashes.
• Administrator actions in the client area are written to an audit log.
• Public forms are rate limited to blunt automated submission.
• Backups are encrypted and reachable only by the same restricted set of people.

10. Third parties and cross-border transfer

The operator does not sell personal data and does not pass it to third parties for their own purposes. Data reaches infrastructure providers only to the extent needed to run the service, and is otherwise disclosed only where the law expressly requires it.

• The operator engages an infrastructure provider to host and run the site, and cross-border transfer of personal data therefore takes place. The transfer is made on the basis of the subject’s consent under article 12 of Federal Law No. 152-FZ, to the extent required for the service to function, and no further.
• Yandex Metrica, a web analytics service — with your consent it receives de-identified information about the visit: the page address, the referring source, device and browser type, and a truncated IP address. The operator uses this only in aggregate and does not match it against anything you entered in a form. Session recording (webvisor) is disabled.
• Transactional email delivery — the recipient address and the message body are passed to the delivery provider.
• Disclosure to competent state authorities where a request is made in the manner prescribed by law.
• Disclosure to competent state authorities where a request is made in the manner prescribed by law.
• By submitting the form you are informed that your data is stored and processed on infrastructure located outside the Russian Federation.

11. Cookies

The site uses strictly necessary cookies, which it needs to work, and — separately, and only with your consent — web analytics cookies. Analytics cookies are not set until you press “Accept all” in the cookie notice, and are excluded from processing if you choose “Necessary only”. You can withdraw your consent at any time through the “Cookie settings” link in the footer.

• NEXT_LOCALE — the interface language you selected. Necessary.
• corexy_mode — Simple or Technical view. Necessary.
• corexy_consent — your answer to the cookie notice. Necessary: without it we could not honour your refusal.
• Flags recording that you have already seen the interface hints. Necessary.
• Yandex Metrica cookies — visit counting, referring source, the sequence of pages viewed, device and browser type. Analytics; set only with consent.
• We do not use analytics to target advertising at you and do not pass visitor data to ad networks.
• You can also disable cookies in your browser; some behaviour, including remembering your language, will stop working.

12. Your rights

You hold the rights set out in articles 14–21 of Federal Law No. 152-FZ. Send a request to the email address in the details below; it is answered within 30 days at the latest.

• Confirm whether your data is being processed, and obtain the legal grounds, purposes, methods and retention periods.
• Require correction, blocking or destruction of data that is incomplete, outdated, inaccurate, unlawfully obtained, or no longer needed for its purpose.
• Withdraw consent at any time — processing stops and the data is destroyed, except where the law permits processing without consent.
• Opt out of promotional messages separately, with no effect on how your enquiry is handled.
• Complain to Roskomnadzor or bring the matter before a court.

13. Who is accountable

The duties imposed by article 18.1 of Federal Law No. 152-FZ are discharged by the site owner personally. Send anything to do with personal data — including withdrawal of consent and requests for erasure — to the address in the details below.

14. Changes

This policy may change. The current version always sits on this page with its date. Material changes to the purposes or the scope of processing are not applied to data already collected without a fresh legal ground.