CONSENT TO THE PROCESSING OF PERSONAL DATA
Effective as of February 15, 2012
I, the data subject, hereby give my consent to [Operator Name], Taxpayer Identification Number [TIN], located at [Operator Address], to process my personal data under the following terms.
Categories of Personal Data Processed
- full name;
- contact telephone numbers;
- email addresses;
- technical data, including IP address, cookies, and device information.
Purposes of Processing
- handling incoming inquiries;
- providing information and consultations regarding services;
- analyzing website traffic and usage;
- fulfilling contractual obligations.
Methods of Processing
The Operator may perform all actions permitted under Federal Law No. 152-FZ, including the collection, recording, organization, storage, updating, retrieval, use, transfer, anonymization, restriction, and deletion of personal data.
Validity of Consent
This consent remains valid until it is withdrawn by sending written notice to the Operator’s address or by email to:
Additional Provisions
This consent may be withdrawn at any time.
Following withdrawal, the Operator may continue processing personal data where such processing is permitted under the laws of the Russian Federation.
Registration Information
Basis for inclusion in the register: Order No. 89 dated February 15, 2012
Notification registration date: February 3, 2012
Registration number: 12-0236060
______________
DEKA-ART
International Privacy & Cookie Policy
EU/EEA • United Kingdom • United States
Effective date: 11 July 2026
Version: 1.0
IMPORTANT — LEGAL REVIEW REQUIRED
This document is a practical international template prepared for the Deka-Art website. It is not a substitute for advice from qualified privacy counsel. Before publication, Deka-Art must complete all placeholders, verify the actual website technologies and vendors, confirm the legal entity that controls the data, and obtain jurisdiction-specific review. In particular, applicability of US state privacy laws depends on business thresholds and actual processing activities.
Prepared for: Deka-Art Architecture & Interior Design Studio
Website: dekaart.ru
Document Completion Checklist
· ☐ Insert the full legal name of the data controller/operator, registration number, tax number, and registered address.
· ☐ Confirm the privacy contact email and whether a Data Protection Officer (DPO) or EU/UK representative is required.
· ☐ Inventory all website forms, cookies, pixels, analytics, embedded maps, fonts, videos, chat widgets, CRM systems, email providers, hosting providers, and advertising tools.
· ☐ Complete the cookie table with exact cookie names, providers, purposes, and retention periods.
· ☐ Confirm whether Deka-Art sells or shares personal information for cross-context behavioral advertising under applicable US state laws.
· ☐ Confirm international transfer mechanisms used by each vendor, including adequacy decisions, Standard Contractual Clauses, the UK International Data Transfer Addendum/Agreement, or another lawful safeguard.
· ☐ Align the retention periods with internal business, accounting, litigation, and contract requirements.
· ☐ Configure the consent management platform so non-essential cookies do not load before consent in the EU/EEA and UK.
· ☐ Add functioning links for “Privacy Choices, ” “Do Not Sell or Share My Personal Information, ” and “Limit the Use of My Sensitive Personal Information” if legally applicable.
· ☐ Create an internal procedure for verifying and responding to privacy rights requests within legally required timeframes.
Suggested Website Legal Documents
· Privacy Policy (this document, after completion)
· Cookie Policy and cookie preference center (included as Part II)
· Cookie banner / consent notice (sample wording in Appendix A)
· Contact-form privacy notice (sample wording in Appendix B)
· US state privacy notice and privacy choices page (Part III)
· Russian personal data policy and consent form for Russian users (maintained separately under Federal Law No. 152-FZ)
PART I — INTERNATIONAL PRIVACY POLICY
1. Who We Are
Data Controller / Business: [FULL LEGAL NAME OF DEKA-ART ENTITY] (“Deka-Art, ” “we, ” “us, ” or “our”)
Registered address: [FULL REGISTERED ADDRESS]
Registration / Tax number: [NUMBER]
Privacy email: [privacy@dekaart.ru or confirmed email]
Telephone: [PRIVACY CONTACT NUMBER]
EU representative, if required: [NAME AND CONTACT DETAILS / NOT APPLICABLE]
UK representative, if required: [NAME AND CONTACT DETAILS / NOT APPLICABLE]
This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit dekaart.ru, contact us, request a consultation, discuss or commission a project, or otherwise interact with Deka-Art. It also explains the privacy rights that may be available to you under applicable law.
2. Scope
This Policy applies to personal information processed through:
· dekaart.ru and its language versions;
· online inquiry, consultation, and contact forms;
· email, telephone, messenger, and video-call communications;
· client onboarding, proposals, contracts, project delivery, sourcing, and support;
· website analytics, security, and permitted marketing activities.
