Personal data processing policy

1. General provisions

This Personal Data Processing Policy sets out the rules for processing personal data through https://bernev.com (the Website). It is an internal policy based on Russian law and principles of good faith and proportionality. It covers automated and manual collection, recording, organisation, accumulation, storage, correction, retrieval, use, disclosure or access, restriction, deletion and destruction.

This Policy applies when you use the Website or its listed communication channels, including messaging, email, telephone and video calls. Contact may require processing for the stated purpose, but a valid legal basis is still required. The rules on cross-border transfers and your data rights also apply. Using a channel is not blanket consent to unrelated processing.

The person determining the processing remains accountable for it. This Policy sets out requirements relevant to regulatory checks, disputes and data-rights requests; it is not proof of compliance by itself. It must be read consistently with the law, giving priority to data-subject rights while respecting the Operator's lawful interests. The rules on legal bases and processing records also apply.

2. Definitions

These definitions apply throughout the Policy, including its provisions on data-subject rights and the Operator's responsibilities. They must be read with the rules on third-party disclosures, processing entrusted to third parties and cross-border transfers.

Personal data means information relating directly or indirectly to an identified or identifiable individual. This includes information that can identify someone when combined with other data, such as an IP address, device identifiers or correspondence. The same definition applies to cookies, web analytics and security measures.

The personal data operator is Andrey Eduardovich Bernev, an individual resident in Georgia. References to the Website Administration mean this Operator.

A data subject is the individual whose personal data is processed. This includes a company representative acting in a business-to-business relationship.

Processing means any operation or set of operations involving personal data, including collection, recording, organisation, accumulation, storage, correction, retrieval, use, transfer, anonymisation, restriction, deletion and destruction.

Transfer means disclosing personal data to specified recipients or granting access to it, including entrusting processing to a third party. The term also applies to the Policy's rules on data-subject rights, processing procedures and records.

Cross-border transfer means transferring personal data to a foreign country or foreign recipient, subject to the applicable legal definition. The Policy's cross-border transfer rules also apply to transfers involving cookies and web analytics.

A personal data information system comprises the databases, technology and equipment used to process personal data. These systems must meet the Policy's security requirements.

Consent means a freely given, specific, informed and unambiguous indication of an individual's wishes, expressed through affirmative action. It must be recorded in line with the Policy's consent requirements and any applicable localisation and storage rules.

Confidentiality requires the Operator to prevent disclosure of personal data to third parties without consent or another lawful basis. This duty must be read with the Policy's security and interpretation rules.

Terms not defined here have the meaning given by applicable Russian law and relevant legal interpretation. The Policy's interpretation rules must respect that meaning.

3. Legal basis and approach

The Policy is based on the Russian Constitution, Federal Law No. 152‑ФЗ on Personal Data, Federal Law No. 149‑ФЗ on Information, Information Technologies and Information Protection, and other applicable rules on processing, security and localisation. Relevant regulatory guidance must also be considered when interpreting the Policy and assessing responsibility.

The Policy takes a risk-based approach, reads legal requirements together and requires documented legal grounds and procedures. Each processing operation must have a defined purpose, a valid legal basis, a retention period and appropriate safeguards.

Personal data processing may be necessary to meet obligations to individuals or pursue the Operator's lawful interests. Processing purposes, legal grounds, responsibilities and record-keeping requirements must be considered together.

4. Operator and privacy contact

The personal data operator is Andrey Eduardovich Bernev, an individual resident in Georgia.

For personal data enquiries, use only the email address bernev_64@mail.com. You may request access, correction or deletion of your data, or withdraw consent, at this address. Explain the request and provide enough information to locate your correspondence. Do not attach a passport or your full case file to the first email.

The Operator is responsible for determining the purposes, means and scope of processing, controlling access and adopting internal procedures. Appointing authorised persons or contractors does not remove the Operator's responsibility for lawful processing or compliance with the Policy's third-party processing and security requirements.

Internal instructions must define responsibilities, authority and access restrictions, while limiting data to what is needed and keeping datasets separate. The Operator must document control, audit and incident-response procedures, with responsibilities and retention requirements clearly defined.

5. Scope and limits

The Policy covers processing connected with the Website and related services, including enquiries, consultation requests, subscriptions, separately agreed document exchanges and technical browsing data. This is not an exhaustive list. Any forms or other processing must have a stated purpose and a valid legal basis. The Website has no public document-upload facility; document exchange remains subject to separate arrangements and the Policy's limits.

Linked third-party websites and services have their own privacy arrangements. This Policy does not govern their independent processing. That distinction does not remove the Operator's own legal duties, including providing relevant information about cross-border transfer risks and transfers involving cookies or web analytics.

The Policy covers information you actively provide and technical events such as cookies and access logs. Both are subject to the Policy's processing purposes, legal-basis requirements and retention limits.

6. Processing principles

Processing must be lawful, fair and limited to specified purposes and necessary data. Data must be accurate, kept no longer than permitted and treated as confidential. These principles apply together, alongside the legal-basis requirements; none overrides mandatory law.

