Privacy Policy

NEREJA — https://nereja-studio.com/

Last updated: 24 August 2026

1. General provisions

1.1. This Privacy Policy (the "Policy") has been prepared in accordance with Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" of the Russian Federation and sets out how personal data is processed and what measures are taken to protect it.

1.2. The data controller (operator) is Individual Entrepreneur Svetlana Sergeevna Vashenyak (IE Vashenyak S. S.), TIN (INN) 500173262037, State Registration Number (OGRNIP) 321774600060724, registered address: 143915, Moscow Region, Balashikha, Michael Lunn Street 8, apt. 382, e-mail: info@nereja-studio.com (the "Operator").

1.3. This Policy applies to personal data that the Operator receives from users of the website https://nereja-studio.com/ (the "Website"), in particular through the "Contact us" form, and during any subsequent communication regarding the purchase of the Operator's products.

1.4. This Policy is a public document and is made freely available on the Website in accordance with Article 18.1(2) of Federal Law No. 152-FZ.

1.5. The Operator does not process special categories of personal data (racial or ethnic origin, political opinions, religious or philosophical beliefs, health, sex life) or biometric personal data.

1.6. The Operator does not knowingly process personal data of persons under 18 years of age. If the Operator becomes aware that such data has been submitted, it will be deleted.

2. Key definitions

Personal data — any information relating to a directly or indirectly identified or identifiable natural person (the data subject).

Processing of personal data — any operation or set of operations performed on personal data, whether or not by automated means.

Operator (controller) — the person who independently or jointly with others organises and (or) carries out the processing of personal data and determines the purposes of processing, the categories of personal data processed and the operations performed on such data.

Data subject — the natural person to whom the personal data relates.

Cross-border transfer of personal data — the transfer of personal data to the territory of a foreign state, to a foreign public authority, a foreign natural person or a foreign legal entity.

3. Categories of data subjects

3.1. The Operator processes personal data of the following categories of data subjects:

• prospective customers — persons who contact the Operator via the contact form on the Website or otherwise in order to obtain information about the Operator's products;
• customers — persons who have entered into or intend to enter into a contract for the sale of goods with the Operator.

4. Personal data processed

4.1. When completing the contact form on the Website, the Operator collects and processes the following personal data provided voluntarily by the data subject:

• first name;
• last name;
• e-mail address;
• country;
• phone number in international format;
• information voluntarily provided by the data subject in the free-text comment field, including the preferred messenger for communication (WhatsApp, Telegram, WeChat).

4.2. During subsequent communication regarding the conclusion and performance of a contract, the Operator may additionally process information required to arrange and deliver an order: delivery address, details of the composition and value of the order, and correspondence with the data subject through the agreed communication channel.

4.3. When the Website is visited, technical data may be processed automatically: IP address, browser and device information, date and time of the request, and cookie data. This data is used to keep the Website operational and secure.

4.4. The Operator does not verify the accuracy of the personal data provided and assumes that the data subject provides accurate information and keeps it up to date.

4.5. Data subjects are asked not to include in the free-text field any information that is not required to handle their enquiry, in particular personal data of third parties or data belonging to special categories of personal data.

5. Purposes of processing

5.1. Personal data is processed for the following purposes:

• preparation, conclusion and performance of a civil-law contract between the Operator and the data subject (contract for the sale of goods);
• handling the enquiry submitted through the contact form and replying to it;
• communicating with the data subject regarding the enquiry and the order, including clarification of product specifications, price, delivery terms and timeframes;
• arranging delivery of purchased goods;
• improving the quality of service and the operation of the Website;
• complying with the requirements of the legislation of the Russian Federation applicable to the Operator.

5.2. Processing is limited to the achievement of specific, predetermined and lawful purposes. Processing that is incompatible with the purposes of collection is not permitted.

6. Legal grounds for processing

6.1. Personal data is processed on the following legal grounds:

• the consent of the data subject to the processing of their personal data (Article 6(1)(1) of Federal Law No. 152-FZ), given by ticking the relevant checkbox in the form on the Website;
• the necessity of processing for the performance of a contract to which the data subject is a party, and for the conclusion of a contract at the initiative of the data subject (Article 6(1)(5) of Federal Law No. 152-FZ).

6.2. The Operator's registration documents and the contracts concluded with data subjects also serve as legal grounds for processing.

7. Methods of processing

7.1. Personal data is processed by automated means, with transmission of data over the Internet.

7.2. The Operator performs the following operations on personal data: collection, recording, systematisation, accumulation, storage, updating (amendment, modification), retrieval, use, transfer (provision, access), blocking, deletion and destruction.

7.3. The Operator does not disseminate personal data, i.e. does not disclose it to an indefinite range of persons.

7.4. The Operator does not take decisions producing legal effects concerning the data subject based solely on automated processing of their personal data.

7.5. The Operator does not process personal data for the purpose of promoting goods, works or services by making direct contact with the data subject by means of communication without the data subject's prior separate consent.

8. Use of Telegram as an internal notification channel

8.1. In order to handle enquiries promptly, the Operator uses a Telegram bot as an internal notification channel. Information submitted by the data subject through the contact form is forwarded via the Telegram bot to persons authorised by the Operator.

8.2. Access to such notifications is available solely to the Operator and persons authorised by the Operator, to the extent necessary to handle the enquiry and perform the contract.

