Personal data processing policy

1.1. This Policy on the processing of personal data (the Policy) sets out the procedure for processing personal data and the security measures taken by Individual entrepreneur Shepitko Mariia Mikhailovna (the Operator). It is issued pursuant to clause 2, part 1, article 18.1 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”.

1.2. The Policy is drawn up in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ, Federal Law No. 149-FZ of 27 July 2006 “On Information, Information Technologies and the Protection of Information”, Decrees of the Government of the Russian Federation No. 1119 of 1 November 2012 and No. 687 of 15 September 2008, and other regulations on personal data.

1.3. The Policy applies to all personal data the Operator receives from data subjects on the website batmeleh.com, including its English version in the /en/ section, and in correspondence by email and telephone.

1.4. Operator details:

1.5. The Policy is a public document and is freely available at batmeleh.com/en/legal/personal-data-policy/. The current version was approved on 5 September 2026.

The Policy uses the terms defined in article 3 of Federal Law No. 152-FZ, in particular:

• personal data — any information relating to a directly or indirectly identified or identifiable natural person (the data subject);
• operator — the person who organises and (or) carries out the processing of personal data and who determines the purposes of processing, the composition of the data and the actions performed with it;
• processing — any action or set of actions performed on personal data with or without the use of automation;
• automated processing — processing by means of computing equipment;
• dissemination — actions aimed at disclosing data to an indefinite circle of persons;
• provision — actions aimed at disclosing data to a particular person or a defined circle;
• blocking — temporary suspension of processing, except where processing is needed to correct the data;
• destruction — actions after which the content of the data cannot be restored in the information system and (or) the physical media are destroyed;
• depersonalisation — actions after which it is impossible to attribute the data to a particular subject without additional information;
• cross-border transfer — transfer of personal data to a foreign state authority, a foreign natural person or a foreign legal entity.

The Operator processes personal data on the principles laid down in article 5 of Federal Law No. 152-FZ:

• processing is lawful and fair;
• processing is limited to achieving specific, predetermined and lawful purposes; processing incompatible with the purposes of collection is not permitted;
• databases whose processing purposes are incompatible with one another are not merged;
• only data matching the purposes of processing is processed;
• the content and volume of the data correspond to the stated purposes; excess data is not permitted;
• the data is accurate, sufficient and, where necessary, up to date; the Operator takes steps to delete or correct incomplete or inaccurate data;
• data is stored in a form allowing the subject to be identified no longer than the purposes require, unless a retention period is set by law or contract; once the purposes are achieved the data is destroyed or depersonalised.

4.1. The Operator processes personal data on the following legal grounds:

• the data subject’s consent to the processing of their personal data (clause 1, part 1, article 6 of 152-FZ) — the text of the consent is published at batmeleh.com/en/legal/consent/;
• the subject’s consent to the processing of personal data authorised for dissemination (article 10.1 of 152-FZ) — for the details the subject sends for publication on the forum and in comments;
• performance of a contract to which the data subject is a party — the site’s terms of use (clause 5, part 1, article 6 of 152-FZ);
• compliance with duties imposed on the Operator by the law of the Russian Federation (clause 2, part 1, article 6 of 152-FZ);
• the exercise of the Operator’s rights and legitimate interests where this does not infringe the subject’s rights and freedoms (clause 7, part 1, article 6 of 152-FZ) — for keeping the site secure and preventing abuse.

4.2. The Operator’s constitutive documents, the contracts concluded between the Operator and data subjects and this Policy are also legal grounds for processing.

No processing is carried out for other purposes incompatible with those listed.

6.1. The Operator processes the personal data of the following categories of subjects:

• unregistered visitors — to the extent needed to run the site and in respect of the data they voluntarily enter in feedback forms;
• registered users of the site;
• participants of the Operator’s meetings, classes and events;
• persons who contact the Operator by email or telephone.

