Evolve
Evolve Agency

Privacy Policy

Version of 1 October 2026

1. General provisions

This personal data processing policy is issued under Russian Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (the “Personal Data Law”) and sets out how personal data is processed and protected by Sole proprietor Matvey Alekseevich Bobryashov, taxpayer ID (INN) 645329808466, registration number (OGRNIP) 325645700109091, address: Saratov, Russia (the “Operator”).

1.1. The Operator’s key goal and condition of its activity is respecting human and civil rights and freedoms when processing personal data, including the right to privacy and to personal and family secrets.

1.2. This policy (the “Policy”) applies to all information the Operator may receive about visitors to https://evolvedesign.ru.

2. Terms used in the Policy

2.1. Automated processing — processing of personal data by means of computers.

2.2. Blocking — temporary suspension of processing (except where processing is needed to correct the data).

2.3. Website — the graphic and information materials, software and databases available at https://evolvedesign.ru.

2.4. Personal data information system — the personal data contained in databases together with the technologies and hardware used to process it.

2.5. Depersonalisation — actions after which the data can no longer be attributed to a specific User or other data subject without additional information.

2.6. Processing — any operation with personal data, with or without automation, including collection, recording, organisation, accumulation, storage, clarification (updating, changing), retrieval, use, transfer (dissemination, provision, access), depersonalisation, blocking, deletion and destruction.

2.7. Operator — a state or municipal body, legal entity or individual that, alone or jointly with others, organises and/or carries out processing of personal data and determines its purposes, scope and operations.

2.8. Personal data — any information relating directly or indirectly to an identified or identifiable User of https://evolvedesign.ru.

2.9. Personal data permitted for dissemination — personal data that the data subject has made available to an unlimited number of persons by giving consent in the manner set out in the Personal Data Law.

2.10. User — any visitor to https://evolvedesign.ru.

2.11. Provision — disclosure of personal data to a specific person or group of persons.

2.12. Dissemination — disclosure of personal data to an indefinite number of persons, including publication in the media or on the internet.

2.13. Cross-border transfer — transfer of personal data to a foreign state authority, foreign individual or foreign legal entity.

2.14. Destruction — actions that irreversibly destroy personal data in the information system and/or destroy its physical carriers.

3. Rights and obligations of the Operator

3.1. The Operator may:

  • receive accurate information and/or documents containing personal data from the data subject;
  • continue processing without the data subject’s consent after consent is withdrawn, where the Personal Data Law provides grounds for it;
  • decide which measures are necessary and sufficient to meet the obligations of the Personal Data Law, unless federal law provides otherwise.

3.2. The Operator must:

  • provide the data subject, on request, with information about the processing of their data;
  • organise processing in accordance with Russian law;
  • respond to requests from data subjects and their representatives as required by the Personal Data Law;
  • provide the data protection authority with the information it requests within 10 days of the request;
  • publish this Policy or otherwise give unrestricted access to it;
  • take legal, organisational and technical measures to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful actions;
  • stop transferring and processing personal data and destroy it in the cases provided by the Personal Data Law;
  • fulfil other obligations under the Personal Data Law.

4. Rights and obligations of data subjects

4.1. Data subjects have the right to:

  • receive information about the processing of their personal data, except as limited by federal law;
  • require the Operator to correct, block or destroy their data if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose;
  • make prior consent a condition of processing for marketing purposes;
  • withdraw consent and demand that processing stop;
  • appeal the Operator’s unlawful actions or inaction to the data protection authority (Roskomnadzor) or a court;
  • exercise other rights provided by Russian law.

4.2. Data subjects must provide accurate information about themselves and inform the Operator of any changes.

4.3. Persons who provide false information about themselves or information about another person without that person’s consent are liable under Russian law.

5. Principles of processing

5.1. Processing is lawful and fair.

5.2. Processing is limited to specific, predefined and legitimate purposes and must be compatible with them.

5.3. Databases processed for incompatible purposes are not combined.

5.4. Only data relevant to the purposes is processed.

5.5. The content and volume of data correspond to the stated purposes and are not excessive.

5.6. The Operator ensures that data is accurate, sufficient and, where needed, up to date, and deletes or corrects incomplete or inaccurate data.

5.7. Data is stored in a form that allows identification of the data subject no longer than the purposes require, unless a longer period is set by federal law or a contract with the data subject, and is destroyed or depersonalised once the purposes are achieved.

6. Purposes of processing

6.1. Purpose: handling a request and clarifying its details.

  • Data: name; Telegram username or phone number; optionally the project type and timeline. The language version, the page the request was sent from and the date and time are stored with the request.
  • Legal basis: the data subject’s consent (Article 6(1)(1) of the Personal Data Law); once a contract is concluded, Article 6(1)(5).
  • Operations: collection, recording, organisation, accumulation, storage, destruction and depersonalisation.