Only data necessary for the stated purpose may be processed. It must not be used for incompatible purposes, and reasonable steps must keep it accurate and up to date. When the purpose ends, data must be destroyed under the Policy's retention and destruction rules, unless an overriding legal requirement applies.

1. lawful and fair processing without arbitrary interference in private life;
2. data proportionate to the stated purposes;
3. transparent processing procedures and information that enables individuals to exercise their data rights;
4. separate datasets for different purposes;
5. confidentiality and security through the safeguards required by the Policy;
6. Operator accountability and records of material operations;

priority to data-subject rights where the lawfulness of processing is in doubt.

7. Whose data is processed

The categories below reflect how people interact with the Website and the legal practice. Processing rules depend on the purpose and substance of the relationship, including any contractual or pre-contractual dealings, rather than a person's role alone.

A company representative's information may be needed for pre-contract discussions or work under a business engagement. The appropriate legal basis must still be assessed. The representative retains their data rights and the right to have requests considered under the Policy's request-handling procedures; a business role does not remove those protections.

1. Website visitors reading its content;
2. people enquiring about a possible engagement;
3. clients and prospective clients entering into service agreements;
4. company representatives acting under a power of attorney or other authority;
5. people providing foreign trade documents for legal assessment;
6. subscribers who have separately consented to receive publications;

participants in video consultations and other communications.

8. Categories of personal data

The data processed must match its purpose and legal basis, and the Operator must regularly check that no more is processed than necessary. The amount of information in an enquiry may vary, but that does not remove the duty to limit unnecessary processing.

The Website does not seek special categories of personal data. If documents exchanged by separate arrangement contain such information, processing requires an appropriate legal basis, heightened confidentiality and additional access restrictions. Applicable law governs how these safeguards are applied.

1. identity and contact details, including full name, telephone number and email;
2. job title and company details for business contacts;
3. data in foreign trade documents, including contracts, invoices and declarations;
4. correspondence and enquiries, including legally significant notices;
5. technical data, including IP address, cookies, user-agent and referrer;

communication and mailing preferences, subject to separate consent.

Anyone providing another person's data must have a lawful basis and appropriate authority, and remains responsible for the lawfulness of that disclosure. This does not remove the Operator's own confidentiality and processing obligations.

9. Sources and collection methods

Data is mainly provided voluntarily by the individual through enquiries, separately arranged document exchanges or the listed communication channels. It may also come from an authorised representative or counterparty, but only with appropriate authority and a lawful basis.

Data may be received through Website interfaces, email, messaging and other channels listed by the Operator. Technical data may also be collected automatically through server logs or analytics, subject to the Policy's cookie and web analytics rules, including applicable consent requirements.

1. contact and consultation-request forms;
2. document exchange by separate arrangement;
3. email and messaging services;
4. telephone enquiries, without recording unless separately agreed;
5. automated access logs and analytics tools;

information provided by company representatives.

10. Processing purposes

Processing purposes must be specific and transparent, not open to broader interpretation. If a purpose changes, the Operator must establish a valid legal basis and inform the individuals concerned, respecting their data rights.

Each processing purpose must be linked to the relevant data categories and retention periods. Stating a purpose does not create consent. Where consent is required, it must be obtained separately under the Policy's consent rules.

1. arranging communications and consultations;
2. reviewing foreign trade documents and preparing legal opinions;
3. entering into and performing client agreements;
4. handling claims and litigation for clients;
5. protecting the Website and preventing misuse;
6. analysing usage and improving the service;

sending publications with separate consent.

11. Legal grounds for processing

Personal data may be processed only on a lawful basis that can be documented. Without one, processing is not permitted. Anonymised web analytics may be used only where the applicable requirements are met; anonymisation does not remove the need for a lawful basis for any personal data processing involved.

Relying on a legitimate interest requires an assessment of proportionality and a balance between that interest and the individual's rights, consistent with the processing principles. Information supplied for a legal engagement, including legally significant documents, may be processed on a contractual or pre-contractual basis only where the conditions for that basis are met.

1. the individual's consent, subject to the Policy's consent requirements;
2. performance of a contract or pre-contract steps requested by the data subject;
3. compliance with a legal obligation;
4. protection of the Operator's rights and lawful interests, where legally permitted;
5. infrastructure security and resilience on an applicable legal basis;

other grounds expressly provided by law.

Each legal basis must be used in a way that interferes with privacy no more than necessary. The Policy's data-minimisation, destruction, anonymisation and restriction requirements also apply.

12. Consent

Consent is a separate legal basis used where no other valid basis applies or where the law expressly requires it. It requires affirmative action and cannot be inferred merely from visiting the Website. The Policy's cookie, analytics and marketing rules also apply.

Consent records must show what was agreed, when and on what terms. Evidence must be kept in technical logs or other records, together with previous versions of the consent wording. These records are subject to the Policy's record-keeping and accountability requirements.

1. separate consent for each processing purpose;
2. an affirmative action, such as selecting a checkbox or button;
3. no preselected consent boxes;
4. consent may be withdrawn at any time;
5. withdrawal is recorded and acted on promptly within applicable legal deadlines;

without consent, processing requires another valid legal basis.

