Skip to content

Personal Data Processing Policy

Version: 1.0-draftEffective from: September 15, 2026

Draft. Prepared per docs/04-LEGAL-RF.md and pending review by the company’s lawyer; the version is marked “-draft” until approved. This is a translation of the Russian original, which prevails. TODO(legal-review).

1. General

This Personal Data Processing Policy (the “Policy”) is based on Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (“152-FZ”) and sets out how Limited Liability Company “RSL AUDIT” (ООО «РСЛ АУДИТ») (the “Operator”) processes personal data and protects it.

The Policy is published on rsl-audit.ru (the “Site”) as required by part 2 of article 18.1 of 152-FZ and covers all personal data the Operator receives through the Site. By using the Site forms a visitor confirms having read the Policy.

2. Operator and contacts

  • Name: Limited Liability Company “RSL AUDIT” (ООО «РСЛ АУДИТ»)
  • INN 9727135247, KPP 772701001, OGRN 1267700282475
  • Address: 34 Bolshaya Cheryomushkinskaya St., premises 2/1N/2, Moscow, 117218, Russia
  • E-mail for personal data requests: office@rsl-audit.ru

The person responsible for organising personal data processing is appointed by an internal order; details are available on request at the e-mail above. TODO(content): add the position once appointed.

3. Definitions

Terms are used as defined in article 3 of 152-FZ:

  • personal data — any information relating to a directly or indirectly identified or identifiable natural person (data subject);
  • processing — any operation with personal data: collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer (provision, access), anonymisation, blocking, deletion, destruction;
  • operator — RSL Audit LLC, which determines the purposes and content of processing.

4. Purposes of processing

  • handling requests sent through the Site forms (consultation, callback, quote request, course enrolment) and contacting the requester;
  • concluding and performing contracts for audit and related services, consulting, subscription support and training;
  • reviewing job applications and CVs;
  • sending information and marketing materials — only with a separate mailing consent;
  • anonymised visit statistics (Yandex Metrica) — only after consent to analytics cookies;
  • protecting forms from automated submissions and keeping the Site secure.

5. Data subjects and categories of data

  • visitors who send a request: full name; phone number; e-mail; company and position (if given); the text of the request;
  • job applicants: information from the CV and cover letter the applicant chose to provide;
  • representatives of clients and counterparties: contact details needed to conclude and perform a contract;
  • technical data of all visitors: IP address, browser and device information, date and time of the request, cookies — as described in the Cookie Policy.

The Operator does not process special categories of personal data (health, beliefs, etc.) or biometric data through the Site. Please do not include such information in the forms.

6. Legal grounds

Processing relies on the grounds set out in article 6 of 152-FZ:

  • consent of the data subject (clause 1, part 1, article 6) — when a request is sent through the Site forms, a job application is submitted or a mailing is subscribed to;
  • necessity to conclude and perform a contract to which the data subject is a party (clause 5, part 1, article 6);
  • obligations imposed on an audit organisation by Federal Law No. 307-FZ of 30 December 2008 “On Auditing”, accounting and archiving legislation;
  • the Operator’s legitimate interest in protecting the Site from automated submissions and abuse — for technical data.

7. Processing procedure and conditions

  • processing is carried out with automation tools (the Site database) and without them (correspondence);
  • personal data is stored in databases located in the Russian Federation (part 5 of article 18 of 152-FZ); no cross-border transfer takes place;
  • access is limited to the Operator’s employees who need it for their duties;
  • processing may be entrusted to the hosting provider (servers in Russia) and the Operator’s e-mail provider under confidentiality terms;
  • Yandex services (Metrica, SmartCaptcha) receive anonymised technical data only — Metrica only after consent to analytics cookies;
  • notifications about new requests are sent to the Operator’s employees by e-mail; the messenger receives a service notice without personal data;
  • personal data is not shared with third parties for marketing and is not published.

Source: article 18 of 152-FZ.

8. Retention periods

  • requests sent through the Site forms and CVs — no longer than 3 years from receipt unless a contract is concluded; expired records are deleted automatically;
  • contract-related data — for the term of the contract and the statutory document retention periods;
  • anonymised statistics — under the terms of the Yandex Metrica service;
  • once the purpose is achieved or consent is withdrawn, personal data is destroyed within 30 days (parts 4 and 5 of article 21 of 152-FZ) unless the law or a contract provides otherwise.

Source: article 21 of 152-FZ. TODO(legal): the retention period for requests is to be confirmed by the lawyer.

9. Rights of the data subject

Under article 14 of 152-FZ the data subject may:

  • obtain information about the processing of their data: confirmation of processing, purposes, methods, periods and the list of data;
  • demand that data be updated, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose;
  • withdraw consent (part 2 of article 9 of 152-FZ);
  • appeal against the Operator’s actions or inaction to Roskomnadzor or a court.

Requests are sent to office@rsl-audit.ru or by post to the Operator’s address with details that identify the requester. The Operator replies within 10 working days of receipt (article 20 of 152-FZ).

10. Data protection measures

Under article 18.1 and article 19 of 152-FZ the Operator takes legal, organisational and technical measures:

  • appointing a person responsible for processing; training employees on the law and internal rules;
  • encrypted connection (HTTPS), account- and role-based access to the database and the Site admin panel;
  • protection of forms from automated submissions, rate limiting, checks of uploaded files;
  • servers located in the Russian Federation, regular backups;
  • monitoring of the measures taken and data recovery after failures.

Information obtained while providing audit and related services is audit secrecy protected under article 9 of 307-FZ.

11. Cookies and analytics

The use of cookies, Yandex Metrica and the map is described in the Cookie Policy. Analytics cookies are enabled only after the visitor’s consent; the choice can be changed via “Cookie settings” in the Site footer.

12. Changes to the Policy

The Operator may amend the Policy. A new version is published on the Site with a new version number and effective date. Continued use of the Site after publication means the visitor has read the new version.

The Operator files the personal data processing notification with Roskomnadzor under article 22 of 152-FZ. TODO(legal): confirm that the notification has been filed.