1. General provisions
This Personal Data Processing Policy explains how Circus Workshops LLC processes and protects personal data of customers, prospective customers, representatives of counterparties, Website visitors and other persons who contact the controller.
The Policy is prepared under Russian Federal Law No. 152-FZ of 27 July 2006 On Personal Data and other applicable Russian laws. It defines processing purposes, data-subject and data categories, processing methods and periods, destruction procedure and data-subject rights. If the Russian and English texts differ, the Russian text prevails.
Controller: Circus Workshops LLC, INN/KPP 7704345580/770401001, address: premises 1/1/4, 6/2 Arbat Street, Moscow 119019, Russia, email: info@circusmaster.ru.
The controller is listed in the Roskomnadzor Register of Personal Data Controllers under registration number 77-26-542851. The notification was registered on 24 March 2026 under Order No. 141 dated 24 March 2026.
2. Processing principles
The controller processes personal data lawfully, fairly and only for specified purposes. The controller does not combine databases with incompatible purposes, does not process excessive data, keeps data accurate and does not retain it longer than required by the purpose, contract or law.
Where separate consent is required by law, the controller obtains it separately from other documents and user actions. Silence or inaction is not used as consent to personal data processing.
3. Data subjects and data categories
The controller processes data of prospective and current customers, lessees, buyers, service customers, representatives of legal entities, contact persons, Website visitors, job applicants and other persons who contact the controller or participate in contractual relations with it.
- full name;
- telephone number, email address, postal address and other contact details;
- company name, position, representative authority, tax number or counterparty details where needed for a contract or documents;
- order, contract, rental, purchase, delivery, installation, payment, deposit, equipment return and claim details;
- correspondence, comments, files and information voluntarily provided to answer a request or perform a contract;
- Website technical data: IP address, request date and time, browser and device data, cookies after consent to their use.
The controller does not request special categories of personal data or biometric personal data for ordinary Website, rental, sale or service processes. If a data subject sends such data without request, the controller deletes it unless a lawful ground for processing exists.
4. Processing purposes
- receiving and handling enquiries;
- preparing estimates, commercial proposals and responses;
- entering into, performing, changing and terminating rental, sale, delivery, installation, service and other contracts;
- organising delivery, installation, dismantling, equipment return, deposit settlement and claim handling;
- maintaining accounting, tax, contract and claims records;
- operating and protecting the Website, forms, CRM and communication channels;
- complying with requests of public authorities and Russian law;
- protecting the rights and lawful interests of the controller, customers and third parties;
- communicating about future cooperation and new offers where consent exists and is required by law.
5. Legal grounds
The controller processes personal data on the basis of consent, to enter into a contract at the data subject's request or perform a contract with the data subject, to comply with legal obligations, to protect life and health in exceptional cases, to exercise rights and lawful interests of the controller or third parties where this does not violate the data subject's rights and freedoms, and on other grounds provided by Federal Law No. 152-FZ.
Where data is needed to respond to an enquiry, prepare a contract, perform an order, deliver, install or return equipment, refusal to provide it may make the relevant action impossible.
6. Processing operations
The controller collects, records, organises, accumulates, stores, updates, retrieves, uses, transfers in the cases described by this Policy, anonymises, blocks, deletes and destroys personal data. Processing may be automated or non-automated.
The controller does not make decisions producing legal consequences for a data subject or otherwise affecting their rights solely on the basis of automated personal data processing.
7. Disclosure and processing instructions
The controller does not make personal data publicly available or provide access to an unlimited number of persons. Data may be transferred with consent, to perform a contract or request, where required by law, for accounting, banking, logistics, technical, postal, communication and CRM support, and to protect the controller's rights.
Processors act under a contract or instruction. Such contract defines data categories, operations, purposes, confidentiality duties, protection measures and the procedure for confirming compliance with Law No. 152-FZ.
The controller remains responsible to the data subject for processor actions. The processor is responsible to the controller.
8. Localisation and international transfers
When personal data of Russian citizens is collected, its recording, systematisation, accumulation, storage, amendment and retrieval are performed using databases located in Russia, except where Russian law provides otherwise.
The controller does not intentionally transfer personal data across borders in ordinary Website, rental, sale or service processes. Before any such transfer begins, the controller will comply with Article 12 of Federal Law No. 152-FZ and update this Policy where necessary.
9. Retention and destruction
Personal data is processed until the purpose is achieved, consent expires, the contract ends, mandatory document-retention periods and limitation periods expire, or consent is withdrawn, unless another lawful ground requires continued processing.
After the purpose is achieved, the controller stops processing and destroys personal data within no more than 30 days unless a contract or law requires further retention. After consent withdrawal, the controller stops processing and destroys data within no more than 30 days where retention is no longer needed and no other lawful ground applies.
If a data subject requests termination of processing, the controller considers the request within the statutory period. If immediate destruction is impossible, the controller blocks the data and destroys it within the period required by Federal Law No. 152-FZ.
10. Data security
The controller uses legal, organisational and technical measures: appoints responsible persons, limits access, informs employees about Law No. 152-FZ and internal documents, uses secure connections, manages access rights, keeps security logs, creates backups, controls contractors and checks compliance with processing rules.
If an incident involving unlawful or accidental transfer, disclosure, distribution or access to personal data occurs, the controller limits consequences, conducts an internal review and notifies Roskomnadzor within the periods required by Federal Law No. 152-FZ.
11. Data-subject rights
Data subjects may obtain confirmation and information about processing, access their personal data, request correction, blocking or deletion of incomplete, outdated, inaccurate, unlawfully obtained or excessive data, withdraw consent, request termination of processing where permitted by law, and complain to Roskomnadzor or a court.
Requests may be sent to info@circusmaster.ru or to the controller's postal address. State your full name, contact method, details confirming your relationship with the controller or processing of your data, and the substance of the request. The controller may request additional information to verify identity and authority.
The controller responds to access requests within 10 business days. This period may be extended by no more than five business days with a reasoned notice. Inaccurate data is corrected within seven business days after supporting information is received. Unlawfully obtained or excessive data is destroyed within the period required by Federal Law No. 152-FZ.
12. Cookies and Website
When the Website is used, the browser sends technical data required for connection and security. Before the cookie notice is accepted, the Website does not store cookies on the user's device or load deferred third-party components. After consent, technical cookies required for forms and Website functions are used. Users can delete cookies through their browser settings.
13. Policy updates
The controller updates this Policy when laws, data categories, purposes or processing activities change. A new version applies once published on the Website. The current version is available through the Website footer.