Privacy Policy

Version of `12 July 2026`
Website: {{ДОМЕН}}

This Policy explains what data is processed when you visit {{ДОМЕН}} (the
"Website"), for what purposes and on what legal grounds, and what rights you have.
It is prepared with regard to Russian Federal Law No. 152-FZ of 27 July 2006 "On
Personal Data" (the "Law No. 152-FZ"), the EU General Data Protection Regulation
2016/679 (GDPR), and applicable United States law. Specific provisions for
visitors from the EU and the US are set out in Sections 11 and 12.

This is a translation of the Russian-language Privacy Policy. In case of any
discrepancy in interpretation, the Russian text prevails.

1. Nature of the Website and data minimisation

1.1. The Website is a personal profile page (portfolio) of its owner: it
presents the owner's professional background and experience and contains links to
external services. The Website **does not sell anything, provides no services,
requires no registration, and contains no forms, user accounts, authentication or
payments**.

1.2. The only data processing on the Website is **anonymised web traffic
analytics. The Website does not collect** your name, address, phone number or
payment details, does not create accounts, and does not ask you for any information
about yourself.

2. Operator (data controller)

Data controller / operator: Pavel Vladimirovich Eliseev, a natural person,
owner of the Website.
Region: Saint Petersburg.
Contact for data matters: paulelysian@outlook.com.

The Website is informational and is not used for trade or paid services, therefore
tax-status and payment details are not provided.

3. What data is processed

3.1. On each visit, the analytics system records technical information needed to
count traffic:

3.2. IP address. The IP address is used transiently — only to compute the
daily anonymous identifier and the approximate region — and is **not stored in its
original form**: it is discarded immediately after processing.

3.3. The Website does not use cookies for analytics and does not use persistent
or cross-site identifiers, tracking pixels or session replay. See Section 5 for more
on cookies and local storage.

3.4. The operator does not process special categories of data (health, beliefs,
biometrics, etc.) and does not collect children's data.

4. Purposes and legal grounds

4.1. The sole purpose of processing is **analysis of traffic and improvement of the
Website** (which materials are in demand, where visitors come from, how the Website
performs on different devices).

4.2. Legal grounds:

• under Law No. 152-FZ — the operator's legitimate interest (cl. 7, part 1, art. 6) and processing for statistical purposes subject to mandatory anonymisation (cl. 9, part 1, art. 6). Consent is not required for such processing;
• under the GDPR — the controller's legitimate interest (art. 6(1)(f)): keeping anonymised traffic statistics without advertising or profiling, in a way that does not override the visitor's rights.

4.3. This processing is not a condition of access to the Website. You may
object to it and disable the collection (see Section 8).

5. Cookies and local storage

5.1. Analytics works without cookies (cookieless): no persistent or cross-site
identifiers, ad pixels or session replay are used, so no cookie-consent banner is
needed.

5.2. Strictly necessary technologies. The Website may use browser local storage
(localStorage) solely to operate the page correctly — for example, to remember a
chosen colour theme. This data does not identify visitors, is not shared with
third parties, and requires no consent.

5.3. Third-party cookies. The Website itself sets none. When you follow external
links, that service may use its own cookies and technologies under its own policy;
the operator does not control them.

6. Disclosure to third parties

6.1. Analytics is run using a self-hosted OpenPanel instance located on the
operator's infrastructure in the Russian Federation. The data is processed by the
operator alone and is not disclosed or sold to third parties.

6.2. The Website contains links to external services (for example, social-media
and other platform profiles). Following such a link takes you to a third-party
resource whose data processing is governed by that service's own policy. The
operator does not control such resources and is not responsible for them (see the
"Terms of Use").

6.3. Data may be disclosed to authorised public authorities only in the cases and in
the manner expressly required by law.

7. Storage, localisation and retention

7.1. Localisation (RF). Visitor data is processed using infrastructure located
in the Russian Federation (part 5, art. 18 of Law No. 152-FZ).

7.2. Retention. The original IP address is not retained (it is discarded
immediately). Anonymised and aggregated statistical data (views, events, daily
identifiers) is kept only as long as needed for traffic analysis and is periodically
aggregated or deleted. The daily identifier loses its link to a visit after 24 hours
because the salt rotates.

8. Your rights and control

8.1. You may: obtain information about the processing; object to processing based
on legitimate interest; request that processing stop and that data be rectified or
erased where technically possible; lodge a complaint with a supervisory authority or
a court.

8.2. How to opt out of analytics:

• enable the "Do Not Track" (DNT) or Global Privacy Control (GPC) signal in your browser — the operator endeavours to honour such signals;
• restrict collection via your browser (extensions, blockers);
• write to paulelysian@outlook.com.

8.3. Limits on exercising rights. Because the analytics data is anonymised
and the operator holds no information allowing it to be matched to a specific
individual, the operator objectively cannot identify a visitor from the anonymised
data and therefore cannot act on individual requests concerning it (e.g. "provide
all my data") — see art. 11 GDPR. This does not limit your right to object to the
processing and to disable collection going forward.

8.4. Requests are handled within a reasonable time and, under Law No. 152-FZ, within
the statutory period (generally up to 10 business days, extendable).

9. Security

The operator applies reasonable organisational and technical measures to protect the
data (including HTTPS transport and restricted access to the analytics system), in
line with the principles of arts. 18.1 and 19 of Law No. 152-FZ and art. 32 GDPR.

10. Children

The Website is not directed to children and is not intended to collect data from
persons below the age set by applicable law (in particular, under 13 — COPPA, USA;
under 16 — GDPR, EU, unless a lower age is set by national law). The operator does
not knowingly collect such data.

11. Additional information for visitors from the European Economic Area (GDPR)

11.1. Controller — the person named in Section 2; contact — paulelysian@outlook.com.

11.2. Legal basis — the controller's legitimate interest in keeping anonymised
traffic statistics (art. 6(1)(f)). The balancing test is met: data is anonymised
almost instantly, and no advertising or profiling is carried out.

11.3. Data-subject rights (arts. 15–21 GDPR): access, rectification, erasure,
restriction, portability, and the right to object to processing based on
legitimate interest — subject to the limitation in cl. 8.3 (anonymised data).

11.4. Automated decision-making. The operator carries out no automated
decision-making producing legal or similarly significant effects.

11.5. International transfer. Data is processed on a server in the Russian
Federation — a country outside the EEA for which the European Commission has issued
no adequacy decision. The processing is minimised and the data is anonymised
immediately; no cookies or advertising technologies are used. An EEA visitor who
does not want such processing may disable analytics as described in cl. 8.2.

11.6. Complaint. You may lodge a complaint with the data-protection supervisory
authority of your place of residence or work.

12. Additional information for US residents (including California)

12.1. The operator does not sell personal information and does not share it
for cross-context behavioural advertising (within the meaning of the CCPA/CPRA). The
operator does not meet the applicability thresholds of the CCPA/CPRA or comparable
state laws.

12.2. The operator endeavours to honour the Global Privacy Control (GPC) signal
as an opt-out of sale/sharing; no sale or sharing in that sense takes place in any
event.

12.3. US residents may direct any data questions to paulelysian@outlook.com.

13. Changes to this Policy

The operator may amend this Policy. The current version is published at {{ДОМЕН}}
and takes effect upon publication.

14. Contact and prevailing text

14.1. Data questions: paulelysian@outlook.com.

14.2. This Policy exists in Russian and English. In case of any discrepancy in
interpretation, the Russian text prevails.