Loading...
Version 3.1, in force from 14 September 2026
This Policy is issued under part 2, article 18.1 of Russian Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" ("the Law") and sets out the purposes, legal grounds, conditions and procedure of personal data processing and the security measures taken by the operator named in section 2 ("the Operator").
It covers all personal data the Operator processes, including data obtained through https://elmica.ru ("the Site"), by email, by telephone, and when contracts are concluded and performed. It is linked from the footer of every page and beside every form that takes personal data; the Consent, the Newsletter Consent and the Cookie Policy are published as separate pages. "Cookies" here also covers other data stored in the browser (localStorage, sessionStorage).
Using the Site means you have been made aware of this Policy. Consent to processing is requested separately and is not implied by visiting the Site. The Russian text prevails in the event of any discrepancy.
ОБЩЕСТВО С ОГРАНИЧЕННОЙ ОТВЕТСТВЕННОСТЬЮ НАУЧНО-ПРОИЗВОДСТВЕННАЯ КОМПАНИЯ "ЭЛМИКА", OGRN 1056166031954, INN 6166053223, Ростовская область, г.о. город Новочеркасск, г. Новочеркасск, ш. Харьковское, д. 10, помещ. 48, этаж 1, 346404
Postal address for requests: 344009, г. Ростов-на-Дону, пр-т Шолохова, д. 203, а/я 6351
Email for personal data requests: am@elmica.ru or sale@elmica.ru
Telephone: 8-800-700-95-25 или (863) 2800-436(-437, -438) (Ростов-на-Дону), (343) 289-92-94 (-93) (Екатеринбург)
The Operator appoints a person responsible for organising personal data processing (article 22.1 of the Law), who handles requests sent to the addresses above.
The Operator processes personal data under the Constitution, the Civil, Labour and Tax Codes, the Law, the Consumer Rights Protection Act, the Advertising Act (38-FZ), the Accounting Act (402-FZ), the Cash Register Act (54-FZ), the laws on personalised pension records, archives and military service, the Retail Sale Rules (Government Decree No. 2463 of 31.12.2020), the Operator's charter, its contracts with data subjects — including the Public Offer and the User Agreement — and data subjects' consents. Processing takes place where at least one of the conditions in clauses 1, 2, 5 or 7 of part 1, article 6 of the Law is met.
For each purpose below: who the data subjects are, what data is processed, on what legal basis, and for how long. Processing incompatible with these purposes is not permitted.
Purpose: concluding and performing contracts for the sale of goods, including those concluded under the Public Offer on the Site — confirmation, invoicing, payment, delivery, returns and refunds, claims, order status notices. Data subjects: buyers who are individuals, including sole traders; representatives of corporate buyers; consignees. Data: full name; telephone; email; delivery address or collection point and locality; order contents, payment method, payments and refunds; for sole traders — INN, OGRNIP, addresses, bank details; for representatives — company name, position, power of attorney and identity document details when collecting goods by proxy. Legal basis: performance of a contract (clause 5, part 1, art. 6), legitimate interests of the Operator and a corporate buyer (clause 7), statutory accounting, tax and cash-register duties (clause 2). Retention: for the life of the contract, then for the statutory retention period of primary accounting documents (art. 29 of 402-FZ; at least five years after the reporting year).
Purpose: registering and running the customer account, confirming the email address, restoring access, identifying the user at sign-in. Data subjects: registered users. Data: email (the login); password, stored only as an irreversible hash and unknown to the Operator; full name or contact person; telephone; account type; delivery address if given; for sole traders and companies — name, INN, KPP, OGRN/OGRNIP, registered, actual and postal addresses, bank details; orders placed through the account; the date and text version of each consent. Legal basis: consent (clause 1) and performance of the User Agreement (clause 5). Retention: until the account is closed or consent withdrawn. An account that never placed an order is erased automatically 30 days after closing; one that did keeps its order-related data for the period in 4.1.
