Version dated 7 October 2026
1. Controller and scope of this Policy
This Policy sets out how CONNECTUM LLC processes the personal data of visitors to https://connectum.ru, people submitting inquiries and representatives of organizations contacting the company through the website or the email addresses published on it.
The personal data controller is CONNECTUM LLC.
INN: 7714614129.
OGRN: 1057747962315.
Registered address: 107031, Moscow, 27 Petrovka Street, premises I, room 1.
Email for personal data inquiries: sales@connectum.ru.
Telephone: +7 (495) 859-33-45.
In this Policy, CONNECTUM LLC is referred to as the Controller, and https://connectum.ru as the Website.
This Policy applies to data processing associated with the corporate Website and inquiries to the company. The processing of guest Wi-Fi users’ data at customer sites is governed by separate documents and falls outside the scope of this Policy.
Processing is carried out in accordance with Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” and other applicable requirements of Russian Federation law.
2. Processing principles
The Controller determines the purpose of processing before collecting data, uses only the information necessary for that purpose and does not combine data for incompatible purposes.
The scope of processing depends on the inquiry and the user’s chosen method of interaction. Information about a company or site is treated as personal data to the extent that it relates to an identified or identifiable individual.
The Controller does not use inquirers’ data for advertising mailings on the basis of consent obtained when a form is submitted. Responding to an inquiry, discussing the task and sending a requested commercial proposal form part of handling that inquiry.
3. Data processed and purposes of processing
3.1. Handling inquiries and discussing projects
Purpose: to receive and review an inquiry, clarify the task, prepare a response or requested proposal, and agree on further steps for the project.
Categories of data subjects: people submitting inquiries and representatives of prospective customers, existing customers and partners.
Data: first name; surname, patronymic and job title if supplied in the inquiry; telephone number; email address; company name; information about the site type and task that relates to the user; and the user’s own personal data contained in correspondence and attached materials.
Submission details are also retained: date and time, submission page, referral source and UTM parameters, where present. These details are used to register the inquiry and identify the Website section or offering to which it relates.
Users may attach a site plan, network diagram or technical specification. These files should not include passport details, health information, individuals’ payment details or other people’s personal data unless required to discuss the task. The Controller does not request such information through Website forms.
Legal basis for inquiries submitted through forms: the user’s consent. For emails received directly, the Controller determines the legal basis according to the content of the inquiry. The minimum contact details needed to answer a question requested by the user may be processed in the Controller’s legitimate interests, provided that the user’s rights and freedoms are respected. Where processing is necessary to enter into or perform a contract with the data subject, the relevant contractual basis applies; where a statutory obligation must be fulfilled, the relevant legal requirement applies.
If further processing or entrusting processing to another party requires consent, the Controller obtains it separately. Sending an email does not in itself constitute permission for any subsequent use of the data.
Method: processing through the Website, email and CRM systems, together with review by authorized company employees.
Period: until work on the inquiry is completed, but no longer than 12 months from its receipt within this process. Continued processing after this period requires new consent or another applicable legal basis. The period is not automatically extended with each message from the user.
If an inquiry leads to a contractual relationship, the applicable legal bases and retention periods for the necessary contractual documents are determined separately. A contract with an organization does not in itself authorize the indefinite retention of any data concerning all of its employees without a legal basis.
3.2. Website operation and security
Purpose: to provide access to pages and forms, prevent abuse, detect technical errors and protect the Website.
Category of data subjects: Website visitors.
Data: IP address, request date and time, requested page address, browser and operating system information, request processing result, technical session identifiers and information about technical errors. Form field contents and attached files are not included in ordinary access logs.
Legal basis: the Controller’s legitimate interests in ensuring Website operation and security, subject to respect for visitors’ rights; compliance with applicable information security requirements.
Method: automated processing through the Website and server infrastructure.
Period: technical identifiers are retained for as long as the relevant function requires; access and error logs are retained for no longer than 30 calendar days from the date of recording. Records needed to investigate a specific incident or protect rights may be retained on a separate legal basis until the relevant proceedings are completed.
3.3. Web analytics
Purpose: to assess Website traffic, referral sources, demand for sections, and the usability of pages and forms.
Category of data subjects: visitors who have allowed web analytics.
Data: IP address; browser and cookie identifiers; device, browser and operating system information; approximate location derived from the IP address; visit date and time; pages viewed; referral source; and page interaction events, including the fact that a form was submitted.
Legal basis: separate consent to personal data processing for web analytics.
Method: automated processing using Yandex Metrica. The service is provided by YANDEX LLC, address: 16 Lva Tolstogo Street, Moscow. The Controller entrusts this company with processing the data necessary to provide visit statistics.
Inquiry field contents and attached files are not transmitted to Yandex Metrica. Transferring contact details from CRM systems, recording form contents or using data for additional purposes is not part of the processing described here.
Period of processing based on consent: until the stated purpose is achieved or consent is withdrawn, but no longer than 12 months from the date consent is given. Section 7 sets out how processing ceases and data is deleted. Individual cookie lifetimes are listed in the Cookie Policy. The expiry of a cookie does not in itself mean that all previously collected server data has been deleted.
Statistics rendered into a form that makes it impossible to establish or restore a link to a specific person may be retained to compare Website performance after personal data processing has ceased.
Declining web analytics does not restrict page browsing or the submission of an inquiry, provided that the consent required to process the inquiry itself is given.
