Privacy Policy

Introduction

The personal data operator whose activities are described in this document is Nordic Star – Polyarnaya Zvezda Law Offices, St. Petersburg (the “Nordic Star Law Offices”), a legal entity incorporated under the laws of the Russian Federation, with its registered address at: Premises 14-N, Building 1-3, Letter A, Malaya Konyushennaya Street, Municipal Okrug Dvortsovy Okrug, St. Petersburg, 191186, Russian Federation; Primary State Registration Number (OGRN): 1227800072840; Taxpayer Identification Number (INN): 7841099128.

In this Policy, the terms “we”, “us”, “our” and similar expressions refer to Nordic Star Law Offices, St. Petersburg. The terms “you”, “your” and similar expressions refer to the personal data subject whose information is processed by us.

This Policy describes the procedures for processing personal data collected or otherwise processed through the website https://fashion-law.ru/ (the “Website”) or through the contact details published on the Website. This Policy does not apply to personal data processing activities that do not concern Website users.

The confidentiality of your personal data is important to us. This Policy is intended to inform Website visitors and other individuals about how we process and protect personal data. Through this document, we seek to provide all interested persons with information about how we process and protect personal data. If you have reason to believe that we process your personal data, we recommend that you review this Policy.

Please review this Policy before using the Website or any other resources made available through it. By using the Website, you confirm that you have reviewed this Policy in full before commencing such use.

Terms used in this Policy that are not separately defined herein, including “personal data” and “personal data processing”, have the meanings assigned to them under the legislation of the Russian Federation and, in particular, Federal Law No. 152-FZ of 27 July 2006 “On Personal Data

Purposes, Categories and Legal Grounds for Processing Personal Data

Personal data shall be processed solely for the specific purposes for which they were provided. These purposes are set out in detail in Appendix 1. For those purposes, personal data may be entered into information systems, stored and otherwise processed by lawful means.

Upon achievement of the purpose of personal data processing, where the need to achieve that purpose no longer exists, upon expiry of the period specified in the personal data subject’s consent, or upon expiry of any other period prescribed by law, the relevant personal data shall be destroyed, unless a different procedure for their storage and destruction is established by federal law.

Any information that you voluntarily provide in addition to the information required for the relevant processing purpose shall be destroyed or blocked after your request has been considered or after any other interaction with you has been completed.

The Website does not collect or otherwise process biometric personal data or special categories of personal data, including information concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, or health data.

Principles of Personal Data Processing

We process personal data on the basis of the following principles:

Personal data are processed lawfully and fairly;
Personal data are processed solely for specific, predetermined and lawful purposes;
Personal data may not be processed for purposes that are incompatible with or contrary to the purposes for which such data were collected;
Databases containing personal data may not be combined where the processing carried out in those databases is performed for mutually incompatible purposes;
Only personal data that are necessary for, and relevant to, the stated processing purposes are processed;
The content and volume of personal data processed must correspond to the stated processing purposes and must not be excessive in relation to those purposes;
The accuracy, adequacy and, where necessary, up-to-dateness of personal data in relation to the processing purposes are ensured. Measures are taken to erase or rectify incomplete or inaccurate personal data;
Personal data are retained in a form that permits identification of you or another personal data subject for no longer than is necessary for the processing purposes, unless a different retention period is established by federal law, consent to the processing of personal data, or an agreement to which the personal data subject is a party, beneficiary or guarantor;
Personal data being processed shall be destroyed upon achievement of the processing purposes or where the need to achieve those purposes no longer exists, unless otherwise provided by federal law;
The processing of personal data is not intended to cause pecuniary or non-pecuniary harm to personal data subjects and may not be used to unjustifiably restrict their rights and freedoms.

Where We Store and How We Protect Personal Data

We process personal data both with and without the use of automated means, including by collecting, recording, systematising, accumulating, storing, updating, using, retrieving, blocking, transferring (to a limited extent), erasing and destroying such data.

When processing personal data using automated means, we implement organisational, legal and technical measures designed to prevent unauthorised access to personal data by persons who are not authorised to process it. These measures include, among other things:

modelling threats to the security of personal data;
maintaining a security regime for premises housing personal data information systems to prevent unauthorised or uncontrolled access to, or presence in, those premises;
determining the list of persons whose access to personal data is necessary for the performance of their official duties;
managing access to personal data, including through password-protection measures;
monitoring the security of personal data, including the installation of software updates;
ensuring the availability of personal data, including by creating backup copies at regular intervals;
implementing malware protection and antivirus protection for personal data information systems; and
other measures required by applicable law.

