Regarding the processing of personal data of users of the studyinrussia.ru portal
1. General provisions
1.1. This Privacy Policy regarding the processing of personal data of users of the studyinrussia.ru portal (hereinafter, the Policy) defines the purposes, legal grounds, procedure and conditions for processing personal data, the categories of personal data processed, the categories of data subjects, the periods for processing and storing personal data, the procedure for its destruction, and measures to ensure personal data security when using the studyinrussia.ru portal, including its language versions, user account, registration and feedback forms, AI consultant, subscription to information mailings and cookie technologies (hereinafter, the Site).
1.2. The Operator of personal data is the federal state budgetary institution ‘Centre for the Development of Education and International Activities (Interobrazovanie)’ (hereinafter, ФГБУ «Интеробразование», the Operator). Operator details: Primary State Registration Number (OGRN) 1027739014379; Taxpayer Identification Number (INN) 7706001432; registered office and postal address: 119021, Moscow, Bolshoy Chudov lane, 8, building 1; telephone: +7 (499) 246-31-10; email address: info@studyinrussia.ru.
1.3. The Policy has been drawn up in accordance with Federal Law No. 152-FZ of 27.07.2006 ‘On Personal Data’ and other regulatory legal acts of the Russian Federation in the field of personal data (hereinafter, personal data legislation), is a publicly available document and is published on the Site at: https://studyinrussia.ru/contacts/privacy. Access to the Policy is provided from all Site pages on which personal data is collected.
1.4. The Policy does not constitute consent to the processing of personal data and does not replace it. Where consent of the data subject is the legal basis for processing, consent is requested separately from other information and documents, including this Policy, and is expressed by an active and unambiguous action of the User. Refusal to provide consent restricts only those Site functions for which the relevant processing is objectively necessary and does not prevent access to publicly available information sections of the Site.
1.5. The Policy applies to the processing of personal data carried out by the Operator through the Site. Processing of personal data carried out by the Operator outside the Site, including in the performance of contracts, organisation of events and acceptance of paper documents, is governed by other local regulations of the Operator.
1.6. The Policy does not apply to third-party websites and services to which the User may proceed via links placed on the Site. The Operator does not control such resources and is not responsible for the conditions for processing personal data applied by their owners. Placing a link does not mean that the Operator approves the content of a third-party resource.
1.7. Enquiries to the person responsible for organising personal data processing at ФГБУ «Интеробразование» should be sent to: 119021, Moscow, Bolshoy Chudov lane, 8, building 1, or to info@studyinrussia.ru marked ‘Personal data’.
1.8. The Operator is included in the register of operators processing personal data (registration number 77-25-456377) and ensures that the information submitted to the authorised body for protecting the rights of data subjects (hereinafter, the authorised body) is up to date.
1.9. The Policy applies to the processing of personal data carried out after it enters into force. For personal data received before the Policy enters into force, it applies insofar as it does not worsen the position of data subjects compared with the conditions under which such data was received.
1.10. If personal data legislation, including legislation adopted or amended after the Policy was approved, establishes rules other than those provided for by the Policy, the rules established by the legislation shall apply. Provisions of the Policy that do not contradict the legislation shall remain in force.
2. Definitions
2.1. Terms used in the Policy shall have the meaning established by personal data legislation unless otherwise defined in this section.
2.2. The following terms are also used in the Policy:
User — an individual visiting the Site or using its Services. A User whose personal data is processed by the Operator is a data subject.
Site Services — software components and functions of the Site, including the user account, registration, feedback and subscription forms, AI consultant and search.
User account — a personal section of the Site to which the User is given access after registration and authentication.
AI consultant — a Site Service that generates reference answers to User queries submitted in free-form text using artificial intelligence technologies.
Cookies — small pieces of data that the Site stores on the User’s device and which are transmitted to the Site during subsequent visits.
Incident — an unlawful or accidental transfer (provision, dissemination or access) of personal data resulting in a violation of the rights of data subjects.
3. Principles and purposes of personal data processing
3.1. The Operator processes personal data lawfully and fairly, observing the principles established by personal data legislation, including:
- processing is limited to achieving specific, predetermined and lawful purposes; processing incompatible with the purposes of collecting personal data is not permitted;
- databases containing personal data whose processing is carried out for purposes incompatible with one another may not be combined;
- only personal data that meets the purposes of its processing is processed; its content and volume correspond to the stated purposes and are not excessive;
- the accuracy, sufficiency and relevance of personal data in relation to the purposes of processing are ensured;
- personal data is stored in a form that makes it possible to identify the data subject for no longer than required by the purposes of processing, unless the storage period is established by federal law or a contract to which the data subject is a party.
