Personal data processing policy

1. General provisions

1.1.This Personal Data Processing Policy (hereinafter the Policy) has been developed pursuant to the requirements of Part 2 of Article 18.1 of Federal Law No. 152-FZ of July 27, 2006 ‘On Personal Data’ (hereinafter Law 152-FZ) and sets out the policy of Istoki Limited Liability Company (hereinafter the Operator) regarding the processing of personal data, as well as information on the personal data protection requirements being implemented.

1.2.The Policy applies to all personal data that the Operator receives from personal data subjects when they use the websites central-archive.ru (including the “Account” section at central-archive.ru/lk) and relic-chat.ru, the account area of the Aggregator platform, the Relic Chat messenger, and when the services of the Family Relic Genealogy Center are provided (collectively, the Service), as well as to the personal data of the Operator's employees and of individuals who are counterparties.

1.3.The Policy has been developed in accordance with the Constitution of the Russian Federation, Law 152-FZ, Federal Law No. 149-FZ of July 27, 2006 ‘On Information, Information Technologies and the Protection of Information’, Decree of the Government of the Russian Federation No. 1119 of November 1, 2012, Order of the FSTEC of Russia No. 21 of February 18, 2013, Order of Roskomnadzor No. 18 of February 24, 2021, and other regulatory legal acts of the Russian Federation in the field of personal data.

1.4.The Policy is a publicly available document and is published at https://central-archive.ru/politika-konfidencialnosti. A link to the Policy is placed in the footer of every page of the Service and in all personal data collection forms.

1.5.The person responsible for organizing the processing of personal data (Article 22.1 of Law 152-FZ) is General Director Pavel Andreyevich Ovchinnikov, acting on the basis of the Charter. Contacts for requests concerning the processing of personal data: email support@central-archive.ru (subject line “Personal data”), postal address 31a Solnechnaya St., office 14 (Solnechny Alyans business center), Voronezh, 394026, telephone 8 800 550-58-90.

2. Terms and definitions

2.1.The Policy uses terms in the meaning established by Article 3 of Law 152-FZ, as well as the following concepts:

• Personal data — any information relating to a directly or indirectly identified or identifiable natural person (the personal data subject).
• Operator — Istoki Limited Liability Company, which independently organizes and carries out the processing of personal data and determines the purposes of processing, the scope of personal data and the actions performed with it.
• Processing of personal data — any action (operation) or set of actions performed on personal data with or without the use of automation tools, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), anonymization, blocking, deletion and destruction.
• Automated processing — processing of personal data by means of computer technology.
• Dissemination of personal data — actions aimed at disclosing personal data to an indefinite group of persons; provision — disclosure to a specific person or group of persons.
• Blocking — temporary suspension of the processing of personal data (except where processing is necessary to clarify the personal data).
• Destruction — actions as a result of which it becomes impossible to restore the content of personal data in the information system and/or the physical media are destroyed.
• Anonymization — actions as a result of which it becomes impossible, without the use of additional information, to attribute personal data to a specific data subject.
• Personal data information system (PDIS) — the set of personal data contained in databases together with the information technologies and technical means that enable its processing.
• Service — the Operator's websites central-archive.ru (including the “Account” section at central-archive.ru/lk) and relic-chat.ru, the Aggregator software and hardware system (the client account and the pro workspace), the Relic Chat messenger, and the services of the Family Relic Genealogy Center provided by the Operator.
• User — any natural person who uses the Service, including without registration.
• Cookie — a small piece of data sent by a web server and stored on the User's device, which the browser sends back to the server with every request.

3. Principles and conditions of processing

3.1.The Operator processes personal data on the basis of the principles established by Article 5 of Law 152-FZ:

• processing is carried out on a lawful and fair basis;
• processing is limited to the achievement of specific, predetermined and legitimate purposes; processing incompatible with the purposes of collection is not permitted;
• databases containing personal data processed for purposes that are incompatible with one another may not be merged;
• only personal data that meets the purposes of its processing is processed; the content and scope of the personal data processed correspond to the stated purposes, and excessive data is not permitted;
• the accuracy, sufficiency and, where necessary, currency of personal data are ensured; the Operator takes measures to delete or clarify incomplete or inaccurate data;
• personal data is stored in a form that allows the data subject to be identified for no longer than the purposes of processing require, unless a retention period is established by federal law or a contract;
• personal data being processed is destroyed or anonymized once the purposes of processing have been achieved or when achieving those purposes is no longer necessary.

