PRIVACY POLICY
Personal Data Processing Policy
We respect the confidentiality of your personal data and ask you to read this Policy (the “Policy”).
It will help you learn what information we process, or are entitled to process, and for what purposes, and also how you can change, delete, or otherwise influence the processing of your personal data.
Who processes personal data
Natalia Anatolyevna Sizykh, applying the special tax regime “Tax on Professional Income”
Taxpayer Identification Number (INN): 890509123847
Authorized email address: natalya.sizykh@gmail.com
For the purposes of this Policy, “Data Controller”, “we”, “us” or “our” means Natalia Anatolyevna Sizykh.
1. Terms and Definitions
Personal Data (PD) — any information relating, directly or indirectly, to an identified or identifiable individual (the data subject).
Personal data authorized by the data subject for dissemination — PD to which the data subject has granted access to an unlimited number of persons by giving consent to the processing of PD authorized by the data subject for dissemination.
Processing of personal data — any operation or set of operations performed on PD, with or without the use of automation tools, including the collection, recording, systematization, accumulation, storage, clarification (updating, amendment), retrieval, use, transfer (dissemination, provision, access), anonymization, blocking, deletion, and destruction of PD.
Dissemination of personal data — actions aimed at disclosing PD to an indefinite number of persons.
Cross-border transfer of personal data — the transfer of personal data to the territory of a foreign state, to an authority of a foreign state, a foreign individual, or a foreign legal entity.
Provision of personal data — actions aimed at disclosing PD to a specific person or a definable group of persons.
Blocking of personal data — the temporary suspension of the processing of PD (except where the processing is necessary to clarify the PD).
Anonymization of personal data — actions as a result of which it becomes impossible, without the use of additional information, to determine that PD belong to a specific data subject.
Destruction of personal data — actions as a result of which it becomes impossible to restore the content of PD in the personal data information system and/or as a result of which the physical media containing PD are destroyed.
Online Platform (Website) — the websites, landing pages, bots, forms, social media pages and other online resources operated by the Data Controller, including:
- — https://natalyasizykh.ru;
- — https://natalyasizykh.com;
- — https://nataliasizykh.com;
- — https://inglowing.com;
- — official InGlowing and Natalia Sizykh landing pages, forms and social media pages;
- — https://t.me/NataliaSizykh_WelcomeBot?start=c1771888550705-ds;
- — https://t.me/NataliaSizykh_TestsBot?start=c1768150426307-ds;
- — https://t.me/NataliaSizykh_MainBot?start=c1728213669920-ds.
2. Data and Purposes of Processing
2.1. We provide information, educational and consulting services, in online or offline format, and may process personal data of the following categories of data subjects, regardless of their country of residence:
- — clients, purchasers and potential clients;
- — website and landing page visitors;
- — subscribers, waitlist members and users who request access to free or paid materials;
- — persons completing forms, tests, questionnaires or applications;
- — persons taking part in events, programs, sessions, case reviews, interviews, practicums, courses and other formats of interaction with the Data Controller;
- — persons who have provided reviews, comments or materials for publication.
