This Privacy Policy (the Policy) describes how information about visitors to circusmaster.ru and its subdomains (the Website) is processed and protected. It applies to all Website pages and functions, including the technical support section.

The Policy has been prepared under the Constitution of the Russian Federation, Federal Law No. 152-FZ of 27 July 2006 On Personal Data, Federal Law No. 149-FZ of 27 July 2006 On Information, Information Technologies and Information Protection, and other applicable laws of the Russian Federation.

General processing of personal data relating to customers, representatives of counterparties and other persons is described in the Personal Data Processing Policy. This Policy specifies those rules for the Website. If the Russian and English texts differ, the Russian text prevails.

1. Data controller

The data controller is Circus Workshops Limited Liability Company (Circus Workshops LLC), Russian taxpayer and registration codes 7704345580/770401001, address: premises 1/1/4, 6/2 Arbat Street, Moscow 119019, Russia.

The controller is listed in the Roskomnadzor Register of Personal Data Controllers under registration number 77-26-542851. The notification was registered on 24 March 2026 under Order No. 141 dated 24 March 2026.

Questions about personal data processing may be sent to info@circusmaster.ru or to the controller's postal address.

2. Principles and legal grounds

The controller processes personal data lawfully and fairly, for specified purposes and only to the extent necessary for those purposes. It keeps data accurate and does not retain data for longer than required by the processing purposes or applicable law.

Processing is based on the data subject's consent; steps requested by the data subject before entering into a contract or performance of a contract; compliance with legal obligations; and the controller's legitimate interests where the data subject's rights and freedoms are not overridden. Consent to personal data processing is obtained separately from other information or documents confirmed or signed by the data subject.

3. Data processed on the Website

  • Ordinary visits: IP address, request date and time, requested page, referring page, browser and device information, server response code and other technical data automatically transmitted by the browser.
  • Equipment lookup by telephone: telephone number, equipment number and the IP address used for request rate limiting.
  • Equipment lookup by QR code: the uploaded image, the equipment identifier extracted from it and the IP address. The QR-code image is not stored in the Website database or media storage and is used only while the request is processed to decode the identifier.
  • After cookie consent and the loading of Yandex Metrica: technical cookie identifiers, IP address, browser and device information, viewed page addresses and referrer, page interactions and Session Replay records, and ecommerce events and goals: product views, cart changes, checkout starts, successful request submissions, telephone-link clicks and PDF openings. Names, telephone numbers, email addresses, comments and other contact details entered into forms are not included in analytics events.
  • When contacting the controller by telephone, email or messenger linked from the Website: name, telephone number, email address, company details, enquiry content, order details and other information voluntarily supplied. Such processing is also governed by the Personal Data Processing Policy.

The controller does not intend to collect special categories of personal data or biometric personal data through the Website. Users should not submit such information or personal data relating to third parties without a lawful basis and proper authority.

4. Processing purposes

  • providing access to the Website and its functions;
  • looking up equipment information and providing technical support;
  • protecting the Website and preventing abuse, attacks and excessive requests;
  • handling enquiries, preparing offers, and entering into and performing contracts;
  • complying with Russian accounting, tax and other legal obligations;
  • responding to data-subject requests and protecting the controller's lawful rights;
  • measuring Website traffic, usability, referral sources and request-funnel steps.

5. Cookies and third-party components

Essential technical cookies may be set without separate consent where they are needed to secure forms, retain the cart or provide a function requested by the visitor. Yandex Metrica, Yandex Maps and other deferred third-party components do not load until the user selects Accept. Closing the notice or continuing to browse without selecting the button is not treated as consent.

  • cm_cookie_consent records cookie consent for up to one year.
  • csrftoken and sessionid are used where necessary to protect forms, retain the cart and maintain a technical session. Their usual lifetimes do not exceed one year and 14 days respectively.
  • Yandex Maps is loaded on the contact page only after consent. Loading the map creates a direct connection between the user's browser and Yandex, which may receive the IP address and browser and device information and may set its own cookies. Yandex processing is governed by the Yandex Privacy Policy and the Yandex Maps Terms of Use.