3.2.The Operator processes personal data when at least one of the conditions provided for in Part 1 of Article 6 of Law 152-FZ is met, including: with the consent of the data subject (paragraph 1); to fulfill obligations imposed on the Operator by law (paragraph 2); to perform a contract to which the data subject is a party or beneficiary, and to conclude such a contract at the data subject's initiative (paragraph 5); to exercise the rights and legitimate interests of the Operator, provided that the rights of the data subject are not violated (paragraph 7).

3.3.The Operator does not process biometric personal data (Article 11 of Law 152-FZ). The Operator does not deliberately collect special categories of personal data (Article 10 of Law 152-FZ). Information on the religion, ethnicity or health of historical persons that the data subject provides in the research questionnaire or a biography is processed solely for the purposes of genealogical research on the basis of paragraph 1 of Part 2 of Article 10 of Law 152-FZ (written consent given in the manner set out in clause 5.4 of the Policy) and is not used to make decisions concerning the data subject.

3.4.The Operator does not make decisions that produce legal consequences for the data subject or otherwise affect their rights and legitimate interests solely on the basis of automated processing of personal data (Article 16 of Law 152-FZ).

3.5.The Service is intended for persons aged 18 and over. The Operator does not deliberately collect the personal data of minors; information about minor relatives is entered into the tree by their legal representatives at their own responsibility.

4. Purposes, legal grounds, categories of data subjects and scope of personal data

4.1.The Operator processes personal data for the following purposes, on the following legal grounds and to the following extent:

4.2.The sources of personal data are: the personal data subject (who fills in forms and the questionnaire and uploads documents and content); the User providing information about their relatives; archives, civil registry (ZAGS) offices and other organizations responding to requests made in the course of research; the technical facilities of the Service (automatic collection of technical data).

4.3.A User who provides the Operator with the personal data of third parties (relatives and other persons mentioned in the questionnaire, tree, documents and content) warrants that they have obtained the consent of those persons to the provision of their personal data to the Operator and to its processing for the purposes set out in clause 4.1 of the Policy, and, with respect to deceased persons, acts with the consent of their heirs (Art. 9(7) of Law 152-FZ) or as an heir, and is liable for any breach of this warranty. In such cases the Operator processes the personal data of third parties on the basis of Art. 6(1)(5) of Law 152-FZ, in the interests of the User as a party to the contract, and Art. 6(3) of Law 152-FZ.

4.4.The Operator does not verify the accuracy of the personal data provided by the User and assumes that the User provides accurate and sufficient data and keeps it up to date.

4.5.Marketing mailings (clause 4.1.8) are sent only with separately expressed consent, which is not a condition of using the Service. Consent to personal data processing for the purposes of clauses 4.1.1–4.1.7 does not include consent to marketing mailings.

5. Procedure and conditions of processing

5.1.Personal data is processed by mixed means: with the use of automation tools (in the “Aggregator” and “Relic Chat” personal data information systems hosted on the Operator’s servers in the Russian Federation) and without the use of such tools (paper contracts, reports, ancestry books).

5.2.The Operator performs the following actions with personal data: collection, recording, systematization, accumulation, storage, updating (revision, modification), retrieval, use, transfer (provision, access), anonymization, blocking, deletion, destruction. Dissemination of personal data (disclosure to an indefinite circle of persons) takes place solely in the case of clause 4.1.6, on the basis of separate consent under Art. 10.1 of Law 152-FZ.

5.3.The Operator does not carry out cross-border transfer of personal data (Art. 12 of Law 152-FZ). When processing the personal data of citizens of the Russian Federation, the Operator ensures that its recording, systematization, accumulation, storage, updating and retrieval are performed using databases located in the territory of the Russian Federation (Art. 18(5) of Law 152-FZ).

5.4.Consent to personal data processing is given by the data subject through implied actions that make it possible to confirm that consent was obtained (Art. 9(1) of Law 152-FZ): checking the box “I consent to the processing of my personal data” when submitting a form on the website, when signing in to the account for the first time (registration), or when registering in Relic Chat. The text of the consent is available at https://central-archive.ru/soglasie. The Operator records the date and time, IP address, email address and the version of the documents in effect at the time consent is given; this information is stored for the period set out in clause 7.1 of the Policy and serves as proof that consent was obtained (Art. 9(3) of Law 152-FZ). When a written contract for services is concluded, consent to personal data processing is executed as part of the contract.

5.5.Personal data contained in the research questionnaire, tree, documents, family websites and memory pages is processed in private mode: it is accessible only to the User, the persons they have invited to the project or family group, and the Operator’s employees within the limits of their roles. Public access to a memory page or family website is opened only after the User performs the “Publish” action and can be revoked by the User at any time.

