English reference translation. Read the current Russian original.
WEBSITE AND CUSTOMER PORTAL
Personal Data Processing Policy
Edition of 16 October 2026 · Version 2026-10-16.2
1. Controller and scope
The controller is Zhelannyy Klimat Limited Liability Company, INN 2543050167, KPP 254001001, OGRN 1142543011445. Registered and postal address: 690089, Vladivostok, 7 Ulyanovskaya Street, 4th floor, Office 10. Personal data enquiries: info@jk-prim.ru, phone +7 (423) 2-444-333.
This policy applies to visitors to jk-prim.ru, enquirers, customers and their representatives in the /lk/ customer portal. It describes information processing through the website, portal and communication channels associated with an enquiry. Employee HR processes are governed by separate employer documents.
Legal basis: Federal Law No. 152-FZ of 27 July 2006 on Personal Data, applicable information and information security legislation, and contractual, tax and archival obligations. The policy is an information document and does not itself constitute user consent.
2. Purposes and categories of data
| Purpose and individuals | Data categories | Legal basis and retention |
|---|---|---|
| Reviewing a visitor's enquiry, responding and preparing a preliminary estimate | Name and phone; email, organisation, project address and requirements supplied by the enquirer | Separate consent (Article 6(1)(1) of Law No. 152-FZ). Until the enquiry and correspondence conclude, for no more than 12 months after submission, or until earlier withdrawal |
| Registering and maintaining an account for a customer or their representative | Name, email, phone, organisation if provided; credentials, sign-in and account recovery information | Separate consent for registration details. Until account closure at the user's request or withdrawal; the controller's legitimate interests also apply to access security, respecting the user's rights (Article 6(1)(7)) |
| Preparing, performing and supporting a contract; handling enquiries in the portal | Contact details of the customer and representatives, project address, work details, messages, agreed documents, photos and reports insofar as they contain personal data | Article 6(1)(5) and (7): a contract with an individual or steps taken at their initiative before a contract; legitimate interest in communication with an organisation's representative. During preparation and performance of obligations, then only to the extent and for the periods required for statutory retention or protection of a specific right |
| Statutory record keeping and responses to lawful requests | Information in contractual, payment and primary accounting documents; data subject requests, consent records and records of compliance | Article 6(1)(2). Retention depends on the document type and applicable law: in particular, primary accounting documents must be retained for at least 5 years after the relevant reporting year under Article 29 of Law No. 402-FZ. This does not justify retaining all portal information without grounds |
| Website connection, abuse prevention and portal sign-in | IP address, request time and URL, browser technical information, session identifier and authentication data to the extent necessary for operation | Legitimate interest in secure service operation (Article 6(1)(7)) and providing the account requested by the user. Session cookie: up to 8 hours. Other technical information is used for the time necessary for connection and abuse prevention |
The forms do not request health data, political or religious views, information about private life or other special categories of data. Images in reports are not used for biometric identification. Do not include unnecessary passport details, bank details or information about unrelated individuals in messages. Information about representatives and third parties must only be provided on a lawful basis.
Advertising, publication of personal data for an unrestricted audience and decisions producing legal effects solely through automated processing are outside the purposes described. Enquiry or registration consent does not replace a separate legal basis for these activities.
3. How processing works
Data is supplied directly by the user when completing a form, registering, submitting an enquiry or sending a message. The controller's team also adds customer-related information to the portal during project work. A manager verifies project access; customers can see their own projects and materials intended for them.
Automated and manual processing includes collection, recording, organisation, accumulation, storage, updating, retrieval, use, provision of necessary access, restriction, erasure and destruction. The data collected is limited to the relevant purpose.
Databases located in Russia are used to collect personal data of Russian citizens. No cross-border transfers are made through the website forms or customer portal.
Access is granted to authorised employees and, where necessary, providers processing data on the controller's instructions under contracts containing confidentiality and security obligations. Data is provided to public authorities where required by law.
Following an external link means interacting with the relevant service under its own rules.
4. Security information
The controller uses a secure connection, separates access rights and takes measures to prevent unauthorised access, alteration, loss or disclosure of personal data.
Employee access is limited by work duties and confidentiality obligations. Access control and backups are used. Local policies govern data processing, retention and destruction.
6. Rights and enquiries
You may obtain information about processing and access your data, request correction, restriction or destruction where statutory grounds apply, withdraw consent, request processing to stop, and complain to Roskomnadzor or a court.
Write to info@jk-prim.ru with the subject “Personal data”, or send a letter to the controller's address. Describe your request and provide contact details or an enquiry number that helps locate the data. Access to information or account deletion requires secure verification that the request concerns you. Do not send a passport scan by ordinary email by default: if necessary, the controller will clarify the statutory identification method and formal request requirements under Article 14.
- Processing information or a reasoned reply: within 10 working days, extendable by no more than 5 working days with an explanation.
- Confirmed inaccuracies are corrected within 7 working days; data is restricted during verification where grounds apply.
- Requests to stop processing: within 10 working days, with a reasoned extension of up to 5 working days, subject to statutory exceptions.
- Once a purpose is achieved or consent is withdrawn, data is destroyed within 30 days where no other lawful basis exists. Unlawful processing stops within 3 working days; if it cannot be made lawful, the data is destroyed within 10 working days.
Withdrawal does not undo earlier lawful processing or contractual obligations. Where the law requires a specific document to be retained, the controller explains the applicable basis and limits further processing to that purpose.
7. End of retention and policy changes
When a purpose is achieved, a retention period expires or other statutory grounds arise, the controller stops processing and arranges destruction of electronic and paper records with the required confirmation. Backups have restricted access and are not used for everyday work; deletion requests are applied after restoration. If destruction within the required period is technically impossible, data is restricted and destroyed within the period provided by Article 21(6) of Law No. 152-FZ.
Consent records and records of compliance with data subject requests are retained to the extent and for the period necessary to demonstrate lawful processing.
The current edition is available on this page without registration and through a link in the portal. Policy changes do not expand previously given consent: a new purpose that requires consent needs separate consent.