Yandex Metrica. After consent, counter 111901561 loads with Session Replay, click maps, link tracking and ecommerce enabled. It is used to measure traffic, page interactions and request-funnel steps. The Website sends events for product views, cart additions and removals, checkout starts, successful request submissions, telephone-link clicks and PDF openings. Form fields are marked for masking in Session Replay; names, telephone numbers, email addresses and enquiry text are not included in goal or ecommerce parameters. Yandex processing is governed by the Yandex Privacy Policy and the Yandex Metrica Terms of Use. Yandex and the counter settings determine the service's cookie and data-retention periods.

As of this revision, the Website does not use advertising pixels or provide information for third parties' independent advertising.

Cookie consent can be withdrawn by deleting Website cookies in the browser settings. Third-party components will then remain disabled until consent is given again. Restricting cookies may make some Website functions unavailable.

6. Data disclosure

Personal data is accessible only to employees and contractors who need it for their duties and are bound by confidentiality obligations. Where necessary, data may be disclosed to providers of hosting and technical infrastructure, communications, email and CRM services acting under a contract or the controller's instructions.

When Yandex Maps or Yandex Metrica is loaded, technical data is transmitted directly to Yandex LLC under the applicable service rules. Data may also be disclosed to public authorities and other persons where and as required by Russian law.

The controller does not sell personal data, provide it for third parties' independent advertising, or make it available to the general public without a separate lawful ground.

7. Retention and deletion

  • web-server technical logs are normally retained for no more than 14 days unless longer retention is required to investigate an incident or comply with law;
  • an IP address used in the rate-limiting cache is retained for no more than one minute;
  • the telephone and equipment number entered in the lookup form are not stored as a separate enquiry in the Website's primary database and are processed only for the duration of the request;
  • a QR-code image is not placed in permanent storage and is deleted after the request has been processed;
  • cookie lifetimes are stated in section 5;
  • enquiry, order and contract data is retained until the relevant purpose is achieved, limitation periods and mandatory document-retention periods expire, or consent is withdrawn, unless another lawful ground requires continued processing.

When processing purposes have been achieved, data is deleted or destroyed within the time limits required by Federal Law No. 152-FZ unless further retention is required by law or contract.

8. Localisation and international transfers

When personal data of Russian citizens is collected, its recording, systematisation, accumulation, storage, amendment and retrieval is organised using databases located in the Russian Federation, except where Russian law provides otherwise.

The controller does not intentionally make international transfers of personal data through the Website. Before any such transfer begins, the controller will comply with Article 12 of Federal Law No. 152-FZ and update this Policy where necessary.

9. Data security

The controller takes necessary legal, organisational and technical security measures, including access controls, HTTPS, software updates, backups, security logging, request rate limiting and oversight of persons with data access. Measures are selected with regard to the nature of the data, relevant threats and legal requirements.

No Internet transmission can be guaranteed to be absolutely secure. If an incident is identified, the controller takes steps to limit its consequences, restore security and notify competent authorities and affected persons where required by law.

10. Data-subject rights

Data subjects may obtain information about processing, request rectification, blocking or deletion of their data, withdraw consent, object where permitted by law, and complain to Roskomnadzor or a court.

Requests may be sent to info@circusmaster.ru or to the controller's postal address. To protect personal data, the controller may request information necessary to verify the applicant's identity and authority. Responses are provided within the statutory time limits, normally within 10 business days, with a reasoned extension of no more than five business days where permitted by law.

Withdrawal does not affect processing lawfully carried out before the withdrawal and does not stop processing supported by another lawful ground.

11. Children

The Website is not specifically intended to collect children's data. If the controller learns that a child's data has been supplied without proper consent from a legal representative, it will delete the data unless another lawful ground applies.

12. Policy updates

The controller reviews this Policy when laws, data processing or Website functions change. The current version is permanently available on this page. Its revision date appears at the top of the page.