3.2. The Operator processes personal data for the following purposes:
3.2.1. Ensuring the functioning, stability and security of the Site, preventing abuse and unlawful acts, and providing technical support.
3.2.2. Registering, authenticating and maintaining user accounts; receiving and storing information and documents uploaded by the User to use user-account functions; and saving settings and the history of significant actions.
3.2.3. Enabling representatives of educational organisations to use Site functions intended for them.
3.2.4. Considering User enquiries, requests and messages, and providing reference support and feedback.
3.2.5. Generating AI consultant responses to User queries.
3.2.6. Sending information and news mailings on education in the Russian Federation.
3.2.7. Analysing use of the Site, assessing demand for materials and improving methods of presenting information (web analytics).
3.2.8. Performing duties imposed on the Operator by the legislation of the Russian Federation, including confirming receipt of consents and considering requests from data subjects and the authorised body.
3.3. Processing personal data for purposes not specified in clause 3.2 of the Policy is not permitted. If processing personal data for a new purpose becomes necessary, the Operator shall amend the Policy before beginning such processing and, where consent is the legal basis, obtain the consent of the data subject.
4. Legal grounds, categories of data subjects and list of personal data processed
4.1. The Operator processes personal data on the basis of personal data legislation, other regulatory legal acts of the Russian Federation governing the Operator’s activities, the charter of ФГБУ «Интеробразование» and the Operator’s local regulations on the processing and protection of personal data.
4.2. The legal grounds for processing personal data are: consent of the data subject; performance of duties imposed on the Operator by the legislation of the Russian Federation; performance of a contract (agreement) to which the data subject is a party, or conclusion of a contract at the initiative of the data subject; exercise of the Operator’s rights and legitimate interests, provided that the rights and freedoms of the data subject are not infringed.
4.3. For each processing purpose, the categories of data subjects, the list of personal data processed, the legal basis and the processing and retention periods are determined as follows:
| Processing purpose | Categories of subjects and list of personal data | Legal basis | Processing and retention period, destruction |
|---|---|---|---|
| 1. Ensuring the functioning, stability and security of the Site, preventing abuse and unlawful acts, and providing technical support | Subjects: Site visitors, registered users. Data: IP address; date and time of access; addresses of requested pages; referral source; information about the browser, operating system, device type and parameters; session identifiers and strictly necessary cookies; information about failures and security events; when contacting technical support — name, email address and enquiry content. | Exercise of the Operator’s legitimate interests, provided that the rights and freedoms of the data subject are not infringed; performance of the duty to ensure personal data security imposed on the Operator by law; for technical-support enquiries — consent of the data subject. | Technical logs and information about security events — no more than 12 months from the date of creation, unless a longer period is required by law or to investigate a specific identified incident. Enquiries — for the periods specified in row 4. |
| 2. Registering, authenticating and maintaining user accounts; receiving and storing information and documents uploaded by the User to use user-account functions; and saving settings and the history of significant actions | Subjects: registered users; legal representatives of minor users. Data: surname, first name and patronymic (if any); gender; date of birth; citizenship; country of residence; telephone number; email address; information about education, selected educational organisations and educational programmes; copies uploaded by the User of a passport or other identity document, education document, photograph and other documents provided for by user-account functions, and the information contained in them; login, user identifier, cryptographically transformed password value, registration date, settings and history of significant actions in the user account; information confirming the authority of a legal representative. | Consent of the data subject; for performance of the user agreement (if any) — performance of an agreement to which the data subject is a party. | Until the account is deleted or consent is withdrawn, but no more than three years from the date of the User’s last authentication in the user account. Destruction — within the periods established by personal data legislation, where there is no other lawful basis for processing. |
| 3. Enabling representatives of educational organisations to use Site functions intended for them | Subjects: representatives of educational organisations. Data: surname, first name and patronymic (if any); position; name of educational organisation; work telephone number and email address; account and authentication information. | Consent of the data subject. | Until consent is withdrawn, the representative’s authority ends (as reported by the representative or educational organisation), or the account is deleted, but no more than three years from the date of the last authentication. Destruction — within the periods established by personal data legislation. |
