Personal Data Processing Policy
Version dated 30 September 2026
Data controller: TK Satori LLC (ООО «ТК Сатори»), INN 1657253680, KPP 165701001, OGRN 1191690036493. Registered address: apartment 122, 87 Yamasheva Avenue, Kazan, Republic of Tatarstan, 420126, Russia. Website: elite-vannaya.ru. Personal data enquiries: Satori116@mail.ru · +7 (987) 217-00-33.
1. Scope and legal grounds
This policy applies to visitors who submit enquiries through elite-vannaya.ru. It describes the processing of ordinary personal data by TK Satori LLC under the ELITE brand in accordance with Russian Federal Law No. 152-FZ on Personal Data. Initial enquiries are processed on the basis of separate, voluntary consent. Where a customer initiates a contract, its conclusion and performance, and compliance with legal obligations, are covered by the applicable grounds under Article 6 of that law.
2. Purposes and data collected
To respond to an enquiry, clarify the task and arrange contact with the selected showroom, we process your name, phone number, selected showroom and employee, service, task description and any completed fields about project preparation, number of bathrooms, budget, order number and showroom of purchase. We also record consent, its version, submission time and website language. Source tags in the page URL may be included in the enquiry to identify how the customer found us. We do not request passport details, payment information, health data, biometric data or other special categories. Please do not enter such information or other people’s personal data in the free-text field.
3. How enquiries are processed
The form is sent over HTTPS to the website server hosted by Beget, validated, and forwarded through the MAX API to an authorised ELITE recipient. The message retains the selected showroom and employee. Access is limited to staff who need it to handle the enquiry. The showrooms at 230 Pobedy Avenue and 93 Yamasheva Avenue operate within the controller; internal forwarding does not remove TK Satori LLC’s responsibility. The website does not maintain a separate enquiry database. If email duplication is enabled by the controller, a copy is sent to its business mailbox for the same purpose.
4. Processing operations and recipients
Processing includes collection, recording, organisation, use, correction, internal disclosure to authorised staff, restriction and destruction, by automated and non-automated means. The website uses Beget, MAX and the controller’s business email service. Access is limited by their technical roles and service terms; the controller must establish the necessary contractual data processing arrangements. Data is not sold, published or used for promotional mailings under this consent. No automated decisions producing legal effects for visitors are made.
5. Retention and deletion
The initial enquiry and its copies are used to handle the request and forward it to the selected showroom within no more than 3 calendar days of receipt. Once that purpose is fulfilled, the responsible person deletes the original MAX message and email copies by the end of that period. Automatic deletion is not currently configured. If the customer continues a consultation or places an order, further processing requires separate valid consent or another lawful ground, including entering into or performing a contract. Contract, accounting and other mandatory records are retained for legally required periods; this does not extend retention of the initial enquiry without a lawful ground. Destruction involves deleting electronic records and copies and documenting deletion where required.
6. Technical data and external services
When you access the website, the server and hosting provider may process your IP address, request time, page URL, browser information and response code to serve pages, diagnose faults and prevent abuse. Hosting logs are processed within necessary security purposes and the provider’s retention rules; they are not an enquiry database. Your chosen language is stored in your browser. A technical session cookie is used for administrator sign-in. Yandex Metrica and Google Analytics are not connected as of this version. Before adding advertising analytics, the controller must update the documents and obtain any necessary consent. MAX, WhatsApp, Telegram and map buttons open external services; those buttons do not automatically forward completed form data. Subsequent conversations and processing in the chosen service are also governed by that service’s terms. The controller has not configured automatic website enquiry forwarding to WhatsApp or Telegram.
7. Security and localisation
The form uses HTTPS. Server configuration containing credentials is kept outside the public directory. Administrator access requires authentication. Enquiry data is not displayed on public pages or in application error logs. The controller organises access on a need-to-know basis, staff confidentiality, media management and incident response. When collecting Russian citizens’ data online, the controller must comply with the localisation requirements of Article 18(5) of Law No. 152-FZ. Hosting, email and messenger terms, and any potential cross-border transfers, must be assessed by the controller before connection; this policy does not replace a required notification or contract.
8. Your rights and withdrawal of consent
You may obtain information about processing, request correction, restriction or destruction where legally justified, withdraw consent, request cessation of processing, and complain to Roskomnadzor or a court. Send requests to Satori116@mail.ru or the controller’s registered address. Provide enough information to locate your enquiry and verify that it belongs to you; do not submit a passport through the website form. You may call to ask about the procedure. Access requests are handled within 10 working days, with a reasoned extension of up to 5 working days where permitted. Other requests are handled within the periods set by Articles 20–21 of Law No. 152-FZ. Processing based on withdrawn consent ends, and data without another lawful retention ground is destroyed within no more than 30 days; the shorter 3-day period applies to initial enquiries.
9. Document updates
The current version is published on this page. New conditions do not apply retroactively to consent already given. Consent for an initial enquiry is separate from this policy and does not include consent to advertising or public disclosure. Internal documents, Roskomnadzor notifications, processor contracts and compliance with deletion deadlines are the controller’s responsibilities and are not replaced by publishing this policy.