Purpose: handling enquiries received through the Site's feedback form, by email or by telephone, and product consultations. Data subjects: people who sent an enquiry. Data: name; telephone and/or email; company and position if given; the enquiry; for the form — the page it was sent from, browser details and an irreversible hash of the IP address for abuse control. Legal basis: consent (clause 1). Retention: one year from receipt; form submissions are then deleted automatically. If an enquiry leads to a contract, the data continues under 4.1.
Purpose: sending information and advertising emails about the Operator's goods, prices, offers and news. Data subjects: people who gave separate consent. Data: name; email; date and text version of the consent; date of withdrawal. Legal basis: consent (clause 1, part 1, art. 6 and part 1, art. 15 of the Law; part 1, art. 18 of the Advertising Act), given by a separate optional tick at checkout, at registration or in the account, and never a condition of ordering. Newsletters go only to people who gave it. Retention: until consent is withdrawn; afterwards only the withdrawal date is kept, so mailing cannot resume without new consent.
Purpose: visit statistics and Site improvement by the Operator's own means. Data subjects: visitors who consented to "Marketing and analytics". Data: a random browser identifier and session identifier (elmica_visitor_id, elmica_session_id); a truncated IP address (the last IPv4 octet is zeroed; only the IPv6 network prefix is kept); country and city derived from the IP before truncation; date and time; page viewed; referrer; device, browser and OS type. The click map is kept only as aggregate counts per page area, not linked to any visitor. Legal basis: consent (clause 1). Retention: one year from recording, then deleted automatically. Nothing is collected and no identifiers are created before consent.
No third-party counters or advertising pixels (Yandex.Metrica, Google Analytics, VK Pixel or similar) are used on the Site.
Purpose: information security of the Site — detecting and stopping attacks, password guessing and unauthorised access. Data subjects: Site visitors and account holders. Data: the security event log — full IP address and the country and city derived from it, date and time, request path and method, browser, OS and device, and for sign-in attempts the email entered (passwords and tokens are never logged); web-server access logs — IP address, date and time, request, referrer and browser for every request. Legal basis: the Operator's legitimate interest in protecting the Site, where the data subject's rights are not overridden (clause 7). Retention: security log — one year, then deleted automatically; web-server logs — 14 days.
Purpose: personnel and accounting records and compliance with labour, tax and social-insurance law. Data subjects: current and former employees. Data: names (including former), date and place of birth, citizenship, identity document, registered and actual address, telephone, email, INN, SNILS, education and qualifications, employment history, family details as needed for statutory benefits and tax deductions, military registration, bank details for salary, position, pay, deductions and leave. Legal basis: statutory duties (clause 2) and the employment contract (clause 5). Retention: during employment, then for the periods set by art. 22.1 of the Archives Act and the Rosarkhiv List of 20.12.2019 No. 236.
Purpose: concluding and performing contracts with suppliers, carriers and other counterparties. Data subjects: sole-trader counterparties and representatives of corporate counterparties. Data: name, position, telephone, email, power of attorney; for sole traders — INN, OGRNIP, address, bank details. Legal basis: contract (clause 5), legitimate interests (clause 7), statutory accounting and tax duties (clause 2). Retention: for the life of the contract, then for the retention period of primary accounting documents (art. 29 of 402-FZ).
The Operator does not process special categories of personal data or biometric data, and takes no decision producing legal effects based solely on automated processing (article 16 of the Law). The Site is intended for people old enough to contract on their own behalf; if a minor has provided data without a guardian's consent, write to am@elmica.ru and it will be deleted.
Processing is mixed — automated and manual — and uses the Operator's internal network and the Internet. Operations: collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer, anonymisation, blocking, deletion and destruction. Personal data of Russian citizens is recorded, systematised, accumulated, stored, updated and retrieved using databases in the Russian Federation (part 5, art. 18). No cross-border transfer takes place; the map background is fetched through the Operator's server, so nothing about the visitor reaches the map-data provider. Data is not disclosed without consent unless federal law requires (art. 7). Processing stops when the purpose is achieved, the period expires, consent is withdrawn (absent other grounds), unlawful processing is found, or the Operator is liquidated. Destruction is recorded by an act and/or an event-log extract under Roskomnadzor Order No. 179 of 28.10.2022.
