Documents

Personal Data Processing Policy

This is a translation. The Russian version of the document is legally binding.

Version of [date].

This Policy describes which personal data of visitors is processed on the website of the band Nuki (the “Website”), why, on what legal basis and for how long, and what rights visitors have. The Policy follows Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (the “Law”).

1. Operator

[operator name / full name], INN (taxpayer number) [INN], [OGRN/OGRNIP], address: [address]. E-mail for personal data requests: [e-mail for requests].

2. What data is processed and why

2.1. The “Write to the band” and “Press kit request” forms

Data: name (first name and surname), name of the media outlet or organisation (in a press kit request), the way of contact and the contact — e-mail address, phone number, WhatsApp number, Telegram username or number, the topic, the text of the message or comment, the list of requested materials. The message also states the language and the address of the page the form was sent from, and the time it was sent.
Purposes: to answer the message — about concerts and booking, press and interviews, merch and orders, collaboration; to provide the press kit.
How it is processed: the data is not stored on the Website. It is sent in one e-mail to the persons who answer messages on behalf of the Operator, and is kept in their mailboxes.

2.2. Comments

Data: the name and the text of the comment are required, the e-mail address is optional. The IP address and browser details of visitors are not stored.
Purposes: to publish the comment after moderation, to prevent abuse.
The name is published next to the comment. The e-mail address is not published.
While a comment awaits moderation, the author’s browser (local storage) keeps the comment number and a check code so that the author can see the comment. They are deleted after moderation or after 30 days.
If the box “Save my name and email in this browser” is ticked, the name and the e-mail address are kept in browser cookies for 1 year. Without the box these cookies are not created.

2.3. Spam protection

To limit how often forms and comments can be sent from one address, the Website computes a hash of the IP address — a one-way transformation from which the address cannot be restored. Only a counter of submissions is kept with the hash. Neither the IP address itself nor the content of the forms is stored for this purpose.

The visitor’s choice in the cookie settings is kept in their browser (local storage) and is not sent to the Website. Consent to analytics is kept for 12 months, after which the Website asks again. A refusal lasts until the end of the visit: if no page of the Website has been opened for 30 minutes, the Website asks again on the next visit.
Web analytics services are loaded only after the visitor agrees to the “analytics” category in the cookie settings: Yandex Metrica (YANDEX LLC, Russia) and Google Analytics 4 (Google LLC, USA).
The services set their own cookies on the Website’s domain: Yandex Metrica — _ym_uid and _ym_d (1 year), _ym_isad (20 hours) and other service cookies _ym*, as well as _ym* keys in the browser’s local storage; Google Analytics 4 — _ga and _ga_* (2 years). Their purposes and lifetimes are described in the documentation of the services: Yandex Metrica, Google Analytics.
Yandex Metrica Session Replay (Webvisor, the recording of the visitor’s actions) is not used. The advertising features of Google Analytics — Google signals and ad personalization — are turned off.
Data: cookie identifiers, IP address, browser and device details, pages viewed and actions on the Website.
Purpose: visitor statistics and improving the Website.
The consent can be withdrawn at any time with the “Cookie settings” button in the footer of the Website. After the withdrawal the Website turns the services off and deletes their cookies and keys on its own domain. Cookies that the services keep on the Yandex and Google domains cannot be deleted by the Website: the visitor deletes them in the browser settings.

3. Legal grounds

the consent of the data subject (clause 1, part 1, Article 6 of the Law) — for the forms, comments and web analytics. The consent for the forms and comments is a separate document — the Consent to Personal Data Processing; the consent for analytics is given in the cookie settings;
the exercise of the rights and legitimate interests of the Operator (clause 7, part 1, Article 6 of the Law) — for protecting the Website from spam.

4. Retention

form data — not stored on the Website; the e-mails are kept in the recipients’ mailboxes until the purpose of processing is achieved or the consent is withdrawn;
comments — while they are published or until the consent is withdrawn;
the IP address hash and the submission counter — no longer than 24 hours after the last submission;
cookies of the analytics services — under the rules of those services, while the visitor’s consent is valid.

5. Storage and transfer of data

The Website is hosted on a server at: [hosting address / country of storage].

Cross-border transfer. When Google Analytics 4 is used, web analytics data is transferred to Google LLC and processed on its servers, including in the USA. The transfer takes place only after the visitor agrees to the “analytics” category and is carried out in accordance with Article 12 of the Law. Without this consent Google Analytics 4 is not loaded on the Website.

The Operator does not sell personal data and does not transfer it to third parties, except as described in this Policy and as required by the legislation of the Russian Federation.

6. Rights of the data subject

The visitor has the right to:

receive information about the processing of their personal data;
demand that the data be clarified, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not needed for the stated purpose;
withdraw the consent to processing;
appeal against the actions of the Operator to Roskomnadzor or in court.

To exercise these rights, write to [e-mail for requests]. The Operator answers within the time limits set by the Law.

7. Security measures

form data is not stored on the Website;
spam protection keeps a hash of the IP address, not the address itself;
access to the management of the Website is limited to accounts assigned by the Operator;
messages from the forms are received only by the addresses set by the Operator in the Website settings;
data between the browser and the Website is transferred over an encrypted connection (HTTPS).

8. Changes to the Policy

The Operator may change this Policy. A new version applies from its publication on this page; the version date is given at the top.