13. Contracts and pre-contract enquiries

When you request legal services, necessary data may be processed to assess the matter, prepare a proposal and agree terms. Where a valid pre-contractual basis covers those specific steps, separate consent may not be required. Processing must still be limited to the necessary data and stated purposes.

After an engagement is agreed, data may be processed to perform it, including preparing legal opinions, corresponding, representing the client and assembling evidence. The scope depends on the agreement and the nature of the instructions. Retention is subject to applicable law and the Policy's retention requirements.

1. preparing proposals and agreeing terms;
2. preparing agreements, schedules and powers of attorney;
3. corresponding about the engagement;
4. preparing procedural documents and legal submissions;
5. archiving case materials after the engagement;

using data on a lawful basis to defend the Operator's rights in a dispute.

14. Processing methods and procedure

Processing combines automated and manual operations. Information systems support storage, retrieval and access control. Manual work includes reviewing documents, preparing advice and considering legal positions.

Processing procedures must make each material step lawful, traceable and capable of being evidenced. This includes registering enquiries, organising documents, monitoring retention periods and recording subsequent destruction under the Policy's retention and destruction rules.

1. receiving data through forms, messaging or other channels;
2. registering the enquiry and opening its file;
3. organising and classifying data by purpose;
4. using data to prepare advice and documents;
5. providing authorised persons with data needed for the engagement;
6. updating or correcting data where necessary;
7. keeping access and activity logs;

archiving, anonymising or destroying data in accordance with retention rules.

15. Third-party transfers and processors

Disclosing personal data to a third party requires a lawful basis, such as an applicable contractual ground, legal obligation or consent. Entrusted processing must be covered by an agreement specifying the operations and the processor's confidentiality and security duties. The agreement must prohibit the processor from setting independent purposes for that processing. The Policy's security and record-keeping requirements also apply.

Only the data needed for the relevant purpose may be transferred. The Operator assesses contractors' ability to protect it and includes responsibility for confidentiality breaches in the agreement.

1. a data-processing agreement is required for entrusted processing;
2. the processor must follow the Operator's instructions;
3. no transfer to subprocessors without the Operator's approval;
4. confidentiality and security requirements apply;
5. data must be returned or destroyed when the processing assignment ends, subject to lawful retention;
6. the Operator must be notified of incidents and risks;

compliance with the processing agreement is subject to monitoring and audit.

Individuals retain the right to information about transfers of their data to third parties. Requests are handled under the Policy's data-rights and request-handling procedures.

16. Cross-border transfers

A cross-border transfer requires a lawful basis and an assessment of the protection available in the recipient country. Even where data is stored locally, it may pass through foreign infrastructure. Individuals must receive relevant information about those transfers, including transfers involving cookies or analytics. The Policy's destruction, anonymisation and restriction requirements also remain applicable.

Before a cross-border transfer, the Operator must assess the applicable requirements and obtain separate consent where required. Choosing a communication channel requests communication through it; it does not replace any mandatory consent or other transfer requirement. You may decline that channel.

1. assess protection in the recipient country;
2. explain relevant risks and legal consequences;
3. obtain any required consent where adequate protection is absent, without bypassing other transfer requirements;
4. limit the data transferred;
5. record the cross-border transfer;

review communication channels when the legal framework changes.

17. Data localisation and storage infrastructure

Where applicable law requires localisation of Russian citizens' personal data, the Operator must meet those requirements, including initial storage in Russia. The Operator must identify and document the actual storage infrastructure and its location. Local storage does not replace other applicable processing duties.

External communication services may transfer data outside Russia. Where applicable law requires initial recording or storage in Russia, that requirement must be met alongside the rules on cross-border transfers and retention.

1. the Operator must identify and document hosting and server locations and meet any applicable Russian localisation requirements;
2. records of data and infrastructure locations;
3. cross-border transfers limited to the necessary data;
4. segmented storage and separate archives;

checks against the applicable infrastructure-security requirements.

18. Retention periods

Retention must be limited by the processing purpose, legal requirements and what is lawfully necessary to protect the Operator's rights. When the purpose ends, data must be destroyed or anonymised unless the law requires or permits continued retention.

Retention decisions take account of limitation periods, accounting and tax duties, and evidential needs. Relevant records may be retained until a dispute is finally resolved where a lawful basis permits this.

1. enquiries that do not lead to an engagement: a policy maximum of 3 years, subject to other applicable lawful retention requirements;
2. contract materials: a policy maximum of the contract term plus 5 years, subject to other applicable lawful retention requirements;
3. financial documents: the periods required by law;
4. technical logs: a policy maximum of 12 months, subject to other applicable lawful retention requirements;
5. web analytics data: a policy maximum of 24 months, subject to other applicable lawful retention requirements;

mailing consent: until withdrawal.

19. Destruction, anonymisation and restriction

Data must be destroyed or anonymised when its purpose ends, consent is withdrawn or another legal requirement calls for it, unless retention remains necessary on another lawful basis to fulfil obligations or protect the Operator's rights. Processing may be restricted temporarily during a dispute or while accuracy is checked. The Policy's data-rights and request-handling procedures also apply.