6.2. The list of personal data processed is given in section 5. Processing is kept to the minimum necessary.

6.3. The Operator does not process special categories of personal data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, health or sex life (article 10 of 152-FZ), nor biometric personal data (article 11 of 152-FZ). If a subject volunteers such details in the free text of an enquiry, they are processed only to the extent needed to consider that enquiry, are not systematised and are not used for any other purpose.

6.4. The Operator does not process the personal data of minors without the consent of their legal representatives.

6.5. The Operator does not process personal data to promote third-party goods, works or services and takes no decisions producing legal effects concerning a subject solely on the basis of automated processing (article 16 of 152-FZ).

7.1. Personal data is processed in a mixed manner: with the use of automation and, when data is passed through the Operator’s internal channels, without it.

7.2. The Operator performs the following actions with personal data: collection, recording, systematisation, accumulation, storage, updating and amendment, retrieval, use, transfer (provision, access), depersonalisation, blocking, deletion and destruction.

7.3. Personal data is collected when the subject fills in forms on the site, registers an account or writes by email, and automatically in respect of the technical details sent by the browser.

7.4. Location of the databases. The recording, systematisation, accumulation, storage, updating and retrieval of the personal data of citizens of the Russian Federation are carried out using databases located in the Russian Federation (part 5, article 18 of 152-FZ). The hosting facility is JSC IOT, Moscow, Skolkovo Innovation Centre (Russia).

7.5. Transfer of personal data. The Operator may entrust the processing of personal data to another person with the subject’s consent, under a contract listing the actions, the purposes of processing and the duty to keep the data confidential and secure (part 3, article 6 of 152-FZ). Personal data may be provided to:

• the hosting provider (JSC IOT, Moscow, Skolkovo Innovation Centre (Russia)) — to the extent needed to host the site and its database;
• the email provider — the recipient’s address and the content of the letter;
• the operator of the Telegram messenger — the username and the content of the answer, if the subject chose that channel;
• state and municipal authorities — on reasoned requests made in accordance with the law of the Russian Federation.

7.6. Cross-border transfer. The Operator carries out no cross-border transfer of personal data, except for passing a username and the text of an answer to the operator of the Telegram messenger on the express instruction of a subject who chose that channel. Notice of the intention to carry out a cross-border transfer is filed with Roskomnadzor under article 12 of 152-FZ before such transfer begins. A subject may choose to receive the answer by email and thereby avoid the transfer.

7.7. Dissemination. The Operator makes public only the data the subject sends for publication: the name or pen name, the profile picture, the content of forum posts and comments and, where the subject ticks the relevant box, the text of a question to the rabbi and the author’s name. Consent to dissemination is obtained separately from other consents (part 6, article 10.1 of 152-FZ) and may be withdrawn at any moment — on the subject’s demand the Operator stops the dissemination within three working days.

7.8. Confidentiality. The Operator and persons who have obtained access to personal data must not disclose it to third parties or disseminate it without the subject’s consent, unless the law provides otherwise (article 7 of 152-FZ).

8.1. Personal data is processed until the purposes of processing are achieved or until the subject withdraws consent.

8.2. Once the purposes are achieved, or upon withdrawal of consent, personal data is destroyed or depersonalised within thirty days, unless another period is set by law or contract (parts 4 and 5 of article 21 of 152-FZ). The destruction is recorded in a deed.

8.3. If unlawful processing is discovered, the Operator stops it — or ensures that the person acting on its instruction stops it — within three working days; where the breach cannot be remedied, the data is destroyed within ten working days (parts 3 and 3.1 of article 21 of 152-FZ).

9.1. The data subject is entitled to the information listed in part 7 of article 14 of 152-FZ: confirmation of the fact of processing, the legal grounds and purposes, the methods used, the name and location of the Operator, details of the persons with access to the data, the list of data processed and its source, the processing and retention periods, the procedure for exercising the subject’s rights, information on any cross-border transfer carried out or intended, and the name of any person processing the data on the Operator’s instruction.

9.2. The subject may demand that their data be corrected, blocked or destroyed if it is incomplete, out of date, inaccurate, unlawfully obtained or unnecessary for the stated purpose, and may take the measures provided by law to protect their rights (part 1, article 14 of 152-FZ).

