Personal Data Processing Policy
Version of 6 October 2026
This is an English translation provided for information only. The Russian version of this document is legally binding; in case of any discrepancy between the two versions, the Russian version prevails.
1. General provisions
This Policy sets out the procedure for processing and protecting the personal data of users of the “Scanner” website and software in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”.
The personal data operator is Индивидуальный предприниматель Липкина Лидия Александровна (INN 524830916587, OGRNIP 326527500103167, address: 603159, Россия, г. Нижний Новгород, Волжская набережная, 8/3 - 187) (the “Operator”). Contact for personal data processing matters: libscanner@yandex.com.
2. What data is processed, for what purposes and for how long it is stored
| Purpose | Data | Retention period |
|---|---|---|
| Registration and access to the personal account | Email address; password — only as a hash (argon2id), the password itself is not stored; two-factor authentication secret, if enabled; account status, roles, dates of registration and of email address confirmation, information about failed login attempts | Until the account is deleted. An account whose email address has not been confirmed is deleted 30 days after registration if it has no orders or licenses |
| Personal account login sessions, protection against unauthorized access | Session identifier (only its hash is stored in the database), browser information (user agent), IP address, dates of the start, last access and end of the session | 30 days after the session ends |
| Placing and fulfilling orders, issuing invoices, accepting payment, accounting and tax records | Contents, amounts, dates and statuses of orders; the buyer’s invoicing details — name, INN (taxpayer identification number), KPP (tax registration reason code), OGRN (OGRNIP) (primary state registration number), address, bank details, surname, first name and patronymic of the head (individual entrepreneur) and of the accountant, telephone number, email address; payment information from the payment operator — identifier, amount, status (without bank card data) | For the periods established by tax and accounting legislation. The most recently entered details, used to prefill the next invoice — until the account is deleted |
| Performance of the license agreement: issuing and verifying licenses, limiting the number of computers, transferring a license to another computer | License key (the database stores its hash and last characters). On activation and verification the program transmits: four SHA-256 hashes of the computer fingerprint — of the machine identifier, motherboard, processor and system disk (the serial numbers themselves are not transmitted), the computer name, operating system information, program version and license key. The server records the IP address of the last request, the dates of activation, last verification and unbinding, and the transfer history | Computer name and IP address — 6 months after the computer is unbound from the license; fingerprint hashes and other information — for as long as the license exists |
| Downloading the distribution in the “Downloads” section: release statistics; marketing mailing — subject to separate consent | Which file was downloaded (product, version, file), date and time, IP address | IP address — 6 months; download record — 3 years |
| Marketing mailing — only with separate consent (section 7) | Email address, download information, date and version of the consent | Until consent to the mailing is withdrawn |
| Replying to enquiries submitted through the feedback form | Name, email address, subject and text of the enquiry, IP address | 3 years, then deleted |
| Confirming the fact of consent (Part 3 of Article 9 of Law 152-FZ) and of acceptance of the offer | Consent log: which consent (to personal data processing, to marketing mailing, acceptance of the offer), given or withdrawn, version of the text, date and time, IP address, browser information | While the consent is in effect and for 3 years after it is superseded by a new record (withdrawal or a new version) |
| Security: log of actions in the personal account and in administration | The action, who performed it and when, IP address | IP address — 6 months |
| Sending emails: email address confirmation, password reset, notifications about orders and licenses | Recipient’s email address and the content of the email in the sending queue; one-time links (email address confirmation, password reset) — only their hash is stored in the database; payment notifications from the payment operator | Emails — 30 days after sending; one-time links — 30 days after expiry; payment operator notifications — 1 year |
| Operation and security of the website, protection against abuse | Web server logs: IP address, browser information, address of the requested page, date and time | No more than 6 months (logs are rotated) |
| Analysis of website traffic and improvement of the website (Yandex Metrica) — only with consent to analytics cookies (section 4) | Yandex Metrica cookie identifiers, IP address, browser and device information (device type, operating system, language, screen resolution), addresses of the pages visited and the referral source, date and time of the visit, actions on the pages: clicks, scrolling, pointer movements, session recording (Webvisor). Form fields containing personal data and the pages of the personal account and of administration are not included in the session recording | Until consent is withdrawn, but no longer than 1 year. The _ym_uid cookie identifier is stored in the browser for up to 1 year; after consent is withdrawn, Metrica cookies are deleted from the website |
Bank card data is entered on the payment operator’s page and is not transferred to the Operator. The Operator does not process special categories of personal data or biometric personal data.
3. Legal grounds
- Performance of a contract to which the personal data subject is a party, and entering into a contract at the subject’s initiative (clause 5 of Part 1 of Article 6 of Law 152-FZ) — account, sessions, orders, invoices, payments, licenses and activations, emails about orders and licenses.
- Performance of obligations imposed on the Operator by law, including tax and accounting legislation (clause 2 of Part 1 of Article 6) — orders, invoices, payments; the obligation to prove that consent was obtained (Part 3 of Article 9) — consent log.
- Consent of the personal data subject (clause 1 of Part 1 of Article 6) — enquiries submitted through the feedback form, download statistics, security logs; website traffic analysis with Yandex Metrica — only with consent to analytics cookies, which the visitor gives in the cookie notice on the website (section 4); marketing mailing — only with separate consent (Part 1 of Article 18 of the Federal Law “On Advertising”).
