PHZAPPA
RU EN
Back to home

Personal Data Processing Policy

Version of 12.10.2026. Approved by the general director’s order No. 2-PDn.

1. General

1.1. This Policy sets out the purposes, conditions and procedure for processing personal data and the measures taken to protect it at FARM ZAPPA LLC (TIN 9703218631, PSRN 1257700350676, address: 123112, Moscow, Presnenskaya Embankment 12, premises 17/70; the “Operator”).

1.2. The Policy follows Russian Federal Law No. 152-FZ “On Personal Data” of 27 July 2006 (the “Law”) and covers all personal data processed by the Operator, including in connection with the website phzappa.com.

1.3. The Policy is published on phzappa.com under Article 18.1(2) of the Law and is available to anyone.

2. Legal grounds

The Constitution of the Russian Federation; the Labour, Tax and Civil Codes; Federal Laws No. 152-FZ on personal data, No. 402-FZ on accounting, No. 27-FZ on personalised accounting in compulsory pension and social insurance, No. 167-FZ on compulsory pension insurance, No. 14-FZ on limited liability companies and No. 129-FZ on state registration of legal entities; the Operator’s charter; contracts entered into by the Operator; the data subject’s consent where required.

3. Purposes, data subjects and data

3.1. HR and accounting records; compliance with labour, tax and pension law

  • Data subjects: General director, employees
  • Personal data: Name; date and place of birth; sex; citizenship; identity document details; registered and residential address; SNILS; TIN; phone; email; position and employment history; income, tax and contribution details; bank details
  • Legal basis: Art. 6(1)(2) and (5) of the Law; Labour Code, Tax Code, Laws 402-FZ, 27-FZ, 167-FZ
  • Retention: Term of employment, then for the document retention periods set by archival, accounting and tax law

3.2. Register of members and corporate procedures

  • Data subjects: Members of the company
  • Personal data: Name; date and place of birth; citizenship; identity document details; registered address; TIN; share; payments and bank details
  • Legal basis: Art. 6(1)(2) of the Law; Laws 14-FZ, 129-FZ, Tax Code; charter
  • Retention: While the person is a member, then for the statutory retention periods of company documents

3.3. Preparing, concluding and performing civil-law contracts; business correspondence

  • Data subjects: Individual and sole-trader counterparties, representatives of corporate counterparties, persons contacting the Operator by email or phone
  • Personal data: Name; position and employer; phone; email; for individual and sole-trader counterparties also identity document details, address, TIN, OGRNIP and bank details
  • Legal basis: Art. 6(1)(5) of the Law; Civil Code
  • Retention: Term of the contract and 5 years after performance; correspondence that did not lead to a contract — no more than 3 years from the last message

3.4. The Operator does not process special categories of personal data or biometric data.

4. The phzappa.com website

4.1. The Site does not collect visitors’ personal data: it has no contact forms, registration, client area, comments or subscriptions, and no analytics or advertising services. The Site sets no cookies for visitors (see the Cookie Policy). Fonts, images and scripts load from the Site’s own server, with no requests to third-party services.

4.2. The server hosting the Site is located in Russia and, like any web server, automatically logs the IP address, request time, requested page and browser details. The logs are needed to run and protect the server; the Operator does not use them to identify visitors.

4.3. Enquiries sent to the email address or made by the phone number shown on the Site are processed for the purpose “Preparing, concluding and performing civil-law contracts; business correspondence”.

4.4. The Site links to third-party resources: event websites, PubMed and PubChem, “Share” buttons (Telegram, WhatsApp, email) and calendar subscriptions. The Site does not pass visitors’ data to them; their own rules apply once you follow a link.

5. Processing procedure

5.1. The Operator collects, records, organises, accumulates, stores, updates, retrieves, uses, transfers (provides, grants access to), blocks, deletes and destroys personal data. Processing is mixed — automated and manual, with transfer over the Internet.

5.2. Personal data is provided to public authorities and state funds (Federal Tax Service, Social Fund of Russia, Rosstat), banks and other persons where required by Russian law.

5.3. Processing is entrusted, under confidentiality terms and in line with the Law, to service providers: SKB Kontur (reporting via Kontur.Extern) and Sprinthost.ru LLC (email and website hosting).

5.4. Personal data of Russian citizens is recorded, organised, accumulated, stored, updated and retrieved using databases located in Russia. Personal data is not transferred abroad.

5.5. The Operator does not disclose personal data to the public, except for information disclosed in the Unified State Register of Legal Entities as required by federal law.

6. End of processing and destruction

6.1. Processing ends when its purposes are achieved, retention periods expire, consent is withdrawn (where processing is based on consent), unlawful processing is detected, or the Operator is liquidated or reorganised.

6.2. Personal data is destroyed or anonymised within 30 days of the purpose being achieved, unless the law or a contract provides otherwise. Destruction is documented in accordance with Roskomnadzor Order No. 179 of 28 October 2022.

7. Data subjects’ rights

7.1. You may obtain information about the processing of your personal data, request its rectification, blocking or destruction if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose, withdraw consent, and complain to Roskomnadzor or a court (Articles 14 and 17 of the Law).

7.2. Send requests to contact@phzappa.com or by post to the Operator’s address. The Operator replies within 10 business days of receipt; this may be extended by up to 5 business days with a reasoned notice.

8. Security measures

8.1. The Operator takes the measures required by Articles 18.1 and 19 of the Law: a person responsible for organising data processing has been appointed; internal policies on data processing and protection have been adopted; the potential harm to data subjects has been assessed; security threats and the required protection level have been determined; persons with access to personal data have been familiarised with the law and internal policies; access control, safekeeping of data carriers, anti-virus protection and backups are in place; internal control is carried out.

8.2. The Operator notifies Roskomnadzor of any unlawful transfer (leak) of personal data within the time limits set by Article 21(3.1) of the Law.

9. Final provisions

9.1. The Operator may amend the Policy. A new version takes effect once approved and published on phzappa.com.

9.2. The person responsible for organising personal data processing is the Operator’s general director. Contact: contact@phzappa.com, 8 800 333 63 28, 123112, Moscow, Presnenskaya Embankment 12, premises 17/70.

The Russian version of this Policy prevails.