Personal Data Processing Policy

1. General provisions

In this Policy, Cartelta means the Cartelta JSIR service and brand used to process business requests, organize demonstrations, and communicate about client-side security, PCI DSS, and payment page protection on https://cartelta.com and the Russian version at https://cartelta.com/ru.

Contractor details, legal requisites and applicable contractual terms are provided before placing an order, making a payment or entering into an agreement for the relevant service.

2. Terms and definitions

Personal data, operator, processing, data subject, disclosure, restriction, deletion, and related terms are used in the sense of applicable personal data laws and the Russian source document.

Cookies and similar technologies mean small data fragments or web storage keys that the site or a connected service may store in the user's browser.

Personal data contacts

Cartelta JSIR is a client-side security service for script inventory, integrity control and payment page change detection in the PCI DSS 4.0.1 context.

Email for personal data requests: support@cartelta.com. Support email: support@cartelta.com.

3. Sites covered by this policy

• https://cartelta.com
• https://cartelta.com/ru

4. Data subject categories

• site visitors;
• people who submit business requests through contact forms or by email;
• potential customers and representatives of customer organizations;

5. Processing purposes

• operating the site and maintaining page availability and security;
• processing incoming business requests and providing a response;
• organizing Cartelta JSIR demonstrations and preparing commercial proposals;
• communicating about PCI DSS 6.4.3/11.6.1, web skimming, formjacking, and payment page protection;
• maintaining site security, including security logs;
• fulfilling contractual and compliance obligations if an agreement is entered into;
• site analytics and improvement only after consent to analytics cookies.

6. Personal data categories

• name or full name provided by the user;
• position and organization, if provided;
• email address;
• phone number if provided voluntarily;
• company website and request content if provided;
• technical site data: IP address, user agent, date and time, URL, referrer, cookie identifiers, browser and device data, security logs;
• data needed for a demo, pilot, agreement, or support if applicable;
• analytics data if the user consents to analytics cookies.

7. Legal bases

• data subject consent when submitting the contact form;
• user consent for analytics cookies when analytics is enabled;
• processing the user's request and preparing a response;
• contractual and compliance obligations if an agreement is entered into;
• other legal bases confirmed for the relevant service or engagement.

8. Processing operations

Cartelta may collect, record, organize, accumulate, store, update, retrieve, use, transfer where legally permitted, anonymize, restrict, delete, and destroy personal data.

9. Retention periods

• requests and correspondence: for the period necessary to process the request, prepare a proposal, confirm communication, and protect legitimate interests of the parties;
• cookie choice: until the user changes settings, clears browser data, or the established retention period expires;
• analytics data: according to Yandex Metrica retention settings; browser storage periods are listed in the Cookie Policy;
• security logs: within the period necessary to maintain security, investigate incidents, and comply with applicable requirements.

10. Third parties and services

• Yandex Metrica, for technical visit analytics with the user's consent.
• Hosting providers and infrastructure vendors used to operate the site and Cartelta JSIR.
• Cartelta email infrastructure used to process requests; access is limited to responsible Cartelta representatives.

Contact names, email addresses, and message contents are not sent to the analytics counter. Session Replay and advertising retargeting are not used.

11. Cross-border transfer

Google Analytics is not used on this website. Technical visit data processed by Yandex Metrica is governed by Yandex's Privacy Policy.

12. Localization

Primary collection, recording, organization, accumulation, storage, update, and retrieval of Russian citizens' personal data must use databases located in the Russian Federation where that rule applies.

13. Data subject rights and requests

• receive information about personal data processing;
• request correction, restriction, or deletion of data;
• withdraw consent;
• send requests to Cartelta about personal data processing.

Requests may be sent to support@cartelta.com. Cartelta may request information needed to confirm the identity of the requester or the authority of a representative.

14. Protection measures

• HTTPS;
• minimization of required contact form fields;
• restricted access to requests and contact data;
• honeypot, submission delay, and rate limiting for the contact form;
• encryption of the local request archive on the server;
• security headers including Referrer-Policy, X-Content-Type-Options, and Permissions-Policy.

15. Cookies and analytics

For cookie categories, analytics settings, retention periods, and the cookie table, see the Cookie Policy.

16. Final provisions

The current version is published on the site and is available without registration. The document is updated when processing operations, service providers, or legal requirements change.

Version: 2026-10-02.1. Revision date: 2026-10-02.