2.2. In the table below, we explain what data we may process, and for what purposes, in respect of each of the categories of data subjects indicated:
Purpose of PD processing | Scope of PD processed |
|---|---|
Conclusion and performance of agreements | — first name, last name — email address — phone number — payment details — date of birth — image (photo, video) — voice |
Establishing and maintaining contact | — first name, last name — email address — phone number — Telegram, WhatsApp account |
Sending informational and advertising materials, newsletters, product updates, invitations, waitlist notifications and other communications related to the Data Controller’s products and services | — first name, last name — email address — phone number |
Conducting case reviews, interviews, practicums, courses, and other events; recording and using the materials with the data subject’s consent | — first name, last name — date of birth — age — email address — phone number — Telegram, WhatsApp account — image (photo, video) — voice — questionnaire responses — information and materials that the data subject communicates in the course of the interaction |
Analyzing the quality of the services provided, developing methodology, and preparing informational, educational, and consulting materials and products | — first name, last name — age — email address — phone number — Telegram, WhatsApp account — questionnaire responses — information and materials that the data subject communicates in the course of the interaction — recordings of calls, lessons, and case reviews — image (photo, video) — voice |
Ensuring the operation of the website, analyzing use of the website, improving the user experience, and keeping visit statistics | — IP address — operating system type — browser type — geographic location — information about use of the Website — information about pages visited and referrals from other resources — cookies — information automatically received when the Website is accessed |
Posting reviews of the services provided on the website and on social media | — first name — gender — age — text of the review — image (photo, video) — voice — where audio or video materials are published |
Providing tests, quizzes, questionnaire results and related informational materials based on the User’s answers | — first name — email address — test, quiz or questionnaire responses — test, quiz or questionnaire result — information voluntarily provided by the User in the relevant form |
2.3. Where tests, quizzes, questionnaires or similar instruments are used, the result may be calculated automatically or semi-automatically based on the answers provided by the User. Such results are intended for informational, educational and self-reflection purposes only and do not produce legal, financial, medical or similarly significant effects for the User.
2.4. The Data Controller does not intentionally request or require special categories of personal data or biometric personal data, including health records, medical diagnoses, genetic data, biometric data used for the purpose of uniquely identifying a person, information concerning a person’s sex life or sexual orientation, racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership.
2.5. Some forms, questionnaires, tests, sessions or programs may invite the User to share information about their emotional state, relationships, personal experiences or wellbeing. The User should not provide medical diagnoses, health records, information concerning sex life or sexual orientation, or other sensitive information. If such information is nevertheless voluntarily provided by the User, the Data Controller does not use it for any separate purpose and may delete, restrict or disregard it where reasonably possible.
3. Consent to the Processing of PD: How You Give It to Us
3.1. You agree to the terms of the Policy and give us your consent to the processing of your PD for the purposes indicated above if you:
Make a payment by completing a form on the Website or in the bot https://t.me/NataliaSizykh_TestsBot?start=c1768150426307-ds, | Consent to the processing of PD is deemed given at the moment you click the “Submit” or “I agree” button and check the box confirming that you have read and agree to the processing of PD |
Respond to the bot’s commands https://t.me/NataliaSizykh_TestsBot?start=c1768150426307-ds, https://t.me/NataliaSizykh_WelcomeBot?start=c1771888550705-ds, | Consent to the processing of PD is deemed given at the moment you click the “I agree” button |
Complete questionnaires, requests, or forms on the Website, in the bot, or on another Online Platform | Consent to the processing of PD is deemed given at the moment you click the “Submit” or “I agree” button, or check the box confirming that you have read and agree to the processing of PD |
Subscribe to a newsletter, join a waitlist, request access to free or paid materials, receive a test or quiz result, or complete a form on the Online Platform | Consent to the processing of PD is deemed given at the moment you click the “Submit”, “I agree”, “Join”, “Get access”, “Get my result” or similar button, or check the box confirming that you have read and agree to the processing of PD in accordance with this Policy |
3.2. By agreeing to the terms of the Policy, you give us your informed and conscious consent to the processing of your PD on the terms provided for by the Policy and by Federal Law No. 152-FZ “On Personal Data” dated July 27, 2006 (the “Law”).
3.3. In doing so, we proceed on the following basis:
- — you have provided fully accurate information;
- — we do not verify the authenticity of the information;
- — all risks of providing inaccurate or insufficient information rest with you;
- — you have reached the age of 18 and have the legal capacity to give the relevant consent;
- — if you have not reached the age of 18 or do not have the legal capacity to give consent, you must not use the Online Platform, complete forms, purchase products or services, or otherwise provide PD to the Data Controller.
3.4. You may independently determine the list of PD that we are entitled to process for the stated purpose.
3.5. Withdrawal of consent. If you refuse the processing of your PD for the stated purposes, we will not have the technical ability to provide you with the corresponding Services.
3.6. The Online Platform, products and services of the Data Controller are intended for persons who have reached the age of 18. By using the Online Platform, completing forms, purchasing products or services, or otherwise interacting with the Data Controller, the User confirms that they are at least 18 years old and have the legal capacity to give consent to the processing of personal data.