Destruction methods must prevent data recovery, and the action must be recorded. Data anonymised for statistics or service improvement must not allow individuals to be re-identified. The Policy's web analytics requirements also apply.

1. logical deletion followed by media sanitisation;
2. overwriting data with appropriate tools;
3. deleting encryption keys;
4. physically destroying storage media where necessary;
5. anonymising analytics data so that individuals cannot be re-identified;

recording destruction in a certificate or log.

20. Security measures

The Operator must use organisational and technical safeguards against unauthorised access, loss, alteration, disclosure and other misuse. Safeguards must reflect the nature of the data, the scale of processing and identified risks, alongside incident-response and accountability requirements. They cannot guarantee that no incident will occur.

Under this Policy, the Operator must establish internal procedures, assign responsibilities and provide training. The Operator must check that confidentiality requirements are met. This Policy also requires encrypted communication channels, backups, malware protection and security-event monitoring.

1. role-based access limited to those who need the information;
2. multi-factor authentication;
3. encrypted data-transmission channels;
4. regular backups and restoration tests;
5. malware protection and software updates;
6. activity logging and incident monitoring;
7. physical protection of workstations and storage media;

contractor audits and checks on processing agreements.

21. Security incidents

A security incident is an event that compromises, or may compromise, the confidentiality, integrity or availability of personal data. The Operator must establish procedures to detect, record and respond to incidents, consistent with applicable law and the Policy's security requirements.

Following a significant incident, the Operator takes steps to contain its effects, assess harm and restore systems. Data subjects and authorities are notified where legally required. The incident and lessons learned are recorded and used to improve safeguards.

1. detect and record the event;
2. classify the incident and assess its scale;
3. contain the incident and stop unauthorised access;
4. investigate causes and vulnerabilities;
5. restore normal operation;
6. notify data subjects and authorities where required;

document the response and corrective action.

22. Your data rights

You have the rights provided by applicable law, including information about processing, correction, restriction or destruction of data, withdrawal of consent and the right to challenge the Operator's actions. Requests are subject to appropriate identity checks and protection of third-party rights under the Policy's request-handling procedures.

The Operator responds within its powers and the applicable legal deadlines. A request may be refused or limited only on lawful grounds, with an explanation.

1. access to information about processing;
2. correction, restriction or destruction of data where applicable;
3. withdrawal of consent;
4. restriction of processing in the circumstances provided by law;
5. objection to processing for marketing;
6. information about third-party transfers;

the right to challenge the Operator's actions.

23. Handling data requests

Requests sent through the designated privacy contact are registered. The Operator checks the requester's identity or authority, assesses the legal basis and responds within the statutory period.

Where necessary, the Operator may request proportionate additional information to identify the requester or clarify the request. Failure to provide it may prevent fulfilment only where the law permits that result. Your data rights remain applicable.

1. register the request and assign a reference;
2. verify identity and authority;
3. assess the request's legal basis;
4. locate the relevant data;
5. prepare a reasoned response;

fulfil the request where required and record the result.

24. Cookies and web analytics

The Website uses cookies and local storage for site functions, preferences and consent records. Strictly necessary storage is separate from optional traffic analytics. On production hosts, Google Analytics runs only after explicit consent. Applicable consent and legal-basis requirements depend on the technology and processing purpose; describing data as anonymous does not by itself remove those requirements.

You can manage cookies through your browser, although restrictions may affect Website functions. Analytics are not used to make automated decisions with legal consequences for you.

1. technical cookies needed for operation;
2. functional cookies that remember preferences;
3. analytics cookies for statistics;
4. security cookies to prevent misuse;

marketing cookies only with consent.

25. Marketing communications

Sending informational publications and advertising messages requires separate consent. Joining a mailing list is not a condition of receiving legal services, and consent may be withdrawn at any time.

Each mailing includes an opt-out. Marketing processing is limited to necessary data, which is not transferred to third parties unless an applicable lawful basis permits it, subject to the Policy's transfer requirements.

1. mailing consent is separate and voluntary;
2. every mailing includes an opt-out;
3. withdrawal is acted on without unjustified delay;
4. mailing data is not reused for unrelated purposes;

sharing mailing-list data with a third party requires a lawful basis and must meet the Policy's disclosure and processor-agreement requirements.

26. Interpretation and amendments

The Policy is interpreted under applicable Russian law. Mandatory law prevails over any conflicting provision, while unaffected provisions remain in force. Amendments take effect when published on the Website unless the new version states otherwise.

The Operator may review the Policy as legislation and legal practice change. Earlier versions are retained as part of the processing record. The Policy is publicly available and applies to processing through the Website and the Operator's related communication channels.

27. Internal procedures and records

Internal procedures must record every material processing operation, including activity not visible in the interface, such as message routing, document-version archiving and checks on legal grounds. These records must support accountability and demonstrate how the Policy's legal-basis, processing and security requirements are met.

Internal record-keeping procedures must cover enquiries, consents, client files, processor appointments, destruction records and archives. They apply regardless of the scale of processing, while respecting data minimisation and retention limits.

