Personal data processing policy

Operator and contact

The operator is ООО «ХАЛЛ ГРУПП», INN 1660274271, address: 420087, Республика Татарстан, г. Казань, ул. Скрябина, д. 8Д, оф. 3.11Б. For personal data, correction, deletion or withdrawal requests, contact client@hallgroup.ru. This policy takes account of Russian Federal Law No. 152-FZ on personal data.

A representative’s business contact details may be personal data. Business confidentiality is addressed in a separate section.

Purposes and legal grounds

The customer form is used to review enquiries and the supplier form to review proposals. Both support clarification, preparing a response and contact about the particular enquiry. Processing of form fields relies on separate consent given through an initially unchecked checkbox.

If dealings lead to a contract, necessary contractual, settlement and accounting data is processed on the applicable lawful grounds. Enquiry consent does not authorise advertising, publication or overseas disclosure.

Minimal technical server information is used for operation, abuse prevention and data protection, taking account of visitors’ rights and legitimate interests.

Data we process

• Contact name, organisation and job title or role if supplied, business email and telephone, country, enquiry category, message, selected catalogue items, delivery location and date if provided, and names and content of relevant attachments.
• Submission time, language, consent version and text, enquiry identifier and processing information.
• Necessary session and form security cookies; hosting access and error logs. Separate hashed anti-abuse markers are short-lived.
• Passports, special-category personal data and biometric data are not needed for an initial enquiry. Remove unnecessary personal details, other people’s contact details and signatures from attachments before submission. Do not submit another person’s data without a lawful basis.

Storage and access in Russia

Enquiries and attachments are initially recorded, stored and processed on Sprinthost servers in the Russian Federation. Intake uses no external CRM or third-party analytics. A notification containing the enquiry number and a link to the restricted journal is sent to client@hallgroup.ru on Russian mail hosting; contact details and attachments are not included in the notification.

The website and corporate email are hosted by ООО «СПРИНТХОСТ.РУ», INN 7814374583. Provider technical access is governed by applicable service terms and law. Within the company, authorised staff access enquiries as necessary for their duties. Enquiries and attachments are not published.

Measures include HTTPS, storage outside the public directory, access controls, separate administrator authentication, validation of upload formats and backups. Protection measures reduce risk and do not promise absolute security.

Retention and deletion

Enquiries are processed while under review. The operational maximum is 365 days after the last substantive contact, or after submission if there is no further contact. This is an upper limit, not a minimum retention period. Viewing a record, resaving an unchanged status or closing an enquiry does not start a new period.

When the purpose is achieved, consent is withdrawn or a justified termination request is received, the operator ends the relevant processing and deletes data within statutory periods unless another lawful basis applies. Closing an enquiry after its purpose is achieved initiates early deletion, not a further 365 days of storage. Records necessary for a contract or legal duties are handled separately under the relevant basis and retention period.

Our hashed anti-abuse markers last up to 24 hours. Application operational backups are limited to 30 days; deletion decisions are reapplied after recovery. These periods do not define retention of every backup or technical log maintained by the hosting provider, which operates under its service terms and legal duties.

International transaction participants

Personal data from website enquiries is not transferred outside the Russian Federation. Information about a customer organisation is disclosed to an overseas transaction participant only where necessary and after agreement with the customer; documents for this exchange are prepared without information that identifies a person. Any proposed change requires assessment of its legal and organisational conditions before transfer begins.

Mandatory disclosure to banks, customs, courts and other authorised bodies is made on a lawful basis and to the necessary extent. Confidentiality does not replace information required for checks and transaction documentation.

Cookies and external services

Only necessary form-session and administrator-access cookies are used. There are no advertising trackers or third-party analytics. A form session lasts no longer than eight hours; administrator sessions also expire after inactivity. Cookies can be deleted in your browser, requiring a new form session or sign-in.

External links and messages sent through your email application are separate channels governed by the relevant service terms.

Your rights

You may request information, correction, restriction or destruction where grounds exist, withdraw consent and complain to Roskomnadzor or a court. Contact client@hallgroup.ru and identify the enquiry. Identity or authority verification may be necessary without collecting excessive information.

The operator responds and fulfils justified requests within statutory periods. Withdrawal does not end processing required under another lawful basis. Revised policies are published here; material new purposes are not automatically covered by earlier consent.