| 4. Considering User enquiries, requests and messages submitted through Site forms or by email, and providing reference support and feedback | Subjects: persons who submitted an enquiry. Data: surname, first name and patronymic (if any) or name; email address; telephone number (if provided); country of residence (if provided); content of the enquiry and correspondence. | Consent of the data subject; if considering the enquiry is a duty of the Operator by law — performance of duties imposed on the Operator by legislation. | No more than one year from the date of receipt or sending, unless a longer period is established by archival legislation and the Operator’s file classification. |
| 5. Generating AI consultant responses to User queries | Subjects: Site visitors, registered users. Data: query text, including personal data if the User independently provides it in free-form text; session technical data specified in row 1. | Consent of the data subject expressed before beginning to use the AI consultant; for technical data — the grounds specified in row 1. | The query text is processed only for the time necessary to generate a response and is not stored thereafter. No dialogue history is retained. |
| 6. Sending information and news mailings on education in the Russian Federation | Subjects: persons who have subscribed to the mailing. Data: email address; name (if provided); mailing language; information about the subscription, its confirmation and opting out. | Separate consent of the data subject; for advertising messages, also compliance with advertising legislation. | Until opting out of the mailing or withdrawing consent, but no more than three years from the date of the User’s last confirmed interaction with the mailing. Destruction — within the periods established by personal data legislation. |
| 7. Analysing use of the Site, assessing demand for materials and improving methods of presenting information (web analytics) | Subjects: Site visitors who have consented to analytical cookies. Data: analytical cookie identifiers; IP address; information about the browser, operating system, device type, screen resolution and interface language; referral source and search or advertising query parameters; pages visited, time of visit and actions on pages. | Consent of the data subject expressed in the cookie management interface. | No more than one year from the date of collection or until consent is withdrawn. |
| 8. Performing duties imposed on the Operator by the legislation of the Russian Federation, including confirming receipt of consents and considering requests from data subjects and the authorised body | Subjects: all categories of subjects specified in rows 1–7; their representatives. Data: information about the provision, amendment and withdrawal of consents (date and time of the action, form or account identifier, version of the consent and Policy text, result of the choice, IP address — if its recording is necessary for confirmation); information contained in requests from data subjects and reasoned requests from state bodies, and responses to them. | Performance of duties imposed on the Operator by the legislation of the Russian Federation. | Consent information — for the period of the relevant processing and three years after it ends. Requests and responses to them — for the period established by the Operator’s file classification. |
4.4. The Operator does not process special categories of personal data concerning race, ethnic origin, political views, religious or philosophical beliefs, health, intimate life, or biometric personal data. Photographs uploaded by the User to the user account are not used by the Operator to establish identity and are not processed as biometric personal data. The Site is not intended to collect special categories of personal data; the User should not include such information in enquiries, queries to the AI consultant or uploaded documents unless its provision is expressly required by the relevant Site function. Such information provided by the User on their own initiative is not used by the Operator.
4.5. The Operator does not request bank card numbers, account details or other payment information through the Site.
4.6. Fields that must be completed in Site forms are marked in the interface. Completing optional fields is voluntary.
4.7. Sources of personal data are the User or their legal representative, as well as the User’s software and the Site’s software when technical data is transmitted automatically. The Operator does not receive from external services to which Site links lead information about the User’s actions in those services, unless the User is informed otherwise before the relevant processing begins.
4.8. Registration for a user account, subscription to a mailing and submission of enquiries on behalf of a person under fourteen years of age may be carried out only by their legal representative. Persons aged fourteen to eighteen provide personal data with the consent of their legal representative, the existence of which is confirmed by the User upon registration. If the processing of a minor’s personal data without the necessary legal basis is identified, the Operator blocks such data, stops processing it and destroys it within the periods established by personal data legislation.
4.9. The Operator carries out the following actions with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating and amendment), extraction, use, transfer (provision and access), depersonalisation, blocking, deletion and destruction. Processing is carried out by mixed means: using automation, and, when processing enquiries and documents, also without using such means, in compliance with the requirements established by legislation for such processing.
