Personal Data Processing Policy

Revision: 1.0
Date of approval and publication on the website: 23.09.2026

Convenience translation. This document is an English translation of the Russian-language Personal Data Processing Policy published at https://solpuga.pro/ru/privacy. In the event of any discrepancy between the English and Russian versions, the Russian version prevails.

This document defines the Operator's policy with respect to the processing of personal data and contains information on the measures implemented to protect such data (Part 2 of Article 18.1 of Russian Federal Law No. 152-FZ of 27 July 2006 "On Personal Data", hereinafter "Law No. 152-FZ").

1. The Operator and the Scope of this Policy

1.1. The personal data operator is a natural person applying the special "Professional Income Tax" regime (self-employed):

• full name: Novikova Daria Sergeevna;
• taxpayer identification number (INN): 637211237896;
• email address for enquiries from data subjects: support@solpuga.pro

The Operator's address is disclosed to the data subject on request, in accordance with Article 14 of Law No. 152-FZ.

1.2. This Policy applies to the processing of personal data that the Operator obtains through the use of the website https://solpuga.pro, including its /ru and /en language versions (the "Site"), the "Solpuga" computer program (the "Program") and related services.

1.3. No separate person responsible for organizing the processing of personal data is appointed: the Operator is not a legal entity and organizes the processing personally.

2. Purposes of Processing, Data Processed, Legal Grounds and Retention Periods

The Operator processes personal data only for the purposes listed in this Section. In every case, destruction of data is carried out in accordance with Section 8.

If the User does not provide data without which a contract or a requirement of law cannot be performed, the Operator may refuse the corresponding service — for example, not grant a license where no account has been created and no email address provided.

2.1. Account, Conclusion and Performance of the License Agreement

Categories of subjects: Users who purchase, request or use a license for the Program.

Data processed: email address; account information — internal identifier, date of creation, confirmation of the email address, and the date and revision of the documents accepted; license information — type, term, date of issue, identifier; subscription and payment information — tariff, amount, charge dates, status; the content of correspondence concerning performance of the contract.

Means of processing: automated and mixed.

Legal ground: Clause 5 of Part 1 of Article 6 of Law No. 152-FZ (performance of a contract to which the subject is a party or a beneficiary).

Retention periods: for the term of the license, and after it ends — for the periods established by tax legislation for a payer of the Professional Income Tax and for the limitation periods for claims.

2.2. Acceptance of Payment for a License

Categories of subjects: Users paying for a license.

Data processed by the Operator: payment identifier (invoice), amount, date, payment status; the payer's email address where it is transmitted together with the order; other payment details returned by the payment service, without the full card number.

The Operator neither receives nor stores full bank card details, CVC/CVV codes or electronic payment instrument data. These are processed by the payment aggregator on its own payment page, as an independent personal data operator.

Means of processing: automated.

Payment information is also used to check the payment for signs of fraud and to handle a chargeback.

Legal ground: Clause 5 of Part 1 of Article 6 of Law No. 152-FZ; as regards checking a payment for signs of fraud and handling chargebacks — Clause 7 of Part 1 of Article 6 of Law No. 152-FZ (legitimate interest in preventing fraudulent payments). Processing of payment details on the payment aggregator's side is carried out by it on its own legal grounds.

Retention periods: the retention periods for settlement records and receipts established by tax legislation, and the limitation periods for claims. Retention on the payment aggregator's side is determined by its own policy.

2.3. Operation of the Program: License Activation, Renewal and Update Checks

Categories of subjects: Users who have installed the Program.

Data processed. When a license is activated on a device, when its term is periodically renewed, and when a device is unbound, the Program transmits to the Operator's licensing server:

• a device identifier — an irreversible hash (SHA-256) computed from the operating system identifier and the installation identifier. The hardware identifier itself, serial numbers and MAC addresses are not transmitted;
• the network name of the device (hostname) — so that the User can tell their own devices apart in the personal cabinet. That name is set by the User through the operating system and may be changed by them at any time;
• the name and version of the operating system and the version of the Program;
• a service license token identifying the license and the device;
• the IP address — to the extent it is transmitted by the communication protocol.

On every launch the Program checks for updates. The platform, the processor architecture and the installed version of the Program are transmitted to the update server, together with the data that any network request conveys — the IP address and client software information. The account, the license and the device identifier are not transmitted.

Means of processing: automated.