5.6.Within the Operator, access to personal data is granted only to employees whose job duties include processing the relevant data, to the extent necessary to perform those duties. The list of such positions and authorized persons is approved by an order of the Operator.

6. Transfer of personal data to third parties and delegation of processing

6.1.The Operator transfers personal data to third parties only in the cases provided for by law or necessary to achieve the purposes set out in clause 4.1, and ensures the confidentiality of personal data (Art. 7 of Law 152-FZ):

6.2.Persons to whom the Operator entrusts the processing of personal data must comply with the processing principles and rules and the confidentiality and security of personal data provided for by Law 152-FZ; the Operator’s instructions define the list of actions to be performed with personal data, the purposes of processing, the obligation to maintain confidentiality and ensure security, and the protection requirements (Art. 6(3) of Law 152-FZ). The Operator is liable to the data subject for the actions of such a person (Art. 6(5) of Law 152-FZ).

6.3.The Operator does not sell personal data and does not transfer it to third parties for marketing purposes.

7. Processing and retention periods

7.1.Personal data is processed and stored for the periods necessary to achieve the purposes of processing, unless a different period is established by federal law or by contract:

7.2.Upon expiry of the established periods, upon achievement of the purposes of processing, upon withdrawal of consent (if there is no other legal basis for processing) or at the data subject’s request in the cases provided for by Art. 21 of Law 152-FZ, personal data is destroyed; where destruction within the established period is impossible, it is blocked and subsequently destroyed, or anonymized. Destruction is documented by a certificate in the manner established by Roskomnadzor Order No. 179 of October 28, 2022.

8. Security measures

8.1.Pursuant to Arts. 18.1 and 19 of Law 152-FZ, the Operator takes the legal, organizational and technical measures necessary and sufficient to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination and other unlawful actions:

• appointing a person responsible for organizing personal data processing (Art. 22.1 of Law 152-FZ);
• issuing this Policy and internal regulations establishing procedures for processing, for preventing and detecting violations, and for remedying their consequences; familiarizing employees with them against signature;
• identifying threats to the security of personal data during its processing in personal data information systems and determining the protection level in accordance with Decree of the Government of the Russian Federation No. 1119 of November 1, 2012; applying organizational and technical measures under FSTEC of Russia Order No. 21 of February 18, 2013;
• hosting databases on servers in the Russian Federation (Art. 18(5) of Law 152-FZ);
• access control: a role-based model (client, relative, manager, genealogist, head, administrator); employees have access only to the personal data necessary to perform their duties; permissions are verified on every request to the server;
• identification and authentication: sign-in with one-time codes, storage of codes and passwords only as hashes, server-side sessions that can be forcibly terminated, a limit on the number of sign-in attempts;
• protection of data transmission channels with TLS (HTTPS); files are served only via short-lived signed links; control of uploaded file types;
• logging of security events and actions with personal data (access logs, project change history);
• backup and recovery of personal data modified or destroyed as a result of unauthorized access;
• non-disclosure undertakings by employees and contractors with respect to confidential information; entrusting processing to third parties only under a contract containing the terms required by Art. 6(3) of Law 152-FZ;
• internal control of compliance of processing with the requirements of Law 152-FZ; assessment of the harm that may be caused to data subjects in the event of a violation.

8.2.Employees of the Operator authorized to process personal data are liable for violations of the requirements of Law 152-FZ in accordance with Art. 13.11 of the Code of Administrative Offenses of the Russian Federation, Art. 137 of the Criminal Code of the Russian Federation and labor legislation.

9. Rights of the personal data subject

9.1.The personal data subject has the right (Chapter 3 of Law 152-FZ):

• to receive information concerning the processing of their personal data to the extent set out in Art. 14(7) of Law 152-FZ: confirmation of the fact of processing, the legal bases and purposes, the methods used, the name and address of the Operator, the personal data being processed and its source, the processing and retention periods, information on any completed or intended cross-border transfer, and information on the persons who have access to the personal data and on the persons entrusted with its processing;
• to demand that their personal data be updated, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing (Art. 14(1) of Law 152-FZ);
• to withdraw consent to personal data processing (Art. 9(2) of Law 152-FZ) and consent to dissemination (Art. 10.1(12) of Law 152-FZ) at any time;
• to demand that the dissemination of their personal data be stopped (Art. 10.1(14) of Law 152-FZ);
• to opt out of marketing mailings (Art. 15(2) of Law 152-FZ, Art. 18(2) of Law 38-FZ);
• to appeal against the Operator’s actions or inaction to the authorized body for the protection of the rights of personal data subjects (Roskomnadzor) or in court (Art. 17 of Law 152-FZ);
• to compensation for losses and for moral harm through the courts (Art. 24 of Law 152-FZ).