The procedures below set out the basic requirements, not an exhaustive list. They may be supplemented as legal requirements and technology change, subject to the Policy's amendment and accountability rules.

28. Risk assessment and impact assessment

The Operator must maintain an internal risk matrix assessing the likelihood of adverse consequences and the potential harm to individuals. The matrix is not public, but its findings must inform decisions on legal grounds, retention periods and security measures.

An impact assessment is undertaken when introducing relevant Website functions, external services or changes to the data processed. Identified risks may require narrower processing, stronger safeguards or a different procedure.

The risks below are examples. The assessment may include others relevant to an enquiry or a change in the law.

1. unauthorised access to case materials caused by access-control failures;
2. data loss after equipment failure where backups are missing;
3. documents sent to the wrong recipient through human error;
4. phishing aimed at stealing account credentials;
5. unprotected file-transfer channels;
6. collection of data beyond the stated purpose;
7. an incorrect legal basis for processing;
8. inadequate checks on a representative's authority;
9. unapproved cross-border transfers through third-party services;
10. failure to destroy data when retention ends;
11. unjustified publication of information that identifies a client;
12. conflicts of interest when processing data for clients with overlapping interests;
13. legal grounds becoming outdated after a change in the law;
14. internal procedures that do not match actual processing;
15. late responses to data-subject requests;
16. weak passwords or missing multi-factor authentication;
17. unauthorised access to processing records and logs;
18. confidentiality breaches during telephone communications;
19. loss of control over data when appointing new contractors;
20. incomplete information about processing purposes and legal grounds;
21. unjustified reliance on legitimate interests;
22. failure to update consent when processing purposes change;
23. inadequate separation of data by sensitivity;
24. re-identification by linking anonymised and identifying data;
25. insufficient control over archiving and destruction;

poor data quality leading to incorrect legal conclusions.

29. Responsibilities and limitations

The Operator's responsibility is determined by applicable Russian law, agreements with individuals and this Policy. Independent processing by third parties outside the Operator's control is distinct from processing entrusted to them or covered by the Operator's contractual obligations. This distinction does not exclude liability imposed by law.

You must provide accurate information and have a lawful basis to disclose it, including appropriate authority when providing another person's data. The Operator may restrict or decline processing where there are grounds to believe the information was supplied unlawfully or in breach of third-party rights. The processing must still meet the Policy's lawfulness and legal-basis requirements.

The following provisions allocate responsibilities subject to mandatory law.

Responsibility for unauthorised third-party acts depends on the law and the Operator's own duties, not solely on whether the third party is a contractor.

Liability for disruption caused by force majeure is subject to the applicable legal requirements.

Provide current, accurate information sufficient for the relevant purpose.

You must have a lawful basis to supply another person's data.

The Operator may decline processing that has no lawful basis.

The Operator may restrict Website access in response to misuse.

Third-party services are responsible for their own privacy policies; the Operator's separate legal duties remain.

Messaging services may involve cross-border transfer risks. Choosing a service does not waive your rights or the Operator's mandatory duties, and you may decline that channel.

A consultation does not guarantee a particular outcome.

General information does not replace an individual assessment. Any limitation of liability remains subject to mandatory law.

Respect any applicable confidentiality obligations for information you receive.

The Operator may protect lawful interests through court proceedings.

Mandatory retention duties may limit deletion or other requests.

Data may be retained to protect legal rights within the relevant limitation period where a lawful basis permits it.

Providing false information may affect responsibility for resulting harm, without excluding the Operator's own legal duties.

30. Compliance controls and audits

The Operator must maintain legal, organisational and technical measures to support ongoing compliance with applicable data-protection law. These must include internal procedures, checks, training for authorised persons and regular document updates, consistent with the Policy's legal approach and security requirements.

Compliance audits are conducted periodically and when key processing arrangements change. Findings are documented, and identified departures from the Policy must be addressed through corrective action.

31. Publications and anonymisation

Publications, including case studies, must protect confidentiality and avoid identifying individuals. Information that could identify a client directly or indirectly may be published only with that client's explicit, documented consent and subject to applicable law. The Policy's consent and interpretation rules also apply.

Public materials are anonymised by removing identifiers, generalising details or aggregating information without distorting the legal meaning. The combined facts must also be considered because they may identify someone even without a name. Where anonymisation is doubtful, access or publication is restricted further.

1. remove names, document numbers, addresses and unique identifiers from anonymised materials;
2. generalise exact dates and amounts only where doing so preserves the meaning;
3. identify the content as informational and as containing no personal data only where that is accurate;
4. complete an internal legal check before publication;
5. record any publication consent separately;
6. do not use publications to make automated decisions about data subjects;

consider further anonymisation or removal following a data-subject request.

32. Interpretation, conflicts and priorities

Read each provision in the context of the Policy as a whole. If the Policy conflicts with another internal document, this Policy takes priority unless the law requires otherwise.

If a provision is invalid, the unaffected provisions remain applicable. Any uncertainty must be resolved by balancing the interests involved, giving priority to data-subject rights while respecting the Operator's lawful interests. Mandatory law and the Policy's legal-basis and accountability requirements still apply.