Legal ground: Clause 5 of Part 1 of Article 6 of Law No. 152-FZ — performance of a contract to which the subject is a party: as regards license activation, renewal and device unbinding, the license agreement, including compliance with the number of devices provided for by the tariff; as regards update checks, the User Agreement, which makes updates part of the Service. The update check is part of the operation of the Program and cannot be switched off separately from it.

Retention periods: for the term of the license and the limitation periods for claims; update server logs — for the period needed to keep that server operational and secure.

2.4. Operation of the Site

Categories of subjects: visitors to the Site.

Data processed: technical request data — IP address, date and time, URL, User-Agent, browser and device information; cookies to the extent described in Section 5.

Means of processing: automated.

Legal ground: Clause 7 of Part 1 of Article 6 of Law No. 152-FZ — legitimate interest in keeping the Site operational and secure.

Retention periods: technical logs of the Site — no more than 12 months. Logs relating to a dispute that has arisen are retained until it is resolved, but no longer than 3 years from the date of its resolution.

2.5. Website Traffic Statistics, Including Analysis of UTM Tags

Categories of subjects: visitors to the Site who have consented to analytics cookies.

Data processed: Yandex Metrica cookie identifiers to the extent described in Section 5; IP address; browser and device information (User-Agent, screen resolution, language); the address of the page visited, the referral source and referrer; UTM parameters; the date and time of the visit and information about page views within a session; information about actions performed on the Site — downloading the Program, choosing the language and the page appearance, opening documentation articles; depersonalized information about on-page behaviour — areas clicked (click map), scroll depth and clicks on links.

Email addresses, names, payment data, license identifiers and device identifiers are not transmitted to Yandex Metrica.

Analytics service: Yandex Metrica, LLC "YANDEX" (INN 7736207543, OGRN 1027700229193), https://yandex.ru/metrika. Processing takes place within the territory of the Russian Federation.

Means of processing: automated.

Legal ground: Clause 1 of Part 1 of Article 6 of Law No. 152-FZ — the subject's separate consent, given through the cookie banner. The counter is not loaded before consent is obtained.

Retention periods: the lifetime of the corresponding cookies (Section 5). Where consent is withdrawn, the collection of statistics stops. Information already collected is held within the Yandex Metrica service, on the side of LLC "YANDEX", for the periods determined by the terms of that service; a subject's demand for their destruction is passed by the Operator to LLC "YANDEX" as the person acting on its instructions.

2.6. Compliance with Obligations Imposed on the Operator by Law

Categories of subjects: all of those listed in this Section.

Data processed: only the data required for the specific obligation — responses to Roskomnadzor and other competent authorities, tax accounting, and notifications provided for by Law No. 152-FZ.

Means of processing: automated and non-automated.

Legal ground: Clause 2 of Part 1 of Article 6 of Law No. 152-FZ and other federal laws imposing the relevant obligation.

Retention periods: the periods established by the relevant legislation.

2.7. Display of Embedded Blocks of Third-Party Services

Categories of subjects: visitors to the Site.

Data processed: the data that any web request conveys — the IP address, browser and device information, and the address of the page from which the request is made. Those data are received by the service whose block is displayed; they are not transmitted to the Operator.

Means of processing: automated.

Legal ground: Clause 7 of Part 1 of Article 6 of Law No. 152-FZ — legitimate interest in presenting on the Site information about the Program published by independent services (ratings and reviews). Such a block cannot be displayed without contacting the service concerned. The services are listed in clause 5.1.

Retention periods: the Operator neither receives nor stores these data; retention on the side of the service is determined by its own terms.

The subject may object to this processing in accordance with Section 6.

2.8. Handling Enquiries and Conducting Correspondence

Categories of subjects: persons sending enquiries to the Operator.

Data processed: email address; name, if provided; the content of the enquiry and its attachments.

Means of processing: automated and mixed.

Legal ground: Clause 5 of Part 1 of Article 6 of Law No. 152-FZ where the enquiry relates to a concluded contract, and Clause 7 of Part 1 of Article 6 of Law No. 152-FZ (legitimate interest in handling the enquiry) otherwise. Enquiries that the Operator is obliged to consider under Law No. 152-FZ, including the demands provided for by Section 6, are processed on the basis of Clause 2 of Part 1 of Article 6 of the same Law.

Retention periods: correspondence relating to an enquiry — until the purpose of processing is achieved, but no longer than 3 years from the date of the last message. Where an enquiry gives rise to a dispute, the correspondence is retained until the dispute is resolved, but no longer than 3 years from the date of its resolution.