This Policy does not apply to third-party websites, platforms, or services that have their own privacy notices. Links to third-party services are provided for convenience and do not mean that Deka-Art controls their privacy practices.
3. Personal Information We Collect
3.1 Information You Provide
· Identity information, such as your name and, where needed for a contract, identification or company details.
· Contact information, such as telephone number, email address, postal address, and messenger account details.
· Project information, including property location, floor area, photographs, plans, budget range, desired services, design preferences, family or occupancy requirements, and project timeline.
· Commercial and transaction information, such as proposals, contracts, invoices, payment status, and purchasing or sourcing records.
· Communications, including inquiries, correspondence, meeting notes, call records where lawfully recorded, and feedback.
· Any other information you voluntarily submit to us.
3.2 Information Collected Automatically
· IP address, approximate location derived from IP, browser type, operating system, device type, language, and referring URL.
· Website usage information, such as pages viewed, links selected, time spent, session events, and error logs.
· Cookie and similar technology identifiers, subject to your consent where required.
· Security and fraud-prevention information, including logs used to detect abuse, attacks, or unauthorized access.
3.3 Information from Other Sources
· Project participants, such as family members, representatives, architects, contractors, developers, suppliers, and consultants.
· Publicly available sources and professional directories.
· Referral partners or social media platforms when you choose to contact us through those services.
· Service providers that support website hosting, analytics, communications, or client management.
4. How and Why We Use Personal Information
Purpose
Typical data
EU/EEA & UK legal basis
Typical retention
Respond to inquiries and arrange consultations
Name, contact details, message, project information
Steps at your request before entering a contract; legitimate interests in responding to business inquiries
Up to 24 months after the last meaningful contact, unless a contract is formed
Prepare proposals, contracts, and project plans
Identity, contact, property and project information, budget, communications
Contract performance or pre-contract steps
Contract term plus the applicable legal limitation and recordkeeping period
Deliver architecture, design, sourcing, supervision, and related services
Project files, plans, photos, specifications, communications, supplier and payment data
Contract performance; legal obligations; legitimate interests in professional project management
Project duration plus up to 10 years, subject to legal and professional requirements
Process payments and maintain accounting records
Billing details, invoices, payment status, tax information
Contract performance and legal obligations
As required by tax, accounting, and anti-fraud laws
Operate, secure, and improve the website
Technical data, logs, device and usage information
Legitimate interests in security and basic website operation; consent for non-essential analytics where required
Security logs typically 6–24 months; analytics according to configured tool retention
Send requested updates or marketing communications
Name, email, communication preferences
Consent, or legitimate interests where permitted by local law and an existing relationship
Until you unsubscribe or after a defined period of inactivity
Establish, exercise, or defend legal claims
Relevant contract, communication, transaction, and project data
Legitimate interests and legal obligations
For the applicable limitation period and while a dispute is active
Comply with laws and regulatory requests
Any information legally required
Legal obligation; substantial public interest where applicable
For the period required by law
5. Cookies and Similar Technologies
We use cookies and similar technologies for website operation, security, preferences, analytics, embedded content, and—only where applicable—advertising. In the EU/EEA and UK, non-essential cookies should not be activated until you have provided valid consent. You may withdraw consent at any time through the cookie preference center. More information appears in Part II of this document.
6. When We Share Personal Information
We may disclose personal information only when reasonably necessary and subject to appropriate safeguards, including to:
· hosting, IT, cybersecurity, email, cloud storage, CRM, analytics, and communications providers;
· architects, engineers, designers, contractors, consultants, suppliers, manufacturers, logistics providers, and other project participants;
· payment, banking, accounting, tax, insurance, and legal advisers;
· public authorities, courts, regulators, or law-enforcement bodies where required by law;
· a buyer, investor, or successor in connection with a genuine merger, restructuring, financing, or sale of all or part of the business, subject to confidentiality and legal requirements.
We do not disclose personal information to third parties for their independent purposes unless this is described in this Policy, authorized by you, or required by law.
7. International Data Transfers
Deka-Art is based in Russia and may work with service providers or project participants located in Russia, the United States, the European Economic Area, the United Kingdom, and other countries. Therefore, personal information may be processed in a country whose privacy laws differ from those in your location.
Where EU/EEA or UK personal data is transferred internationally, we will use a lawful transfer mechanism where required, such as:
· an adequacy decision or adequacy regulation;
· European Commission Standard Contractual Clauses;
· the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses;
· an approved certification or other legally recognized safeguard;
· a limited derogation permitted by law, such as an occasional transfer necessary to perform a contract or based on informed explicit consent where appropriate.