5. Procedure and conditions for processing personal data
5.1. Consent to the processing of personal data is provided through a separate form or separate interface element after the User has reviewed its terms, separately for each purpose for which consent is the legal basis. Consent must be specific, clearly defined in scope, informed, consciously given and unambiguous. Silence, inactivity, continued browsing of the Site, a pre-ticked box or acceptance of this Policy are not recognised as consent to the processing of personal data.
5.2. The Operator enables confirmation of receipt of consent and records, to the extent necessary for such confirmation, the date and time of the User’s action, the form or account identifier, the version of the consent and Policy text, the result of the User’s choice and technical information related to the action, including the IP address if recording it is necessary for confirmation.
5.3. The User may withdraw consent at any time by the method specified in the consent text, using the relevant Site interface functions, including the mailing opt-out link and cookie management interface, by sending an application to info@studyinrussia.ru or to the Operator’s postal address specified in clause 1.2 of the Policy. The Operator does not impose requirements on withdrawal that restrict the data subject’s right to withdraw consent. Withdrawal of consent does not affect the lawfulness of processing carried out before it was received.
5.4. After receiving withdrawal of consent, the Operator stops the processing of personal data based on that consent. The Operator may continue processing without the consent of the data subject only where other grounds provided for by personal data legislation exist.
5.5. The Operator does not disseminate Users’ personal data. Dissemination of personal data is permitted only where there is separate consent to the processing of personal data that the data subject has authorised for dissemination, issued in accordance with the requirements of personal data legislation.
5.6. The Operator may entrust the processing of personal data to another person with the consent of the data subject, unless otherwise provided by federal law, on the basis of an agreement concluded with that person. Processing entrusted by the Operator may be carried out by persons providing Site hosting and technical support, delivery of messages and newsletters, operation of communication systems, information security and web analytics. The agreement under which processing is entrusted contains the conditions provided for by personal data legislation, including the list of personal data and actions with it, processing purposes, the obligation to maintain confidentiality and ensure personal data security, and the obligation to notify the Operator of incidents. The Operator is liable to the data subject for the actions of that person; the person processing data on the Operator’s instructions is liable to the Operator. The name of that person (or, for an individual, their surname, first name and patronymic) and their address shall be provided to the data subject upon request.
5.7. The Operator provides personal data to third parties exclusively in the following cases:
- the data subject has consented to such provision;
- the data is provided to a person to whom the Operator has entrusted personal data processing in accordance with clause 5.6 of the Policy;
- the provision is required by the legislation of the Russian Federation, including pursuant to a reasoned request from state authorities, a court, or bodies of inquiry and preliminary investigation, to the extent and in the manner established by the legislation of the Russian Federation.
5.8. When the User follows a link to a third-party resource, including to submit documents to an educational organisation, personal data is not automatically transferred from the user account. Transfer of personal data to an educational organisation or another recipient through a separate Site function is carried out only at the User’s initiative, where the necessary legal basis exists and after the User has been provided with information about the recipient and the purpose of the transfer.
5.9. Generalised statistical data on Site visits that does not make it possible to identify a specific User may be provided to third parties.
5.10. When collecting personal data, including through the Site, the Operator ensures the recording, systematisation, accumulation, storage, clarification (updating and amendment) and extraction of personal data of citizens of the Russian Federation using databases located in the Russian Federation. Site databases containing Users’ personal data are located in the Russian Federation.
5.11. The Operator does not carry out cross-border transfers of personal data. If a cross-border transfer becomes necessary, the Operator shall, before it begins, comply with the requirements of personal data legislation and make the relevant amendments to the Policy.
5.12. The text of a query submitted to the AI consultant is processed exclusively to generate a response using hardware and software operated by the Operator, without transfer to third parties. The Operator does not retain dialogue history or query texts, including in technical logs. The User should not submit passport details, health information or other personal data not necessary to obtain a reference answer to the AI consultant. AI consultant responses are for reference only; decisions producing legal consequences for the User or otherwise affecting their rights and legitimate interests are not made by the Operator solely on the basis of automated processing of personal data.
5.13. Access to personal data is granted only to the Operator’s employees and other persons who need it to perform their employment or contractual duties. Such persons are familiarised with the requirements of personal data legislation and the Operator’s local regulations and undertake to maintain the confidentiality of personal data.
5.14. The Operator and other persons who have obtained access to personal data must not disclose it to third parties or disseminate it without the consent of the data subject, unless otherwise provided by federal law.