When collecting personal data of citizens of the Russian Federation, including through the Internet, Nordic Star Law Offices shall ensure that the recording, systematisation, accumulation, storage, updating (including amendment), and retrieval of such personal data are carried out using databases located in the Russian Federation, unless otherwise provided for by the legislation of the Russian Federation.

Transfer and Disclosure of Personal Data to Third Parties

We do not disclose the personal data of clients and other persons to third parties, unless such disclosure is required in accordance with applicable law, for the performance of contracts with counterparties or for the provision of legal services to our clients. In other cases, your personal data may be transferred to third parties only on the basis of your prior consent, provided at your request. At the same time, in the course of our business activities involving the processing of personal data, we may use the services of third-party providers (hosting providers, technical support service providers). In this regard, personal data may be transferred to contractors processing personal data on our behalf when providing us with the relevant services. We ensure that all such providers enter into data processing agreements with us, pursuant to which they take the legal, organisational and technical measures necessary to ensure the protection of your personal data.

The provision of personal data to state authorities (including within the framework of submitting accounting, tax and other reporting) shall be carried out in accordance with the requirements of applicable law.

Your Rights as a Personal Data Subject

Withdrawal of consent to the processing of personal data

Where we process your personal data on the basis of your consent, you may withdraw that consent at any time. In particular, you may opt out of marketing communications at any time by contacting us at flr@nordicstar.law

Access to information about the processing of your personal data

You have the right to access information relating to the processing of your personal data by submitting a written request for the following information:

confirmation that personal data are being processed;
the legal grounds for and purposes of the processing of personal data;
the methods used to process personal data;
information about persons that have access to personal data or to whom personal data may be disclosed under an agreement with us or federal law;
the personal data being processed that relate to you and the source from which they were obtained, unless otherwise provided by law;
the period for which personal data are processed, including the retention period;
the procedure for exercising rights provided for by law;
information about the location of the database containing personal data;
the name, or the surname, first name, patronymic and address, of a person processing personal data on our behalf, where processing has been or will be entrusted to that person;
any other information required by law.

The request must include the number of the principal identity document of you or your representative, information on its date of issue and issuing authority, and information confirming that we process the relevant personal data. The request must also be signed by you or your representative.

We will send a response within 10 (ten) business days after receiving the request. We may extend this period by up to 5 (five) business days, in which case we will provide you with a written explanation of the reasons for the extension.

Restriction of dissemination of personal data permitted for dissemination

If your personal data are processed as Disseminable Personal Data, you have the right to set conditions and restrictions on their dissemination, including by limiting the categories of persons to whom such personal data may be provided, disclosed or made accessible.

Prior determination of the method and conditions of dissemination

If you have consented to the dissemination of Disseminable Personal Data, you have the right to determine in advance the method, conditions and scope of such dissemination, including the categories of personal data, the categories of recipients and the channels through which the data may be made available.

Withdrawal of Consent to Dissemination

If you have previously consented to the dissemination of Disseminable Personal Data, you may withdraw that consent at any time and require the cessation of any further dissemination of the relevant personal data.

Rectification, blocking or destruction of personal data

You may require us to rectify, block or destroy your personal data if such data are incomplete, outdated, inaccurate, unlawfully obtained or no longer necessary for the stated processing purpose. While we review your request, we may temporarily suspend the processing of your personal data.

If the personal data we process are found to be inaccurate, we will rectify them within 7 (seven) business days after receiving information confirming the inaccuracy. We will resume processing your personal data upon receipt of your consent to continue the processing.
If unlawful processing of personal data is identified, we will remedy the breach within 3 (three) business days after identifying it. If the breach cannot be remedied, we will destroy the personal data within 10 (ten) business days after identifying the unlawful processing.
If you withdraw your consent to the processing of personal data, we will cease processing and destroy your personal data within 30 (thirty) calendar days, unless otherwise provided for by an agreement to which you are a party or by applicable legal requirements.

Challenging actions of the Personal Data Operator

You have the right to challenge in court any action or omission by us in connection with the processing and protection of personal data, as well as to take any other measures available under applicable law to protect your rights. If you believe that the manner in which we process your personal data violates applicable law, you may also file a complaint with the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor).

