This Privacy Policy describes how Circus Workshops LLC processes data when operating circusmaster.ru and its subdomains, including the technical support section.
The Policy is prepared under Russian Federal Law No. 152-FZ of 27 July 2006 On Personal Data, Federal Law No. 149-FZ of 27 July 2006 On Information, Information Technologies and Information Protection, and other applicable Russian laws. General rules for customers, representatives of counterparties and other persons are set out in the Personal Data Processing Policy. This Policy specifies those rules for the Website. If the Russian and English texts differ, the Russian text prevails.
1. Controller
The personal data controller is Circus Workshops Limited Liability Company (Circus Workshops LLC), INN/KPP 7704345580/770401001, address: premises 1/1/4, 6/2 Arbat Street, Moscow 119019, Russia.
The controller is listed in the Roskomnadzor Register of Personal Data Controllers under registration number 77-26-542851. The notification was registered on 24 March 2026 under Order No. 141 dated 24 March 2026.
Personal data requests may be sent to info@circusmaster.ru or to the controller's postal address.
2. Data processed by the Website
- Ordinary visits: IP address, request date and time, page address, referring page, browser and device information, server response code and other technical data sent by the browser to connect to the Website.
- Equipment lookup by telephone: telephone number, equipment number and the IP address used for rate limiting.
- Equipment lookup by QR code: uploaded image, extracted equipment identifier and IP address. The QR-code image is not stored in the Website database or media storage and is used only to decode the request.
- After cookie consent: technical cookie identifiers and data available to enabled third-party components.
- When contacting by telephone, email or messenger: name, telephone number, email address, company details, enquiry content, order details and other information voluntarily provided by the user.
The Website is not intended to collect special categories of personal data, biometric personal data or data of minors. Do not submit such information or third-party personal data without a lawful basis and authority.
3. Purposes and legal grounds
- Website operation: providing access to pages and functions, protecting against abuse and technical failures. Legal ground: lawful interests of the controller and user.
- Technical support: looking up equipment information, processing QR codes and limiting excessive requests. Legal ground: user request and lawful interests of the controller.
- Enquiries and communication: responding to enquiries, preparing offers, arranging rental, sale, delivery, installation or service. Legal ground: steps requested before a contract, contract performance or consent.
- Documents and accounting: preparing and retaining order and contract documents. Legal ground: the controller's obligations under Russian law.
- Rights and security: handling data-subject requests, protecting the controller's rights and investigating incidents. Legal ground: law and lawful interests of the controller.
4. Cookies and third-party components
Before the user selects Accept, the Website does not store cookies on the user's device or load deferred third-party components. Closing the notice or continuing to browse without selecting the button is not treated as consent.
- cm_cookie_consent records cookie consent for up to one year.
- csrftoken and sessionid are used after consent to protect forms, maintain a technical session and operate Website functions. Their usual lifetimes do not exceed one year for csrftoken and 14 days for sessionid.
- Yandex Maps is loaded on the contact page only after consent. Loading the map connects the browser to Yandex. Yandex may receive the IP address and browser and device information and may set its own cookies. Yandex processing is governed by the Yandex Privacy Policy and the Yandex Maps Terms of Use.
As of this revision, the Website does not use advertising cookies, advertising pixels or web analytics systems. The controller will update this Policy and the consent mechanism before introducing such technologies.
Cookie consent can be withdrawn by deleting Website cookies in browser settings. Third-party components will then remain disabled until consent is given again. Restricting cookies may disable some Website functions.
5. Data disclosure
Personal data is accessible to the controller's employees and contractors who need it for their duties. Where necessary, data may be processed by hosting, technical infrastructure, communication, email, CRM and other information-system providers under a contract or the controller's instructions. The controller remains responsible to the data subject for processor actions.
When Yandex Maps is loaded, technical data is transmitted directly to Yandex LLC under its service rules. Data may also be disclosed to public authorities and other persons where required by Russian law.
The controller does not sell personal data, provide it for third-party independent advertising or make it available to the general public without a separate lawful ground.
6. Retention periods
- web-server technical logs are usually retained for no more than 14 days unless longer retention is needed to investigate an incident, protect rights or comply with law;
- an IP address in the rate-limiting cache is used for no more than one minute;
- the telephone and equipment number from the lookup form are not stored as a separate enquiry and are processed only during the request;
- a QR-code image is not placed in permanent storage and is deleted after processing;
- cookie lifetimes are stated in section 4;
- enquiry, order and contract data is retained until the purpose is achieved, mandatory document-retention periods and limitation periods expire, or consent is withdrawn, unless another lawful ground applies.
After the processing purpose is achieved, the controller stops processing and destroys personal data within the statutory period unless a contract or law requires further retention.
7. Localisation and international transfers
When personal data of Russian citizens is collected, its recording, systematisation, accumulation, storage, amendment and retrieval are performed using databases located in Russia, except where Russian law provides otherwise.
The Website does not intentionally transfer personal data across borders. Before any such transfer begins, the controller will comply with Article 12 of Federal Law No. 152-FZ and update this Policy where necessary.
8. Security and incidents
The controller uses legal, organisational and technical measures: access control, HTTPS, software updates, backups, security logging, request rate limiting and oversight of persons with data access. Measures are selected according to the data, threats and legal requirements.
If unlawful or accidental transfer, disclosure, distribution or access to personal data is detected, the controller takes steps to limit consequences and notifies Roskomnadzor where and within the time limits required by Federal Law No. 152-FZ.
9. Data-subject rights
Data subjects may obtain information about processing, access their data, request correction, blocking or deletion, withdraw consent, request termination of processing where permitted by law, and complain to Roskomnadzor or a court.
Requests may be sent to info@circusmaster.ru or to the controller's postal address. To protect data, the controller may request information confirming the applicant's identity and authority.
The controller responds to access requests within 10 business days. This period may be extended by no more than five business days with a reasoned notice. Inaccurate data is corrected, and unlawfully obtained or excessive data is destroyed within the periods set by Federal Law No. 152-FZ.
10. Policy updates
The controller updates this Policy when laws, data categories, Website functions or processing activities change. The current version is published on this page. The revision date appears at the top of the page.