4. Cookies
The website uses three categories of cookies and browser storage entries (localStorage):
- necessary — the session identifier for logging in to the personal account, a security token against request forgery (CSRF) and a record of the chosen cookie settings; login and forms do not work without them, so they are always enabled;
- functional — remembering the selected color theme (light or dark); they are stored only in the browser, are not sent to the server and are used only if the visitor has allowed them;
- analytics — cookies and storage entries of the Yandex Metrica service (_ym_uid, _ym_d and others with the _ym prefix): visit statistics and recording of actions on the website (Webvisor) in order to improve the website. They are used only with the visitor’s consent: without it the Metrica counter is not loaded and no data is sent to Yandex. The contents of form fields containing personal data and of the pages of the personal account and of administration are not included in the session recording.
The choice is made in the notice shown on the first visit and can be changed at any time via the “Cookie settings” link at the bottom of every page. If analytics cookies are declined, data collection stops and Metrica cookies are deleted from the website. No advertising cookies are used on the website.
5. Procedure and conditions of processing
- Processing includes the collection, recording, systematisation, accumulation, storage, clarification, retrieval, use, transfer (provision, access), blocking, deletion and destruction of personal data, using automated means.
- The recording, systematisation, accumulation, storage, clarification and retrieval of personal data of citizens of the Russian Federation are carried out using databases located in the territory of the Russian Federation. The website server and the database are located in the Russian Federation.
- No cross-border transfer of personal data takes place.
- Upon expiry of the retention periods set out in section 2, upon achievement of the purposes of processing or after withdrawal of consent, the data is destroyed unless its storage is required by law or for the performance of a contract.
6. Transfer to third parties and processing on the Operator’s instructions
Personal data is transferred to third parties, or processed by them on the Operator’s instructions, only to the extent necessary for the purposes of processing:
- ООО «ЯНДЕКС» (YANDEX LLC; 16 Lva Tolstogo Street, Moscow, 119021, Russia) — email service: sending emails to users (recipient’s address, content of the email);
- ООО «ЯНДЕКС» (YANDEX LLC; 16 Lva Tolstogo Street, Moscow, 119021, Russia) — Yandex Metrica web analytics service: visit statistics and recording of actions on the website (Webvisor) to the extent set out in section 2 — only with the visitor’s consent to analytics cookies. The data is stored on servers in the Russian Federation;
- АО «ИОТ» (IOT JSC; INN 7731399513; 42 Bolshoy Boulevard, bldg. 1, Skolkovo Innovation Centre, Moscow, 121205, Russia) — hosting provider from which the server in the Russian Federation is rented: hosting of the website and the database;
- ООО НКО «ЮМани» (YooMoney NCO LLC, YooKassa service; INN 7750005725; 82 Sadovnicheskaya Street, bldg. 2, Moscow, 115035, Russia) — payment operator: accepting online payments and generating the cash receipt (order number and amount, order contents, the buyer’s email address for sending the receipt). Card and other payment details are entered by the buyer on the YooKassa page and are not transferred to the Operator.
In addition, data is provided to government authorities at their request in cases established by law.
7. Marketing mailing
Emails with news about releases, updates and offers are sent only with separate optional consent, which can be given at registration or in the “Downloads” section of the personal account. The mailing uses the email address and download information. You can opt out of the mailing at any time: via the “Unsubscribe” link in every email, in the “Downloads” section of the personal account, or by writing to libscanner@yandex.com. After consent is withdrawn, the mailing stops.
8. User rights
The user has the right to:
- receive information about the processing of their personal data (Part 7 of Article 14 of Law 152-FZ);
- demand that the data be clarified, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;
- withdraw the consent to the processing of personal data and the consent to marketing mailing, and demand deletion of the account;
- withdraw the consent to analytics cookies (Yandex Metrica) via the “Cookie settings” link at the bottom of the page;
- appeal against actions or omissions of the Operator to Roskomnadzor (the Russian data protection authority) or in court.
A request is sent to libscanner@yandex.com from the email address specified at registration, or by post to the Operator’s address. The Operator replies within 10 working days of receiving the request; this period may be extended by no more than 5 working days with notice of the reasons. After consent is withdrawn, processing stops and the data is destroyed within 30 days, except for data that the Operator is required to retain by law or processes on another legal ground (performance of a contract).
9. Data protection
The Operator takes legal, organizational and technical protection measures: data is transmitted only over a secure connection (HTTPS); passwords, session identifiers and one-time links are stored as hashes; access is restricted; administrators’ actions are logged; data is deleted upon expiry of the retention periods.
If an unlawful or accidental transfer (provision, dissemination, access) of personal data that has resulted in a violation of the rights of data subjects is detected, the Operator notifies Roskomnadzor: within 24 hours — of the incident, its presumed causes, the possible harm, the measures taken and the contact person; within 72 hours — of the results of the internal investigation and of the persons whose actions caused the incident (if any) (Part 3.1 of Article 21 of Law 152-FZ).
10. Changes to the Policy
The Operator may amend this Policy. A new version takes effect upon publication on this page; the date of the version is shown at the top.