3. Data the Operator Does Not Process

3.1. Traffic intercepted by the Program, the content of requests and responses, saved sessions, rules and the User's files remain on the User's device and are not transmitted to the Operator. Cryptographic keys and certificates generated by the Program are stored only on the User's device.

3.2. Crash reports from the Program are not transmitted to the Operator; no third-party crash reporting services are used.

3.3. Special categories of personal data (Article 10 of Law No. 152-FZ) and biometric personal data (Article 11 of Law No. 152-FZ) are not processed.

3.4. The Operator does not process personal data for advertising purposes: no advertising mailings are sent, targeted advertising and retargeting are not used, and the data collected under clause 2.5 are not transmitted to advertising systems. The analysis of UTM tags (clause 2.5) shows only the link by which a visitor came to the Site. Session recording of Site visitors (Webvisor) is not used.

3.5. The Operator does not acquire personal data databases from third parties and does not place subjects' personal data in publicly available sources.

3.6. Should any of the processing listed in this Section be introduced, this Policy will be updated before it begins.

4. Transfer of Data, Delegated Processing and Localization

4.1. The Operator performs the following actions with personal data: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), delegation of processing, anonymization, blocking, deletion and destruction. Personal data are not disseminated to an indefinite range of persons. A request made by the User's browser to services whose blocks are embedded in the pages of the Site (clauses 2.7 and 5.1) is not dissemination: the data are transmitted to a specific service, not to an indefinite range of persons.

4.2. Confidentiality of personal data is maintained as required by Article 7 of Law No. 152-FZ. The obligation to maintain it is included in the contracts with the persons engaged in processing (clause 4.6).

4.3. Localization. The databases in which the personal data of citizens of the Russian Federation are processed are located within the territory of the Russian Federation (Part 5 of Article 18 of Law No. 152-FZ).

4.4. Cross-border transfer of personal data is not carried out by the Operator. Should such a transfer become necessary, this Policy will be updated before it begins.

4.5. Personal data are disclosed to third parties only where a delegation contract obliging the processor to comply with Law No. 152-FZ — including its requirements on localization, confidentiality and destruction of data once the delegation ends — is in place, or in cases expressly provided for by the legislation of the Russian Federation, including reasoned requests from competent state authorities. This clause does not apply to data that the User's browser transmits directly to a service whose block is embedded in a page of the Site (clause 2.7): the Operator neither receives nor discloses such data.

4.6. Persons engaged in processing:

The name and address of a person processing personal data on the Operator's instructions are disclosed to the data subject on request, in accordance with Article 14 of Law No. 152-FZ.

The hosting provider and LLC "YANDEX" act on the Operator's instructions. The payment aggregator acts on the Operator's instructions as regards accepting payments in its favour and is at the same time an independent operator in respect of the payer's payment details, which are not transmitted to the Operator. Third-party services embedded in the pages of the Site (clauses 2.7 and 5.1) do not process data on the Operator's instructions and act as independent operators in respect of the data they receive when their blocks are displayed.

4.7. Personal data are obtained directly from the subject or automatically from the subject's device when the Site or the Program is used.

5. Cookies and Similar Technologies

5.1. The Site uses cookies of two kinds:

• technical (strictly necessary) — the operation and security of the Site, including signing in to an Account and placing an order, and storage of the User's choice regarding cookies. No separate consent is required;
• analytics — cookies of the Yandex Metrica service (clause 2.5). These are enabled only after the User's separate consent.

The third-party blocks embedded in the pages of the Site — Product Radar and Peek Product (clause 2.7) — may set cookies of their own; this Policy does not extend to them.

5.2. Retention periods. The cookie recording the User's choice regarding analytics is stored for up to 12 months. Other technical cookies are stored for the duration of the browser session or for no more than 1 hour. The retention periods of Yandex Metrica cookies and of third-party services' cookies are determined by their own terms.

5.3. Consent to analytics cookies is requested by a banner on the first visit. Refusing does not prevent use of the Site, other than for statistics collection.

5.4. The User withdraws consent themselves, by deleting the Site's cookies in the browser settings: the choice is held in their own browser, so the withdrawal takes effect immediately and needs no request to the Operator. A demand to destroy information already collected is sent to the address given in clause 1.1 and is acted on as described in clause 2.5. Deleting the Site's cookies also ends any signed-in session of the Account. Disabling technical cookies may make some features of the Site unavailable.

