Version No. 3 dated 24.10.2026. Identifier: 2026-10-24-aml-analytics-1.
1. General provisions and Controller information
1.1. The Controller is Individual Entrepreneur Andrei Viktorovich Svirin, INN 772872317733, OGRNIP 322774600176722. Postal address: P.O. Box 15, Moscow, 117647. Telephone: +7 965 751-25-80. Personal data enquiries: zapros@aml-expert.ru.
1.2. The Policy defines the purposes, grounds, data categories, procedure and periods of personal data processing when using https://aml-expert.ru/, considering enquiries, concluding and performing contracts. Terms have the meanings defined by Federal Law No. 152-FZ of 27.07.2006, On Personal Data.
2. Principles and grounds
2.1. Processing is limited to specific, predetermined and lawful purposes. Data categories must correspond to the purpose; excessive processing and use for incompatible purposes are prohibited. The Controller relies on the data subject's consent, grounds for concluding and performing a contract, compliance with statutory duties or another applicable independent lawful basis.
2.2. Enquiry consent is separate from advertising consent and consent to data processing for mailings. Submitting an enquiry or visiting the website does not itself authorise advertising or optional analytics. Consent concerning the Applicant's data does not replace a lawful basis for processing other persons' data.
3. Enquiries and form operation
3.1. To consider an enquiry, clarify the task and prepare a response, the name, telephone or email, topic, network and asset information, enquiry text, documents, images and related subsequent correspondence provided are used. Material sufficiency and necessity are assessed for the task. Remove information unrelated to the examination.
3.2. On the main aml-expert.ru website, the form sends the enquiry and selected attachments to a server handler that forwards them to zapros@aml-expert.ru using the server's email facilities. The visitor sees the technical submission result. Handover to the email system does not confirm inbox delivery or acceptance of an order: work terms are agreed separately. In the static preview, instead of server submission, the form prepares an email or downloadable .eml draft that the visitor checks and sends independently.
3.3. An enquiry requires separate data processing consent, version 2026-10-24-aml-1. Selecting files separately requires acceptance of the terms for transferring materials. Up to 10 files may be selected, each up to 10 MB, 15 MB in total; empty files are rejected. In the operational version, checked files are temporarily received by the server to create an email; temporary copies are deleted after the sending attempt. The application creates no permanent public archive of these files and does not retain the enquiry text in the consent log.
3.4. On server submission, the email to the Controller includes the direct connection IP address, browser and device information transmitted by the browser (User-Agent), browser language (Accept-Language), approximate completion time of the current page according to browser data and time since the secure form token was issued according to the server clock. This information is used to check enquiry circumstances, technical failures and improper submissions; it does not establish the sender's identity or confirm the full website visit duration. A separate minimum enquiry record contains contact email or telephone, form type, page address, server date and time, enquiry identifier, consent information and materials terms version. Text, attachment contents and names, IP address and User-Agent are not retained in that record. In the static preview, the email is prepared locally without the listed server information.
3.5. Materials are used to consider the task, agree the work and prepare a response. Initial transfer does not authorise publication, advertising use or transmission to analytics. A task description suffices for the initial enquiry. Bank statements and documents are transferred to the necessary extent and on a lawful basis.
4. Contract, obligations and protection of rights
4.1. When a contract is concluded, necessary data are processed to agree the assignment, conduct the examination, make settlements, exchange documents and deliver the result. Categories are limited to what is necessary for each action. Passport and other identification information are requested only if needed for the relevant document or statutory duty.
4.2. Representative data and authority documents are processed insofar as interaction takes place through that representative. Third-party data in materials are examined only on an independent lawful basis. A contract with the Applicant does not authorise processing of any data about other persons.
4.3. Processing for accounting, settlements, lawful requests, complaints and protection of rights occurs on the relevant independent basis and to the necessary extent. Mandatory documents are not deleted solely because consent is withdrawn if another applicable retention basis remains.
5. Subscription and withdrawal from mailings
5.1. Subscription is separate from an examination enquiry. It requires two independent checkboxes, not preselected: consent to receive advertising and consent to data processing for mailings. The email, subscription identifier and status, registration date and versions of both consents are used. In the operational version, the server registers the subscription and submission circumstances; in the static preview, the form only prepares an email that must be sent independently. The address, enquiry text and attachments from the main form are not automatically used for advertising.
5.2. On the operational website, subscription is registered after successful verification of the separate form and both consents. In the static version, a request is considered after receipt of the independently sent email; preparing, copying or downloading a draft does not register a subscription. Consent lasts no more than three years from expression unless withdrawn earlier; viewing messages does not extend it.
5.3. Withdrawal may be sent to zapros@aml-expert.ru or through the unsubscribe page. It requires no advertising consents and simultaneously withdraws advertising permission and consent to data processing for mailings. In the operational version, the server immediately marks the subscription inactive after form processing. In the static version, an email is prepared and must be sent, since a draft alone does not deliver the request to the Controller. Further advertising processing and sending stop upon receipt of withdrawal under the established procedure.
6. Technical mechanisms, analytics and persons involved
6.1. Yandex Metrica with a separate website counter is used for visitor analysis. The counter library loads only after the visitor's separate consent and only on aml-expert.ru and www.aml-expert.ru. The counter does not start on /legal/ or /rassylka/otpiska/ pages. Analytics are disabled on technical preview addresses.
6.2. The purpose is to assess traffic, referral sources, page use and website usability. Metrica may process the IP address, request date and time, technical browser, operating system and screen information, browser and visit identifiers, viewed page and referral source information. Addresses expressly transmitted by the application are limited to the protocol, domain and page path: query parameters and the address fragment are excluded.
