Personal Data Processing Policy
Version dated 8 October 2026. Effective from the date of publication.
1. General provisions
1.1. The personal data operator is Aida Rushanovna Gubaidullina, Individual Entrepreneur (INN 165507103300, OGRNIP 317169000078342), hereinafter the "Operator" or "Leto Flowers". Registration number in the register of personal data operators: 16-24-016404.
1.2. Address for enquiries and correspondence: Leto Flowers studio, 13, 2-ya Rybinskaya Street, Moscow 107113. Place of registration of the Individual Entrepreneur: Kazan, Republic of Tatarstan. Email: hello@letoflowers.ru. Phone: +7 905 553-67-36.
1.3. The duties of the person responsible for organising the processing of personal data are performed by Aida Rushanovna Gubaidullina, Individual Entrepreneur.
1.4. This Policy has been drawn up in accordance with Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" (the "Personal Data Law"). It sets out the purposes, legal bases, conditions and periods of personal data processing, the categories of data subjects and the personal data processed, the procedure for transferring and destroying personal data, and the rights of data subjects. The Policy applies to personal data that the Operator receives through the websites letoflowers.ru and letoflowers.com, by phone, via messengers, by email and at the studio, and to CVs of job applicants received via HeadHunter.
2. Categories of data subjects
The Operator processes the personal data of the following categories of data subjects:
- customers: persons who place an order on the website, by phone, via a messenger or at the studio;
- recipients: persons to whom a customer has ordered a delivery;
- representatives of organisations that order the Operator's goods and services;
- website visitors;
- subscribers to marketing and informational messages;
- loyalty programme members and personal account users;
- authors of reviews and enquiries;
- the Operator's employees, including former employees, and their relatives, to the extent provided for by employment, tax and pension legislation;
- job applicants (CVs received via HeadHunter).
3. Purposes of processing, personal data, legal bases and periods
The Operator processes the personal data necessary to achieve the purposes set out below and does not allow processing that is incompatible with the purposes for which the personal data were collected.
| Purpose | Data subjects | Personal data | Legal basis | Processing and retention period |
|---|---|---|---|---|
| 3.1. Entering into and performing a contract: accepting, paying for and fulfilling an order, contacting the customer about the order, handling complaints, refunds | customers | surname, first name, phone number, email address, preferred contact method, messenger and social network identifiers through which the customer contacts the Operator, delivery address, delivery date and time, order contents, bouquet preferences, payment amount and method, order history, correspondence about the order, complaints and the outcome of their consideration, bank account details (for refunds) | performance of a contract to which the data subject is a party, and entering into a contract at the data subject's initiative (Article 6(1)(5) of the Personal Data Law) | 7 years after the last order |
| 3.2. Delivering the order to the recipient and keeping the order details in the customer's order history | recipients | first name, surname (if provided by the customer), phone number, delivery address, delivery date and time, the notes "do not call the recipient, it is a surprise" and "contactless delivery", card message, occasion of the order | performance of a contract under which the recipient is the beneficiary (Article 6(1)(5)) and the Operator's legitimate interest in delivering the gift ordered by the customer (Article 6(1)(7)); the recipient's personal data are provided by the customer | 7 years after the customer's last order |
| 3.3. Performing contracts with organisations | representatives of organisations | surname, first name, patronymic, job title, phone number, email address, organisation details | performance of a contract with the organisation and the Operator's legitimate interest (Article 6(1)(5) and (7)) | the term of the contract and 5 years after its end (Article 23(1)(8) of the Tax Code of the Russian Federation) |
| 3.4. Accounting and tax records | customers, representatives of organisations | surname, first name, patronymic, payment amount, date and method, payment document details | performance of obligations imposed on the Operator by the legislation of the Russian Federation (Article 6(1)(2); Tax Code of the Russian Federation) | 5 years (Article 23(1)(8) of the Tax Code of the Russian Federation) |
| 3.5. Handling enquiries: questions, call-back requests, reviews | authors of enquiries | first name, phone number, email address, text of the enquiry, file attached to a review | where the enquiry relates to an order: entering into or performing a contract at the data subject's initiative (Article 6(1)(5)); in other cases: the Operator's legitimate interest in responding to the enquiry (Article 6(1)(7)) | 7 years after the last enquiry or order |
