Personal Data Processing Policy

Revision dated 13.10.2026. Identifier: 2026-10-13-email-1.

Terms used in this document: INN — taxpayer identification number; OGRNIP — primary state registration number of an individual entrepreneur; OGRN — primary state registration number; OOO — limited liability company; IP address — the network address from which a request originates; cookies — small records that a website stores in the browser.

1. General provisions and information about the Controller

1.1. The personal data Controller is Individual Entrepreneur Andrei Viktorovich Svirin:

• INN: 772872317733;
• OGRNIP: 322774600176722;
• correspondence address: P.O. Box 15, Moscow, 117647;
• email for personal data matters: info@adhoc.moscow;
• website: https://adhoc.moscow/.

1.2. This Personal Data Processing Policy (hereinafter the Policy) defines the purposes, legal bases, categories, procedure and periods for personal data processing by Individual Entrepreneur Andrei Viktorovich Svirin (hereinafter the Controller) when using the website https://adhoc.moscow/ (hereinafter the Website), considering email inquiries and subsequent interaction concerning them. Inquiries through web forms are not accepted. If the parties enter into a separate contract, necessary processing is also governed by that contract and the law.

1.3. The Policy applies to the personal data of Website visitors, persons submitting inquiries (hereinafter Applicants), Clients, their representatives and other individuals whose personal data is lawfully processed by the Controller in connection with the provision of services. The Controller considers inquiries personally.

2. Legal grounds and principles of processing

2.1. Personal data is processed in accordance with Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (hereinafter the Personal Data Law) and other applicable regulatory legal acts of the Russian Federation. The terms "personal data", "personal data processing", "controller", "provision of personal data", "depersonalization of personal data" and "destruction of personal data" are used with the meanings established by Article 3 of that Law.

2.2. Personal data is processed on a lawful and fair basis and is limited to achieving specific, predetermined and lawful purposes. The content and volume of the personal data processed must correspond to the stated processing purposes; excessive processing and processing incompatible with the purposes of the initial collection are not permitted.

2.3. Visiting the Website, clicking the “Write an email” button and sending an ordinary email do not constitute universal consent to personal data processing. Consent, where necessary, is given separately and does not cover advertising mailings, advertising calls, publication of materials or optional analytics.

3. Purposes, scope of data and grounds for processing

3.1. Consideration of inquiries and feedback

3.1.1. Purposes of processing: receiving and considering an inquiry, clarifying the circumstances relevant to it, preparing and sending a reply, and subsequent interaction exclusively concerning that matter. For the Website, this means considering a question about ad hoc arbitration and preparing an informational reply. The main inquiry channel is email at info@adhoc.moscow.

3.1.2. Categories of data: first name or surname, first name and patronymic to the extent provided by the applicant; email address; telephone number, if provided for a reply; email text; information about the task; the applicant's own personal data in necessary documents and attachments; information relevant to the matter in subsequent correspondence. Unrequested and excessive data is not used for other purposes.

3.1.3. The date and time of receipt, sender's address, subject, message identifier and necessary delivery service information are used to register the email and confirm the circumstances of the inquiry. Where separate consent is given, its content, date of receipt, method of expression and revision are retained. The Website does not create a web form submission record or attach information about visitor behavior to the email.

3.1.4. The legal basis is determined by the contents of the inquiry. Where the data subject takes the initiative to enter into a contract, and when performing a contract to which they are a party, beneficiary or guarantor, paragraph 5 of part 1 of Article 6 of the Personal Data Law applies, exclusively to the extent of necessary processing. For other inquiries, if there is no independent basis, separately obtained and confirmed consent applies under paragraph 1 of part 1 of Article 6. The contractual basis does not automatically cover any and all data in attachments or information about third parties.

3.1.5. The reply is sent using the contact details specified by the applicant and agreed channels. A telephone number provided for contact on the matter is not used for advertising. During telephone clarification, only information necessary for the inquiry is processed; this description does not provide for audio recording of conversations.

3.1.6. Attachments are used for review, clarification of the circumstances and preparation of a reply. The initial submission does not authorize publication, advertising use or transmission of files to analytics. Submission rules are set out in the Terms for the Transfer and Use of Materials.

3.2. Conclusion and performance of a separate contract

3.2.1. If the parties enter into a contract, the processing purposes are agreeing its terms, performing obligations, exchanging documents and delivering the result. The scope of data is determined by the subject matter of the contract, rather than by the mere fact of an inquiry through the Website.

3.2.2. Categories of data: necessary surname, first name and patronymic, contact details, addresses, information about the task, documents and materials; information about a representative and their authority. Identification and payment information is requested only where necessary for a specific action. This provision does not mean that pro bono assistance is charged for or that payment is available on the Website.

3.2.3. Bases: paragraph 5 of part 1 of Article 6 for data of a party, beneficiary or guarantor and for the data subject's own initiative to enter into a contract; paragraph 2 of part 1 of Article 6 for obligations established by law. A separate applicable basis is determined for representatives and other persons.