4. Processing of PD
4.1. The legal bases for the processing of PD are:
- — the public offer;
- — the data subject’s consent to the processing of personal data;
- — the data subject’s consent to receiving informational and advertising materials;
- — the data subject’s consent to the processing of PD authorized for dissemination — in the cases of publication of reviews, materials from case reviews, interviews, practicums, courses, and other materials;
- — this PD Processing Policy;
- — other grounds provided for by the legislation of the Russian Federation.
4.2. Methods of PD processing:
- — collection,
- — recording,
- — systematization,
- — accumulation,
- — storage,
- — clarification (updating, amendment),
- — retrieval,
- — use,
- — transfer (provision, access),
- — dissemination — in the cases specified in Section 7 of the Policy,
- — blocking,
- — deletion,
- — destruction.
4.3. We store your PD on electronic media.
4.4. Sometimes, in order to fulfill our obligations to you arising from the requirements of the law or of a contract, we may retrieve them and store them on physical media.
5. Transfer of PD to Third Parties
The main purpose of processing PD is to ensure the fulfillment of our obligations to you. Sometimes this requires the involvement of third parties.
5.1. The scope of the data transferred is determined by the terms of the relevant agreements.
The list of third parties to whom we may transfer your PD where you have given your consent, or where other legal grounds exist for the transfer of your data:
- — Tsentr Smart Resheniy LLC (Smart Solutions Center), INN 9731146971, Primary State Registration Number (OGRN) 1257700042896, registered address: 121596, Moscow, Gorbunova St., 2, building 3, premises 12/8 (services for the use of an electronic payment facility service);
- — Telegram Messenger Inc, INN 1968129, registered address: Vistra Corporate Services Centre, Wickhams Cay II, VG1110 Road Town, Tortola, British Virgin Islands, owner of the Telegram information resource (messaging, bot functionality and communication services);
- — LAVALANE LTD, registered under the laws of the Republic of Cyprus with registration number HE 387079, registered address: Kallipoleos, 3, Flat/Office 102, 1055, Nicosia, Cyprus, operator of the lava.top platform and a third-party payment processor and payment infrastructure provider engaged by the Data Controller where payments, checkout, provision of access to digital content or products, customer account functionality, payment confirmations, refunds, and other payment-related or platform services are processed through lava.top.
The Data Controller may also use third-party service providers for website operation, forms, bots, email communications, payment processing, analytics, advertising technologies, cloud storage, security and other operational purposes. Such providers may process personal data only to the extent necessary to provide their services to the Data Controller and for the purposes described in this Policy.
6. PD Processing Periods
6.1. We process your PD from the moment you express your consent, or in other cases provided for by law.
6.2. The period of storage and processing of your PD runs from the moment you give consent to the processing of PD, submit a form, complete a test, quiz, questionnaire or application, join a waitlist, subscribe to communications, make a payment, or otherwise provide PD to the Data Controller, and ends in the cases specified in clause 6.3 of the Policy, unless a longer storage period is required or permitted by applicable law.
6.3. We stop processing your PD if:
- — you have withdrawn your consent to the processing of PD or have sent us a demand for their destruction;
- — the PD storage period established by law has expired;
- — the purposes of the PD processing have been achieved.
6.4. Requests concerning withdrawal of consent, destruction, correction or other rights provided by this Policy or by mandatory applicable data protection laws may be sent to the authorized email address specified in this Policy.
7. How Your Data May Be Published on the Internet
7.1. Your PD may be published on our website, on our social media, on video hosting platforms, and in informational, educational, and consulting materials, for the following purposes:
Posting reviews | — first name — gender — age — text of the review — image (photo, video) — voice — where audio or video materials are published |
Publication and use of materials from case reviews, interviews, practicums, courses, reality shows, live streams, and other filming | — first name, last name — age — image (photo, video) — voice — responses, comments, and other materials provided by the data subject — excerpts and derivative materials created on the basis of the materials provided |
7.2. We do this solely on the basis of your consent to the processing of the PD authorized by you for dissemination.
The form of such consent to the dissemination of your PD depends on the purpose of the publication or use of the materials.