Requests regarding personal data processing: how you can contact us

If you have any questions regarding this Policy or the processing of your personal data, please contact us by email at flr@nordicstar.law or send us a request to the address: 191186, Saint Petersburg, Malaya Konyushennaya St., 1/3 A, B34.

A response to the request will be sent by us within 10 (ten) business days from the moment of its receipt. This period may be extended by 5 (five) business days, in which case we will send you a written explanation of the need for such extension.

Review and Amendment of this Policy

We reserve the right to amend the Policy. We recommend that you review this Policy from time to time for any changes.

Terms Governing the processing of Disseminable Personal Data

The Website contains information about our personnel, including their personal data. Personal data posted on the Website are accessible to an unlimited number of persons. Our employees have not imposed any conditions or restrictions on the processing by an unlimited number of persons of personal data permitted for dissemination and posted on the Website.

Appendix 1. List of Processed Personal Data

1. Recruitment

Purpose of processing	Recruitment
Categories of personal data	Surname, first name, patronymic Date of birth and place of birth Gender Citizenship Residential address and registration address Contact telephone numbers Email addresses Place of work and position held Information on previous places of work Information on education Information on marital status Information on social media accounts Information on interests Information on business and personal qualities Photograph Other personal data specified by the applicant in the CV or cover letter
Categories of Personal Data Subjects	Applicants
Legal Basis for Processing	The processing of personal data is necessary for entering into a contract at the initiative of the personal data subject or for entering into a contract under which the personal data subject will be a beneficiary.
Methods of processing	Collection, recording, systematisation, accumulation, storage, rectification (including updating and amendment), retrieval, use, transfer (including provision of and access to personal data), blocking, deletion and destruction. Processing is carried out in a mixed manner (both automated and without the use of automation means).
Retention Period	Until an employment contract is concluded or for 30 days following a refusal to enter into an employment contract, whichever occurs first, in accordance with Part 4 of Article 21 of Federal Law No. 152-FZ.
Procedure for destruction	Destruction of personal data from information systems using the standard means of the respective system; in the case of paper media — their shredding or destruction by other means precluding the recovery of data

2. Website analytics to improve Website performance and assess the effectiveness of marketing campaigns

Purpose of processing	Website analytics to improve Website performance and assess the effectiveness of marketing campaigns
Categories of personal data	Location data (country and region); Operating system type and version; Browser type and version; Device type and screen resolution; Traffic source (the referring website or advertisement); Operating system and browser language; User activity data on the Website, including page views, navigation paths, session duration, clicks and analytics events; IP address This data is used only to the extent necessary for analytics and is not used to identify an individual Website user.
Categories of Personal Data Subjects	Website visitors
Legal Basis for Processing	The processing of personal data is limited to information necessary to analyse Website traffic and improve Website performance; no other data are processed.
Methods of processing	Collection, recording, systematisation, accumulation, storage, rectification (including updating and amendment), retrieval, use, transfer (including provision of and access to personal data), blocking, deletion and destruction. Processing is carried out in a mixed manner (both automated and without the use of automation means).
Retention Period	Until the Website is no longer operated and/or used.
Procedure for destruction	Destruction of personal data from information systems using the standard means of the respective system; in the case of paper media — their shredding or destruction by other means precluding the recovery of data

3. Entering into and performing contracts with counterparties in the context of civil-law relations

Purpose of processing	Entering into and performing contracts with counterparties in the context of civil-law relations
Categories of personal data	Surname, first name, patronymic Citizenship Gender Date and place of birth INN (Taxpayer Identification Number) SNILS (Insurance Number of Individual Ledger Account) Passport details Information on income Residential address and registration address Bank account details Data of the certificate of registration as an individual entrepreneur (if available) Telephone numbers Email addresses Information on the position held Information on the place of work
Categories of Personal Data Subjects	Counterparties and their representatives
Legal Basis for Processing	-The processing of personal data is necessary for the performance of a contract to which the personal data subject is a party or under which the personal data subject is a beneficiary or guarantor; or for entering into a contract at the initiative of the personal data subject or a contract under which the personal data subject will be a beneficiary or guarantor. - Processing of personal data of representatives of counterparties is necessary for the exercise of the rights and legitimate interests of the operator
Methods of processing	Collection, recording, systematisation, accumulation, storage, rectification (including updating and amendment), retrieval, use, transfer (including provision of and access to personal data), blocking, deletion and destruction. Processing is carried out in a mixed manner (both automated and without the use of automation means).
Retention Period	Until the relevant contract with the counterparty terminates or a decision is made not to enter into it, and thereafter for the document-retention periods prescribed by accounting and tax legislation and by other mandatory legal requirements applicable to the relevant relationship.
Procedure for destruction	Destruction of personal data from information systems using the standard means of the respective system; in the case of paper media — their shredding or destruction by other means precluding the recovery of data