3.3. Compliance with obligations established by law

3.3.1. The purposes are maintaining mandatory records where necessary and complying with lawful demands and requests from authorized bodies. The categories of data are limited by the contents of the relevant obligation. The basis is paragraph 2 of part 1 of Article 6 and the provisions establishing that obligation.

3.4. Considering claims and protecting rights

3.4.1. The purposes are considering claims, resolving disputes, protecting rights and legitimate interests, and confirming the contents of interactions and lawfulness of processing.

3.4.2. The data consists of documents and correspondence relating to a specific dispute, necessary information about interactions and a minimal consent record. The bases are statutory requirements and paragraph 7 of part 1 of Article 6, subject to respect for the data subject's rights and freedoms. This provision does not authorize indefinite retention of all inquiries and attachments.

3.5. Website operation and security

3.5.1. The purposes are delivering pages, detecting errors, and protecting against unlawful requests and technical abuse. The data consists of the IP address, request date and time, page address, result of processing the request and necessary browser information transmitted when connecting to the server.

3.5.2. The basis is paragraph 7 of part 1 of Article 6: ensuring the Website's operation and security while respecting the visitor's rights and freedoms. This information is not used on that basis for optional analytics or advertising.

3.6. Analytics and advertising

3.6. Advertising mailings and advertising calls are not organized through the Website. Optional analytics have been prepared separately: the dedicated Yandex Metrica counter 110629371 is permitted only after the visitor makes a separate choice and the data retention configuration is checked. Consent relating to an inquiry does not include analytics. A new revision of the Policy does not expand consent previously given.

4. Processing procedure and data recipients

4.1. Within the purposes and legal bases, collection, recording, systematization, accumulation, storage, rectification, retrieval, use, transfer (provision, access), blocking, deletion and destruction are carried out. Processing takes place using automated means, without them or by a combination of methods.

4.2. The inquiry is considered personally by the Controller. Access is limited to the extent necessary for the relevant function; inquiry contents and attachments are not made publicly available.

4.3. Technical hosting and delivery of data are provided by the hosting and email infrastructure used by the Controller. The Controller determines the actual technical recipients, access conditions and hosting location before entrusting processing to them. Such an arrangement is formalized under part 3 of Article 6 of the Personal Data Law; it does not relieve the Controller of obligations to the data subject. Information about actual recipients is provided at the data subject’s request in the manner prescribed by law. This Policy does not authorize transfer to an indefinite group of persons.

4.4. Under a separate contract, materials may be provided to agreed participants in performance only to the extent necessary and on an applicable lawful basis. An inquiry does not in itself authorize forwarding materials to any specialist.

4.5. Data is provided to courts and state authorities in the cases and manner established by law. Contact details may not be transferred to third parties for their independent advertising without a separate lawful basis.

4.6. When collecting personal data of citizens of the Russian Federation, the Controller ensures compliance with part 5 of Article 18 of the Personal Data Law concerning the use of databases in the Russian Federation. The applicant's choice of email service does not remove the Controller's obligations.

4.7. Before starting a cross-border transfer, the Controller complies with Article 12 of the Personal Data Law, identifies recipients and provides necessary information to data subjects. Consent relating to an inquiry does not override localization and cross-border transfer requirements. Naming a Russian hosting provider does not in itself confirm the geography of all email systems.

5. Processing, retention and deletion periods

5.1. Ordinary inquiries that do not lead to a contract, including correspondence and attachments, are retained for the period necessary for consideration, but for no more than 90 calendar days from the last substantive message or agreed telephone clarification. If there was no follow-up, the period runs from receipt of the inquiry. Automatic replies and service notifications do not extend the period.

5.2. Data relating to a separate contract is retained for the duration of its performance and the statutory retention periods for the relevant documents. An independent basis is required thereafter. Mandatory retention of certain documents does not authorize retention of all excessive attachments.

5.3. Ordinary technical security logs are retained for no more than 30 calendar days. Information about a specific incident may be retained for longer only on an independent basis for the period necessary for investigation or protection of rights.

5.4. A minimal consent record may be retained on an independent basis for no more than three years from the date consent was expressed, if necessary to confirm the lawfulness of processing or protect rights, while respecting the data subject's rights and freedoms. Contents: name, if provided, contact details allowing the consent to be matched to the inquiry, the separate consent text, date and time, message identifier and document revision. The full original inquiry, the contents and names of its attachments, and excessive technical headers are not included. This limit does not imply an obligation to retain the record for all three years.

5.5. Information necessary for a specific claim or dispute is retained to the extent necessary on an independent basis. The reason and period for such retention are determined separately; ordinary correspondence does not automatically become an archive for protecting rights.