Processors acting on the Operator's instructions (part 3, art. 6): BEGET LLC (INN 7801451618, St Petersburg) — hosting of the Site and its database on servers in Russia; YANDEX LLC (INN 7736207543, 16 Lva Tolstogo St., Moscow 119021) — corporate email (Yandex 360), including the Site's own letters.
Recipients, only as far as necessary: the carriers CDEK and Dellin (Delovye Linii) or another carrier the buyer chooses — the consignee's name, telephone and delivery address or collection point, and the shipment details, only for the carrier chosen; the bank holding the Operator's account (VTB Bank (PJSC)) — as needed to take payment and make refunds (payment is made against the Operator's invoice, including by the Faster Payments System QR code printed on it, from the buyer's own bank); the fiscal data operator — the buyer's email or telephone when an electronic receipt is sent under 54-FZ; the DaData company-details service — an INN and a bank BIC, to fill in details from the public registers; and state authorities where the law requires.
The collection-point map may be drawn by Yandex Maps, which the visitor's browser loads directly from YANDEX LLC (INN 7736207543, 16 Lva Tolstogo St., Moscow 119021) on Yandex's own terms; the Operator passes it nothing about the visitor. The Operator does not sell personal data or share it for advertising. All recipients are Russian organisations processing data in Russia; a current list is available on request.
You may: obtain information about the processing of your data to the extent of part 7, art. 14 of the Law; require data that is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary to be corrected, blocked or destroyed; withdraw consent; require processing for direct marketing to stop — it stops immediately (part 2, art. 15); require processing to stop under part 5.1, art. 21; and complain to the supervisory authority or a court.
Much of your data can be changed in your account, where the newsletter consent is also given and withdrawn. Accounts can be closed from the account page or on request.
Supervisory authority: Roskomnadzor, 109074, Moscow, Kitaygorodsky proezd 7 bld. 2; rkn.gov.ru.
The Operator answers a request, or gives a reasoned refusal, within 10 working days, extendable by up to 5 working days with a reasoned notice; corrects incomplete or inaccurate data within 7 working days; stops unlawful processing within 3 working days and, if it cannot be made lawful, destroys the data within 10 working days; destroys data within 30 days once the purpose is achieved or consent is withdrawn, absent other grounds; and notifies Roskomnadzor of an unlawful or accidental disclosure within 24 hours and of the internal investigation's outcome within 72 hours (part 3.1, art. 21).
The Operator takes the legal, organisational and technical measures required by articles 18.1 and 19 of the Law: a responsible person; this Policy and internal rules; staff training; internal control; harm assessment under Roskomnadzor Order No. 178 of 27.10.2022; threat modelling and protection levels under Government Decree No. 1119 of 01.11.2012; access control with individual accounts, anti-virus and backups; accounting of data carriers; incident detection and cooperation with GosSOPKA. On the Site: HTTPS; key-only server access with password login disabled; passwords stored only as a bcrypt hash; rate limiting and automatic lockout against credential guessing; a security event log (4.7); backups.
Send requests in writing to 344009, г. Ростов-на-Дону, пр-т Шолохова, д. 203, а/я 6351, or as an electronic document signed with an electronic signature to am@elmica.ru or sale@elmica.ru. A request must contain the number of your identity document, its date of issue and issuing authority, information confirming your relationship with the Operator (an order number, the account email, a contract date) and your signature (part 3, art. 14).
Withdraw consent by post or at am@elmica.ru or sale@elmica.ru. Cookie consent is withdrawn under "Cookie settings" at the foot of any page; the newsletter — by unticking it in your account, by replying to a newsletter, or by writing to am@elmica.ru or sale@elmica.ru.
The Operator may amend this Policy; a new version takes effect when published on the Site. Where the list of cookies or counters changes, consent is requested again. Matters not covered here are governed by Russian law.
The Operator is a Russian legal entity, processes data in Russia and does not target offers at data subjects outside it. If the law where you are gives you additional rights over personal data (access, rectification, erasure, restriction, portability, objection), write to am@elmica.ru or sale@elmica.ru; the request will be considered within 30 days.