6.3. Form content, names, contacts, enquiry text, file information, selected questions and search strings are not sent as analytics parameters. Session Replay, click maps, external link and address fragment tracking are disabled. The application does not send page titles to the counter or additional events about form actions; Yandex Tag Manager is disabled. Analytics are not used to identify clients or select examination content.
6.4. The analytics data recipient is YANDEX LLC, provider of Yandex Metrica. Service operation is governed by the Metrica terms of use and Yandex Privacy Policy. The service may use cookies and local storage records to count visits; their contents and lifetimes are given in the official documentation. The choice validity period on our website is not the retention period for each cookie or all data in the service infrastructure.
6.5. Consent is expressed with the separate Allow analytics button in the settings panel. The Without analytics button saves a refusal. Closing the panel, continuing to browse, making an enquiry and subscribing do not constitute consent. Declining does not restrict access to pages or forms. Detailed terms are set out in the Analytics Consent, version 2026-10-24-aml-analytics-1.
6.6. The choice is saved for 180 days in local storage aml-analytics-choice-v1 and, on the operational website, additionally confirmed by the server and signed aml_analytics_choice cookie. The record contains permission or refusal, document version and expiry time. The cookie applies the choice and has HttpOnly, SameSite=Lax and Secure on HTTPS. It contains no enquiry text. A valid choice applies on subsequent visits; refreshing does not extend its period or require a new selection each time. If permission is absent, expired or cannot be verified, analytics remain disabled.
6.7. You can change your choice or withdraw consent with Analytics settings in the footer. After refusal, new analytics requests stop. Previously transmitted data and service cookies do not disappear automatically after one click: deletion is considered in light of applicable processing bases and service terms. Cookies and local records can be deleted through the browser. Deleting the choice record may cause another settings request on the next visit.
6.8. Operational server forms use the FORMSESSID session cookie to protect against forged submissions. This is an essential technical cookie with HttpOnly, SameSite=Lax and Secure on HTTPS; it lasts until the browser session ends. The one-time protective form token is valid for no more than 3600 seconds. Blocking essential cookies may prevent server form submission and settings confirmation. Their purpose is unrelated to advertising or behavioural analytics.
6.9. The application does not save entered form data in its own local storage. Temporary operational form attachments are used only to create an email and deleted after the sending attempt; email copies follow section 7 retention periods. In the static version, downloaded drafts and files remain on the visitor's device. Browser or email application retention of entered data depends on their settings.
6.10. The email services used deliver and store messages. If a processor is engaged, appropriate data processing instructions apply. The hosting environment may keep its own technical connection logs for page delivery, operation and security; their retention depends on its settings and is not automatically equivalent to the application log periods below.
7. Retention and deletion periods
7.1. Data for enquiries not resulting in a contract, including email correspondence and attachments, are retained as necessary for consideration, but no longer than 90 calendar days from the last substantive message or telephone conversation. If interaction did not continue, the period starts on the enquiry date. Data are deleted once the purpose is achieved or the period expires unless an independent lawful retention basis exists.
7.2. Necessary contractual, accounting and settlement documents are retained for the applicable mandatory periods. Materials for protecting rights are retained to the necessary extent on an independent basis. This does not permit retention of excessive documents or copies.
7.3. Subscription and mailing data are processed until subscription termination, withdrawal or expiry of both consents, but no longer than three years from registration. After withdrawal, the subscription becomes inactive. Minimum advertising consent, status and withdrawal information is retained for up to three years after termination on an independent basis to honour withdrawal and evidence lawful interaction; it is not used to resume advertising.
7.4. The minimum server enquiry record without text or files is retained for no more than 90 days from registration. Technical information about server submission of subscriptions and withdrawals — IP address, User-Agent, language and timings — is retained for no more than 30 days from the event, then removed during scheduled maintenance. These periods do not define retention for general hosting and email infrastructure logs.
7.5. Minimum server analytics choice records — permission or refusal, identifier, date and time, version and document address — are retained for no more than three years from registration of the choice. IP address, User-Agent, contacts and enquiry content are excluded. The record evidences and applies the choice rather than serving behavioural analytics. Its retention does not extend permission to start the counter: permission itself lasts no more than 180 days.
7.6. Scheduled maintenance removes expired application records and technical snapshots. The Controller deletes substantive correspondence and attachments from email systems under clause 7.1; application file maintenance does not automatically clear mailboxes. Mandatory contractual and accounting documents are retained on an independent applicable basis. Processing cessation and destruction upon achievement of the purpose, withdrawal or discovery of a breach follow the established procedure.
8. Data subject rights and requests
8.1. The data subject may obtain processing information, request correction, blocking or destruction on relevant grounds, withdraw consent and challenge the Controller's actions before the authorised authority or a court. Withdrawal does not affect lawful earlier processing or stop processing for which another independent basis exists.
8.2. Requests are sent to the email or postal address in section 1. To link the request to an enquiry, provide the contacts used, approximate date and substance of the request. The Controller may request necessary information to verify the applicant; excessive identification data are not requested.
9. Data protection and Policy changes
9.1. The Controller applies necessary organisational and technical measures to restrict access, protect confidentiality, prevent misuse and observe retention periods. Confidential materials are transferred by a method agreed before transfer.
9.2. The current version is published on this page. Policy changes do not automatically expand previous consent or replace obtaining new consent when needed for new processing.