General Provisions
This Privacy Policy for the processing of personal data (hereinafter referred to as the Policy) has been developed in accordance with the requirements of Federal Law No. 152-FZ of July 27, 2006 “On Personal Data” (hereinafter referred to as the Personal Data Law) and defines the procedures for processing personal data and the measures taken to ensure the security of personal data by Sole Proprietor Viktoria Leonidovna Dobrovolskaya (hereinafter referred to as the Operator).
The Operator considers the observance of human and civil rights and freedoms in the processing of personal data, including the protection of the right to privacy, personal and family confidentiality, as a primary goal and condition of its activities.
This Policy applies to all information that the Operator may receive about visitors to the website https://vaorchestra.com.

Key Terms Used in the Policy
Automated processing of personal data – processing using computer technology.
Blocking of personal data – temporary suspension of data processing (except where processing is necessary to clarify personal data).
Website – the set of graphic and informational materials, software, and databases accessible online at https://vaorchestra.com.
Personal data information system – the set of personal data contained in databases and IT/technical tools used to process them.
Depersonalization of personal data – actions that make it impossible to determine the data’s owner without additional information.
Processing of personal data – any action or set of actions performed with or without automation, including collection, recording, organization, accumulation, storage, clarification, retrieval, use, transfer, depersonalization, blocking, deletion, or destruction.
Operator – any public body, legal entity, or individual that organizes and/or carries out the processing of personal data and determines its purposes, scope, and means.
Personal data – any information relating directly or indirectly to an identified or identifiable user of the website.
Personal data made publicly available – data that the subject has consented to share with an unlimited number of persons.
User – any visitor to the website https://vaorchestra.com.
Provision of personal data – actions intended to disclose personal data to a specific person or group.
Dissemination of personal data – any actions that make data available to an unlimited number of persons.
Cross-border data transfer – transfer of data to a foreign country, its authority, foreign individual, or legal entity.
Destruction of personal data – any actions resulting in the permanent loss of personal data beyond recovery.

Rights and Obligations of the Operator
The Operator has the right to:

• request accurate information and/or documents from the data subject
• continue processing personal data without consent where permitted by the Personal Data Law
• determine independently the necessary measures to ensure compliance with applicable laws

The Operator must:

• provide the data subject with information on their data processing
• organize processing in accordance with Russian legislation
• respond to data subjects’ requests
• submit information to authorized authorities upon request within 10 days
• publish or otherwise make this Policy publicly available
• implement legal, organizational, and technical measures to protect personal data
• cease processing and destroy personal data when required by law
• fulfill other obligations established by law

Rights and Obligations of Personal Data Subjects
Data subjects have the right to:

• obtain information on their data processing (except as limited by law)
• request correction, blocking, or deletion of inaccurate or unlawfully obtained data
• require prior consent for marketing use of personal data
• withdraw consent to processing
• file complaints with data protection authorities or the courts
• exercise other rights under Russian law

Data subjects must:

• provide accurate personal data to the Operator
• inform the Operator about updates to their personal data

Individuals providing false or third-party data without consent are legally liable.

Principles of Personal Data Processing

• Processing is lawful and fair
• Data is processed for specific, legitimate purposes
• Combining databases with incompatible purposes is not allowed
• Only data relevant to the processing purpose is processed
• The scope and content of data must match the processing goals
• Data must be accurate, adequate, and up-to-date
• Data is stored no longer than necessary for its processing purpose unless otherwise required by law or contract

Purpose of Personal Data Processing
Providing the user access to services, information, and materials on the website
Personal Data: Full name, email address, phone number
Legal Basis: Operator’s founding documents
Processing Types: Collection, recording, organization, storage, destruction, depersonalization, informational email communication

Conditions of Personal Data Processing
Based on the user’s consent
Required to fulfill legal obligations or international agreements
Necessary for legal proceedings or enforcement of legal decisions
Required to perform a contract involving the data subject
Required to protect the legitimate interests of the Operator or third parties, provided this does not infringe the data subject’s rights
For publicly available personal data
For data subject to disclosure under federal law

Procedure for Collection, Storage, Transfer, and Other Processing
The Operator ensures data confidentiality and prevents unauthorized access.
Data is not disclosed to third parties without legal basis or consent, unless required to fulfill contractual obligations.
Users can update their data by emailing victoriaartis@yandex.ru with the subject line “Personal Data Update.”
The data retention period is determined by the purpose of collection unless otherwise specified by law or contract. Consent may be withdrawn by emailing “Withdrawal of Consent to Data Processing.”
Data collected by third-party services (e.g., payment systems, communication tools) is processed under their own privacy policies. The Operator is not responsible for third-party actions.
Restrictions set by data subjects on dissemination do not apply to cases involving public interest as defined by Russian law.
Data is stored only as long as necessary for its purpose unless otherwise required by law.
Processing ends upon achieving its purpose, consent withdrawal, or unlawful processing detection.

Data Processing Actions
The Operator performs collection, recording, organization, accumulation, storage, clarification, retrieval, use, transfer, depersonalization, blocking, deletion, and destruction.
The Operator may conduct automated processing with or without telecommunications networks.

Cross-Border Data Transfers
The Operator must notify the authorized data protection authority of its intention to conduct cross-border transfers (separate from general processing notices).
Before such notification, the Operator must obtain relevant guarantees from the receiving parties.

Confidentiality of Personal Data
The Operator and any parties with access to personal data must not disclose or distribute it without the data subject’s consent, unless otherwise provided by law.

Final Provisions
Users may contact the Operator with questions about personal data processing via email at victoriaartis@yandex.ru
Any changes to this Policy will be reflected in the document. The Policy remains effective indefinitely until replaced by a new version.
The current version is publicly available at https://vaorchestra.com/privacy