We will also assess whether supplementary technical, contractual, or organizational measures are needed. You may request information about the applicable transfer safeguards by contacting us.
8. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide services, maintain project records, comply with legal and accounting duties, resolve disputes, enforce agreements, and protect our systems.
Retention periods are determined by:
· the nature and sensitivity of the information;
· the duration and complexity of the client relationship or project;
· contract, tax, accounting, construction, design, insurance, and professional recordkeeping requirements;
· applicable limitation periods;
· security, fraud-prevention, and dispute considerations;
· whether you have withdrawn consent or exercised a deletion right.
When information is no longer required, we delete it, anonymize it, or securely isolate it until deletion is possible.
9. Security
We use reasonable administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. Measures may include access controls, authentication, backups, encryption where appropriate, staff confidentiality requirements, vendor due diligence, and incident-response procedures.
No transmission or storage system is completely secure. You should use appropriate precautions when sending confidential project or identity information electronically.
10. Your Privacy Rights
10.1 EU/EEA and UK Rights
Subject to applicable conditions and exceptions, you may have the right to:
· receive transparent information about processing;
· request access to your personal data;
· request correction of inaccurate or incomplete data;
· request deletion;
· request restriction of processing;
· object to processing based on legitimate interests or to direct marketing;
· withdraw consent at any time, without affecting processing already carried out;
· receive certain data in a portable format;
· not be subject to a solely automated decision that produces legal or similarly significant effects, where applicable;
· lodge a complaint with the data protection authority in your country.
10.2 United States Privacy Rights
Depending on your state of residence and whether the relevant law applies to Deka-Art, you may have rights to request access, correction, deletion, or a portable copy of personal information; to obtain information about categories of data, sources, purposes, and recipients; to opt out of sale, sharing, targeted advertising, or certain profiling; to limit certain uses of sensitive personal information; and to appeal a denied request.
Deka-Art will not discriminate against you for exercising a legally protected privacy right. Part III provides additional information for US residents.
10.3 How to Exercise Your Rights
Submit a request using one of the following methods:
· Email: [PRIVACY EMAIL]
· Web form: [PRIVACY REQUEST URL]
· Mail: [POSTAL ADDRESS]
· Telephone, where required: [TOLL-FREE OR OTHER NUMBER]
We may need to verify your identity and authority before completing a request. Authorized agents may submit requests where permitted by law, but we may require proof of authorization and direct identity verification. We will respond within the period required by applicable law and explain any lawful refusal or extension.
11. Marketing Communications
We send marketing communications only where permitted by law. You can unsubscribe at any time by using the link in an email or contacting us. Unsubscribing from marketing does not prevent us from sending non-marketing communications relating to an inquiry, contract, payment, security, or project.
12. Children
The website and Deka-Art services are not directed to children. We do not knowingly collect personal information directly from children under 13 in the United States or under the applicable digital-consent age in the EU/EEA or UK. Project information about children may be provided by an adult client when relevant to designing a family residence. If you believe a child has provided information to us without appropriate authorization, please contact us.
13. Automated Decision-Making
Deka-Art does not currently use personal information to make solely automated decisions that produce legal or similarly significant effects. If this changes, we will provide the disclosures and choices required by applicable law.
14. Changes to This Policy
We may update this Policy to reflect changes in our services, technologies, vendors, or legal obligations. The current version will be posted on the website with an updated effective date. Where required, we will provide additional notice or request renewed consent.
15. Contact and Complaints
Questions, privacy requests, or complaints may be sent to:
· Deka-Art / [LEGAL ENTITY NAME]
· Privacy email: [EMAIL]
· Postal address: [ADDRESS]
· EU representative: [IF APPLICABLE]
· UK representative: [IF APPLICABLE]
EU/EEA and UK residents may also complain to their local supervisory authority. We encourage you to contact us first so we can try to address your concern.
PART II — COOKIE POLICY
1. What Cookies Are
Cookies are small text files or similar identifiers stored on or accessed from your device when you visit a website. Similar technologies include pixels, local storage, software development kits, tags, and scripts.
