Privacy Policy

1. General Provisions

This personal data processing policy is drawn up in accordance with the requirements of Federal Law No. 152-FZ dated July 27, 2006, “On Personal Data” (hereinafter referred to as the Personal Data Law) and defines the procedure for processing personal data and measures to ensure the security of personal data undertaken by ECU COMPANY (hereinafter – the Operator).

1.1. The Operator considers the observance of human and civil rights and freedoms when processing personal data, including the right to privacy, personal and family secrecy, as a primary objective and condition of its activity.

1.2. This Policy applies to all information that the Operator may obtain about visitors of the website [https://ecu-company.com](https://ecu-company.com).

2. Key Terms Used in This Policy

2.1. Automated processing of personal data – processing using computer technology.

2.2. Blocking of personal data – temporary suspension of the processing of personal data (except in cases where processing is necessary to clarify personal data).

2.3. Website – a set of graphic and information materials, as well as software and databases, made available on the internet at [https://ecu-company.com](https://ecu-company.com).

2.4. Personal data information system – a set of personal data contained in databases, and the information technologies and technical means that ensure their processing.

2.5. Depersonalization of personal data – actions that make it impossible to determine the identity of the personal data subject without the use of additional information.

2.6. Processing of personal data – any action (operation) or set of actions (operations), performed with or without the use of automation tools, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.

2.7. Operator – a state or municipal authority, legal entity, or individual who, independently or jointly with others, organizes and/or performs the processing of personal data, determines the purposes of data processing, the composition of the data, and the actions (operations) carried out with personal data.

2.8. Personal data – any information relating directly or indirectly to a specific or identifiable user of the website [https://ecu-company.com](https://ecu-company.com).

2.9. Personal data allowed by the subject for distribution – personal data to which an unlimited number of people have been granted access by the subject through consent, in accordance with the Personal Data Law.

2.10. User – any visitor of the website [https://ecu-company.com](https://ecu-company.com).

2.11. Provision of personal data – actions aimed at disclosing personal data to a specific person or a specific group.

2.12. Distribution of personal data – any actions aimed at disclosing personal data to an indefinite number of persons or making the data available to the public, including publication in media, online, or by any other means.

2.13. Cross-border transfer of personal data – transfer of personal data to a foreign country, a foreign authority, a foreign individual, or a foreign legal entity.

2.14. Destruction of personal data – any actions that result in the irreversible deletion of personal data, making it impossible to restore the contents, including the destruction of physical storage media.

3. Rights and Obligations of the Operator

3.1. The Operator has the right to:

• Receive accurate information and/or documents containing personal data from the data subject;
• Continue processing personal data without the subject’s consent if the subject withdraws consent, provided that there are legal grounds as per the Personal Data Law;
• Independently determine the scope of measures necessary and sufficient to fulfill the obligations under the Personal Data Law and related regulations, unless otherwise specified by the law.

3.2. The Operator is obliged to:

• Provide the data subject with information regarding the processing of their personal data upon request;
• Organize personal data processing in accordance with current legislation;
• Respond to inquiries and requests from personal data subjects and their legal representatives;
• Provide necessary information to the authorized body for personal data protection upon request within 30 days;
• Publish or otherwise ensure unrestricted access to this Policy;
• Take legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, distribution, or any other unlawful actions;
• Cease the dissemination and processing of personal data, and destroy the data as prescribed by law;
• Fulfill other duties as outlined by the Personal Data Law.

4. Rights and Obligations of Personal Data Subjects

4.1. Personal data subjects have the right to:

• Receive information regarding the processing of their personal data, except in cases where federal laws dictate otherwise. This information must be provided in an accessible form and must not include data on other subjects unless legally justified;
• Request corrections, blocking, or deletion of their data if it is incomplete, outdated, inaccurate, obtained unlawfully, or not needed for the stated purpose;
• Require prior consent for their data to be used for marketing;
• Withdraw consent to personal data processing;
• File complaints with the authorized body or courts regarding unlawful actions or inaction by the Operator;
• Exercise other rights as provided by law.

4.2. Personal data subjects must:

• Provide the Operator with accurate personal data;
• Notify the Operator about updates or changes to their personal data.