1. mandatory law prevails over conflicting policy wording;
2. related provisions must be read together, including those on processing purposes, legal bases and retention periods;
3. data-subject rights take priority;
4. relevant regulatory guidance is considered within the applicable legal framework;
5. Policy changes are recorded and archived;

the Policy applies to all processing within its stated scope, including Website activity and related services.

33. Data classification and access

The Operator must classify data by sensitivity to set proportionate storage and access restrictions. Classification must be considered when data is first received, transferred, archived or destroyed, together with the Policy's retention, destruction and security requirements.

Access depends on the data category, source and purpose. Authorised persons receive only the access needed for their work, and changes are recorded. Where classification is uncertain, the stricter protection applies.

Data classification must be kept up to date and reviewed when processing purposes, contractual terms or applicable legal requirements change. The Policy's processing principles and amendment rules also apply.

34. International standards and working practices

This Policy requires risk-based planning, separation of processing activities and internal controls. The Operator must use relevant information-protection practices only where they are applicable and consistent with mandatory Russian law. This Policy does not claim certification to an international standard.

Document management, logging, incident handling and training must support a processing record that can be audited. These practices must operate within applicable law and the Policy's security, incident-response and accountability requirements.

The Operator commits to the following practices where applicable and consistent with Russian law:

1. accountability through records of key decisions;
2. data protection by design and by default through minimisation and access limits;
3. a regularly updated risk matrix;
4. separation of process ownership, operational and oversight roles;
5. confidentiality training for authorised persons;
6. assessment of the impact on data-subject rights;
7. processing registers and process records;
8. access limited to the minimum necessary permissions;
9. encrypted communication channels and protection of stored data;
10. incident-response procedures with time-stamped records;
11. contractor checks before access is granted;
12. regular internal audits, reports and corrective-action plans;
13. monitoring legal changes and updating documents;
14. separate operational and archive storage;
15. access logs and subsequent review;
16. records sufficient to reconstruct processing during an audit;
17. reassessment of legal grounds whenever purposes change;
18. retained version histories for the Policy and consents;
19. cross-border transfers limited to the necessary data;
20. a publicly accessible policy stating the principal processing terms;
21. periodic checks on retention and destruction deadlines;
22. anonymisation to reduce analytics risks;
23. business-continuity and incident-recovery plans;
24. internal indicators for compliance with processing procedures;
25. security measures proportionate to the risks;
26. confidentiality terms in counterparty agreements;

data-subject complaint procedures with recorded outcomes.

35. Processing records and notices

Logs, registers and internal reports record material processing actions for possible audits or disputes. Recordkeeping applies to all relevant data categories, including technical and archived data, regardless of the scale of processing.

The Operator must notify individuals and authorities where the law requires it and record each notice's date, channel and content. Where needed, the notice must explain the individual's rights and how to exercise them under the Policy's request-handling procedures.

Processing records must be protected, with access limited to authorised persons. They must be kept only within the Policy's retention limits and remain subject to its destruction, anonymisation and restriction rules.

36. External services and integrations

The Operator may use external email, analytics, notification and cloud video-conferencing providers to support the Website and communications. Any data transfer must meet the Policy's third-party disclosure, processor-agreement and cross-border transfer requirements, as well as its confidentiality and data-minimisation rules. Technical convenience is not a separate legal basis.

External services receive only the data needed for the relevant function, not the full dataset. Required agreements address confidentiality and security, and access is limited to the task. Relevant risks are explained. An alternative channel may be chosen where it allows the Operator to fulfil the engagement and legal obligations.

The examples below describe external-service uses and safeguards. Additional uses remain subject to the Policy's general requirements.

1. email services for replies and records of agreements;
2. messaging for prompt communication, subject to cross-border transfer requirements and the right to decline that channel;
3. video consultations without recording unless separately consented to;
4. traffic analytics subject to anonymisation and applicable consent requirements;
5. notifications confirming receipt of an enquiry;
6. encrypted cloud storage for temporary document exchange;
7. file transfers limited to necessary content;
8. required processing agreements with services that access data;
9. checks on server locations and localisation requirements;
10. regular review of providers' privacy policies;
11. discontinuing a service that fails applicable legal requirements;
12. information for data subjects about transfers through third-party services;
13. alternative communication channels where available under the Policy;
14. records of service use in the processing log;
15. limits on providers' access to archived data;
16. no use of these services for automated decision-making;
17. encryption of data transmitted through external services;
18. control of providers' data-retention periods;
19. checks on the legal basis for transfers through integrations;
20. data minimisation in every integration;
21. the ability to end an integration where required by law;

service terms recorded in the compliance register.

37. Professional confidentiality and permitted use

The Operator treats information received in legal work as confidential, including initial enquiries made in confidence before an engagement is agreed. The Policy's interpretation rules and confidentiality safeguards for publications also apply.

Information may be used only for the purposes permitted by this Policy, the engagement and applicable law. Publication, third-party disclosure or use for another client requires consent or another valid legal basis. The Operator takes steps to avoid conflicts of interest and keep different clients' files separate.