9.3. The subject may withdraw at any moment their consent to processing and their consent to the processing of data authorised for dissemination.

9.4. The subject may object to processing for promotional purposes and refuse to receive newsletters.

9.5. The subject may appeal against the Operator’s acts or omissions to the authorised body for the protection of data subjects’ rights (Roskomnadzor) or in court.

9.6. How to make a request. Requests are sent to batmelekh@yandex.com or by post to 117545, Russia, Moscow, Podolskikh Kursantov street 6, building 3, flat 83. A request must contain the number of the main identity document of the subject or their representative, the date it was issued and the issuing authority, information confirming the subject’s relationship with the Operator (a contract number, the date of an enquiry or other details) or otherwise confirming the fact of processing, and the signature of the subject or their representative. A request may be sent electronically and signed with an electronic signature.

9.7. The Operator considers the request and provides the information within ten working days of the enquiry; the period may be extended by no more than five working days, with notice to the subject stating the reasons (part 2, article 20 of 152-FZ). Other enquiries are answered within thirty days.

9.8. The Operator may refuse to provide information on the grounds set out in part 8 of article 14 of 152-FZ, giving written reasons.

10.1. Pursuant to part 1 of article 18.1 and article 19 of 152-FZ, the Operator:

• appoints a person responsible for organising the processing of personal data: Shepitko Mariia Mikhailovna (head);
• issues this Policy and internal acts on the processing of personal data setting out procedures to prevent and detect breaches;
• carries out internal control over the compliance of processing with the law and the regulations adopted under it;
• assesses the harm that could be caused to subjects by a breach;
• familiarises staff and other persons directly involved in processing with the requirements of the law and the Operator’s internal acts, and provides training;
• identifies threats to the security of personal data in its information systems and applies the organisational and technical measures required by Decree of the Government of the Russian Federation No. 1119 of 1 November 2012;
• keeps an inventory of machine media holding personal data;
• detects unauthorised access and takes steps to stop it;
• restores data modified or destroyed as a result of unauthorised access from backups;
• sets rules of access to personal data and logs all actions performed in the information system;
• monitors the measures taken and the level of protection of its information systems.

10.2. Technical measures on the site: HTTPS only, passwords stored as irreversible hashes, limited rights of access to the administrative area, logging of administrators’ actions, protection of forms against automated submissions, and regular database backups.

10.3. The Operator notifies Roskomnadzor of any unlawful or accidental transfer of personal data that infringes subjects’ rights within twenty-four hours of detecting the incident, and reports the results of its internal investigation within seventy-two hours (part 3.1, article 21 of 152-FZ).

11.1. The person responsible for organising the processing of personal data (article 22.1 of 152-FZ): Shepitko Mariia Mikhailovna (head).

11.2. Contacts: batmelekh@yandex.com, +7 985 968-85-99.

11.3. The responsible person takes instructions directly from and is accountable to the Operator’s executive body, exercises internal control over compliance with the law, informs staff of the provisions of the law and of internal acts, and organises the receipt and handling of data subjects’ enquiries.

12.1. The Operator has not filed a personal data processing notification with Roskomnadzor and is not listed in the register of operators (TIN 772672576603, PSRN 326774600351022).

12.2. Should the notification be filed, the register number will appear in this section. Any change to the details given in it will be reported to Roskomnadzor in the manner and within the deadlines set by part 7 of article 22 of 152-FZ.

13.1. This Policy is amended when the personal data legislation of the Russian Federation changes and when the composition of the data processed, the purposes or the methods of processing change.

13.2. A new version takes effect once it is published at batmeleh.com/en/legal/personal-data-policy/, unless the version itself provides otherwise. Earlier versions are available on request at batmelekh@yandex.com.

13.3. The current version was approved on 5 September 2026.

13.4. Other documents of the Operator on personal data: consent to the processing of personal data, privacy policy, cookie policy.

13.5. This is a translation of the Russian original. In case of any discrepancy the Russian text prevails.