1.1. This Privacy Policy (the "Policy") is drawn up in accordance with Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" (the "Personal Data Law") and defines how the Operator processes personal data and the measures taken to ensure its security.

1.2. Data Operator (Controller): Individual Entrepreneur Andrei Dvoinishnikov OGRNIP: 325774600409180 INN (Tax ID): 772142683166 E-mail for requests: hello@madebycult.site

1.3. The Operator processes the personal data of users of the website madebycult.site for the purposes, to the extent, and by the means described in this Policy.

1.4. By using the website and/or submitting data through the contact form, the user confirms their agreement with this Policy. If the user does not agree, they must not use the contact form or provide their data to the Operator.

2.1. Personal data — any information relating to a directly or indirectly identified or identifiable natural person (the data subject).

2.2. Processing of personal data — any operation performed on personal data: collection, recording, systematization, accumulation, storage, updating, use, transfer, blocking, deletion, and destruction.

2.3. Operator (Controller) — the person specified in clause 1.2, who independently organizes and carries out the processing of personal data.

5.2. Consent to the processing of personal data is given by the user by ticking the corresponding checkbox in the contact form before submitting it. Such consent is specific, informed, and conscious.

5.3. The user may withdraw consent at any time by sending a request to the e-mail specified in clause 1.2. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

6.1. Processing is carried out with and/or without the use of automation tools.

6.2. Storage and localization. The personal data of citizens of the Russian Federation is recorded, systematized, accumulated, and stored using databases located within the territory of the Russian Federation (the Operator's hosting and corporate e-mail are hosted with a Russian provider). Inquiries received through the contact form are sent to the Operator's corporate e-mail hosted in the Russian Federation.

6.3. Transfer to third parties. The Operator does not sell personal data and does not transfer it to third parties, except where necessary for the operation of the website and communication, or where required by law. The Russian hosting and e-mail provider may be engaged as a processor (hosting the website and receiving inquiries).

6.4. Notifications about new inquiries may be sent to the Operator's internal channels (including messengers) without transferring users' personal data — only as a service notification of the fact that an inquiry has been received.

6.5. If the user contacts the Operator on their own initiative via messengers (Telegram, WhatsApp), the privacy policies of the respective services additionally apply to such correspondence.

7.1. Personal data is stored no longer than required by the purposes of processing or by the period established by law. Data from the contact form is stored for the duration of the communication and for a reasonable period afterward, after which it is deleted or anonymized.

7.2. Data is destroyed upon achievement of the purposes of processing, withdrawal of consent (in the absence of other legal grounds), or at the request of the data subject.

8.1. The website uses only strictly necessary cookies (and similar local-storage technologies) required for the site to function correctly and to remember interface settings. These are not used for analytics, advertising, or tracking and do not require consent. No web analytics services are used on the website.

8.2. The user may restrict or disable cookies in their browser settings; in this case, certain website features may not work correctly.

9.2. Requests are sent to the e-mail specified in clause 1.2. The Operator reviews them within the time limits established by the Personal Data Law.

10.1. The Operator takes the necessary legal, organizational, and technical measures to protect personal data from unlawful access, destruction, alteration, blocking, copying, and distribution.

10.2. Data transmission over the internet cannot be guaranteed to be 100% secure, and therefore the Operator cannot ensure the absolute security of transmitted data.

This section applies in addition to the rest of the Policy where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to the processing of your personal data — for example, if you are located in the European Economic Area (EEA) or the United Kingdom. In case of conflict, this section prevails for such users.

11.1. Controller. The data controller is the Operator identified in clause 1.2, reachable at the e-mail there.

11.2. Legal bases (Art. 6(1) GDPR): your consent (Art. 6(1)(a)); pre-contractual steps and performance of a contract at your request (Art. 6(1)(b)); our legitimate interests in operating and securing the website (Art. 6(1)(f)).

11.3. Your rights. You have the right to access, rectification, erasure ("right to be forgotten"), restriction of processing, objection to processing, data portability, and to withdraw consent at any time without affecting prior lawful processing. You may also lodge a complaint with a supervisory authority in your country of residence, place of work, or place of the alleged infringement. To exercise these rights, contact us at the e-mail in clause 1.2; we respond within the time limits set by the GDPR (generally one month).

11.4. International data transfers. The Operator is established in the Russian Federation, which has not received an adequacy decision from the European Commission. Where we transfer personal data outside the EEA/UK, we rely on an applicable safeguard or derogation under Chapter V of the GDPR — such as your explicit consent to the transfer or the necessity of the transfer to perform a contract with you or at your request (Art. 49 GDPR). By submitting the contact form, where required, you consent to this transfer, having been informed of the possible risks due to the absence of an adequacy decision.

11.5. Automated decision-making. We do not carry out automated decision-making or profiling producing legal or similarly significant effects.

11.6. EU representative. Our processing of EU/EEA users' data is occasional, limited in scale, and does not involve special categories of data; we therefore consider the exemption under Art. 27(2) GDPR to apply. Should this change, we will appoint an EU representative and update this Policy.

12.1. The Operator may amend this Policy. The current version is posted on this page with the date of update. Continued use of the website after changes are published constitutes agreement with the updated Policy.