6. Processing and retention periods. Destruction of personal data
6.1. Personal data is processed and stored for no longer than required by the purposes of processing, for the periods specified in clause 4.3 of the Policy, unless a longer period is established by federal law or a contract to which the data subject is a party.
6.2. Personal data in electronic form is stored in the Operator’s information systems located in the Russian Federation. Physical media containing personal data are stored separately for each processing purpose in conditions that prevent unauthorised access.
6.3. Once the processing purposes have been achieved, the retention period has expired, consent has been withdrawn or another legal basis for processing has ended, personal data shall be destroyed or depersonalised unless otherwise provided by federal law.
6.4. When an account is deleted, access to the user account ends; user-account information and files uploaded by the User, including those contained in backups, shall be destroyed. If it is impossible to destroy personal data within the prescribed period, the Operator blocks such personal data and ensures its destruction within the periods established by personal data legislation.
6.5. Destruction of personal data is confirmed by documents provided for by the authorised body’s requirements for confirming the destruction of personal data, which the Operator stores for the period established by those requirements.
7. Measures to ensure personal data security. Incidents
7.1. The Operator takes necessary and sufficient legal, organisational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision and dissemination, as well as from other unlawful actions, in accordance with personal data legislation, including:
- appoints a person responsible for organising personal data processing and issues local regulations on the processing and protection of personal data;
- identifies personal data security threats and the level of protection required when processing personal data in information systems;
- familiarises employees with the requirements of personal data legislation and the Operator’s local regulations;
- ensures the separation and recording of access to personal data, and the registration and accounting of actions involving it;
- uses information-security tools that have undergone the prescribed conformity-assessment procedure, stores passwords only in cryptographically transformed form and uses a secure data-transfer protocol;
- ensures the backup and recovery of personal data modified or destroyed as a result of unauthorised access;
- detects unauthorised access to personal data and takes measures to eliminate it;
- carries out internal monitoring of compliance of personal data processing with legal requirements and assesses the effectiveness of the measures taken in the manner and at the intervals established by the Operator’s local regulations.
7.2. If an incident is identified, the Operator, in the manner and within the periods established by personal data legislation, notifies the authorised body of the incident, its presumed causes and the harm caused to the rights of data subjects, the measures taken to eliminate its consequences and the results of the internal investigation, and takes measures to stop the violation, eliminate its consequences and prevent recurrence.
7.3. The Operator ensures interaction with the state system for detecting, preventing and eliminating the consequences of computer attacks on information resources of the Russian Federation, including reporting computer incidents that resulted in the unlawful transfer (provision, dissemination or access) of personal data, in the manner established by the legislation of the Russian Federation.
8. Use of cookies and web analytics services
8.1. The Site uses strictly necessary and analytical cookies. Cookies may contain a session or user identifier, interface settings and other technical information; the content of cookies depends on their purpose.
8.2. Strictly necessary cookies enable authorisation, security, retention of the selected language and other settings, and operation of functions expressly requested by the User. They are used without separate consent to the extent necessary for the Site to operate. Blocking them in browser settings may make certain Site functions unavailable.
8.3. Analytical cookies and the web analytics tool are activated only after separate consent has been obtained from the User through the information banner displayed on the first visit to the Site. Before the User selects ‘Accept’, no data is transferred to the web analytics service provider. The banner provides an equivalent opportunity to select ‘Reject’ without restricting access to the main content of the Site. The User may change their choice and withdraw consent at any time through the cookie management interface available on the Site, and may also delete or disable cookies in browser settings.
8.4. The Site uses the ‘Yandex Metrica’ service for web analytics, provided by YANDEX LLC (Russian Federation), without using the ‘Webvisor’ function. The service may receive the IP address, cookie identifiers, information about the browser, device and referral source, pages visited, time of visit and actions on the Site. The Operator does not transfer to the service the content of completed forms, information and documents uploaded to the user account, or texts of queries to the AI consultant.
8.5. The Operator does not carry out personalised advertising based on analytical data. Before connecting a new web analytics service or changing the data provided to it, the Operator makes the relevant changes to the Policy and the consent interface and, where necessary, obtains new consent from the User.
8.6. Information about the User’s choice is stored in a consent-management cookie and used to apply the User’s settings. Cookie retention periods do not exceed the periods specified in clause 4.3 of the Policy.