3.4. Evidence of consent and handling data requests
Purpose: to demonstrate the lawfulness of processing, record the user’s choice and fulfill their personal data requests.
Categories of data subjects: users who have given or withdrawn consent and people who have submitted a request to the Controller.
Data: information enabling a request to be matched to a user or inquiry; the date, time and method of giving or withdrawing consent; selected settings; the version of the consent text; and the content and outcome of the request. IP addresses and other technical information are included only to the extent necessary to demonstrate the action taken.
Legal bases: fulfillment of the Controller’s obligations under personal data legislation and protection of the Controller’s legitimate interests, subject to respect for the data subject’s rights.
Method: recording in information systems and review by authorized employees.
Period: the minimum information demonstrating consent and the outcome of a request may be retained for up to three years after the relevant processing ceases, where necessary to demonstrate its lawfulness or protect rights. This period does not automatically apply to the full inquiry and all attached files. Information is deleted earlier if it is no longer needed.
4. Operations performed on data
Depending on the purpose, the Controller collects, records, organizes, accumulates, stores, updates, retrieves and uses data; provides necessary access to authorized persons; transfers data to processors where a legal basis exists; and anonymizes, blocks, deletes and destroys data.
Processing may be automated, non-automated or a combination of both. The data described in this Policy is not used to make decisions based solely on automated processing that have legal consequences for the user.
5. Data access and use of processors
Access is granted to the Controller’s employees who need the information to perform the relevant task.
To operate the Website and handle inquiries, the Controller may engage hosting, email and CRM providers, as well as contractors maintaining information systems. Where these parties process personal data on the Controller’s behalf, the processing terms are set out in a contract specifying the necessary data, purposes, operations, confidentiality and security requirements, and obligations when processing ends or incidents occur.
Users may request information about the specific parties processing their data on the Controller’s behalf and the conditions of access by emailing sales@connectum.ru.
For web analytics, data is transferred to YANDEX LLC under separate consent. The service documents are available at:
https://yandex.ru/legal/metrica_termsofuse/ru/
https://yandex.ru/legal/confidential/ru/
Information may be provided to public authorities and other recipients where required by law and supported by an appropriate legal basis.
The Controller does not publish inquirers’ personal data on the basis of ordinary form consent. Where the law requires separate consent to dissemination, data is published only after that consent has been obtained or where another applicable legal basis exists.
6. Database location and transfers outside Russia
When collecting Russian citizens’ personal data through the Website, recording, organization, accumulation, storage, updating and retrieval are performed using databases located in the Russian Federation, subject to statutory exceptions.
The form, email and CRM workflows described in this Policy do not provide for personal data transfers to foreign recipients. If a new process requires a cross-border transfer, the Controller identifies the recipients, countries, purposes and data involved before the transfer begins, fulfills the requirements of Article 12 of Federal Law No. 152-FZ, including submitting the necessary notification to Roskomnadzor, and updates the processing documents and legal bases.
User consent does not in itself override database location requirements or cross-border transfer procedures.
7. Cessation of processing and destruction
Processing ceases when its purpose is achieved, the specified period expires, consent is withdrawn or another statutory ground arises.
Once the purpose has been achieved or consent withdrawn, the Controller stops processing based solely on that consent and ensures destruction of the data within no more than 30 calendar days, unless another legal basis exists for its retention and processing.
Where the user separately requests that processing cease, the request is fulfilled within 10 working days, except where the law permits continued processing. Where statutory grounds exist, this period may be extended by no more than five working days; the user is notified of the reasons.
Data is deleted from operational systems and must also be destroyed by the processors engaged. The Controller also arranges destruction in backups and on other media. If destruction cannot objectively be completed within the statutory period, the data is blocked and destroyed in the manner and within the periods specified in Article 21 of Federal Law No. 152-FZ.
Withdrawal of consent does not prevent processing for which an independent legal basis remains, such as fulfillment of a statutory obligation. In that case, the Controller limits the data and purpose of processing to that basis.
8. Data protection
The Controller appoints people responsible for organizing processing, restricts data access, uses secure information transmission, applies information system security measures, controls access and takes steps to detect and resolve incidents.
Processors engaged must ensure data confidentiality and protection in accordance with the law and the terms of their instructions.
Details of security configurations are not published where disclosure could reduce information system security.
9. User rights and contact with the Controller
Users have the right to:
- Obtain information about the processing of their data, its purposes, legal bases, periods and processors engaged;
- Request correction of inaccurate information;
- Request that data be blocked or destroyed if it is processed unlawfully, is unnecessary for the stated purpose, or is incomplete, outdated or inaccurate;
- Withdraw consent and request cessation of processing, subject to statutory exceptions;
- Contact Roskomnadzor or a court to protect their rights.
Requests should be sent to sales@connectum.ru or the Controller’s registered address. To help locate the relevant record, users may use the subject line “Personal Data” and provide contact details, the inquiry date or other identifying information.
The Controller may request information necessary to verify the applicant’s identity and authority, proportionate to the request. Passport details are not automatically requested for every inquiry.
Information about processing is provided within 10 working days of receipt of a duly completed request. Where necessary and legally permitted, this period may be extended by no more than five working days, with a reasoned notification. Confirmed inaccuracies are corrected within seven working days of receiving the necessary information.
10. Changes to this Policy
The current version is published at https://connectum.ru/privacy. The version date is shown on the page.
Changes to this Policy do not in themselves extend consent previously given. The Controller obtains separate consent for new purposes or conditions that require it.