This English translation is provided for convenience only. The legally binding version is the Russian text of the Policy.
1. General provisions
1.1. This Policy sets out how the personal data of users of the website ilyazadornov.com, including the “Origami Database” section (the “Website”), is processed and protected. It is published in accordance with Part 2 of Article 18.1 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (the “Law”).
1.2. The personal data operator is the individual Ilya Dmitrievich Zadornov. Email for questions about personal data processing: contact@ilyazadornov.com; the postal address is given on the Legal information page (the “Operator”).
1.3. The Policy applies to personal data that the Operator receives through the Website. It does not apply to third-party websites linked from the Website.
1.4. The Operator does not process special categories of personal data or biometric personal data. The Website does not ask for your surname, phone number or passport details.
1.5. The legal grounds for processing are: the Law; Federal Law No. 149-FZ of 27 July 2006 “On Information, Information Technologies and Information Protection”; Articles 437 and 438 of the Civil Code of the Russian Federation (the Terms of use as a public offer); the data subjects’ consent to the processing and to the dissemination of personal data.
1.6. The Operator personally organizes the processing of personal data and is responsible for it.
2. Purposes of processing, data, legal grounds and retention periods
2.1. Registering and maintaining a user account. Processed data: username; password as a cryptographic hash, the password itself is not available to the Operator; email address or Telegram username for restoring access; dates of registration, last sign-in, acceptance of the Terms of use and giving consent; lists, submissions and photos created by the user. Data subjects: users who have registered an account. Legal grounds: the data subject’s consent (clause 1, Part 1, Article 6 of the Law) and performance of the Terms of use (in Russian) (clause 5, Part 1, Article 6 of the Law). Retention: until the account is deleted or consent is withdrawn.
2.2. Receiving and reviewing submissions sent without an account: photos, book covers, corrections to model pages. Processed data: the name or pseudonym given by the user; a link to a profile or website; comment text; the uploaded image; the IP address, used to protect the Website from spam and abuse. Data subjects: visitors who have sent a submission. Legal ground: the data subject’s consent. Retention: the IP address is deleted automatically 90 days after the submission is sent; other data is kept as long as the submission or the photo published from it is kept, or until consent is withdrawn.
2.3. Dissemination of data. The Website publishes only data that the data subject has chosen to make public. The caption of an approved photo (name, pseudonym or username and a link to a profile) is published subject to consent to dissemination (in Russian) (Article 10.1 of the Law), which is given when the photo is sent. The username is published on the user’s gallery page if the photo was sent with the “Add to my gallery” option checked, in the caption of photos attached to a new model submission and published together with that model (consent to this is given when the account is registered), and on a list that the user has shared by link. Contact details, IP addresses, the contents of private lists and statistics data are not published.
2.4. Visit statistics. Processed data: a random browser and session identifier created on the user’s device; addresses of pages viewed; clicks on links and buttons; search queries in the “Origami Database” and the number of results found; the referring page address; a flag showing that the request, judging by the browser header, was sent by a search engine crawler. For a signed-in user, events are linked to their account. Data subjects: Website visitors. The IP address is not recorded in statistics. Purposes: understanding which sections and models are in demand, counting views, finding errors. Legal ground: for registered users, the consent given at registration; data about unregistered visitors does not make it possible to identify them. Retention: until the purpose is achieved; when an account is deleted, the link between events and the account is removed. The Website uses no third-party analytics or advertising systems.
2.5. Technical web server logs contain the IP address, the time and address of the request and the browser header. The logs are used to keep the Website running and secure, their size is limited, and they are overwritten automatically.
2.6. Messages to the Operator by email or on Telegram. Processed data: the sender’s address or username, their name if given, and the message text. Data subjects: persons who have contacted the Operator, including rights holders and personal data subjects. Purpose: replying to the message. Retention: until the message has been dealt with.