| 3.6. Publishing a review on the website | authors of reviews | first name, text of the review, rating, photo or video | consent to the processing of personal data authorised by the data subject for dissemination (Article 10.1) | until the review is removed from the website or consent is withdrawn |
| 3.7. Maintaining a personal account on the website | personal account users | login, email address, phone number, password (in encrypted form), order history | performance of a contract (Article 6(1)(5)) | until the personal account is deleted by the user or at the user's request |
| 3.8. Participation in the loyalty programme under the rules published at https://letoflowers.com/info/loyalty_program/ | loyalty programme members | first name, phone number, email address, bonus account and transactions on it, promo codes, information about invited members | performance of a contract, namely the loyalty programme rules (Article 6(1)(5)) | for the duration of participation in the programme and 3 years after the last transaction on the bonus account |
| 3.9. Taking the customer's preferences into account when fulfilling their orders (customer record in the CRM) | customers | gender, date of birth (if provided by the customer), preferred flowers and colour palettes, occasions and dates of previous orders, links with recipients and other customers, wishes, manager's notes, order and correspondence history | the Operator's legitimate interest in taking the customer's wishes into account in future orders (Article 6(1)(7)); at the customer's request, the Operator stops such processing | until the customer requests that the processing stop, but no longer than 7 years after the last order |
| 3.10. Sending marketing and informational messages (news, selections, personal offers) via WhatsApp, Telegram, text message (SMS) and email | subscribers | first name, phone number, email address, order history | the data subject's consent (Article 6(1)(1) and Article 15(1) of the Personal Data Law; Article 18(1) of Federal Law "On Advertising"), given by ticking a box when placing an order on the terms set out on the page "Consent to receive marketing messages" (https://letoflowers.com/include/ads_consent.php) | until consent is withdrawn |
| 3.11. Analysing website traffic and advertising effectiveness | website visitors | cookies, IP address, browser and device information, addresses of pages viewed, referral source and advertising tag, on-page actions including session recording (Yandex Metrica Webvisor), visitor identifier in Yandex Metrica; the referral source, advertising tag and visitor identifier are passed to an order placed on the website | consent (Article 6(1)(1)), which the visitor gives or declines in the cookie banner | collection: until consent is withdrawn; cookies: for the periods set out in section 6; data in Yandex Metrica reports: for as long as the counter is in use |
| 3.12. Performing the obligations of an employer: compliance with employment, tax and pension legislation, human resources and accounting records | employees, including former employees, and their relatives | information provided for by employment, tax and pension legislation, including surname, first name, patronymic, date and place of birth, identity document details, registered and residential address, INN, SNILS, employment history, education and military registration details, income, bank account details | performance of obligations imposed on the Operator by the legislation of the Russian Federation (Article 6(1)(2)) and performance of an employment contract (Article 6(1)(5)) | for the periods established by the legislation of the Russian Federation |
| 3.13. Recruitment: considering candidates for vacant positions | job applicants | surname, first name, patronymic, phone number, email address, information from the CV received via HeadHunter (education, work experience), interview results | the job applicant's consent (Article 6(1)(1)) | 30 days after the decision on the candidate is made |
3.14. The recipient's name and the occasion of the order are kept in the customer's order history (clauses 3.2 and 3.9). The Operator sends the customer personal offers related to the occasions of previous orders if the customer has consented to receive marketing messages (clause 3.10).
3.15. The Operator does not process biometric personal data.
4. Conditions of personal data processing
4.1. The Operator performs the following actions with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), depersonalisation, blocking, deletion and destruction. Dissemination of personal data is permitted for publishing a review with its author's consent (clause 3.6). Processing is carried out both with and without the use of automation tools.