2. Categories of Cookies
Category
Purpose
Consent in EU/UK
Examples / placeholders
Strictly Necessary
Security, network management, consent choices, load balancing, and core website functions
Usually not required, but must be limited to what is strictly necessary
[SESSION COOKIE], [CONSENT COOKIE]
Functional / Preferences
Remember language, region, form preferences, or optional interface features
Generally required unless the function was explicitly requested by the user
[LANGUAGE COOKIE], [VIDEO/CHAT PREFERENCE]
Analytics
Measure traffic, page performance, and user interaction to improve the website
Required before activation in the EU/EEA and UK unless a narrow local exemption applies
[GA4 / MATOMO / YANDEX METRICA — VERIFY]
Advertising / Social Media
Measure campaigns, personalize advertising, or enable third-party social media features
Required before activation in the EU/EEA and UK; may also trigger US opt-out rights
[META PIXEL / GOOGLE ADS / OTHER — VERIFY]
3. Cookie Inventory — Complete Before Publication
Cookie / technology
Provider
Category
Purpose
Duration
Data transfer / link
[NAME]
[PROVIDER]
[CATEGORY]
[PURPOSE]
[DURATION]
[COUNTRY / PRIVACY LINK]
[NAME]
[PROVIDER]
[CATEGORY]
[PURPOSE]
[DURATION]
[COUNTRY / PRIVACY LINK]
[NAME]
[PROVIDER]
[CATEGORY]
[PURPOSE]
[DURATION]
[COUNTRY / PRIVACY LINK]
[NAME]
[PROVIDER]
[CATEGORY]
[PURPOSE]
[DURATION]
[COUNTRY / PRIVACY LINK]
[NAME]
[PROVIDER]
[CATEGORY]
[PURPOSE]
[DURATION]
[COUNTRY / PRIVACY LINK]
[NAME]
[PROVIDER]
[CATEGORY]
[PURPOSE]
[DURATION]
[COUNTRY / PRIVACY LINK]
[NAME]
[PROVIDER]
[CATEGORY]
[PURPOSE]
[DURATION]
[COUNTRY / PRIVACY LINK]
[NAME]
[PROVIDER]
[CATEGORY]
[PURPOSE]
[DURATION]
[COUNTRY / PRIVACY LINK]
4. Managing Your Choices
When required, the website will display a cookie banner that provides equally accessible options to accept or reject non-essential cookies and a link to granular settings. Rejecting non-essential cookies must not require more steps than accepting them. No non-essential cookie should be set before a valid choice is made.
You can change or withdraw your consent at any time through the “Cookie Settings” link displayed in the website footer. Browser controls may also allow you to block or delete cookies, although doing so may affect website functionality.
5. Global Privacy Control and Do Not Track
Where required by applicable US law, Deka-Art will recognize valid browser-based opt-out preference signals, including Global Privacy Control, for the browser or device sending the signal. The website’s treatment of traditional “Do Not Track” signals should be stated here after technical verification: [INSERT DNT PRACTICE].
PART III — SUPPLEMENTAL NOTICE FOR UNITED STATES RESIDENTS
1. Applicability
This Part supplements the International Privacy Policy for residents of US states with comprehensive privacy laws. These laws apply only when their statutory thresholds and other requirements are met. Inclusion of this Part does not state that every US state privacy law applies to Deka-Art.
2. Categories of Personal Information
Category
Examples
Business purposes
Disclosed to
Identifiers
Name, email, phone, postal address, IP address
Inquiries, contracts, services, security, communications
Service providers, project participants, professional advisers
Customer and commercial information
Project interests, proposals, contracts, transaction and payment records
Provide services, billing, account management, legal compliance
Payment/accounting providers, advisers, project partners
Internet or electronic activity
Pages viewed, device/browser data, interaction events
Security, analytics, website improvement, advertising if enabled
Hosting, security, analytics, advertising providers
Geolocation
Approximate location derived from IP; project/property location you provide
Localize services, plan projects, security
Service providers and relevant project participants
Audio, visual, and similar information
Project photographs, property images, video-call content, recordings if lawfully made
Consultation, design, documentation, quality control
Project participants and service providers
Professional or employment information
Company, job title, professional role
Business communications and project coordination
Project participants and advisers
Inferences
Inferred design preferences, service interests, likely project needs
Personalize proposals and services
Internal team and relevant service providers
Sensitive information, if provided
Account login credentials; precise property access or security details; government ID where legally necessary
Security, contract administration, property access, legal compliance
Restricted personnel and necessary providers only
3. Sale, Sharing, and Targeted Advertising
Complete one of the following statements after auditing the website:
· Option A — No sale/share: “Deka-Art does not sell personal information for money and does not share personal information for cross-context behavioral advertising.”
