Privacy Policy

Operator: Natalia Aleksandrovna Motorina, individual entrepreneur OGRNIP (state registration number) 309774635800707 (certificate No. 309 774 635 800 707 of 24.12.2009) Postal address: 4 bldg. 31 Andreya Tarkovskogo Boulevard, Moscow 108850, Russia Registration number in the Register of Personal Data Operators: 77-22-051931 Email for personal data enquiries: psy@psy.one Phone: +7 991 239-11-98

1. General provisions

1.1.This Policy sets out which personal data Natalia Aleksandrovna Motorina, individual entrepreneur (the “Operator”), processes in operating the psy.one website and its subdomains (the “Site”) — the PSY.one online journal, the professional community of specialists and the consultation booking service — for what purposes and for how long, to whom the data is disclosed and how it is protected.

1.2.This Policy has been drawn up in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (the “Law”) and the regulations adopted under it.

1.3.This Policy is publicly available at psy.one/privacy. The date of the current version is shown at the top of the page.

1.4.Consent to the processing of personal data is a separate document (psy.one/consent). The user gives it by ticking a separate box when registering or subscribing to the newsletter.

1.5.Consent to the dissemination of personal data — publication of a specialist’s photo and profile — is also a separate document (psy.one/consent/public). It is given by ticking a separate box when uploading a photo or submitting an author application.

1.6.The Site records the date of each consent and the version of the text the user agreed to.

2. Definitions

2.1.Personal data means any information relating directly or indirectly to an identified or identifiable natural person.

2.2.Processing of personal data means any operation performed on personal data: collection, recording, systematisation, accumulation, storage, clarification, retrieval, use, transfer (provision, access), dissemination, depersonalisation, blocking, deletion and destruction.

2.3.Special categories of personal data include, among other things, information on health.

2.4.Visitor means any person who opens the Site.

2.5.User means a person registered on the Site. All users register as readers.

2.6.Specialist means a user who has filled in an author application, or a user whose qualifications have been verified: a psychologist, article author or reviewer.

2.7.Client means a user who has booked a consultation with an expert through the Site.

3. Processing principles

3.1.The Operator processes personal data lawfully and fairly, only for purposes defined in advance and only to the extent necessary for those purposes.

3.2.Databases processed for mutually incompatible purposes are not combined.

3.3.The Operator ensures that data is accurate and lets users correct it themselves in their personal account.

3.4.Data is kept no longer than the purposes of processing or the law require, after which it is destroyed or depersonalised.

4. Purposes of processing

4.1.The Operator processes personal data for the following purposes:

• registration on the Site, signing in to the personal account and operation of the account;
• comments, “Helpful” ratings, complaints about comments, saved articles, following authors and rubrics;
• review of author applications and verification of specialists’ professional qualifications;
• publication of specialists’ profiles and of author and reviewer bylines on articles;
• editorial activity: preparing, reviewing and publishing articles;
• booking consultations, payment, and organisational correspondence between client and expert about the date and time of a consultation;
• service notifications about events in the account: signing in, application status, replies to comments, consultation bookings;
• the journal’s newsletter — only with separate consent;
• Site traffic statistics (Yandex Metrica) — only with the visitor’s consent in the cookie notice;
• moderation and protection of the Site and its users against abuse;
• replies to enquiries;
• compliance with the legislation of the Russian Federation.

5. Categories of data subjects

5.1.The Operator processes the personal data of:

• Site visitors;
• users (readers);
• specialists: authors, reviewers, experts;
• clients;
• newsletter subscribers;
• persons who have sent an enquiry to the Operator.

6. Personal data processed

6.1.Visitors: information about the browser and device, IP address, addresses of pages opened, date and time of requests, cookies (section 13).

6.2.Users: first name, surname (optional), email address, confirmation of being 18 or over, name or pseudonym for signing comments, photograph (optional), the text of comments and complaints, saved articles and subscriptions, notification settings. When signing in with Yandex ID or VK ID — the first name, surname, email address (if the service provides it) and account identifier passed on by Yandex or VK with the user’s consent.

6.3.Specialists — in addition: photograph, positioning (specialisation), therapeutic approach and methods, areas of work, information on education and further education, length of practice and description of work experience, “About me”, languages, copies of documents confirming education, practice and supervision, supervisor’s contact details (optional), payout status (self-employed or individual entrepreneur), review history, community participation rating, warnings and blocks.