6.2. Purpose: web analytics — only if the User clicks “Allow all” in the cookie notice.

  • Data: IP address, cookie identifiers, device and browser details, pages visited and actions on them. Request form data is not sent to analytics.
  • Legal basis: the data subject’s consent (Article 6(1)(1) of the Personal Data Law). See the Cookie Policy.
  • Operations: collection, recording, storage, use, depersonalisation, deletion.

6.3. The Operator does not send advertising or newsletters. If such mailings are introduced, separate consent will be requested.

7. Conditions of processing

7.1. Processing is carried out with the data subject’s consent.

7.2. Processing is necessary to achieve purposes set by an international treaty of the Russian Federation or by law, or to perform the Operator’s legal duties.

7.3. Processing is necessary for the administration of justice or the enforcement of a court or other official act.

7.4. Processing is necessary to perform or conclude a contract to which the data subject is a party, beneficiary or guarantor.

7.5. Processing is necessary for the legitimate interests of the Operator or third parties, provided the data subject’s rights and freedoms are not violated.

7.6. Data made publicly available by the data subject or at their request is processed.

7.7. Data subject to publication or mandatory disclosure under federal law is processed.

8. Collection, storage, transfer and other processing

The security of personal data is ensured by legal, organisational and technical measures that fully meet the requirements of data protection law.

8.1. The Operator keeps personal data safe and prevents access by unauthorised persons: only the Operator can access requests through a password-protected admin panel, and connections to the Website are encrypted (HTTPS). Personal data of Russian citizens is stored in a database on a server located in the Russian Federation.

8.2. The User’s personal data will never be transferred to third parties except as required by law or with the data subject’s consent to transfer for the performance of a civil contract.

8.3. If the User finds inaccuracies in their data, they can update it by emailing the Operator at work@evolvedesign.ru with the subject “Personal data update”.

8.4. The processing period is determined by the purposes for which the data was collected, unless a contract or law provides otherwise. Request data is kept no longer than 12 months from receipt unless a contract is concluded with the User.

The User may withdraw consent at any time by emailing the Operator at work@evolvedesign.ru with the subject “Withdrawal of consent to personal data processing”. Consent to web analytics can also be withdrawn in the cookie settings in the site footer.

8.5. Information collected by third-party services, including payment systems, means of communication and other service providers, is stored and processed by those parties under their own terms and privacy policies. The Website uses: a hosting provider with servers in the Russian Federation; Yandex Metrica (Yandex LLC, Russia) and Google Analytics via Google Tag Manager (Google LLC, USA) — only with the User’s consent; Telegram — to contact the User about a request using the username they provided. The Operator is not responsible for the actions of third parties, including those listed in this clause.

8.6. Restrictions set by the data subject on data permitted for dissemination do not apply to processing in state, public and other public interests defined by Russian law.

8.7. The Operator keeps personal data confidential.

8.8. The Operator stores personal data in a form that allows identification of the data subject no longer than the purposes require, unless a longer period is set by federal law or a contract with the data subject.

8.9. Processing may end when its purposes are achieved, when consent expires or is withdrawn, when the data subject demands it, or when unlawful processing is discovered.

9. Operations performed with personal data

9.1. The Operator collects, records, organises, accumulates, stores, clarifies (updates, changes), retrieves, uses, transfers (disseminates, provides, gives access to), depersonalises, blocks, deletes and destroys personal data.

9.2. The Operator processes personal data automatically, with or without receiving and/or transmitting it over information and telecommunication networks.

10. Cross-border transfer

10.1. Before starting cross-border transfers, the Operator must notify the data protection authority of its intention (separately from the notification of processing).

10.2. Before submitting that notification, the Operator must obtain the relevant information from the foreign authorities, individuals or legal entities to which the transfer is planned.

10.3. Cross-border transfer takes place only if the User consents to web analytics: the technical data listed in clause 6.2 is transferred to Google LLC (USA). Request form data is not transferred abroad.

11. Confidentiality

The Operator and other persons with access to personal data must not disclose or disseminate it to third parties without the data subject’s consent, unless federal law provides otherwise.

12. Final provisions

12.1. The User can get any clarification on the processing of their personal data by emailing the Operator at work@evolvedesign.ru.

12.2. Any changes to the Operator’s policy will be reflected in this document. The Policy is valid indefinitely until replaced by a new version.

12.3. The current version of the Policy is available at https://evolvedesign.ru/policy. The consent to personal data processing is published at https://evolvedesign.ru/en/consent.

12.4. This is a translation. In case of discrepancy, the Russian version prevails.