4.2. When collecting personal data, including via the Internet, the Operator records, systematises, accumulates, stores, clarifies (updates, modifies) and retrieves personal data of citizens of the Russian Federation using databases located in the territory of the Russian Federation.
4.3. The Operator does not make decisions that produce legal consequences for the data subject or otherwise affect their rights and legitimate interests on the basis of solely automated processing of personal data.
5. Transfer of personal data
5.1. The Operator transfers personal data to third parties to the extent necessary to achieve the purposes set out in section 3. The Operator is liable to the data subject for the actions of a person processing personal data on the Operator's instructions.
5.2. Personal data are processed on the Operator's instructions by, among others:
- RetailDriver LLC (RetailCRM), 7 Khlebozavodsky Proezd, bldg 9, office 501-1, Moscow 115230: order and customer records;
- Yandex LLC, 16 Lva Tolstogo Street, Moscow 119021: website traffic statistics (Yandex Metrica).
Persons processing personal data on the Operator's instructions are obliged to keep the data confidential and to take the protection measures provided for by Article 19 of the Personal Data Law.
5.3. When the following services are used, personal data are transferred to them, among others:
- Lognex LLC (MoySklad), Skolkovo Innovation Centre, 42 Bolshoy Boulevard, bldg 1, room 1617, Moscow 121205: order and sales records;
- IOT JSC (FirstVDS), Skolkovo Innovation Centre, 42 Bolshoy Boulevard, bldg 1, Moscow 121205: website hosting;
- Hosting Technologies LLC (VDSina), 2/1 1st Frezernaya Street, bldg 2, Moscow 109202: server for internal reporting and analytics;
- Yandex LLC, 16 Lva Tolstogo Street, Moscow 119021: maps and delivery address lookup (Yandex Maps), corporate email (Yandex 360);
- Data Q LLC (DaData), 6 Turchaninov Lane, bldg 2, premises 1/3, Moscow 119034: address suggestions when placing an order;
- 1C-Bitrix LLC, 2 Entuziastov Boulevard, Moscow 109544: website platform;
- Evgeny Vladimirovich Slesarev, Individual Entrepreneur (i2crm), 3 Semashko Street, apt 41, Saransk 430021: transferring messenger correspondence to the CRM.
5.4. The Operator also transfers personal data, among others:
- to YooMoney Non-bank Credit Organization LLC (YooKassa), 82 Sadovnicheskaya Street, bldg 2, Moscow 115035: payer details when paying by bank card or via a payment link; YooMoney processes them as an independent operator;
- to couriers delivering orders, to the extent necessary for delivery (the recipient's name and phone number, delivery address, date and time, and delivery notes);
- to public authorities: on request, in the cases provided for by the legislation of the Russian Federation.
5.5. If a data subject contacts the Operator via a messenger (WhatsApp, Telegram, MAX), the correspondence is transmitted through that messenger's service and processed by it in accordance with its own rules.
5.6. The Operator does not sell personal data and does not provide them to third parties for the promotion of those parties' goods and services.
6. Cookies
6.1. The website uses essential cookies without which it cannot function (basket, personal account login, form protection). Consent to their use is not requested.
6.2. Analytics cookies (those of Yandex Metrica, including Webvisor, and the cookies storing the referral source and advertising tag) are set provided that the visitor has given consent in the cookie banner. Form fields into which contact details are entered are hidden from session recording.
6.3. Analytics cookies can be declined in the cookie banner ("Change settings") or in the browser settings, and Yandex Metrica can also be declined using the add-on at https://yandex.ru/support/metrica/ru/general/opt-out.html.
