Personal data

Controller and contact

The personal data controller is individual entrepreneur Valeriy Aleksandrovich Kuznetsov, OGRNIP 323730000063373, INN 732771473709. Contact leripai@yandex.ru about data processing and requests. The postal address appears on the “Seller and contacts” page.

Data and purposes

The guest order form requests the recipient’s name, email and phone number, plus a postcode and address for shipping. The order records the selected painting, receiving method, language, prices, dates and statuses of payment, handover and refund. These details support entering into and performing the contract, communication, delivery, returns and handling claims.

The sales system stores fiscal receipt details, tracking, payment identifiers and URL, guest access and duplicate-order prevention records, notification queues and an action log. These support payment reconciliation, receipts, order access and reliable operation of the service.

Notifications to the seller at leripai@yandex.ru contain the order number, painting, amount, receiving method, recipient’s name, email and phone, shipping address where applicable and tracking when available. When you contact the seller, your contact details, correspondence and attachments you send are processed to respond and resolve the issue. Do not send card details or unnecessary information about yourself or others.

Legal grounds and processing operations

Necessary order processing is based on entering into a contract at the buyer’s initiative and performing it; mandatory tax and fiscal recordkeeping is based on law. Enquiries are handled to perform the contract and the controller’s obligations. Where separate processing relies on consent, you may withdraw it; this does not end processing that retains another lawful basis.

Processing includes collection, recording, organisation, storage, correction, use and sharing for these purposes, restriction and destruction when legally required. Automated systems and manual work by the seller are used. Reading this policy and accepting the sale terms do not themselves constitute separate consent to processing by the fiscal receipt provider or sharing with a fiscal data operator.

Who receives data

Payments are provided by JSC TBank (АО «ТБанк»). The bank receives the order number, amount, language, payment and receipt parameters, including email and details of goods and shipping. The website receives payment identifiers, URL and result. Card details are entered on the bank’s payment page; Leripai’s order form does not request them, and full card details and CVC are not stored in the sales system. The bank also processes data for its own payment and statutory obligations.

If you select Dolyami within the payment service, T-Pokupki LLC (ООО «Т-Покупки») provides it under separate terms. Order and payment information is used for this payment, and you provide additional details to the service when applying. Leripai has no separate form collecting those additional details.

CloudKassir LLC (ООО «КЛАУДКАССИР») provides electronic receipts through “Receipts from T-Business”: the bank supplies the buyer’s email, transaction, goods and tax details. The provider generates and emails the receipt and sends fiscal data through a fiscal data operator (OFD) to the Federal Tax Service. This is separate processing for fiscal recordkeeping.

Yandex Mail (Yandex LLC, ООО «ЯНДЕКС») is used for correspondence and notifications. Email addresses, sender and recipient details, message content and attachments you send are transmitted and stored through it.

The carrier selected for an order receives the recipient’s name and phone, address and postcode, and shipment details needed for delivery. Collection does not require sharing with a carrier. Data may also be supplied to authorised authorities where provided by law.

Hosting, access and technical information

The website and order database are hosted on the same AEZA server in Moscow, Russia. The seller keeps order information in the website database and ordinary free Yandex Mail, using only the mail web interface without mail apps, forwarding or email downloads. The seller keeps no other separate order copies; necessary information is shared with the carrier for delivery. Only the owner, who is the seller, has internal human access to orders. This does not exclude processing by hosting infrastructure and the other services listed above for their respective tasks. This server location does not mean that every provider copy is in Russia and does not guarantee the absence of cross-border processing.

Application, server and database logs support website operation and investigating errors. Errors may cause technical request information and order-related data to enter these logs. Logs rotate; there is no single fixed retention period in days for all logs. They do not replace the order database or justify indefinite retention of buyer information.

Retention and deletion

The manual policy requires a weekly review of whether data is still needed for its specific purpose and daily checks of email. Requests and incidents must be handled as they arise within statutory time limits, without waiting for the weekly review.

Data for an unsettled payment is needed until final reconciliation with the bank. Once its processing purpose ends, destruction is required within 30 days unless a dispute or retention obligation applies. For fulfilled orders, unnecessary contacts, addresses, tracking and duplicate emails are subject to the same period after their specific contractual or claim-handling purpose ends. Any shorter applicable statutory time limits still apply.

Separate records needed for tax accounting are retained for five years after the end of the tax period in which they were last used for accounting and tax calculation. A specific legal obligation or dispute may require longer retention. This period does not automatically apply to the entire order or all correspondence.

Orders are not deleted automatically. Deletion is manual, after checking completed payments, handover or return of the painting, the absence of a dispute and any obligation to retain particular information. The limited contact-clearing procedure in the system is intended for completed orders with expired guest access; it does not cover every request. Guest access duration does not extend statutory response or destruction deadlines: a request requiring earlier action is considered separately.

Clearing contact details does not delete the whole order: amounts, purchased items, payment and receipt information, order and session identifiers and the action log may remain. These links may still be personal data and require their own retention purpose and period. Email, copies held by payment, receipt and mail providers, technical copies and logs are considered separately. Changing a database record does not physically erase every copy. The policy requires checking storage under the seller’s control and documenting the actions taken.

Cookies

In the production configuration, the __Host-leripai_guest cookie links the browser to the order for up to 90 days. It is inaccessible to JavaScript and sent over a secure connection. The lp_lang cookie remembers the chosen language for 365 days.

Deleting the guest cookie may remove this browser’s access to the order; it does not delete the order itself. Contact leripai@yandex.ru if you lose access.

Your rights

You may request information about processing, seek correction, blocking or deletion where provided by law, withdraw consent for processing based on it, and complain to Roskomnadzor or a court. Send requests to leripai@yandex.ru; identity verification may be needed to protect data.

Requests are handled within statutory time limits. Responses consider the specific data, purposes and grounds for further retention. Deletion does not automatically erase information that must be kept on a lawful basis.