4.3. Persons providing false information or data about others without consent bear legal responsibility.

5. Types of Personal Data Processed

5.1. Full name; 5.2. Email address; 5.3. Phone numbers; 5.4. Residential address and registration data; 5.5. Anonymized data (cookies, analytics from Yandex.Metrika, Google Analytics, etc.); 5.6. The above are collectively referred to as “Personal Data.” 5.7. Special categories of data (e.g., race, religion, political views) are not processed. 5.8. The Operator may process data permitted for public dissemination only in accordance with Article 10.1 of the Personal Data Law. 5.9. Consent to the processing of such data must be separate and meet the standards set by the authorized body. 5.9.1–5.9.4. The Operator must publish terms of processing, honor withdrawal of consent, and limit the use of such data accordingly.

6. Principles of Data Processing

6.1. Data processing must be lawful and fair; 6.2. Data processing must pursue specific, lawful purposes; 6.3. Combining data sets with incompatible purposes is not allowed; 6.4. Only data relevant to the stated purposes may be processed; 6.5. Excessive data collection is not permitted; 6.6. Data must be accurate, sufficient, and up to date; 6.7. Data must be stored no longer than required. It must be deleted or anonymized when no longer needed.

7. Purpose of Data Processing

7.1. To send email notifications; 7.2. To grant user access to services and content on https://ecu-company.com; 7.3. To send promotional or service-related messages, unless opted out via customer@ecu-company.com; 7.4. Anonymized data is used to analyze user behavior and improve website quality.

8. Legal Basis for Processing

8.1. Legal grounds include:

• Operator’s charter documents;
• Contracts with data subjects;
• Applicable federal laws and regulations;
• User consent for processing and distribution of personal data.

8.2. Data is processed only when voluntarily submitted via website forms or email; 8.3. Anonymized data may be collected via cookies and JavaScript if browser settings permit; 8.4. The subject gives consent freely and willingly.

8.3. The Operator processes anonymized user data if this is allowed in the user’s browser settings (such as cookies and JavaScript enabled).

8.4. The data subject independently decides to provide their personal data and gives consent freely, of their own will, and in their own interest.

9. Conditions for Personal Data Processing

9.1. Processing is carried out with the consent of the data subject.

9.2. Processing is necessary to fulfill obligations under international treaties or laws, or the legal responsibilities of the Operator.

9.3. Processing is required for justice administration, enforcement of court or official decisions in accordance with Russian law.

9.4. Processing is required for fulfilling a contract involving the data subject, including pre-contract arrangements.

9.5. Processing is necessary for the Operator’s or third parties’ legitimate interests or public purposes, provided the subject’s rights are not violated.

9.6. Processing is allowed if data was made publicly accessible by the data subject.

9.7. Processing may also be done when required for legal publication or disclosure.

10. Collection, Storage, and Other Processing Methods

The Operator ensures the security of personal data using legal, organizational, and technical measures to comply with data protection laws.

10.1. The Operator secures personal data and takes measures to prevent unauthorized access.

10.2. Personal data will not be shared with third parties except under legal requirements or with the subject’s consent for fulfilling a civil contract.

10.3. Users can update their personal data by sending an email to customer@ecu-company.com with the subject “Update of Personal Data.”

10.4. Data is processed as long as necessary for the stated purposes unless otherwise required by law or contract. Consent may be withdrawn at any time by emailing customer@ecu-company.com with the subject “Withdrawal of Consent.”

10.5. Third-party services (e.g. payment systems, communication tools) process data under their own privacy policies. The subject is responsible for reviewing those policies. The Operator is not liable for third-party actions.

10.6. Any restrictions on distribution or processing do not apply when data is processed for public or legal interests as per Russian law.

10.7. The Operator ensures data confidentiality.

10.8. Data is stored only as long as necessary to identify the subject and achieve the processing goals, unless longer storage is required by law or contract.

10.9. Processing may be stopped when its purpose is achieved, consent expires, or is revoked, or if processing is found unlawful.

11. Actions with Personal Data

11.1. The Operator performs collection, recording, organization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, access), anonymization, blocking, deletion, and destruction of personal data.

11.2. Automated processing may include data transmission over communication networks.

12. Cross-Border Data Transfer

12.1. Before transferring data across borders, the Operator ensures the receiving country provides reliable protection of personal data rights.

12.2. If the country does not meet protection requirements, cross-border transfer is allowed only with written consent or to fulfill a contract involving the data subject.

13. Confidentiality

The Operator and others who access personal data must not disclose or share it without the subject’s consent unless required by law.

14. Final Provisions

14.1. Users can contact the Operator with questions at customer@ecu-company.com.

14.2. Changes to this Policy will be reflected in this document. It remains valid until replaced by a new version.

14.3. The current version is available at https://ecu-company.com/privacy