The following confidentiality and ethical requirements apply to personal data used in the practice:

1. no disclosure of client information without consent or another lawful basis;
2. protection of correspondence and documents;
3. case-file access limited to authorised persons;
4. no unauthorised use of a client's information for another person's benefit;
5. steps to prevent conflicts between concurrent engagements;
6. separate client files without mixing materials;
7. heightened safeguards for trade-secret documents;
8. no case-study publication without adequate anonymisation or client consent;
9. information for clients about messaging-service transfer risks;
10. no third-party transfer without a lawful basis;
11. requests for client information limited to what is needed;
12. correction of data following a valid request;
13. retention of evidence supporting lawful processing for the applicable period;
14. good faith and reasonableness in processing;
15. assessment of the legal consequences of disclosure;
16. no use incompatible with the engagement;
17. compliance with advertising rules for mailings;
18. information about processing in response to a valid request;
19. the right to withdraw consent and request that processing stop, subject to applicable law;
20. responses within the applicable deadlines;
21. archive retention only for lawful periods;
22. destruction or anonymisation when the processing purpose ends, subject to lawful retention;

internal checks on professional confidentiality.

38. Terminology and cross-references

Defined terms and references to related policy topics must be read together. A reference includes the relevant conditions and limitations, even where they are not repeated. The Policy must be interpreted as a whole, subject to mandatory law.

References to related policy topics preserve the conditions that apply to processing, including third-party disclosures, entrusted processing and cross-border transfers. A provision cannot be read in isolation from the processing principles, retention limits and security requirements.

Conditions on transfers, confidentiality, legal bases and retention may appear in several parts of the Policy. They must be read consistently across the rules on processing, data rights and responsibility. Repetition does not create a separate permission to process data.

1. processing covers the operations included in the Policy's definitions, even when a relevant operation is not repeated in a particular provision;
2. legal grounds means the bases described in the Policy, but only a basis valid for the particular processing may be used;
3. consent must meet the Policy's requirements for how it is given, recorded and withdrawn;
4. transfer includes entrusting processing to a third party and cross-border operations, subject to the requirements for each;
5. retention periods must be read with the Policy's retention rules and its requirements for destruction, anonymisation and restriction;
6. confidentiality includes the Policy's security safeguards and the practice's commitment to protect information received in legal work;
7. communication includes email, messaging, telephone and video calls, subject to the rules on data collection and external services;
8. security incidents must be recorded and handled under the Policy's incident-response procedures;
9. data-subject rights include restriction of processing as well as access and withdrawal of consent;
10. anonymisation requires methods that prevent individuals from being identified or re-identified;
11. legitimate interests require a proportionality and balancing assessment;
12. archives remain subject to access, retention and destruction requirements;
13. authorised person refers to anyone given access to data, regardless of their role or status;
14. foreign trade documents require heightened confidentiality;
15. notices include communications to data subjects and authorities;
16. an auditable record includes consent records, logs and archives;
17. marketing communications require separate consent;
18. localisation refers to legal duties, including initial storage in Russia where required by applicable law;
19. contractor references include the applicable processing-agreement requirements;
20. compliance includes internal procedures, audit and monitoring;

terms not defined in the Policy are interpreted under applicable Russian law.

39. Internal checks and Policy updates

The Operator must check compliance with this Policy and applicable Russian law through scheduled reviews and ongoing monitoring. Checks must cover enquiry records, consent documentation and retention periods. Findings must be documented, and failures corrected within the required deadlines, in line with the Policy's compliance-review and record-keeping requirements.

The Policy is updated when needed, including after legal, technical or operational changes or identification of a legal risk. New versions are published on the Website and earlier versions archived.

Internal controls and document updates cover:

1. scheduled audits comparing actual processing with the Policy;
2. retention deadlines and timely destruction;
3. complete and accurate consent and notice records;
4. a valid legal basis for each purpose;
5. accurate sensitivity classifications;
6. access-log review and unusual activity;
7. contractors' compliance with processing agreements;
8. cross-border transfer and localisation requirements;
9. publication confidentiality and anonymisation;
10. updated internal procedures when processing changes;
11. changes in legislation and legal practice;
12. training on new requirements and procedures;
13. registration and review of data-subject requests;
14. the effectiveness of safeguards and corrective action;

an archive of Policy versions and related documents.

40. Application and effective date

The Policy applies to personal data processed through the Website and related communication channels, whether supplied actively or generated by technical processes. An exception requires a legal basis or a written agreement consistent with mandatory law.

The Policy takes effect on publication. A new version replaces the previous version unless stated otherwise, while earlier versions remain part of the record for their period of operation. Changes required by law or identified risks may be published without advance notice only to the extent permitted by law.

Read these provisions with the Policy's rules on interpretation, conflicting requirements, internal checks and updates. Related conditions and repeated provisions form part of the Policy as a whole, but cannot restrict statutory rights.

41. General statement

The Policy addresses the Operator's lawful interests and data-subject rights together. Individual provisions should be read with their relevant conditions and cross-references, not as independent permissions to process data.

The Policy is intended to operate as one document, interpreted in good faith and consistently with data-subject rights, the Operator's lawful interests and applicable law.