8.3. The data subject is informed that the servers of the Telegram service are located outside the Russian Federation, and that sending notifications via Telegram therefore constitutes a cross-border transfer of personal data. The terms of such transfer are set out in Section 10 of this Policy.

9. Location of databases and storage of personal data

9.1. Personal data is stored in a form permitting identification of the data subject for no longer than required by the purposes of processing, unless a retention period is established by federal law or by contract.

9.2. Databases containing personal data are hosted in the following data centres:

• Qupra DC2, Guroscoopweg 58, 1042 AC Amsterdam, Kingdom of the Netherlands;
• De Gouden Driehoek, Beneluxweg 4, 9636 HV Zuidbroek, Kingdom of the Netherlands.

9.3. These data centres are not owned by the Operator and are used on the basis of agreements with hosting providers.

9.4. Once the purposes of processing have been achieved, or if the data subject withdraws consent, personal data is destroyed or anonymised, unless otherwise provided by the legislation of the Russian Federation.

10. Cross-border transfer of personal data

10.1. The Operator carries out cross-border transfers of personal data to the Kingdom of the Netherlands in connection with the hosting of databases in the data centres listed in clause 9.2 of this Policy, and in connection with the use of the Telegram service as an internal notification channel.

10.2. The Kingdom of the Netherlands is a party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data and is regarded as a state providing adequate protection of the rights of data subjects.

10.3. The Operator notifies the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) of cross-border transfers of personal data in accordance with Article 12 of Federal Law No. 152-FZ.

10.4. By submitting personal data through the form on the Website, the data subject confirms that they have been informed of the cross-border transfer of their personal data on the terms set out in this Section.

11. Transfer of personal data to third parties

11.1. The Operator does not sell personal data and does not transfer it to third parties, except in the cases set out in clause 11.2 of this Policy.

11.2. Personal data may be transferred to:

• transport and courier services and postal operators — to the extent necessary to deliver purchased goods;
• persons ensuring the operation of the Website and the Operator's information infrastructure (hosting services, technical support) — provided that they comply with confidentiality and data security requirements;
• public authorities of the Russian Federation — upon their reasoned request, in the cases and in the manner provided for by the legislation of the Russian Federation.

11.3. Personal data is transferred to third parties only to the minimum extent necessary and solely to achieve the purposes set out in Section 5 of this Policy.

11.4. Where the Operator engages another person to process personal data on its behalf, the Operator concludes an agreement with that person imposing an obligation to maintain the confidentiality and security of the personal data.

12. Security measures

12.1. The Operator takes the necessary legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, provision and dissemination, as well as against other unlawful acts.

12.2. These measures include:

• appointment of a person responsible for organising the processing of personal data;
• adoption of internal regulations on the processing and protection of personal data;
• publication of this Policy in open access on the Website;
• segregation of access rights to information systems and user accounts;
• password protection and two-factor authentication for account access;
• anti-virus protection of workstations;
• data backup;
• use of a secure HTTPS (SSL/TLS) connection when transmitting personal data;
• monitoring of the measures taken and detection of unauthorised access to personal data.

12.3. If the Operator identifies any unlawful or accidental transfer of personal data resulting in a breach of the rights of data subjects, the Operator notifies Roskomnadzor within the timeframes set out in Article 21(3.1) of Federal Law No. 152-FZ.

13. Cookies

13.1. The Website uses cookies and similar technologies to ensure its operation, to save user settings and to analyse traffic.

13.2. The data subject may at any time disable cookies in their browser settings or delete previously stored cookies. In that case certain functions of the Website may not work correctly.

14. Rights of the data subject

14.1. The data subject has the right to:

• obtain information concerning the processing of their personal data, to the extent provided for by Article 14(7) of Federal Law No. 152-FZ;
• request the rectification, blocking or destruction of their personal data where it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;
• withdraw previously given consent to the processing of personal data;
• object to the processing of personal data for the purpose of promoting goods, works and services;
• appeal against the acts or omissions of the Operator to Roskomnadzor or before a court.

15. Requests and withdrawal of consent

15.1. Requests, demands and enquiries concerning the processing of personal data should be sent to the Operator at info@nereja-studio.com or to the postal address set out in Section 1 of this Policy.

15.2. A request must contain information enabling the Operator to identify the data subject, including information confirming their relationship with the Operator (for example, the e-mail address or phone number provided when contacting the Operator through the Website), together with the signature of the data subject or their representative.

15.3. The Operator will review the request and provide a response within ten working days of receipt. This period may be extended by no more than five working days, with a reasoned notice sent to the data subject.

15.4. Consent to the processing of personal data may be withdrawn at any time by sending a notice using the means set out in clause 15.1. Withdrawal of consent does not affect the lawfulness of processing carried out before the Operator received the withdrawal.

15.5. Where consent is withdrawn, the Operator will cease processing and ensure the destruction of the personal data within thirty days of receipt of the withdrawal, unless the Operator is entitled to continue processing on another lawful ground.

16. Final provisions

16.1. The Operator may amend this Policy. The current version is published on the Website at a permanent address. The date of the last update is shown at the top of the document.

16.2. This Policy has been drawn up in Russian. The English version is provided on the Website for the convenience of users. In the event of any discrepancy between the versions, the Russian text prevails.

16.3. This Policy and the relationship between the Operator and the data subject are governed by the legislation of the Russian Federation.