Privacy Policy - ZA GROUP

ZA GROUP | ZARETSKAYA ADVISORY

Personal data processing policy for [https://zareckaya.com]

Edition of 13 October 2026 · This is an English translation provided for convenience. In case of any discrepancy, the Russian version prevails.

We collect only the data needed for a specific purpose: to reply to your enquiry, fulfil an order, run a recruitment process or send a newsletter. Each purpose, the data used, the legal basis and the retention period are listed in Section 4. We ask for consent in a separate document, and you can withdraw it by writing to info@zareckaya.com. Your data is stored on servers located in the Russian Federation. - ZA GROUP, OCTOBER 2026

Contents

1. General provisions 2. Operator details 3. Principles 4. Purposes, data, legal basis and retention 5. How we process data 6. Security 7. Your rights 8. Visitors from outside Russia 9. Cookies 10. Children and third-party links 11. Changes and contact

1. General provisions

1.1.

This Policy explains what personal data Svetlana Igorevna Zaretskaya (the Operator) processes when you use [https://zareckaya.com] and related services (Business, Careers, the ZA Tools store, your account), why, on what basis, for how long, how it is protected, and what rights you have.

1.2.

The Operator processes data in accordance with:

Federal Law of 27 July 2006 No. 152-FZ «On Personal Data» (as amended, including Federal Law No. 156-FZ of 24 June 2025);
Federal Law No. 149-FZ «On Information, Information Technologies and Information Protection»;
Federal Law No. 38-FZ «On Advertising» (Article 18 - direct marketing);
where applicable to you, the laws of the country of your residence that cannot be waived by agreement (Section 8).

1.3.

This Policy is published as required by Article 18.1(2) of Law No. 152-FZ. A link is placed in the footer of every page and next to every data collection form.

1.4.

This Policy is not a consent. Consent is given through separate documents: consent for enquiries, candidate consent, and newsletter consent.

1.5.

By using the website you confirm that you have read this Policy. If you do not agree with it, do not submit your data through the website.

2. Operator details

2.1.

Operator: Svetlana Igorevna Zaretskaya. Tax ID […], registration no. […]. Address: Republic of Belarus, Minsk, Igorya Luchenka St., 1.

2.2.

Website: [https://zareckaya.com]. Contact for personal data matters: info@zareckaya.com.

2.3.

Person responsible for organising personal data processing: [full name, position]. The Operator is entered in the Roskomnadzor register of data operators, no. […].

3. Principles

3.1.

Processing is lawful and fair, limited to specific predetermined purposes, and does not exceed what those purposes require.

3.2.

Data is kept accurate and up to date. It is stored no longer than required by the purpose and is deleted or anonymised when the purpose is achieved, consent is withdrawn or the data is no longer needed, unless the law requires otherwise.

4. Purposes, data, legal basis and retention

Purpose	Data	Legal basis	Retention
1. Enquiries and consultations. Replying to requests and preparing proposals	Name, e-mail, phone, company, position, message	Consent	Until the purpose is achieved or consent is withdrawn; no longer than 3 years after last contact
2. Orders in the ZA Tools store and contract performance. Order, delivery of digital products, payment, receipts, support	Name, e-mail, phone, company details, order content. Card data is processed by the payment service and is not received or stored by the Operator	Performance of a contract; legal obligations (accounting, tax)	Contract term plus 5 years
3. Account and subscriptions. Access to purchased products, order history	E-mail, name, password (hashed), language, order history	Performance of a contract (User Agreement)	While the account exists plus 30 days after deletion
4. Recruitment (Careers). Handling applications	Name, contacts, CV, experience, education, salary expectations, professional profiles, correspondence	Candidate's consent	Recruitment period plus 12 months; up to 3 years if you consent to the talent pool
5. Newsletters. Information, analytics and marketing messages	E-mail, name	Consent	Until you unsubscribe or withdraw consent
6. Website operation, security and statistics	Cookies, IP address, device and browser type, pages visited. See the Cookie Policy	Legitimate interest (necessary cookies); consent (analytics)	Logs up to 12 months; cookies as stated in the Cookie Policy
7. Protection of rights. Claims, disputes, requests of authorities	Data contained in claims and related documents	Legal obligation; legitimate interest	3 years after the end of the relationship, unless the law requires longer

4.1.

The Operator does not process special categories of personal data or biometric data. Please do not include such information in enquiries or CVs.

4.2.

The Operator does not take decisions producing legal effects solely on the basis of automated processing.

5. How we process data

5.1.