4. Reviewing enquiries, communicating with the individual making the enquiry, conducting a preliminary assessment of the enquiry, corresponding with that individual, and deciding whether further engagement is possible.

Purpose of processing	Reviewing enquiries, communicating with the individual making the enquiry, conducting a preliminary assessment of the enquiry, corresponding with that individual, and deciding whether further engagement is possible.
Categories of personal data	Surname, first name, patronymic, if provided Telephone number Email address Information on the place of work and position, if provided Content of the request Other personal data voluntarily disclosed in the request or attached materials
Categories of Personal Data Subjects	Website visitors, prospective clients, representatives of organisations and other individuals who submit enquiries using the email address published on the Website.
Legal Basis for Processing	The processing of personal data is necessary for the exercise of the rights and legitimate interests of the operator
Methods of processing	Collection, recording, systematisation, accumulation, storage, rectification (including updating and amendment), retrieval, use, transfer (including provision of and access to personal data), blocking, deletion and destruction. Processing is carried out in a mixed manner (both automated and without the use of automation means).
Retention Period	For the period necessary to review the enquiry, conduct correspondence and decide on further engagement, and thereafter for 3 years after the correspondence is completed or a decision is made not to proceed with further engagement, unless otherwise required by law. For information necessary for the resolution of disputes, the processing period is limited to the applicable general limitation period.
Procedure for destruction	Destruction of personal data from information systems using the standard means of the respective system; in the case of paper media — their shredding or destruction by other means precluding the recovery of data

5. Promotion of the operator's services

Purpose of processing	Promotion of the operator's services
Categories of personal data	Surname, first name, patronymic Telephone number Email address Information on the position held Information on the place of work
Categories of Personal Data Subjects	Prospective counterparties and their representatives
Legal Basis for Processing	- Consent to the processing of personal data. - The processing of personal data is necessary for the exercise of the rights and legitimate interests of the operator.
Methods of processing	Collection, recording, systematisation, accumulation, storage, rectification (including updating and amendment), retrieval, use, transfer (including provision of and access to personal data), blocking, deletion and destruction. Processing is carried out in a mixed manner (both automated and without the use of automation means).
Retention Period	Until the termination of the operator's activities
Procedure for destruction	Destruction of personal data from information systems using the standard means of the respective system; in the case of paper media — their shredding or destruction by other means precluding the recovery of data

6. Processing of personal data of employees and other individuals acting on behalf of the Operator on the basis of contracts, for the purpose of information support of the Operator's activities, organisation and implementation of external communications, including participation in public events, preparation and placement of materials in the Operator's official sources, including on the website, in social networks and messengers

Purpose of processing	Processing of personal data of employees and other individuals acting on behalf of the Operator on the basis of contracts, for the purpose of information support of the Operator's activities, organisation and implementation of external communications, including participation in public events, preparation and placement of materials in the Operator's official sources, including on the website, in social networks and messengers
Categories of personal data	Surname, first name, patronymic Email address Telephone number Profession Position Information on education Current and previous places of work Information on professional achievements Photographs Video images City of business activity
Categories of Personal Data Subjects	Employees, advocates and other individuals representing the Operator at public events, business meetings, interviews, presentations, on the website, in social networks, messengers and other channels of external communications of the Operator
Legal Basis for Processing	Consent to the processing of personal data
Methods of processing	Collection, recording, systematisation, accumulation, storage, rectification (including updating and amendment), retrieval, use, transfer (including provision of and access to personal data), blocking, deletion, destruction and dissemination. Processing is carried out in a mixed manner (both automated and without the use of automation means).
Retention Period	Until the relevant resource is no longer used or the publication ceases to be relevant, provided that the consent to the processing of personal data remains valid.
Procedure for destruction	Destruction of personal data from information systems using the standard means of the respective system; in the case of paper media — their shredding or destruction by other means precluding the recovery of data

Last updated: 24 August 2026