This Policy explains how “Meditek” Ltd. processes the personal data of visitors to astrocard-meditek.com.
1. General provisions
This Policy sets out the procedures and conditions under which “Meditek” Ltd. processes personal data when operating astrocard-meditek.com, handling enquiries and using external online services. It applies to information relating to an identified or identifiable natural person.
The Operator processes data lawfully and fairly, for predetermined purposes, avoids processing excessive data and retains data no longer than required by the processing purposes or by law.
2. Operator details
“Meditek” Ltd.Russian Taxpayer Identification Number (INN) 7719069501, Primary State Registration Number (OGRN) 1027700331658.
Registered address: Room 1, Premises II, Floor 1, Building 2, 6 Burakova Street, Moscow 105118, Russia.
Contact address: Building 6, 52 Smolnaya Street, Moscow 125445, Russia.
Email: info@astrocard.ru.
3. Purposes, data and legal bases
| Purpose and data subjects | Data | Legal basis | Retention period or condition for ending processing |
|---|---|---|---|
| Operation, protection and diagnostics of the website; all visitors | IP address, URL, HTTP Referer, date and time, session identifier, browser and device information, essential cookies | The Operator’s legitimate interests, provided visitors’ rights are respected; statistics are used after anonymisation | Online visitor record: approximately one hour; technical logs: only for as long as required for security and diagnostics |
| Responding to an enquiry, preparing a quotation and communicating at the visitor’s request | Name, phone number, email address, submission page, date and time, and records of document acceptance | Separate consent; where applicable, steps taken at the data subject’s request before entering into a contract | Until a response is provided and related correspondence is complete, or until consent is withdrawn, unless another lawful basis arises |
| Documenting consent and compliance with legal requirements | Content of the request, page and time, versions of the consent and policy, and confirmation result | The Operator’s obligation to demonstrate that consent was obtained and its legitimate interest in protecting its rights | For a reasonable period consistent with retaining the related correspondence and addressing potential claims |
| Website traffic analysis and improvement; visitors who have allowed analytics | IP address, URL and HTTP Referer, cookie and localStorage identifiers, browser, operating system, device, time and actions on pages | Separate consent to analytics | Until the preference is withdrawn; individual identifiers are retained according to the website and Yandex Metrica settings |
| Displaying the address on a map at the visitor’s request | Technical request data, including IP address, browser, device and HTTP Referer | The visitor’s explicit action: “Show map” | Under the Google service terms; the Operator does not retain a separate copy of the map request |
| Displaying an embedded video in a news article at the visitor’s request | Technical request data, including IP address, browser, device, URL and HTTP Referer | The visitor’s explicit action: “Show video” | Under the YouTube or VK Video terms; the Operator does not retain a separate copy of the video request |
4. Data categories and sources
The Operator obtains contact details directly from the visitor and technical data automatically from the browser, server and services allowed by the visitor. The website is not intended to collect special categories of personal data, biometric data, payment details or health information. Please do not submit such information through the website’s forms.
5. Processing operations and methods
Processing may include collection, recording, organisation, accumulation, storage, updating, retrieval, use, making data available to authorised persons, blocking, erasure and destruction. The Operator processes data by automated and non-automated means. Form-field content is excluded from Yandex Webvisor recordings and form analytics.
6. Recipients and processors
- authorised employees of “Meditek” Ltd., within their job responsibilities;
- hosting and corporate-email providers, to operate the website and deliver enquiries, subject to confidentiality and data-protection obligations;
- Yandex LLC, for Yandex Metrica only after analytics is allowed and for the map only after a separate click;
- the owners of YouTube and VK Video, only after the visitor separately requests an embedded video;
- government authorities, only where and as required by law.
The Operator does not sell personal data and remains responsible to the data subject when it engages another person to process personal data.
7. Data localisation and cross-border transfers
When the Operator collects personal data of citizens of the Russian Federation online, it records, organises, accumulates, stores, updates and retrieves that data using databases located in the Russian Federation, unless an exception under law applies. Before any possible cross-border transfer, the Operator complies with Article 12 of Federal Law No. 152-FZ and completes the required notification procedures.
8. Retention, withdrawal and destruction
Processing ends when its purpose is achieved, the prescribed period expires, the lawful basis ceases or the Operator receives a withdrawal, unless an independent lawful basis permits continued processing. When retention is no longer required, the Operator destroys the data within the periods prescribed by Article 21 of Federal Law No. 152-FZ—normally no later than 30 days after the purpose is achieved or consent is withdrawn.
9. Data subject rights
The data subject may obtain information about processing; request rectification, blocking or destruction of incomplete, outdated, inaccurate, unlawfully obtained or unnecessary data; withdraw consent; demand that processing cease; and challenge the Operator’s actions.
Send a request to info@astrocard.ru with the subject “Personal Data” or to the Operator’s registered address. To protect the data, the Operator may request information needed to verify the requester’s identity and connection to the data concerned. The Operator responds and ends processing within the periods prescribed by law.
10. Security and amendments to this Policy
The Operator applies the required legal, organisational and technical measures: it restricts access, appoints responsible personnel, inventories media and systems, protects communications and accounts, backs up data, monitors events, trains personnel and maintains incident-response procedures.
The current version is always available at /personal-data-policy. The Operator publishes a new version before beginning any processing affected by material changes to the purposes, data categories or external services.