8. Legal Basis for the Processing of PD
8.1. Personal data are processed in accordance with, and in performance of, the agreements and other arrangements between the Data Controller and the User, the User’s consent to the processing of personal data, the Data Controller’s internal regulations, and the laws and subordinate regulations governing relations connected with the Data Controller’s activities in the field of personal data processing, including:
- — the Civil Code of the Russian Federation;
- — Federal Law No. 149-FZ “On Information, Information Technologies and Information Protection” dated July 27, 2006;
- — Decree of the President of the Russian Federation No. 188 “On Approval of the List of Information of a Confidential Nature” dated March 6, 1997;
- — Resolution of the Government of the Russian Federation No. 1119 “On Approval of the Requirements for the Protection of Personal Data During Their Processing in Personal Data Information Systems” dated November 1, 2012;
- — Resolution of the Government of the Russian Federation No. 687 “On Approval of the Regulation on the Specific Aspects of Personal Data Processing Carried Out Without the Use of Automation Tools” dated September 15, 2008;
- — Order of the Federal Service for Technical and Export Control (FSTEC) of Russia No. 21 “On Approval of the Composition and Content of Organizational and Technical Measures to Ensure the Security of Personal Data During Their Processing in Personal Data Information Systems” dated February 18, 2013;
- — Federal Law No. 152-FZ “On Personal Data” dated July 27, 2006.
8.2. Where mandatory data protection laws applicable to a User require a specific lawful basis for the processing of PD, the lawful basis may include, to the extent applicable, the User’s consent, performance of an agreement with the User or steps taken at the User’s request before entering into an agreement, compliance with legal obligations, and/or the Data Controller’s legitimate interests, provided that such interests do not override the User’s rights and freedoms.
9. Rules on the Cross-Border Transfer of PD
9.1. The Data Controller is based in the Russian Federation.
9.2. With respect to personal data of citizens of the Russian Federation, the Data Controller processes such personal data using databases located in the territory of the Russian Federation, as required by applicable Russian law.
9.3. If the User accesses the Online Platform, products or services from outside the Russian Federation, the User understands that their personal data may be collected, used, stored and otherwise processed in the Russian Federation and, where applicable, in other countries where the Data Controller’s service providers operate.
9.4. Before commencing cross-border transfer of personal data, where such transfer is subject to mandatory requirements under applicable law, the Data Controller takes the measures required by such applicable law, including, where required, obtaining or assessing information about the foreign recipient of personal data and notifying the competent authority.
10. Cookies, Analytics and Advertising Technologies
10.1. The Online Platform may use cookies, pixels, tags, analytics tools and similar technologies, including Google Analytics, Meta Pixel and similar tools.
10.2. These technologies may be used to ensure the operation and security of the Online Platform, analyze how Users interact with the Online Platform, measure the effectiveness of content and advertising, improve the User experience, and support advertising and marketing activities.
10.3. Where required by applicable law, non-essential cookies, analytics tools, advertising pixels and similar technologies are used only after the User has given consent. The User may refuse non-essential cookies or withdraw consent through the cookie banner, cookie settings or another available consent mechanism.
10.4. Strictly necessary cookies may be used without consent where they are required for the technical operation, security or availability of the Online Platform.
11. Changes to the Policy
11.1. We are entitled to make changes to this Policy at any time, including in connection with changes in applicable law, the Online Platform, products, services, technologies used, third-party service providers, or our personal data processing practices.
11.2. The updated version of the Policy becomes effective from the moment it is published on the Online Platform, unless otherwise stated in the updated Policy.
11.3. We undertake not to materially restrict the rights of Users established by this Policy without publishing an updated version of the Policy on the Online Platform and, where required by applicable law, providing an additional notice.
11.4. By continuing to use the Online Platform, products or services after the updated Policy has been published, the User confirms their agreement with the updated Policy.
11.5. This section does not replace any separate consent that may be required under applicable law for specific types of processing.