Personal data processing policy

Version of 10 October 2026. This document applies to the website https://www.re-panel.ru and describes what data RePanel processes, why it is needed and how individuals can exercise their rights.

This is an English translation provided for convenience. In case of any discrepancy, the Russian version prevails.

General provisions

This Policy has been drawn up in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” and other applicable laws and regulations of the Russian Federation.

The Policy applies to personal data that the operator receives through the website when orders are placed, paid for and delivered, when the operator is contacted, and when the website’s technical features are used. The operator does not process special categories of personal data or biometric personal data through the website.

Personal data operator

Operator: Individual Entrepreneur Nikita Igorevich Kuznetsov
INN: 770470443780
OGRNIP: 324774600411399
Address: apt. 22, bldg. A, 14 Ulansky Lane, Moscow, Russia
Email for data enquiries: panels@recycleobject.com

Processing principles

The operator processes only the data necessary for specific, predefined and lawful purposes, does not merge databases whose processing purposes are incompatible, ensures that the data are accurate and keeps them no longer than the purposes of processing or the law require. Access is granted only to persons who need it for their work.

Purposes, categories of data and retention periods

Purpose	Data	Retention period
Responding to enquiries and preparing proposals	name, company, phone number or Telegram, email, city, content of the enquiry	until the communication is complete and no longer than 3 years after the last contact
Placing and fulfilling orders	first name, surname, phone number, email, city, delivery address, order contents and value, comment, delivery details and payment status	for the duration of the contract and thereafter for the periods established by accounting and tax legislation, as a rule at least 5 years
Payment, refunds and handling of claims	order number and amount, payment status, contact details, refund details. The operator does not receive bank card details	for the duration of the obligations and the applicable document retention periods
Website operation and security	IP address, date and time of the request, page address, browser and device type, technical error logs and security events	no more than 12 months, unless a longer period is needed to investigate an incident
Emailing a project from the configurator on request	email; optionally who you are (architect, designer, for yourself, café or shop); dimensions, colour, price and an image of the item	no longer than 3 years after the last contact
Newsletter about new models, colours and offers — only with separate consent	email, where the subscription came from, optionally who you are, dates of consent, confirmation and unsubscription, the promo code issued	until unsubscription; the record of consent and unsubscription — 3 years
Visit statistics and advertising performance measurement (Yandex Metrica) — only with consent	Metrica cookie identifiers, IP address, browser and device type, addresses of pages viewed and the referral source, actions on the website: clicks, file downloads, the fact that a form was submitted without its contents	until consent is withdrawn; Metrica cookies are kept in the browser for no more than 1 year

Legal grounds

The grounds for processing are: the consent of the personal data subject; the need to conclude or perform a contract at the subject’s initiative; the performance of obligations imposed on the operator by law; and the operator’s legitimate interest in ensuring the security of the website and protecting its rights, provided that the rights and freedoms of the subject are not violated.

Consent to the processing of personal data is drawn up separately from other documents and is confirmed by a separate action of the user. The newsletter about new models, colours and offers is sent only with separate consent to receive advertising (Article 18 of the Federal Law “On Advertising”): it is given by ticking a box in the subscription form (terms in the Russian document “Согласие на рассылку”) and confirmed via the link in an email. Every email contains an unsubscribe link.

Visit statistics are collected through Yandex Metrica only with the user’s consent, given with the “Allow analytics” button in the cookie notice. The “Essential only” button means refusal. Consent can be withdrawn at any time via the “cookie settings” link in the website footer.

Processing operations and methods

The operator may carry out the collection, recording, systematisation, accumulation, storage, clarification, retrieval, use, provision to authorised recipients, blocking, deletion and destruction of data. Processing is carried out using automated means and, where necessary to fulfil an order, without them.

The operator does not disseminate or publish personal data and does not make decisions that produce legal consequences solely on the basis of automated processing.

Data recipients

To the extent necessary for a specific operation, data may be provided to:

Bank Tochka LLC and Tochka JSC — to process and confirm payments;
CDEK-Global LLC — to calculate and arrange the chosen delivery;
Yandex.Cloud LLC (the Yandex Cloud Postbox service) — to send order emails, “project by email” and the newsletter, on the operator’s instructions, on servers in Russia;
YANDEX LLC (INN 7736207543) — for the Yandex Metrica service, only if the user has allowed analytics; Yandex processes these data on the operator’s instructions under the service’s terms of use;
a Russian hosting, database and backup provider acting on the operator’s instructions;
public authorities — only in the cases and to the extent provided for by law.

The operator enters into contracts with persons processing data on its instructions that set out requirements for confidentiality, security, localisation and deletion of data.

Localisation and cross-border transfer

When personal data of citizens of the Russian Federation are collected via the internet, their recording, systematisation, accumulation, storage, clarification and retrieval are carried out using databases located in the territory of the Russian Federation.

The operator does not carry out cross-border transfer of personal data collected through the website’s forms. A service involving such transfer may be connected only after the requirements of Article 12 of Federal Law No. 152-FZ have been met, this Policy has been updated and, where required, separate consent has been obtained.

Cookies and local storage

Strictly necessary cookies and browser local storage entries are always active: for the cart, an applied promo code, remembering the choice made in the cookie notice, and secure staff access to restricted sections.

Yandex Metrica analytics cookies (_ym_uid, _ym_d and others) are set only after “Allow analytics” is clicked. Metrica collects visit statistics, a click map and goal completions, such as downloading a 3D model or submitting an enquiry. The operator needs this to improve the website and to measure the performance of advertising on Yandex, including showing ads to people who have already visited the website. Session recording (Webvisor) is not used, and the contents of form fields are not sent to Metrica.

The choice can be changed or consent withdrawn at any time via the “cookie settings” link in the website footer: after withdrawal, Metrica cookies are deleted and the counter is no longer loaded. All cookies can also be deleted in the browser settings; after that, the cart or signing in to a restricted section may need to be set up again.

Data protection and deletion

The operator applies legal, organisational and technical protection measures: access control, secure data transmission, logging of actions in information systems, backups, software updates, incident monitoring and confidentiality obligations for persons with access to the data.

Once the purpose of processing has been achieved, the data are destroyed or depersonalised within no more than 30 days, unless a contract or the law provides another ground for retaining them. If unlawful processing is identified, the operator stops it and takes action within the time limits set by Article 21 of Federal Law No. 152-FZ.

Rights of the personal data subject

The subject has the right to obtain information about the processing of their data, to demand that the data be clarified, blocked or destroyed, to withdraw consent, to demand that processing be stopped, and to appeal against the operator’s actions to Roskomnadzor (the Federal Service for Supervision of Communications, Information Technology and Mass Media) or in court.

Requests can be sent to panels@recycleobject.com. A request should state the sender’s full name, contact details for the reply, information confirming their relationship with the operator, and the substance of the request. The operator responds within the time limits established by law; a request to stop processing is, as a rule, considered within 10 working days.

Changes to the Policy

The operator may update the Policy when its processes, services or legislation change. A new version takes effect from the moment it is published on this page. The version date is shown at the beginning of the document.