42. Changes in the law

A provision affected by a change in law or legal interpretation must be applied consistently with mandatory law and updated where necessary. The Operator may make prompt corrections without reducing data-subject rights, while keeping the Policy consistent as a whole.

43. Supplementary statement

The Policy's cross-references, qualifications and related provisions are to be read together.

44. Changes to processing

The Policy must be updated when processing purposes, data categories or services change. These changes do not remove the Operator's identity or the contact details for data-rights requests.

45. Contacting the Operator

Andrey Eduardovich Bernev, an individual resident in Georgia. The sole contact for personal data enquiries is: bernev_64@mail.com.

46. International routes, the EAEU and China

Data is minimised for enquiries about supplies, disputes, documents, payments, valuation, classification, origin, marking, post-release checks or appeals involving the EAEU, China, Hong Kong, Kazakhstan, Belarus, Armenia, Kyrgyzstan or another foreign jurisdiction. Before an engagement is agreed, the Website requests only initial contact details: a name or business form of address, contact channel, company or transaction role, country or route, document type, receipt date, response deadline or proposed meeting date.

The Website has no public upload facility for files, customs declarations, contracts, invoices, bank records, third-party documents or material containing trade secrets. The booking calendar and Telegram bot are intended for meeting details and reminders, not document submission. Documents needed for analysis are exchanged by separate arrangement through direct contact. Share only what is needed, taking account of confidentiality, the documents involved, third-party information and applicable law.

EAEU enquiries use the Russian processing framework together with country annexes for Belarus, Kazakhstan, Armenia and Kyrgyzstan. The annexes address local terminology, data rights, cross-border transfers, minimisation and external services. Kazakh, Armenian, Kyrgyz and Belarusian versions are not published as unchecked machine translations; their publication remains subject to separate language and legal approval.

China–Russia enquiries, Hong Kong trading chains and the English page for Chinese businesses are subject to additional launch controls. Chinese-language forms remain unavailable pending approval of the page, processing notice, data categories, recipients, analytics, advertising tags and transfers against the relevant PIPL/CAC requirements. Russian text or an automatic translation is not presented as an approved Chinese version.

47. External services and approval requirements

The Website may use or link to communication, analytics, video, advertising and professional outreach services. Each is assessed separately for purpose, data, loading time, recipient country, consent requirements and behaviour before and after consent.

1. Telegram is used for communication and meeting notifications. The bot does not accept files. Document sharing is arranged directly after initial contact.
2. The booking calendar collects a time, name or business form of address, contact details, topic, document type and deadline. It must not collect unnecessary information.
3. Zoom or another video service is used for the meeting. A meeting link or reminder does not mean that documents are shared through that service.
4. YouTube embeds may send requests to external domains. Country pages with stricter privacy requirements use or favour covers, links or loading deferred until the user acts, as appropriate to the approved configuration.
5. Google Analytics 4 and other analytics tools are permitted only in a consent-aware configuration, with network checks before and after consent.
6. LinkedIn account-based marketing, Insight Tag, retargeting, customer-list uploads and similar tools are not launched on international or legally sensitive pages without a separate provider map, required consent, policy coverage and legal approval.
7. WhatsApp, email, telephone and other external channels are used at the user's initiative. The relevant platform's terms also apply when that service is opened.

Paid targeting, retargeting, LinkedIn Insight Tag, Chinese-language forms and EAEU or China-specific enquiry forms remain subject to an approved provider map. It records the service, purpose, data category, recipient and country, loading trigger, cookie/localStorage use, legal basis, consent requirement, privacy-policy link and live implementation test results.

48. Country annexes and launch status

Country annexes define launch restrictions; they are not individual advice from a lawyer in that country. Pending local legal approval, pages operate only in a limited mode: no file uploads, advertising pixels or hidden retargeting, and only minimal contact and deadline information.

1. Russia: the Federal Law No. 152-ФЗ framework covers contact details, enquiry purpose, document type and deadline, communication channel, consent records and withdrawal rights.
2. Belarus: enquiry forms and advertising remain subject to approval under Law No. 99-Z, including purpose transparency, minimisation and disclosure of external services.
3. Kazakhstan: the ru-KZ and planned kk-KZ versions require country-specific approval under Law No. 94-V, including consent, cross-border transfers and service-provider arrangements.
4. Armenia: the initial ru-AM version is subject to review under HO-49-N. The hy-AM version is not approved for publication until its language and legal terms are cleared.
5. Kyrgyzstan: approval must address the current digital framework and data-protection authority and registry practice. References to earlier legislation may not suffice after the transition period.
6. China: PIPL/CAC approval covers the overseas recipient, purposes, data categories, individual rights, cross-border transfers and any separate consent required.
7. EU/EEA and UK: separate cookie, consent and transfer controls apply where relevant, including for visitors in the Netherlands, Germany and the UK under GDPR, PECR or ePrivacy requirements.
8. United States: targeted advertising, retargeting and processing involving residents of particular states require a separate assessment of applicable privacy and advertising disclosures.

Technical readiness is not full privacy approval. Until the country annex, provider map, implementation evidence and legal assessment are complete, a page may serve as an informational route only, not as an approved international data-collection service.