· Option B — Advertising technologies used: “Deka-Art may allow certain advertising or analytics partners to collect identifiers and internet activity for targeted or cross-context behavioral advertising. Where applicable, you may opt out through Privacy Choices, the Do Not Sell or Share link, or a recognized opt-out preference signal.”
4. US Consumer Rights
· Know or access the personal information we process and, where applicable, the categories, sources, purposes, and recipients.
· Correct inaccurate personal information.
· Delete personal information, subject to legal exceptions.
· Obtain a portable copy of certain information.
· Opt out of sale, sharing, targeted advertising, or qualifying profiling.
· Limit certain uses and disclosures of sensitive personal information, where applicable.
· Appeal a denial of a request, where the applicable state law provides an appeal right.
· Receive equal service and pricing without unlawful discrimination for exercising privacy rights.
5. California-Specific Disclosures
If the California Consumer Privacy Act, as amended, applies to Deka-Art, the privacy notice must be reviewed at least annually and describe the categories of personal information collected, sources, business or commercial purposes, categories of recipients, and applicable sale/sharing practices. Deka-Art must provide required request methods and, when applicable, conspicuous links for “Do Not Sell or Share My Personal Information” and “Limit the Use of My Sensitive Personal Information.”
California residents may also request information about certain disclosures for direct marketing under California’s “Shine the Light” law, if applicable. Insert the required contact method here: [CONTACT].
6. Metrics and Request Records
Where legally required, Deka-Art will maintain records of privacy requests and publish request metrics. Internal records should not be used for unrelated purposes and should be retained only for the required period.
APPENDIX A — SAMPLE COOKIE BANNER
Recommended First Layer
We value your privacy
We use necessary cookies to operate and secure this website. With your permission, we also use optional analytics and other technologies to understand website use and improve our services. Select “Accept All, ” “Reject Optional, ” or “Manage Preferences.” You can change your choice at any time in Cookie Settings.
Buttons: ACCEPT ALL | REJECT OPTIONAL | MANAGE PREFERENCES
Cookie Settings Categories
· Strictly Necessary — Always Active
· Functional — Optional
· Analytics — Optional
· Advertising / Social Media — Optional
APPENDIX B — CONTACT FORM PRIVACY NOTICE
Short notice below the form
We use the information you submit to respond to your inquiry and, where requested, to take steps toward providing our services. Required fields are marked accordingly. For details about retention, international transfers, your rights, and how to contact us, please read our Privacy Policy.
Optional marketing checkbox (unchecked by default): “I would like to receive occasional news and project updates from Deka-Art. I can unsubscribe at any time.”
APPENDIX C — SAMPLE PRIVACY REQUEST FORM FIELDS
· Full name
· Email address used with Deka-Art
· Country and state/region of residence
· Type of request: access / correction / deletion / portability / objection / opt-out / restriction / appeal
· Description of the request
· Authorized agent details, if applicable
· Preferred response method
· Identity verification information requested only when necessary
APPENDIX D — IMPLEMENTATION NOTES FOR WFOLIO
· Add permanent footer links: Privacy Policy, Cookie Policy, Cookie Settings, and Privacy Choices (when applicable).
· Configure the cookie banner so analytics, video embeds, advertising pixels, and other optional tools remain blocked before consent for EU/EEA and UK visitors.
· Do not use pre-ticked boxes or treat continued browsing as consent.
· Make “Reject Optional” as visible and easy to use as “Accept All.”
· Record the user’s consent choice, date/time, policy version, and categories selected.
· Allow consent withdrawal from every page through a persistent Cookie Settings link.
· Place a short privacy notice next to every form that collects personal information.
· Use HTTPS and restrict access to form submissions and client files.
· Ensure third-party embedded content does not load before the applicable consent is obtained.
· Keep the Russian-law privacy documents separate and clearly identify which legal entity and processing activities they cover.
APPENDIX E — OFFICIAL LEGAL SOURCES USED FOR THIS TEMPLATE
· European Commission — Data protection under the GDPR
· European Commission — Information that must be provided when data is collected
· European Commission — International dimension of EU data protection
· European Data Protection Board — Cookie policy / consent model
· European Data Protection Board — Cookie Banner Taskforce report
· UK Information Commissioner’s Office — Privacy information requirements
· UK Information Commissioner’s Office — International transfers
· California Department of Justice — California Consumer Privacy Act
· California Department of Justice — CCPA regulations
Publication Approval
Legal entity confirmed
[YES / NO]
Vendor and cookie audit completed
[YES / NO]
International transfer safeguards verified
[YES / NO]
Reviewed by qualified counsel
[NAME / DATE]
Approved for publication
[NAME / DATE]