5.6. Upon achievement of the purpose, expiry of the period or cessation of the basis, data is deleted or destroyed unless an independent lawful basis requires continued retention. Upon achievement of the purpose, the periods under part 4 of Article 21 of the Personal Data Law apply. Deletion covers email, attachments, local copies, information systems used and copies held by processors. Retention in “Sent”, “Archive” and “Trash” folders counts as storage.

5.7. Upon withdrawal, processing based on consent ceases. If the data is no longer necessary and there is no other basis, destruction is ensured under part 5 of Article 21: as a general rule, within no more than 30 days from withdrawal, taking account of statutory exceptions.

5.8. When cessation of processing is requested, part 5.1 of Article 21 applies: as a general rule, processing ceases within no more than 10 working days; where statutory grounds exist, the period may be extended by no more than five working days with a reasoned notification. Lawful exceptions are considered separately.

5.9. If destruction within the statutory period is impossible, the data is blocked and destroyed under the procedure in part 6 of Article 21, as a general rule within no more than six months, unless a different period is established by federal law. The existence of a backup does not in itself authorize continued use of the data.

6. Cookies and technical tools

6.1. Cookies are small records saved by the browser when a website operates; local storage (localStorage) saves records on the device between visits and does not transmit them to the server automatically.

6.2. Web forms and advertising subscriptions are not used. The cookie adhoc_analytics_choice_v2 and localStorage have been prepared for a separate analytics choice, which is valid for 180 days. The FORMSESSID cookie does not apply to inquiries: the applicant sends the email themselves. Counter 110629371 is not loaded before separate consent is given and the data retention configuration is confirmed.

6.3. The server may receive the IP address and connection information without cookies; this data is processed within the security purpose under paragraphs 3.5 and 5.3. Saving the analytics choice and optional analytics are considered separately from security logs.

6.4. The data, recipient, purposes, periods and procedure for withdrawing separate consent are set out in the Cookie and Technical Data Policy and Analytics Consent. Continuing to browse or sending an email does not express consent to analytics.

6.5. A visitor may delete the Website’s data or block cookies in their browser settings. Deleting browser records does not delete previously sent emails from the Controller’s systems: a request for this is sent using the contact details in the Policy.

7. Rights of the personal data subject

7.1. The personal data subject has the right to receive information about the processing of their personal data, to demand its correction, blocking or destruction in the cases provided for by law, to withdraw consent to processing, and to appeal against the Controller's actions or omissions in the manner prescribed by law.

7.2. Inquiries and requests from personal data subjects are accepted at the email address info@adhoc.moscow or at the correspondence address specified in section 1 of the Policy.

7.3. To identify the inquiry, it is recommended to specify the contact details used when submitting it, the approximate submission date and the inquiry identifier, if available. The Controller may request proportionate verification of the subject's identity or their representative's authority. Requests provided for in Article 14 of the Personal Data Law are subject to the requirements for request contents established by that Article.

7.4. Information about the processing of personal data is provided to the subject or their representative within 10 working days from the date of the inquiry or receipt of the request. Where grounds provided for by law exist, this period may be extended by no more than five working days, with a reasoned notification stating the reasons for the extension being sent.

7.5. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal was received. If the processing of certain data continues on an independent lawful basis, the Controller informs the subject of such processing and its legal basis.

7.6. The subject may seek protection of their rights from the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) or in court.

8. Processing of third parties' personal data

8.1. Documents and information provided by email must be limited to what is necessary to consider the inquiry. Before sending materials, it is recommended to remove or conceal excessive passport, financial, medical and other personal data.

8.2. The Applicant's consent applies to their personal data and does not constitute the consent of other persons whose personal data is contained in the submitted materials.

8.3. Where materials are sent by a representative or third parties' personal data is provided, the Controller checks that the relevant authority and legal basis for processing exist. In the absence of a sufficient legal basis, the data is not used to provide services and must be blocked and deleted within the periods provided for by law.

8.4. Special categories of personal data and biometric personal data are processed in compliance with Articles 10 and 11 of the Personal Data Law. Expressing consent through an ordinary email does not replace consent in written form where that form is expressly required by law.

8.5. When submitting files, the applicant ensures they were obtained lawfully and that the applicant has the right to submit them to the Controller for considering the inquiry. The following apply: Material Transfer and Use Terms. The email itself does not constitute consent by all persons in the documents and does not relieve the Controller of obligations. Where there is doubt, authority and the bases for submission are requested, access is restricted and use of the materials is suspended.

9. Personal data protection and final provisions

9.1. The Controller takes the necessary legal, organizational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful acts. Such measures include restricting access, ensuring secure data transmission, monitoring retention periods and monitoring compliance with requirements by engaged processors.

9.2. Personal data is destroyed by methods that preclude restoration of its contents in the information system and/or provide for the destruction of physical media containing personal data. The Controller ensures documentary confirmation of destruction in the cases and manner established by legislation.

9.3. The current version of the Policy is posted on the Website with its revision date. Changes to the Policy do not change the scope of consent previously given. If subsequent processing requires new consent, such consent is obtained separately before the relevant processing begins.