Processing is mixed: with and without automation. Operations include collection, recording, organisation, storage, updating, use, transfer (as listed below), anonymisation, blocking and deletion.

5.2.

The Operator may entrust processing to third parties under a contract and shares only the data necessary for the purpose:

payment service [name; ЮKassa and/or other provider] - to accept payments and issue receipts;
hosting provider [name, servers located in the Russian Federation] - to store data;
newsletter / support service [name, if used];
web analytics [Yandex.Metrica, if used] - only after consent to analytics cookies;
public authorities - upon a reasoned request, where required by law.

5.3.

Candidate data is passed to a prospective employer only with separate candidate consent identifying the recipient or its category and the purpose.

5.4.

Storage in Russia. Data of Russian citizens, and, as a matter of practice, all data collected through the website, is stored in databases located in the Russian Federation.

5.5.

International transfers. The main processing takes place in Russia. If payment in foreign currency is processed by a payment provider outside Russia ([name, country - complete after choosing the provider; if none, state that no transfers abroad are made]), only the data needed to execute the payment is transferred. Before such transfer the Operator notifies Roskomnadzor and updates this Policy.

5.6.

Public disclosure of personal data (testimonials with name or photo) takes place only with separate consent under Article 10.1 of Law 152-FZ.

6. Security

6.1.

The Operator applies legal, organisational and technical measures required by Articles 18.1 and 19 of Law 152-FZ: internal policies and a register of personnel with access; TLS encryption in transit; role-based access with two-factor authentication for administrators; backups and logging; assessment of possible harm to individuals; staff instruction and confidentiality undertakings; an incident response procedure.

6.2.

In the event of a data leak the Operator notifies Roskomnadzor within 24 hours and reports the results of its internal investigation within 72 hours, and informs the affected individuals as required by law.

7. Your rights

7.1.

You have the right to:

obtain confirmation of processing and information about purposes, methods, retention, recipients and the source of data;
request correction, blocking or deletion of data that is incomplete, outdated, inaccurate or no longer needed;
withdraw your consent at any time;
object to processing for marketing purposes;
complain to Roskomnadzor or a court and claim compensation for damage.

7.2.

To exercise a right, write to info@zareckaya.com with the subject «Personal data». Please state your full name, the contact you used on the website and your request. We may ask for additional information to verify your identity.

7.3.

We respond within 10 working days; this period may be extended by up to 5 working days with a reasoned notice. Processing is stopped and data is deleted within the periods set by Article 21 of Law 152-FZ, unless another legal ground requires retention (for example, accounting records).

7.4.

Withdrawing consent: write to info@zareckaya.com with the subject «Withdrawal of consent», use the «Unsubscribe» link in a newsletter or the account settings. Withdrawal does not affect the lawfulness of processing carried out before it. Withdrawal may make it impossible to provide a service that requires the data.

8. Visitors from outside Russia

8.1.

The Operator is established in the Russian Federation and processes data under Russian law. If you use the English version of the website from another country, your data will be transferred to and stored in the Russian Federation, where the level of data protection may differ from that of your country. By giving consent you expressly acknowledge and accept this.

8.2.

If the data protection law of your country (for example, the GDPR in the EU or the UK GDPR) applies to the processing of your data by the Operator by operation of that law, you may exercise the rights provided for there: access, rectification, erasure, restriction, portability and objection. Send your request to info@zareckaya.com; we respond within the time limits required by the applicable law. You may also contact your local data protection authority.

8.3.

The website is not specifically directed at consumers in the European Union or the United Kingdom, and the Operator does not monitor their behaviour. Business customers and individuals who contact the Operator on their own initiative are welcome.

8.4.

Visitors from the Republic of Belarus may also exercise rights under Law No. 99-Z of 7 May 2021 (Articles 10-15), including withdrawal of consent and requests to stop processing, with a response within 15 days (5 working days for information requests).

9. Cookies

9.1.

Necessary cookies always work; analytics, functional and marketing cookies are enabled only after your consent through the banner. Details are in the separate Cookie Policy.

10. Children and third-party links

10.1.

The website is intended for persons over 18. The Operator does not knowingly collect data of minors; if such data is received it will be deleted on request of a legal representative.

10.2.

The website may contain links to third-party resources. The Operator is not responsible for their privacy practices.

11. Changes and contact

11.1.

The Operator may amend this Policy. The new version applies from the moment of publication. Earlier versions are available on request at info@zareckaya.com. Last updated: 13 October 2026.

Version 1, 17/10/2026