9.2.The User can update, change or delete most of their personal data themselves using the account tools (the “Personal details”, “Questionnaire”, “Family tree”, “Documents”, “Family websites” and “Memory pages” sections). Consent is withdrawn using the “Withdraw consent and delete data” button in the “Personal details” section or by submitting a request in the manner set out in Section 11.

9.3.The data subject’s right of access to personal data may be restricted in the cases set out in Art. 14(8) of Law 152-FZ. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal and does not terminate processing for which there is another legal basis (performance of the contract, statutory document retention requirements).

10. Obligations of the Operator

10.1.The Operator is obliged:

• to provide the data subject, at their request, with the information specified in Art. 14(7) of Law 152-FZ or a reasoned refusal within the time limits established by Art. 20 of Law 152-FZ;
• to ensure that the recording, systematization, accumulation, storage, updating and retrieval of the personal data of citizens of the Russian Federation are performed using databases located in the territory of the Russian Federation;
• to take the measures provided for by Arts. 18.1 and 19 of Law 152-FZ; to make this Policy publicly available;
• to notify the authorized body of personal data processing in the manner set out in Art. 22 of Law 152-FZ and to report any changes to the information contained in the notification;
• to notify the authorized body and data subjects of any unlawful or accidental transfer of personal data (an incident) in the manner and within the time limits established by Art. 21(3.1) of Law 152-FZ (within 24 hours — of the fact of the incident; within 72 hours — of the results of the internal investigation);
• to cease processing and destroy personal data in the cases and within the time limits provided for by Art. 21 of Law 152-FZ;
• to keep a register of requests from personal data subjects.

11. Procedure for handling requests

11.1.Requests from personal data subjects (requests for information, demands for updating, blocking or destruction, withdrawal of consent) are sent in writing to the Operator’s mailing address or as an electronic document to support@central-archive.ru from the email address specified by the data subject at registration or in the contract. The request must contain the information required by Art. 14(3) of Law 152-FZ: the number of the primary identity document of the data subject or their representative, its date of issue and issuing authority, information confirming the data subject’s relationship with the Operator (the account email address, contract or project number) or other information confirming the fact of processing, and the signature of the data subject or their representative.

11.2.The Operator provides the requested information or a reasoned refusal within 10 business days of receiving the request; this period may be extended by no more than 5 business days, with notice to the data subject (Art. 20(1) and (1.1) of Law 152-FZ). The information is provided in an accessible form and must not contain personal data relating to other data subjects.

11.3.Upon withdrawal of consent, the Operator ceases processing the personal data and destroys it (in the absence of another legal basis) within no more than 30 days of receiving the withdrawal (Art. 21(5) of Law 152-FZ). If unlawful processing is detected, the Operator ceases it within no more than 3 business days and destroys the data within no more than 10 business days (Art. 21(3) of Law 152-FZ). If inaccurate data is detected, the Operator blocks it for the period of verification and updates it within 7 business days (Art. 21(1) and (2) of Law 152-FZ).

11.4.A request submitted via the “Withdraw consent and delete data” button in the account is deemed to have been submitted by an authenticated data subject and is registered in the Operator’s request system with the date and time recorded; the Operator notifies the data subject of the outcome at the account email address.

11.5.Requests are recorded in the register of requests from personal data subjects.

12. Cookies and analytics tools

12.1.The Service uses cookies and browser local storage: strictly necessary ones (session identifier, sign-in token, interface settings — without them it is impossible to sign in to the account) and analytics ones (Yandex.Metrica counter No. 99465067 of Yandex LLC, including the Webvisor session replay technology, which collects anonymized information about actions on pages).

12.2.On the User’s first visit to the Service, a cookie notice with a link to the Policy is displayed; continued use of the Service constitutes the User’s consent to the processing of technical data for the purposes of clause 4.1.9. The User may disable cookies in their browser settings or use the Yandex LLC counter-blocking tool; in that case, Service features that require authentication may be unavailable.

12.3.The Operator does not use analytics data to identify a specific User and does not combine it with account data.

13. Final provisions

13.1.The Operator may amend the Policy. A new version takes effect from the moment it is published at the address specified in clause 1.4, unless the new version provides otherwise. The current version and the date of its approval are stated at the beginning of the document; previous versions are provided on request.

13.2.Matters not governed by the Policy are governed by the legislation of the Russian Federation. In the event of a conflict between the Policy and the contract with the data subject, the provisions that afford the data subject a higher level of protection apply.

13.3.The Policy was approved by order of the General Director of Istoki LLC dated September 8, 2026.