Privacy Policy

Published: - Operator: -

1. General provisions

1.1. This Privacy Policy (the “Policy”) sets out how personal data of the users of the website https://galathilion.ru (the “Site”) is processed and protected by the operator: -, INN -, OGRN -, address:

• (the “Operator”).

1.2. The Policy is prepared in accordance with the Constitution of the Russian Federation, the Civil Code of the Russian Federation and Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (the “Law”).

1.3. The Site does not create personal accounts and does not require registration. Personal data is processed only to the extent necessary to handle inquiries.

2. What data we process

2.1. Data that the user submits through the request form: name, company (if provided), contact details (email, Telegram username and/or phone as provided by the user), selected service and the description of the task.

2.2. Technical data: IP address (in server logs and hashed when a form is submitted), browser and device information (User-Agent), date and time of the request, requested page address.

2.3. We do not process special categories of personal data, biometric data, bank card details or payment data. Please do not submit such data through the form.

2.4. The Site does not use third-party analytics, advertising services, social plugins or pixels.

3. Purposes of processing

3.1. Processing inquiries: receiving, reviewing and responding to a user’s message; clarifying the task; preparing an assessment and possible terms of cooperation.

3.2. Communicating with the user regarding their inquiry.

3.3. Ensuring site security: preventing abuse, blocking automated attacks, maintaining logs.

3.4. Compliance with applicable law where such obligations apply to the Operator.

4. Legal bases

4.1. Consent of the data subject given when submitting the form (mandatory consent checkbox).

4.2. Legitimate interests of the Operator in ensuring site security and protecting rights, to the extent that does not violate the rights of data subjects.

5. Processing and storage

5.1. Form data is stored in a database on a server located in the Russian Federation. No cross-border transfer of personal data is performed.

5.2. Access is limited to authorised personnel who need it to process the inquiry, on a least-privilege basis and with logging.

5.3. Retention: inquiries and related correspondence — no longer than 12 months from the last interaction, unless otherwise required by a contract or the law; technical logs — no longer than 90 days. After that, data is deleted or anonymised.

5.4. Data may be transferred to third parties only where required by law or necessary to perform a contract with the data subject (for example, to a hosting provider, to the extent required to operate the Site and subject to confidentiality).

6. Rights of the data subject

6.1. The user may request information about the processing of their data; request correction, blocking or deletion; withdraw consent; and appeal the Operator’s actions to the regulator or a court.

6.2. Requests may be sent to -. The Operator responds within the period established by law (usually 10 business days, extendable). To prevent abuse, the Operator may request reasonable proof of identity.

6.3. Withdrawal of consent leads to termination of processing and deletion (anonymisation) of data, unless further retention is required by law.

7. Security measures

7.1. Data between the browser and the Site is transmitted over HTTPS with modern TLS versions; HSTS is enabled.

7.2. Measures include: data minimisation; access control; logging; rate limiting and anti-automation for forms; limited retention of IP addresses; access-controlled backups.

8. Final provisions

8.1. The Operator may amend the Policy; the current edition is published on the Site with the date of the edition.

8.2. Questions about personal data processing: -.

8.3. Registration number in the register of personal data operators (if any): -.