Privacy Policy

How LLC "CTI" collects, uses and protects personal data of website users

Effective date: October 3, 2026

1. General Provisions

This Personal Data Processing Policy (the "Policy") sets out how Limited Liability Company "Center of Technology Innovation" (LLC "CTI", INN 2221263040, OGRN 1252200008631, address: 656052, Altai Krai, Barnaul, Georgiya Isakova St., 111, apt. 15; the "Operator") processes and protects personal data received in connection with the ctinnovations.ru website (the "Website") and the provision of services.

The Policy is based on Federal Law No. 152-FZ "On Personal Data" dated 27.07.2006 and is a publicly available document published on the Website pursuant to Part 2 of Article 18.1 of that law.

The person responsible for organizing personal data processing is the CEO of LLC "CTI", Sergey Vladimirovich Brovko.

2. Categories of Data Subjects

The Operator processes personal data of the following categories of data subjects: employees of LLC "CTI"; family members of employees, to the extent required to provide tax deductions and labour-law guarantees; Website visitors; persons who contact the Operator via the contact form, email or phone; counterparties who are individual entrepreneurs or self-employed individuals paying the professional income tax, and representatives of customers and other counterparties, in connection with preparing, concluding and performing contracts.

3. Data We Process

Contact form: name, email address, company name (optional), message text, and the IP address, date and time of submission.

Email or phone inquiries: name, email address, phone number and information provided in the inquiry.

Counterparty representatives: full name, position, organization, phone number and email address. Counterparties who are individual entrepreneurs or self-employed: full name; taxpayer ID (INN); OGRNIP (for individual entrepreneurs); registered address; phone number and email address; bank details (account number, bank name and BIC); professional income tax registration details (for the self-employed); amounts paid under the contract.

When the Website is visited, the hosting provider's server automatically logs the IP address, date and time of the request, the requested page and browser information. If the user accepts analytical cookies in the Website banner, Yandex.Metrica additionally collects visit statistics (see the Cookie Policy).

Employees: full name; date and place of birth; passport details; registered and residential address; SNILS (individual insurance account number); INN; employment and education history; income and tax information; bank details; phone number and email address; marital status. Employees' family members (children): full name; date of birth; birth certificate details; full-time education status, to the extent required to provide standard tax deductions (article 218 of the Tax Code) and guarantees under the Labour Code.

Special categories of personal data (racial or ethnic origin, political opinions, health, etc.) and biometric personal data are not processed.

4. Purposes of Processing

Personal data is processed in order to: respond to user inquiries; prepare, conclude and perform service agreements; maintain HR and accounting records and fulfil employer and tax agent obligations; ensure the operation and security of the Website; analyze Website traffic (only with consent to analytical cookies).

5. Legal Basis

Personal data submitted through the contact form is processed based on a separate consent of the data subject to the processing of personal data (available at ctinnovations.ru/en/consent), given by ticking the corresponding checkbox before submitting the form.

Analytical cookies are used based on the consent the user gives in the Website banner.

Personal data of counterparties who are individual entrepreneurs or self-employed, and of counterparty representatives, is processed on the basis of contracts being concluded or already concluded, and to fulfil the Operator's obligations under Russian law, including accounting and tax law.

Employees' personal data is processed on the basis of the employment contract and in accordance with the Labour Code, the Tax Code, Federal Law No. 402-FZ "On Accounting" of 06.12.2011 and Federal Law No. 27-FZ of 01.04.1996 on individual (personalized) accounting in compulsory pension and social insurance systems.

Web server logs are processed in the legitimate interests of the Operator in ensuring the operation and security of the Website (clause 7, part 1, article 6 of Federal Law No. 152-FZ), provided that the rights and freedoms of the data subject are not violated.

6. Processing Procedure

The Operator carries out mixed processing of personal data (with and without automation tools), including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access) in the cases stated in this Policy, blocking, deletion and destruction.

Recording, systematization, accumulation, storage, clarification and retrieval of personal data of Russian citizens are carried out using databases located in the Russian Federation. No cross-border transfer of personal data takes place.

Personal data is not disseminated (disclosed to an indefinite range of persons). No decisions producing legal effects for the data subject are made solely on the basis of automated processing.

7. Data Transfer to Third Parties

Contact-form messages are processed on the Website hosting provider's server and delivered to LLC "CTI" corporate email; both the server and the mail service are located in the Russian Federation. With the user's consent, Yandex.Metrica (Yandex LLC) is used for traffic analysis.

Employees' personal data is provided to the Federal Tax Service, the Social Fund of Russia and the servicing bank to the extent and in the cases required by Russian law. Personal data of counterparties who are individual entrepreneurs or self-employed is provided to the servicing bank to make payments under the contract and to the Federal Tax Service in the cases required by Russian law.

We do not sell or transfer personal data to third parties for any purpose other than those stated in this Policy, except as required by Russian law.

8. Data Retention

Inquiries received via the contact form, email or phone: until the purpose of processing is achieved, but no longer than 3 years from receipt, or until consent is withdrawn.

Records of consents given (date, IP address, name, email address, consent version): 3 years from the date consent was given, to demonstrate lawful processing.

Personal data of counterparties who are individual entrepreneurs or self-employed, and of counterparty representatives: for the term of the contract and 5 years after the end of the year of its performance, where retention of documents is required by accounting or tax law.

Personal data of employees and their family members: for the duration of employment and the retention periods for HR and accounting documents established by Russian law (up to 50 years for certain HR documents).

Web server logs: for the period set by the hosting provider, but no longer than necessary for the operation and security of the Website. Yandex.Metrica data is stored in accordance with the service terms of use.

9. Blocking and Destruction of Data

Personal data is destroyed when the purposes of processing are achieved or no longer needed, the retention period expires, the data subject withdraws consent, or unlawful processing is identified, unless otherwise provided by federal law.

Destruction deadlines: when the purpose is achieved — within 30 days; upon withdrawal of consent, a request to stop processing, or identification of unlawful processing that cannot be remedied — within 10 business days. If data cannot be destroyed within that period, the Operator blocks it and destroys it within 6 months, unless federal law sets a different period.

Destruction is carried out by deleting records from mailboxes, logs and other information systems and/or destroying paper media, and is documented in a personal data destruction certificate in accordance with Roskomnadzor requirements.

10. Data Subject Rights

The data subject has the right to obtain information about the processing of their personal data, to demand its clarification, blocking or destruction if the data is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose, and to withdraw consent to processing.

Requests are sent to contact@ctinnovations.ru or to the Operator's postal address. The Operator responds within 10 business days of receipt; this period may be extended by no more than 5 business days with a reasoned notice.

The data subject may appeal the Operator's actions or inaction to Roskomnadzor or in court.

11. Data Protection Measures

The Operator takes legal, organizational and technical measures to protect personal data: a person responsible for organizing personal data processing has been appointed; only employees who need access to perform their duties can access personal data; access to mailboxes and the server is password-protected; the Website uses a secure HTTPS connection.

12. Changes to this Policy

LLC "CTI" may amend this Policy. The current version is always available at ctinnovations.ru/en/privacy.

13. Contacts

For questions about personal data processing, contact contact@ctinnovations.ru, call +7 933 311-15-44, or write to: LLC "CTI", 656052, Altai Krai, Barnaul, Georgiya Isakova St., 111, apt. 15.