3. Cookies and browser storage
3.1. The Website stores the following entries in the user’s browser.
| Name | Purpose | Retention |
|---|---|---|
origami_user (cookie) | Signing in to a user account | Until sign-out, at most 180 days |
origami_admin (cookie) | Signing in to the Website control panel, Operator only | Up to 14 days |
ow_model_viewer (cookie) | Random marker for counting repeat views of a model page | 180 days |
origami.telemetry.* | Random browser and session identifiers for statistics (clause 2.4) | Until deleted by the user, session 30 minutes |
origami-model-viewer | View marker in case cookies are disabled | Until deleted by the user |
origami-lang | Chosen website language (ru or en): written when the visitor picks a language with the switcher in the header and used to open pages in that language; contains no personal data | Until deleted by the user |
origami-user-session, origami-books-view, db-book-view, origami-cookie-notice | Interface settings: a note of a previous sign-in, list view, dismissed cookie notice | Until deleted by the user |
3.2. While a tab is open, the Website caches loaded catalogue data in sessionStorage to speed up navigation between pages. Cookies and Website data can be deleted in the browser settings; after that you will need to sign in to your account again.
4. Processing procedure
4.1. Processing is automated. The Operator performs the following actions with personal data: collection, recording, systematization, accumulation, storage, clarification (updating, changing), retrieval, use, dissemination (only in the cases listed in clause 2.3), depersonalization, blocking, deletion, destruction.
4.2. Personal data is recorded, stored and processed in a database on a server located in the Russian Federation (Part 5, Article 18 of the Law). Personal data is not transferred across borders.
4.3. The Operator does not transfer personal data to third parties and does not entrust its processing to other persons, except as required by the laws of the Russian Federation.
4.4. Users can correct their personal data themselves on the account page, or the Operator corrects it at the data subject’s request within 7 working days of receiving information confirming that the data is inaccurate.
4.5. When the purposes of processing are achieved, the periods specified in section 2 expire, consent is withdrawn or unlawful processing is detected, the personal data is deleted from the Website database and file storage. Destruction of personal data is confirmed in the manner established by Roskomnadzor Order No. 179 of 28 October 2022.
5. Personal data protection measures
5.1. The Operator applies the following measures: an encrypted connection to the Website (HTTPS); storing passwords only as a hash; preventing page scripts from accessing sign-in cookies; separate authorization for users and the administrator; access to the server and the database for the Operator only; limits on sign-in attempts and form submissions; automatic deletion of data that is no longer needed.
5.2. If an unlawful or accidental transfer of personal data that violates data subjects’ rights is detected, the Operator notifies Roskomnadzor of the incident within 24 hours and of the results of its investigation within 72 hours (Part 3.1, Article 21 of the Law).
6. Third-party resources
6.1. The Website contains links to YouTube, Telegram, VK, WhatsApp and model designers’ websites. The “Share” buttons are ordinary links and do not pass any information about the user to third-party services until clicked.
6.2. On the page for suggesting a model by YouTube link, once a link is entered, the user’s browser loads the video thumbnail from YouTube servers.
7. Rights of the data subject
7.1. The data subject has the right to obtain information about the processing of their personal data, to demand its clarification, blocking or destruction, to withdraw consent to processing and consent to dissemination, and to appeal against the Operator’s actions to Roskomnadzor or in court (Articles 14–17 of the Law).
7.2. On the account page users can change their contact details, download their data as a single file and delete their account. Deleting an account erases the username, password, contact details, lists, submissions and photos not yet reviewed, and removes the link between statistics and the account. Published photos remain with their existing caption; to remove a caption or a photo, send a request to the Operator. Users turn off a public link to a list in the list itself.
7.3. Requests should be sent to contact@ilyazadornov.com. A request should state the username or the name under which the submission was sent, and be sent from the contact specified in the account. A reply is sent within 10 working days; this period may be extended by 5 working days with notice of the reasons.
7.4. When consent is withdrawn, the Operator stops processing and destroys the personal data within 30 days, unless its retention is required by law. A demand to stop disseminating data (clause 2.3) is fulfilled within 3 working days.
8. Final provisions
8.1. The Operator may amend this Policy. A new version takes effect when it is published on the Website. If the purposes of processing or the personal data processed change, the Operator asks for consent again.