1. General Provisions
This Personal Data Processing Policy (the "Policy") defines how personal data is processed and protected on the website onecatalog.net and the API service at api.onecatalog.net (collectively, the "Service").
The Policy is drafted in accordance with Russian Federal Law #152-FZ "On Personal Data" of July 27, 2006, Federal Law #242-FZ of July 21, 2014, Russian Government Decree #1119 of November 1, 2012, and other regulations of the Russian Federation.
The Russian version of this Policy is the legally binding text. This English version is a courtesy translation.
2. Data Controller
The data controller is Individual Entrepreneur Aivazov Said Sabirovich (the "Operator").
- INN: __YOUR_INN__
- OGRNIP: __YOUR_OGRNIP__
- Email for data requests: hello@onecatalog.net
3. Categories of Data Subjects and Data Collected
3.1. Unregistered visitors
- IP address (anonymized to /24 for storage)
- Browser User-Agent
- Cookies and session identifiers (with consent — see Cookie policy)
- Page view history within a session (with analytics consent)
3.2. Registered users (personal account)
- Email — for login and contact
- Password — stored as a cryptographic hash
- Display name and avatar, if provided
- API keys issued to the user and their usage statistics
- Payment history and balance
- Notification settings and interface preferences
3.3. Legal entities (for invoicing)
- Name, INN, KPP, OGRN/OGRNIP
- Legal address
- Bank account and BIC
- Authorized signatory name and role
4. Purposes of Processing
- Providing access to Service features
- User identification on login
- API usage accounting and billing
- Communication on technical and organizational matters
- Invoicing and payment processing
- Service improvement (with analytics consent)
- Notifying users of material changes to the Service or pricing
- Compliance with Russian legislation (accounting, tax reporting)
5. Storage and Localization
Processing is automated using server infrastructure located in the Russian Federation (Moscow data centers). Cross-border data transfer is not performed.
Retention periods:
- Account data — while the account is active, plus 3 years after deletion (accounting requirement)
- Payment history — 5 years from the transaction (tax law requirement)
- Technical logs — up to 6 months identifiable, then anonymized
- Cookie consent record — 1 year, then re-asked
6. Third Parties
The Operator transfers data to third parties only in these cases:
- DaData (Hi-Tech Group LLC, Russia) — to obtain legal-entity details by INN. Only the INN is sent.
- Payment provider (Tinkoff Kassa, JSC Tinkoff Bank, Russia) — for payment processing. Email, amount, and transaction description are sent.
- Tax and regulatory authorities — in the scope and timeframes required by Russian law.
7. Subject Rights (per FZ-152, Art. 14–17)
- Obtain information about the processing of personal data
- Demand correction, blocking, or deletion of inaccurate, outdated, or unlawfully used data
- Withdraw consent (unless processing is based on other legal grounds)
- File a complaint with Roskomnadzor or in court
- Obtain a copy of the data in a machine-readable format
Send requests to hello@onecatalog.net with identity confirmation. Response within 30 calendar days.
8. Security
- HTTPS (TLS 1.2+) for data in transit
- Password storage as cryptographic hashes (bcrypt)
- Least-privilege access for staff
- Encrypted backups
- Action logging
- Regular vulnerability scanning
9. Contact
For personal-data questions: hello@onecatalog.net.