9. Rights and obligations of the parties. Handling of requests
9.1. The data subject has the right to:
- receive information concerning the processing of their personal data, to the extent and in the manner established by personal data legislation;
- require the clarification, blocking or destruction of their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated processing purpose;
- withdraw consent to the processing of personal data;
- require the cessation of personal data processing, including for sending information mailings, in cases provided for by personal data legislation;
- challenge the actions or omissions of the Operator before the authorised body or in court;
- protect their rights and legitimate interests, including seeking damages and/or compensation for moral harm through the courts;
- exercise other rights provided for by personal data legislation.
9.2. The User must provide accurate personal data and promptly report any changes to it. The User may not provide personal data of third parties through the Site without an appropriate legal basis.
9.3. The Operator may independently determine the composition and list of measures necessary and sufficient to perform the duties provided for by personal data legislation, require the User to clarify the personal data provided, and continue processing personal data after withdrawal of consent where the grounds specified in clause 5.4 of the Policy exist.
9.4. The Operator must process personal data in accordance with personal data legislation and this Policy, consider enquiries and requests from data subjects and provide reasoned responses, give the data subject the opportunity to review their personal data free of charge, and perform other duties established by the legislation of the Russian Federation.
9.5. A request from a data subject or their representative shall be sent in writing to: 119021, Moscow, Bolshoy Chudov lane, 8, building 1, or as an electronic document to info@studyinrussia.ru. The request must contain the information required by personal data legislation, including information that makes it possible to identify the data subject or their representative and confirms that the data subject has a relationship with the Operator or otherwise confirms that the Operator processes their personal data. The Operator does not require information beyond that established by law.
9.6. In the manner and within the periods established by personal data legislation, the Operator:
- provides the data subject or their representative with the requested information or a reasoned refusal to provide it;
- blocks personal data for the period of verification if its inaccuracy or unlawful processing is identified;
- clarifies personal data when its inaccuracy is confirmed and removes the blocking;
- stops unlawful processing of personal data and, if it is impossible to make the processing lawful, destroys such personal data;
- destroys personal data that was obtained unlawfully or is unnecessary for the stated processing purpose;
- stops processing and destroys personal data when the processing purpose has been achieved, consent has been withdrawn or a request to stop processing has been received, if there are no other grounds for continuing processing;
- notifies the data subject or their representative, and, if the enquiry or request was received from the authorised body, also the authorised body, of the measures taken, and takes reasonable measures to notify third parties to whom the subject’s personal data was transferred;
- considers requests from the authorised body and provides the necessary information.
10. Liability
10.1. The Operator is liable for violations of personal data legislation in accordance with the legislation of the Russian Federation.
10.2. The User is responsible for the accuracy of the information they provide and the lawfulness of providing personal data of third parties in accordance with the legislation of the Russian Federation.
10.3. The Operator’s employees who have access to personal data are liable for violating personal data legislation in accordance with the legislation of the Russian Federation.
10.4. The Operator’s application of measures to ensure personal data security does not restrict the data subject’s right to seek protection of violated rights, damages and compensation for moral harm through the courts.
11. Dispute resolution
11.1. The Policy and relations between the User and the Operator arising in connection with personal data processing are governed by the legislation of the Russian Federation.
11.2. Before going to court, the User may submit an enquiry (claim) to the Operator in accordance with the procedure provided for in clause 9.5 of the Policy. Compliance with the pre-trial procedure is not a mandatory condition for the User to apply to the authorised body or a court.
12. Final provisions
12.1. The Policy enters into force on the date it is posted on the Site.
12.2. The Operator amends the Policy when the purposes or methods of processing, the composition of personal data processed or the Site Services change, and where changes in legislation require its provisions to be supplemented or amended.
12.3. Amendments to the Policy do not change the terms of consents previously provided and do not give the new version of the Policy retroactive effect. If a change in processing requires new consent, the Operator obtains it before that processing begins. Changes affecting processing purposes, the composition of personal data, recipients or Users’ rights are brought to Users’ attention by posting a new version of the Policy on the Site before the relevant processing begins.
12.4. The current version of the Policy is permanently posted on the Site. Previous versions of the Policy are retained by the Operator.
12.5. For all matters related to personal data processing, the User may contact the Operator and the person responsible for organising personal data processing: 119021, Moscow, Bolshoy Chudov lane, 8, building 1; tel.: +7 (499) 246-31-10; e-mail: info@studyinrussia.ru.