Personal data processing policy

1. Controller and principles

The Controller is The Svirin Family Company, INN 7728727210, KPP 772801001, OGRN 1107746115905. Address: 18-175, Akademika Kapitsa Street, Moscow, 117647. Contact for data matters: order@import-furniture.ru. This policy applies to import-furniture.ru and Import Furniture enquiries.

Data is processed under Federal Law No. 152-FZ of 27.07.2006 “On Personal Data”. Only information necessary for a specific purpose is collected. Biometric data and special categories of data are not requested through the form.

2. Processing enquiries

Purposes: to receive an enquiry, clarify preferences, prepare furniture and manufacturer proposals, assess purchasing and delivery, respond and agree an order.

Data: the name as provided, email, optional phone number, a description of furniture and the space linked to a person, city, budget, countries, timing, manufacturer, model, materials, links and preference notes. Not all furniture information is personal data; the policy applies to the extent that it relates to an identifiable person.

The form includes separate consent that is not selected in advance. Visiting the website does not in itself constitute such consent. An ordinary email sent on a person’s initiative about entering into or performing a contract may be handled on an independent basis, including paragraph 5 of part 1 of Article 6 of Law No. 152-FZ. There is no need to add special consent wording to every business email; any necessary separate consent is requested separately.

3. Contracts and accounting

Once an order is agreed, data necessary to conclude and perform the contract is processed on the corresponding basis. Statutory obligations apply to payments, tax and accounting records.

An enquiry does not sign a paid contract or authorise advertising mailings. The information required for a contract is clarified separately. A passport, banking codes and detailed home address are not required for an initial enquiry.

4. Operations and recipients

For the stated purposes, collection, recording, organisation, accumulation, storage, updating, retrieval, use, necessary disclosure and access, blocking, deletion and destruction are permitted. Processing may be automated or non-automated.

Enquiries are received by the Controller’s authorised personnel. Technical hosting and email providers may provide hosting, transmission and storage to the necessary extent on a lawful basis. Where processing is entrusted to a provider, security and confidentiality terms and the processor’s obligations are documented.

For initial sourcing, requirements sent to manufacturers are anonymised wherever possible. An enquiry does not authorise unconditional disclosure of personal data to any foreign supplier. If a transfer is necessary, its basis and scope are determined separately and applicable requirements are met, including cross-border transfer rules.

The Controller complies with localisation requirements when collecting data of citizens of the Russian Federation. Information about processors actually engaged and the legal bases is provided to the data subject in the manner prescribed by law.

5. Technical information

When a request is made, the hosting server technically receives the IP address, time, resource address and browser service headers. Necessary logs are used to operate and protect the website, rather than for advertising profiling.

The session cookie IMPORTFSESSID links the form’s single-use token to the browser. To confirm separate consent, the enquiry identifier, time, version, page, enquiry type, checkbox selection and a cryptographic identifier of contact details are recorded. The enquiry text is retained in business correspondence. For analytics, a random identifier, permission or refusal, time, consent version and choice validity period are recorded separately; these records do not include enquiry fields.

An enquiry does not require recording the visit, pointer movements or browsing history. Form fields are not saved in localStorage.

6. Retention and deletion

Enquiries without a contract are processed until review is complete, but for no longer than 90 calendar days from the last substantive message or conversation, unless another lawful basis exists. Automated notifications do not extend this period.

Contractual, payment and mandatory accounting documents are retained for the periods prescribed by law. Minimal information to confirm consent and protect legitimate interests may be retained on an independent basis for no longer than three years after registration.

Technical logs are retained only for the period necessary for operation and protection. Backups are deleted within the established update cycle and are not used to resume processing whose legal basis has ended.

When the purpose has been achieved, consent withdrawn or processing found unlawful, the time limits for cessation and destruction under Article 21 of Law No. 152-FZ apply. Withdrawal does not end processing that has another lawful basis.

7. Rights and requests

You may request information, seek correction, blocking or destruction of data where grounds exist, withdraw consent and challenge the Controller’s actions. Address: order@import-furniture.ru. Provide information that allows the enquiry to be found and confirms that the request relates to you; excessive identity documents are not required by default.

Responses and actions are provided within the time limits of Law No. 152-FZ. Additional information is requested only where objectively necessary. The right to contact Roskomnadzor or a court is preserved.

8. Analytics and security

Yandex Metrica is used to analyse visits only after separate voluntary permission in the “Analytics settings” panel. The recipient of analytics data is YANDEX LLC. Webvisor, click maps, tracking of external links and URL fragment changes, Yandex Tag Manager and additional user parameters are disabled. Enquiry contents and files are not sent to analytics. The counter does not run on /legal/ pages. Advertising and mailings are not enabled.

The Controller restricts access and uses secure transmission, form validation, organisational measures and allocation of permissions. Send only necessary information and links without other people’s secrets or unnecessary personal data.

New versions are published here and do not automatically expand previously given consent. The Controller’s details are provided in this section.