6.3.1.Experts who offer consultations — in addition: services and their prices, working hours and days off, booking settings, the Telegram chat identifier for booking notifications (if the expert has connected notifications themselves), information on consultations held and payouts.

6.4.Clients — in addition: booking details (expert, service, date and time, status), payment and refund details (amount, date, status, payment identifier), and correspondence with the expert on organisational matters: the date and time of the consultation. The Operator does not receive or store bank card details: payments are accepted by the YooKassa payment service.

6.5.Newsletter subscribers: email address, date and time of consent to the newsletter.

6.6.Persons who have sent an enquiry: name and contact details given in the enquiry, the text of the enquiry.

6.7.Special categories. The Operator does not request or process information on health, biometric data, or information on race or ethnicity, political views, religious or philosophical beliefs, intimate life or criminal record. Correspondence between a client and an expert on the Site is organisational only (date, time, rescheduling); the rules for correspondence are shown in the personal account. Users are asked not to share such information in comments or messages: what a client comes to a consultation with, they discuss with the expert at the consultation itself.

7. Legal grounds for processing

7.1.Consent of the data subject (Article 6(1)(1) of the Law).

7.2.Performance of a contract to which the data subject is a party, including the Terms of Use and the contract for consultation services (Article 6(1)(5) of the Law).

7.3.Performance of obligations imposed on the Operator by the legislation of the Russian Federation (Article 6(1)(2) of the Law).

7.4.For information published on the Site (section 12) — separate consent to the dissemination of personal data (Article 10.1 of the Law).

8. Processing methods

8.1.The Operator processes personal data with and without the use of automated means.

8.2.Decisions producing legal effects for the user are not taken solely on the basis of automated processing. Specialist applications, comments, complaints and publications are checked by people: administrators and the editors.

8.3.The community participation rating is calculated automatically according to rules published in advance and affects only how a user’s activity is displayed on the Site.

9. Processing and retention periods

9.1.Account data — until the user deletes the account or withdraws consent.

9.2.Copies of a specialist’s documents — until the qualification check is complete and for as long as the specialist remains a member of the community; they are destroyed once the account is deleted.

9.3.Booking and payment records — for the periods established by the legislation of the Russian Federation.

9.4.A newsletter subscriber’s address — until they unsubscribe. Every email contains an unsubscribe link.

9.5.Server logs — no longer than 30 days.

9.6.Database backups — no longer than 14 days, after which they are overwritten.

9.7.Records of consents given (date and version of the text) — for as long as the consent is in force and for the limitation period after it is withdrawn.

10. Account deletion and destruction of data

10.1.Users can delete their account in the personal account settings. Deletion erases the email address, sign-in data, sessions, application and documents, photograph, “About me”, saved articles, subscriptions and notifications.

10.2.When deleting an account, the user chooses what to do with their comments: keep them without a name (“User deleted their account”) or delete them. If someone has already replied to a comment, it remains as a placeholder without text.

10.3.Published articles and reviews remain on the Site under the author’s name as part of the journal’s publications — without a link to the profile and without any other information about the author.

10.4.If personal data is processed unlawfully or the purpose of processing has been achieved, the Operator stops processing and destroys the data within the periods set by Article 21 of the Law. Data is removed from backups when their retention period expires (clause 9.6).

11. Disclosure of personal data

11.1.The Operator does not sell personal data or pass it to third parties for advertising.

11.2.To operate the Site, the Operator entrusts the processing of data to the following persons (Article 6(3) of the Law):

• Timeweb Cloud — hosting of the Site, database and files on servers in the Russian Federation;
• Yandex — sending the Site’s emails, signing in with Yandex ID, protecting forms against automated submissions (Yandex SmartCaptcha), visit statistics (Yandex Metrica, with the visitor’s consent);
• VK — signing in with VK ID;
• YooKassa — accepting payment for consultations and processing refunds.

11.3.The expert with whom a client has booked receives the client’s name and the booking details. The client receives the contact for the consultation (a video call link) in their personal account.

11.4.The expert conducts the consultation in person. The Operator does not receive or process information the client shares with the expert during the consultation. The expert ensures its confidentiality in accordance with the law and professional ethics.

11.5.Personal data is provided to state authorities only in the cases and in the manner provided for by the legislation of the Russian Federation.