6. Rights of the Data Subject and How to Exercise Them

6.1. The data subject has the right to:

• obtain information about the processing of their personal data to the extent set out in Article 14 of Law No. 152-FZ;
• demand clarification, blocking or destruction of personal data where they are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose;
• withdraw consent to the processing of personal data;
• demand that processing carried out on the basis of Clause 7 of Part 1 of Article 6 of Law No. 152-FZ be stopped, unless otherwise provided by federal law;
• appeal against the Operator's actions or omissions to Roskomnadzor or to a court;
• exercise the other rights provided for by Law No. 152-FZ.

6.2. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal and does not stop processing that is necessary to perform the license agreement or to comply with the law.

6.3. Requests are sent to the email address given in clause 1.1. A request concerning account data is to be sent from the email address of that account; otherwise the Operator may require other confirmation of the subject's identity, since naming another person's address does not of itself establish that the request comes from the subject. A request should state a sufficiently definite description of the demand and information allowing the subject to be identified in the Operator's information systems (as a rule, the email address of the account) and, for a representative, a document confirming their authority. The Operator may request additional information needed to identify the subject or to consider the request.

6.4. Requests are considered within the periods established by Article 20 of Law No. 152-FZ.

6.5. Where the Operator cannot comply with a demand in full, it informs the subject and gives the reason. Access to personal data is restricted only in the cases expressly listed in Part 8 of Article 14 of Law No. 152-FZ. The Operator refuses to stop processing or to destroy data where the processing continues on another lawful ground — performance of a contract or of an obligation established by law — and names that ground.

7. Information on the Implemented Personal Data Protection Requirements

7.1. The Operator applies the legal, organizational and technical measures provided for by Article 19 of Law No. 152-FZ.

7.2. Those measures include: adopting and applying this Policy; processing personal data by the Operator personally — no other persons are admitted to them, except those named in clause 4.6; access rights separation and password protection of information systems; encryption of data in transit; keeping the software in use up to date; backups; event logging in information systems; concluding delegation contracts with persons engaged in processing; locating databases of personal data of citizens of the Russian Federation within the territory of the Russian Federation; and monitoring retention periods and destroying data once the purposes of processing are achieved.

7.3. The specific set of technical measures is determined having regard to current threats, the security level of the information system and the requirements of Resolution of the Government of the Russian Federation No. 1119 of 01.11.2012, and is not published to the extent that publication would itself reduce the level of protection.

7.4. On establishing that personal data have been unlawfully or accidentally transferred in a way that infringes subjects' rights, the Operator takes measures to remedy the consequences.

8. Clarification, Blocking and Destruction of Personal Data

8.1. Where inaccuracy or unlawfulness of processing is confirmed, the Operator clarifies the data or blocks them and stops the processing in accordance with Article 21 of Law No. 152-FZ.

8.2. Personal data are destroyed on the grounds and within the periods established by Article 21 of Law No. 152-FZ, and upon the expiry of the retention periods stated in Section 2.

8.3. The destruction of personal data, the documentary evidence of it and the notification of the subject are carried out in the manner provided for by Article 21 of Law No. 152-FZ and by the requirements adopted pursuant to it.

8.4. Not subject to destruction until the established periods expire: information necessary to perform concluded license agreements and to evidence the grant of a license; settlement records and receipts that the Operator is required to retain under tax legislation; and data that federal law requires to be retained.

8.5. On ceasing its activity the Operator stops collecting personal data and concluding new contracts, continues to process previously obtained data only to the extent necessary to complete obligations under concluded contracts and to comply with the law, and instructs persons engaged in processing on its behalf to stop processing and destroy the data, except for information those persons are required to retain themselves by law or as independent operators.

9. Final Provisions

9.1. This Policy is a publicly available document and is published on the Site, including on the pages through which personal data are collected (Part 2 of Article 18.1 of Law No. 152-FZ).

9.2. The Operator may amend this Policy. A new revision takes effect upon publication on the Site unless it states otherwise. Where an amendment requires new consent, the Operator requests it separately. The current revision is available at https://solpuga.pro/en/privacy; each revision is also available at an address of the form https://solpuga.pro/en/privacy/1.0, where the last element of the address is the revision number.

9.3. Enquiries about the processing of personal data are to be sent to the contacts given in clause 1.1.

9.4. Matters not governed by this Policy are subject to the legislation of the Russian Federation.

9.5. If any provision of this Policy is found invalid, the remaining provisions remain in force.

9.6. This Policy is drawn up in Russian. Translations into other languages are for information only and do not narrow the rights of data subjects; in the event of any discrepancy between the Russian version and a translation, the Russian version prevails.