RUENFR中文
PDF catalogue

Personal Data Processing Policy

Revision of 25 September 2026. This is a translation; in case of discrepancy the Russian version prevails.

This Policy is issued under Article 18.1(2) of Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” (the “Law”) and sets out how IE Vladimir Sergeevich Kuzub (st.Aura) processes and protects personal data.

1. Operator

1.1. The personal data operator (controller) is Individual Entrepreneur Vladimir Sergeevich Kuzub, OGRNIP 315784700199194, INN 246010142944 (the “Operator”, the “Studio”).

1.2. Personal data requests are accepted via Telegram @aura_management or by e-mail at vne-ramok@yandex.ru.

2. Definitions

Terms have the meanings given by the Law. User — a person visiting the Website https://aurart.art. Client — a person who has sent a request to, or concluded an agreement with, the Studio.

3. Principles

The Studio processes personal data lawfully and fairly, only for specified purposes and to the extent necessary for them. It does not combine databases with incompatible purposes, keeps data accurate and stores it no longer than the purposes or the law require.

4. Purposes, Data, Legal Bases and Retention

4.1. Responding to requests and consultation. Data: name, phone, e-mail or messenger handle, city, message text, Works of interest. Basis: consent (Article 6(1)(1) of the Law). Retention: until the purpose is achieved, but no longer than 3 years from the last contact, or until consent is withdrawn.

4.2. Concluding and performing the agreement. Data: full name, contacts, delivery address, recipient details, order and payment details, images and materials provided by the Client. Basis: contract (Article 6(1)(5) of the Law). Retention: term of the agreement plus 5 years (retention of primary records and limitation period).

4.3. Accounting and tax. Data: full name, payment details, transaction details. Basis: legal obligation (Article 6(1)(2) of the Law). Retention: as required by accounting and tax law.

4.4. Newsletters and marketing. Data: e-mail or messenger handle, language, name. Basis: separate consent (Article 18 of the Russian Advertising Law; Article 6(1)(1) of the Law). Retention: until consent is withdrawn or the User unsubscribes.

4.5. Website operation and analytics. Data: cookies, IP address, browser and device information, pages and time of visit. Basis: strictly necessary cookies are required for the Website to work; analytics and marketing cookies are used only with the User’s consent. Retention: as stated in the Cookie Policy.

4.6. Publishing works in the portfolio. Data: images of Works and interiors without information identifying the Client. The Client’s details, likeness or property address are published only with separate consent.

5. Processing Operations

The Studio collects, records, organises, accumulates, stores, updates, retrieves, uses, transfers (provides, grants access to), blocks, deletes and destroys personal data, with and without automation. The Studio does not take decisions producing legal effects for the data subject solely on the basis of automated processing.

6. Recipients

6.1. The Studio transfers data only to the extent necessary for the purpose:

  • carriers and courier services — for delivery;
  • banks, payment services and the fiscal data operator — to accept payment and issue receipts;
  • the Studio’s contractors involved in production — only order details, without the Client’s contacts unless required for performance;
  • hosting providers and communication services through which the Website and Official Channels operate;
  • public authorities — where required by law.

6.2. Persons instructed to process data must keep it confidential and comply with the Law (Article 6(3) of the Law).

7. Localisation and Cross-Border Transfer

7.1. When collecting personal data of citizens of the Russian Federation, the Studio records, organises, accumulates, stores, updates and retrieves it using databases located in the Russian Federation (Article 18(5) of the Law).

7.2. Cross-border transfer may occur where the Client chooses a foreign messenger for correspondence, orders delivery abroad or is a foreign person. The Studio transfers data abroad after notifying Roskomnadzor under Article 12 of the Law and only to the extent necessary: to a foreign carrier and recipient for international delivery, and to the communication service chosen by the Client.

8. Security

The Studio takes the legal, organisational and technical measures required by Articles 18.1 and 19 of the Law: appointing a person responsible for processing, restricting access, using passwords and two-factor authentication, encrypting connections to the Website (HTTPS), keeping backups, and destroying data after the retention period. The Studio notifies Roskomnadzor of incidents of unlawful data transfer within 24 hours and of the investigation results within 72 hours (Article 21(3.1) of the Law).

9. Data Subject Rights

The data subject may:

  • obtain information about the processing of their data (Article 14 of the Law);
  • demand that incomplete, outdated, inaccurate or unlawfully obtained data be corrected, blocked or destroyed;
  • withdraw consent to processing;
  • unsubscribe from newsletters at any time;
  • appeal the Studio’s actions to Roskomnadzor or a court.

The Studio responds within 10 business days. This period may be extended by 5 business days with a reasoned notice to the data subject (Articles 14(3) and 20 of the Law).

10. Withdrawal of Consent and Deletion

Consent is withdrawn by a message via the channels in clause 1.2. After withdrawal, the Studio stops processing and destroys the data within 30 days, except data that must be kept by law or to perform an agreement (Articles 9(2) and 21(5) of the Law). Images provided by the Client for a bespoke Work are deleted within 100 days after handover of the Work unless the Client asks to keep them longer.

11. Users in the European Union (GDPR)

11.1. For users located in the EU/EEA, Regulation (EU) 2016/679 (GDPR) additionally applies to the extent it covers the Studio’s activities. The controller is the Operator named in Section 1.

11.2. Legal bases: performance of a contract and pre-contractual steps at the data subject’s request (Art. 6(1)(b) GDPR); consent (Art. 6(1)(a)) — for newsletters and analytics and marketing cookies; legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) — fraud prevention and Website security.

11.3. Rights: access, rectification, erasure, restriction, portability, objection, withdrawal of consent at any time, and complaint to the supervisory authority of the country of residence.

11.4. Data may be transferred to the Russian Federation and other countries for which the European Commission has not adopted an adequacy decision. Such transfer is based on Art. 49(1)(b) GDPR (necessity for performing a contract at the data subject’s request) or explicit consent (Art. 49(1)(a)). The User has been informed of the associated risks.

12. Changes

The Studio may amend this Policy. A new revision takes effect upon publication on the Website. The current revision is always available at https://aurart.art/en/legal/privacy/.