01 General

This Policy defines how personal data (hereinafter — PD) is processed and protected when you useevolostok.ru, contact forms, consultation booking, and CRM cabinets (/login, /cabinet, /app, /admin).

The Policy is prepared with regard to Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” and related regulations. By using the site and submitting forms, you confirm that you have read this Policy.

This document describes Evolostok’s actual processes. It is not a public offer and does not replace an individual contract or project NDA.

02 Controller and contacts

The personal data controller is the person processing PD through the website and services under theEvolostok brand (hereinafter — “Controller”, “we”).

• Website: https://evolostok.ru
• PD inquiries: info@evolostok.ru
• Contact form: /en/contact/
• Phone / WhatsApp: +7 965 770-00-00

Full legal details of the Controller (name, TIN/OGRN or sole-proprietor details, address) are stated in the services agreement and provided on request to the email above — we do not publish invented entity details on the site.

03 Who is a data subject

We process PD of the following categories of subjects:

• website visitors and people who fill inquiry / call-booking forms;
• representatives of client and prospective-client companies;
• CRM cabinet users (clients, operators, admins) — after invitation or registration;
• counterparties and partner contact persons within an agreed project.

Special categories of PD (health, biometrics, etc.) are not intentionally collected via the website.

04 Data and purposes

We process general personal data only to the extent needed for the stated purpose:

05 Legal bases

Processing is carried out on one or more bases under Art. 6 of 152-FZ:

• subject’s consent — checkbox in the inquiry form and other explicit consent actions;
• contract — concluding and performing a contract to which the subject (or the organisation they represent) is a party or beneficiary;
• Controller’s legitimate interests — answering inquiries, spam and abuse protection, within limits that do not violate subjects’ rights;
• fulfililling duties imposed by Russian law (where such requirements apply).

06 Actions and methods

PD may be collected, recorded, systematised, accumulated, stored, updated, retrieved, used, transferred (provided / accessed), depersonalised, blocked, deleted or destroyed.

Processing is automated (website, CRM, email) and, where needed,non-automated (correspondence, project working papers). Profiling in the sense of legally significant decisions based solely on automated processing is not used.

07 Retention and deletion

• website inquiries — until the processing purpose is achieved (reply / assessment) and then no longer than needed for business correspondence and rights protection, or until consent is withdrawn if no other basis applies;
• contract-related data — for the contract term and periods required by accounting / tax / contractual retention rules;
• CRM accounts — while access is active; after deactivation — for periods needed to close the project and archive under the contract.

After retention ends or consent is withdrawn (if no other legal basis remains), PD is deleted or depersonalised: removal from working systems, access revocation, and backup clearance within the normal rotation cycle.

08 Third-party transfer

We do not sell personal data. Transfer is possible only:

• to contractors and partners needed for the project (e.g. local operating support in Bangladesh), in the volume agreed with the client, and with a legal basis;
• to infrastructure providers (hosting, email, CRM infrastructure) acting under the Controller’s instructions or a service agreement;
• when required by a court, regulator or other authorised body under applicable law.

When processing is entrusted to a third party, we require confidentiality and protection measures proportionate to the task.

09 Cross-border transfer

Evolostok projects involve markets in Russia and Bangladesh. Contact details and project materials may be shared with the local team / partners outside the Russian Federationonly to the extent needed to perform agreed work, and on the basis of consent, a contract or another lawful ground.

If services with servers outside Russia are connected (e.g. analytics after it is enabled), the list and terms will be reflected here and/or in the cookie policy.

10 Security measures

The Controller applies organisational and technical measures, including:

• role-based access to PD (CRM cabinet);
• HTTPS for the website and cabinets;
• accounts, sessions and secure authentication practices;
• NDAs and access segregation for sensitive project materials;
• regular access reviews when the project team changes.

Absolute security on the internet cannot be guaranteed; we aim for a protection level proportionate to the risk and nature of the data processed.

11 Cookies and analytics

The site may use necessary cookies for operation and security (including CRM sessions). Marketing / analytics tools are connected separately; until counters are enabled, analytics cookies are not set intentionally.

Details, cookie types and controls — in the document“Cookies”.

12 Your rights and how to contact us

Within 152-FZ you may:

• obtain information about processing of your PD;
• request rectification, blocking or deletion where lawful grounds apply;
• withdraw consent to processing;
• complain about the Controller’s actions to Roskomnadzor or a court.

How to contact us

Write to info@evolostok.ru or use thecontact form. Include your name, contact email and the substance of the request. We will reply within the timelines set by Russian law.

Withdrawal of consent does not affect the lawfulness of processing before withdrawal and does not cancel processing if another basis applies (e.g. contract or law).

13 Policy changes

We may update this Policy when processes, services or legal requirements change. The current version is always at /en/privacy/. The date and version number are in the page header.

For material changes affecting previously given consent, we may request new consent or notify you through available channels (email / cabinet).