The personal data operator is [Full legal name of the operator], taxpayer identification number (INN) [ИНН], state registration number (OGRN / OGRNIP) [ОГРН / ОГРНИП], registered address: [Registered address of the operator] (the Operator). Astera Legal is the name of the legal firm used on the Operator’s website.

The Policy applies to users of https://asteralegal.ru (the Website) and to people who contact the Operator through the contacts published on the Website, including email and their chosen communication channel.

The Policy takes account of Russian Federal Law No. 152-FZ of 27 July 2006, On Personal Data (the Personal Data Law). Personal data means information relating to a directly or indirectly identified or identifiable individual.

The Website does not set cookies or use web analytics or advertising tracking systems. The absence of cookies does not exclude processing the contacts you provide, the enquiry context or technical information necessary to operate and protect the Website.

The Policy does not cover third-party websites or services linked from the Website. If you use Telegram, WhatsApp or another external service, that service’s terms and documents also apply.

The Operator obtains your separate consent to process personal data for receiving an enquiry through the form and following up. You read the consent and personally select the corresponding checkbox before submitting the form.

Consent must be specific, informed, conscious and unambiguous, with a defined subject and purpose. Using the Website, reading this Policy or sending an email does not by itself replace consent where the law requires it.

In cases provided for by law, processing may take place without consent where necessary to enter into a contract at your initiative or perform a contract with you, comply with the Operator’s legal obligation, or exercise the legitimate rights and interests of the Operator or third parties while respecting your rights and freedoms. Each ground applies only to processing within its scope.

The Policy is not consent to public dissemination of personal data, advertising mailings, or processing special categories of personal data or biometric personal data. These activities are outside the purposes of the enquiry form.

Processing is limited to specific, predetermined and lawful purposes. The data collected and the actions performed must be proportionate to those purposes. The Operator must not combine databases with incompatible purposes or collect information excessive for your enquiry.

Depending on the purpose, processing may include collection, recording, organisation, accumulation, storage, correction, retrieval, use, granting access, blocking, deletion and destruction. Automated and manual methods may be used on electronic media and, where necessary, paper.

Access is permitted only for people who need it to perform the relevant task. Processing may be entrusted to a technical service provider under a contract specifying confidentiality, data protection, permitted actions and purposes. The Operator remains responsible to you to the extent required by law. Persons entrusted with processing: [Names and addresses of persons entrusted with data processing]. Storage location and information systems: [Data storage location and information systems used].

Disclosure to other persons is permitted only on a lawful ground and to the necessary extent. Enquiry data is not intended for public publication, sale, advertising mailings or disclosure to an unrestricted group of persons.

Collection of personal data of Russian citizens must comply with the legal requirements for using databases in the Russian Federation. Any proposed cross-border transfer is permitted only after the applicable requirements of the Personal Data Law have been met. Your choice of an external messenger does not remove these requirements for the Operator.

Data is retained no longer than necessary for the relevant purpose unless a different period is established by law or contract. When the purpose is achieved, consent is withdrawn or unlawful processing is identified, the Operator must cease processing, correct, block or destroy data in the circumstances and within the time limits required by the Personal Data Law. Further processing requires an independent lawful ground.

Do not send passport details, health information, biometric data, passwords or other people’s personal data without a proper ground through the general form or in an initial enquiry. If legal work requires documents containing personal data, the arrangements for providing and processing them are determined separately according to the matter and legal requirements.

Receiving an enquiry and following up about Astera Legal’s legal services.

• Individuals: people who make an enquiry for themselves or as representatives of an organisation.
• Form data: a Russian mobile telephone number in the Russian version; a Telegram username or profile link, or a WhatsApp number in the English version; the chosen contact method and a record of consent.
• Enquiry context: form language, submission page, first landing page, the selected service or specialism, insight or lawyer, referring source and link tags, where present. These details help identify the subject of the enquiry; no cookies are used for this purpose.
• During follow-up: your name, email address and a brief description of the matter, if you voluntarily provide these details and they are necessary to consider the enquiry. Information about a company and your role as its representative is used only to the extent necessary to understand the matter.
• Actions: receiving, recording and considering the enquiry; clarifying the matter; replying through the provided contact; discussing possible legal work arrangements.
• Ground: separate consent; where applicable, your initiative to enter into a contract or another ground provided for by law.
• Period: until consideration of the enquiry and necessary follow-up are complete, or consent is withdrawn, unless another lawful ground permits further processing.

Operating and protecting the Website and form against technical failures and abuse.

• Individuals: Website visitors and people who interact with the form.
• Data: technical request information that may be recorded by the server, including IP address, date and time, requested resource address, browser information and response code; the technical result of form submission. This information is not used for advertising profiling.
• Actions: technical delivery of requests, error diagnosis, availability checks and detection of unlawful activity.
• Ground: legitimate interests in operating and protecting the Website while respecting your rights and freedoms; applicable legal obligations.
• Technical log retention period: [Technical log retention period]. Processing is limited to what is necessary for diagnosis, protection and compliance with applicable legal requirements.

Handling personal data requests and complying with legal requirements.

• Individuals: people who submit a request, demand or withdrawal of consent.
• Data: a reply contact, the contents of the request and information necessary to confirm the applicant’s identity and connect the request to the data processed.
• Actions: checking and considering the request, replying, correcting data or ceasing processing, and recording performance of the Operator’s obligations.
• Ground: obligations under the Personal Data Law and other applicable lawful grounds.
• Request processing period: until the request has been considered and applicable obligations have been fulfilled. Retention period for records of request handling: [Retention period for records of personal data request handling].

The Website has no event registration or mailing subscription. Data provided for an enquiry is not used for these purposes without a separate ground and, where required, separate consent. Processing under any subsequent legal services contract is governed by that contract and applicable law.

You may receive information on the processing of your personal data to the extent provided for in Article 14 of the Personal Data Law, including the purposes and grounds, categories of data, periods, source and persons entrusted with processing. The law may restrict access to certain information.

You may request correction, blocking or destruction of data that is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose; withdraw consent; and request that processing cease in cases provided for by law.

Send your request to info@astera.legal or [Registered address of the operator]. Identify the data or enquiry concerned and how you wish to receive a reply. To provide protected information, the Operator may request only the confirmation of identity and authority necessary under the law.

Withdrawal of consent does not make previously lawful processing unlawful. After withdrawal, processing ceases unless the Operator has another ground provided for by law. If such a ground exists, data is processed only for the corresponding purpose.

You may challenge the Operator’s actions or omissions before Roskomnadzor or a court and use other remedies available under Russian law.

The Operator must ensure lawful processing, confidentiality and accuracy of personal data, and fulfil valid user requests in the manner and within the time limits required by law.

The Operator must take the necessary legal, organisational and technical measures to protect data against unlawful or accidental access, destruction, alteration, blocking, copying, disclosure, dissemination and other unlawful actions in accordance with Articles 18.1 and 19 of the Personal Data Law.

If unlawful processing, loss of data or unauthorised access is identified, the measures required by law apply to restrict access, remedy the breach and fulfil any resulting obligation to notify the competent authority.

The current Policy is freely available on the Website. Its revision date is shown on the document page. A change to the Policy does not itself extend consent you have previously given or replace obtaining new consent where required.

For questions about personal data processing and protection, contact info@astera.legal. Matters not addressed by the Policy are governed by Russian law.