Personal Data Processing Policy

Last updated: 9 October 2026

1. Who is the operator

The personal data operator is Цветков Алексей Михайлович (Tsvetkov Alexey Mikhailovich), a self-employed individual applying the special tax regime “Professional Income Tax” (NPD), Taxpayer ID (INN) 771565295596.

Data protection enquiries: order@dev-box.ru. Correspondence: admin@dev-box.ru (we do not accept post).

This policy covers the website dev-box.ru (the “Site”). If the Russian and English versions differ, the Russian version prevails.

2. What data we collect and from whom

We process the data of Site visitors and clients who leave a request or write to us.

From the request form. We keep what you wrote yourself: your name, a contact for our reply, your email (optional field), the task description (also optional), plus the site language and the time of sending.

Consent. You give consent to processing with a separate tick next to the button — without it the form is not sent. Together with the request we store when consent was given and which version of the consent text was shown: this is our evidence in case of a dispute.

Technical information. Together with the request we store what your browser sends automatically: the network address of your device and browser data. This is needed to answer enquiries, block spam and investigate failures. There is no separate tracking — this information sits in the same record as the request.

Telegram conversations. If you write to us on Telegram, we keep the conversation history so that we can continue the dialogue and keep its context.

Visit statistics. We collect it only with your consent and do not link it to your request: the analytics counter is not loaded until you click “Accept” in the banner. We do not record video of your actions on the page (Webvisor is off), but we do count page views, clicks and link follows.

How we process. Processing is automated: the data is kept electronically and processed by computer means. No decisions producing legal consequences for you are made automatically.

The Site is not intended for children, and we do not knowingly collect data of minors. If such data reaches us, we will delete it on request.

3. Why we process the data

• to answer your enquiry and discuss the task;
• to perform a contract if the enquiry turns into work;
• to protect the Site from spam and abuse;
• to understand which pages are useful — from visit statistics and with your consent;
• to keep the data safe in case of a failure — that is what backups are for.

We do not sell your data and we do not send advertising without separate consent. Each purpose uses its own set of data: statistics, for example, does not need your name or contact.

4. Legal grounds

• Your consent — to process the form data and to contact you, and separately to analytics. Consent is given separately from other actions, is voluntary and can be withdrawn (Article 6(1)(1) of Federal Law No. 152-FZ).
• Performance of a contract — if you become our client (Article 6(1)(5) of No. 152-FZ).
• Our legitimate interests — protecting the Site from spam, fraud and failures; this processing is limited to those purposes and does not touch data beyond what is necessary (Article 6(1)(7) of No. 152-FZ).

5. Where and how the data is stored

The data is stored on a server located in the Russian Federation.

How we protect the data. Only the operator has access to it, access to the server is restricted and protected, and the connection between your browser and the Site is encrypted. Backups are made daily and kept separately from the main server so that the data survives a failure; backups are kept for 30 days and deleted automatically. Data is deleted as soon as its retention period expires (section 8), and actions in the admin panel are written to a log.

The Site and its infrastructure are managed by the operator; no third-party specialists have access to the data.

6. Who receives the data

We do not sell data or transfer it to third parties, except for the services without which the Site cannot work.

Services that process data on our instructions: they act on our instructions and do not use the data for their own purposes.

The service that processes data independently is Telegram: it receives the request data and the conversation so that we can reply to you quickly. Telegram's infrastructure is located outside Russia, so request notifications are a transfer of data abroad. All other data is processed within the Russian Federation.

7. Cookies and browser storage

We use cookies and browser storage to:

• remember the language you chose;
• avoid asking you about cookies on every visit;
• prevent the form from being sent twice by an accidental double click;
• keep the admin panel login working — that cookie is set only after signing in and never on ordinary pages;
• measure visit statistics — Yandex.Metrica sets its own cookies, and only after you click “Accept”.

We do not record video of your actions on the pages (Webvisor is off), but we do count page views, clicks and link follows. We process this data on the basis of your consent.

How to opt out and withdraw consent. Click “Decline” in the banner: the analytics counter will not load, no statistics will be collected and your choice will be remembered. You can change your mind at any time: the “Cookie settings” button in the site footer withdraws consent and deletes the analytics cookies already set. Other data stored in your browser can be removed in its settings (usually “Site data” or “Clear browsing data”). Declining analytics does not restrict the Site or the request form in any way.

8. How long we keep the data

We stop processing when the purpose is achieved, the retention period expires or you withdraw your consent.

• Requests and conversations — 12 months from the last contact, after which they are deleted automatically. Earlier — at your request.
• Bot conversations — 12 months from the last message.
• Backups — 30 days.
• Admin panel action log — 6 months.
• Data in your browser — until you clear the site's storage or withdraw consent.

How we delete. When a period expires, the data is deleted automatically by a scheduled task; at your request — earlier (a request can also be deleted manually in the admin panel). Each deletion is recorded in the log. From backups, data disappears through rotation within 30 days.

9. Your rights

• Access — to learn what data of yours we process and to receive a copy.
• Rectification — to have inaccurate data corrected.
• Erasure — to have data deleted where there is no lawful basis to keep it.
• Blocking — to have processing suspended while disputed data is being checked.
• Withdrawal of consent — to refuse processing at any time. Withdrawal does not affect processing that was lawful before it.
• Appeal — to complain to Roskomnadzor or to a court if you believe we are violating your rights.

Write to order@dev-box.ru. If a representative acts for you, please attach a document confirming their authority.

Response times. We reply to an enquiry within 10 working days of receiving it; the period may be extended by no more than 5 working days, and we will tell you about the extension. We rectify, block or delete data no later than 7 working days from receiving the enquiry and the supporting information. If you withdraw consent, we stop processing and destroy the data within 30 days.

10. Changes to this policy

We may update this page: the current text always lives here, and the last-updated date is shown at the top. If the changes are significant, we will announce them separately — for example, in our reply to your request.

11. Contacts

Цветков Алексей Михайлович (Tsvetkov Alexey Mikhailovich), self-employed, NPD taxpayer, INN 771565295596. Data protection enquiries: order@dev-box.ru. Correspondence: admin@dev-box.ru (we do not accept post).