| Cookie | Set by | Purpose | Retention period |
|---|---|---|---|
| PHPSESSID | the Operator's website | basket, checkout and personal account functionality, form protection | session |
| BITRIX_SM_SALE_UID | the Operator's website | storing the basket | 360 days |
| MAX_VIEWED_ITEMS_* | the Operator's website | showing recently viewed products | 30 days |
| BITRIX_SM_LOGIN, BITRIX_SM_UIDH, BITRIX_SM_UIDL | the Operator's website | personal account login; if "Remember me" is selected, login without re-entering the password | 360 days |
| BITRIX_SM_AGREE_COOKIE, BITRIX_SM_TECHNICAL_CHECK, BITRIX_SM_ANALITIC_CHECK | the Operator's website | storing the visitor's choice in the cookie banner | 180 days |
| agec_utm_* | the Operator's website | storing the referral source and advertising tag for the order | 30 days |
| _ym_uid, _ym_d | Yandex Metrica | distinguishing visitors, date of the first visit | 1 year |
| _ym_isad | Yandex Metrica | detecting ad blockers | 20 hours |
| _ym_visorc | Yandex Metrica | Webvisor operation | 30 minutes |
| _ym_debug | Yandex Metrica | counter debug mode indicator | session |
| mdd | Yandex Metrica | technical cookie of the counter | 1 day |
| tildauid | Tilda (website pages built on Tilda) | visit statistics: distinguishing visitors | 90 days |
| tildasid, previousUrl | Tilda (website pages built on Tilda) | visit statistics: session and previous page | 30 minutes |
| TILDAUTM | Tilda (website pages built on Tilda) | storing the referral source and advertising tag for a form request | 30 days |
7. Rights of data subjects
7.1. The data subject has the right to:
- obtain information about the processing of their personal data, including the purposes and legal bases of processing, the data processed, the processing and retention periods, the persons to whom the personal data may be disclosed, and the name and address of any person processing personal data on the Operator's instructions;
- require personal data to be clarified, blocked or destroyed if they are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;
- withdraw consent to the processing of personal data (to receive marketing messages, to analytics cookies, to the publication of a review) at any time; withdrawal of consent does not affect the lawfulness of processing carried out before it was received;
- require the processing referred to in clause 3.9 to stop;
- opt out of marketing messages by replying in the same channel (for example, with the word "stop"), by telling the manager, by writing to hello@letoflowers.ru or by using the "Unsubscribe" link in an email;
- appeal against the Operator's actions or omissions to Roskomnadzor (rkn.gov.ru) or to a court.
7.2. Requests are sent to hello@letoflowers.ru or by post to the address given in clause 1.2. A request must contain the information provided for by Article 14(3) of the Personal Data Law: the number of the main identity document of the data subject or their representative, the date of its issue and the issuing authority; information confirming the relationship with the Operator (for example, the order number, phone number or email address given when ordering); and the signature of the data subject or their representative. A request in the form of an electronic document is signed with an electronic signature. The Operator responds within 10 working days of receiving the request. This period may be extended by no more than 5 working days, in which case the Operator sends the data subject a reasoned notice stating the reasons for the extension. Personal data that are incomplete, inaccurate or out of date are clarified, and personal data that were unlawfully obtained or are not necessary for the stated purpose of processing are destroyed, within 7 working days of the date on which the supporting information is provided (Article 20(3) of the Personal Data Law).
8. Destruction of personal data
8.1. When the purposes of processing have been achieved, the retention period has expired or consent has been withdrawn, the Operator destroys the personal data within 30 days unless a different period is established by the legislation of the Russian Federation (for example, documents needed to calculate and pay taxes are kept for 5 years under Article 23(1)(8) of the Tax Code of the Russian Federation). If unlawful processing is identified, the Operator stops it within 3 working days; if the processing cannot be made lawful, the personal data are destroyed within 10 working days of the date on which it was identified.
8.2. Personal data in electronic form are deleted irreversibly, and paper media are shredded. Destruction is confirmed by a record of destruction of personal data and, where processing is carried out using automation tools, also by an extract from the event log of the information system (Roskomnadzor Order No. 179 of 28 October 2022).
9. Protection of personal data
9.1. The measures taken to protect personal data are described in the document "Information on Implemented Personal Data Protection Requirements".
10. Final provisions
10.1. The Operator updates the Policy when the purposes of processing, the personal data processed or the services used change. The new version is published on this page with its date; previous versions are provided on request.
