Privacy Policy

This Policy sets out the procedure for processing and protecting the personal data of users of the Have CMS service located at cms.have.studio (hereinafter, the “Service”).

1. Personal Data Operator

The personal data operator is the person specified on the “Company Details and Contacts” page. That page also gives the address for submitting requests and the email address through which the rights provided for by this Policy and applicable law may be exercised.

Personal data is processed in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”.

2. Data Processed

The Operator processes only the data necessary for the operation of the Service:

• data the buyer provides when placing an order: name, email address, phone number, website address;
• order information: contents, subscription term, amount, date and time of consent to the offer and the policy, and the IP address and browser from which the order was placed;
• organization details, if the buyer requests an invoice;
• the content of requests to support.

Bank card details are entered on the payment service’s page and are not transferred to the Operator; the Operator receives only confirmation of payment and its identifier.

Technical data is also processed — IP address, browser and device type, information about pages viewed — collected by web analytics systems.

The Operator does not request or process special categories of personal data or biometric personal data.

3. Purposes of Processing

• placing and fulfilling orders, activating purchased plans and modules;
• concluding and performing the services agreement, issuing invoices and accepting payments;
• providing access to the customer dashboard and providing technical support;
• improving the Service based on depersonalized statistics.

Data is not processed for any other purposes.

4. Legal Grounds

• the consent of the personal data subject, given by ticking a checkbox when placing an order;
• an agreement to which the personal data subject is a party — when providing subscription services;
• the requirements of accounting and tax legislation — with respect to payment documents.

5. Transfer to Third Parties

The Operator does not transfer personal data to third parties, except where this is:

• required by the laws of the Russian Federation;
• necessary to fulfill obligations to the user — for example, transferring the minimum necessary information to a payment service to process a payment or to a bank to issue an invoice;
• expressly permitted by the user.

Bank card details are neither transferred to nor stored by the Operator: the payment is processed on the payment service’s side.

6. Data Retention Period

Data from requests is retained for three years from the date of the last interaction. Data related to the performance of the agreement and payments is retained for the periods established by accounting legislation. Once the purposes of processing have been achieved, or at the user’s request, the data is deleted or depersonalized.

7. Rights of the Personal Data Subject

In exercising the rights of a personal data subject, the User may:

• obtain information about the processing of their personal data;
• demand that the data be rectified, blocked or destroyed if it is incomplete, outdated, inaccurate or unlawfully obtained;
• withdraw consent to processing;
• appeal against the Operator’s actions to the authorized body for the protection of the rights of personal data subjects or in court.

To exercise any of these rights, it is sufficient to send a request to the email address specified on the “Company Details and Contacts” page. A response is sent within thirty days.

8. Withdrawal of Consent

Consent to processing is withdrawn by sending a written request to the same address. After withdrawal, the Operator ceases processing and destroys the data, except for information that it is required by law to retain.

9. Data Protection

The Operator takes legal, organizational and technical measures to protect data against unlawful access, destruction, alteration and dissemination: access to data is granted only to employees who need it for their work; data transmission between the browser and the Service is protected by encryption; backups are created daily.

The Operator does not guarantee the absolute security of data transmission over the internet, of which the user has been notified.

10. Changes to the Policy

The Operator may amend this Policy. A new version is published on this page, stating its effective date, no later than ten days before it applies. Continued use of the Service after the new version takes effect constitutes consent to it.

Revised on 15.09.2026