12. Information visible to everyone

12.1.The following is shown publicly on the Site — on the basis of consent to dissemination (clause 1.5), and in the case of a name or pseudonym in comments, because the user publishes the comment themselves:

• for a user — their name or pseudonym, photograph (if uploaded) and the text of their comments;
• for a specialist — first name and surname, photograph, positioning, approach, areas of work, education and further education, length of practice, work experience, “About me”, languages, the mark showing that their qualifications have been verified, articles and reviews.

12.2.Email addresses, specialists’ documents, payout status, supervisors’ contact details and information on bookings and payments are not published.

12.3.Specialists’ documents are kept in private storage. Only the administrator and the editor-in-chief can open them, via a temporary link, and every view is logged.

13. Cookies

13.1.The Site uses only strictly necessary cookies and the browser’s local storage:

• session cookie — to keep the user signed in to the personal account (up to 30 days);
• sign-in service cookies — protection against request forgery and returning to the right page;
• registration cookie — stores the name, age confirmation and consent mark entered at registration until the user follows the link in the email (up to 24 hours);
• a record in local storage of the visitor’s choice in the cookie notice;
• Yandex Metrica cookies (names beginning with _ym) — only with the visitor’s consent, for up to 1 year.

13.2.The Yandex Metrica web analytics service is enabled only after the visitor consents (the “Accept” button in the cookie notice); session recording (Webvisor) is switched off. Consent can be withdrawn using the “Cookie settings” link at the bottom of the page. No advertising cookies are used on the Site.

13.3.Visitors may block cookies in their browser settings; signing in to the personal account will then be unavailable.

13.4.The full list of cookies with their retention periods is in the Cookie Policy: psy.one/cookies.

14. Editorial activity

14.1.Journal articles are published under their authors’ names, and reviewers are named under the article. A specialist agrees to this by submitting an article or accepting an article for review.

14.2.Articles from the archive of the previous version of the Site are published under the name of the author given in the original publication. The author may contact the Operator to link the article to their account or change the byline.

14.3.Comments are moderated. Users may sign their comments with a pseudonym.

15. Measures to protect personal data

15.1.The Operator takes legal, organisational and technical measures to protect personal data against unauthorised access, destruction, modification, blocking, copying, provision and dissemination:

• data is transmitted only over the secure HTTPS protocol;
• sign-in by a one-time link sent by email, or with Yandex ID or VK ID, with no passwords stored;
• role-based access control: each staff member sees only what they need for their work;
• specialists’ documents are kept in private storage, with access via temporary links and every access logged;
• a log of actions by administrators and editors;
• daily backups;
• appointment of a person responsible for organising the processing of personal data.

16. Rights of the data subject

16.1.Users have the right to:

• obtain information about the processing of their personal data;
• demand that their data be clarified, blocked or destroyed if it is incomplete, out of date, inaccurate, unlawfully obtained or not necessary for the stated purpose;
• withdraw their consent to the processing of personal data;
• unsubscribe from the newsletter using the link in any email;
• correct their data and delete their account in the personal account settings;
• appeal against the Operator’s actions or inaction to Roskomnadzor (the Russian data protection authority) or in court.

17. How to submit requests

17.1.Requests and withdrawals of consent should be sent to psy@psy.one from the email address given in the account, or by post to the Operator’s postal address.

17.2.The Operator replies within 10 working days of receiving the request. This period may be extended by no more than 5 working days, with notice and an explanation of the reasons.

17.3.After consent is withdrawn, the Operator stops processing and destroys the data within 30 days, unless otherwise provided by law. Withdrawing consent means deleting the account.

18. Confidentiality

18.1.The Operator and persons who have obtained access to personal data do not disclose it to third parties or disseminate it without the data subject’s consent, unless otherwise provided by law.

19. Persons under 18

19.1.The Site is intended for persons over 18. When registering, users confirm that they are 18 or over.

19.2.If the Operator becomes aware that an account has been created by a person under 18, the account will be deleted together with its data.

20. Cross-border transfer and localisation

20.1.Personal data is not transferred across borders.

20.2.The recording, systematisation, accumulation, storage, clarification and retrieval of the personal data of citizens of the Russian Federation are carried out using databases located in the Russian Federation.

21. Changes to this Policy

21.1.The Operator may amend this Policy. A new version takes effect when it is published on the Site, unless it states otherwise.

21.2.Registered users are notified by email of changes that extend the list of data processed or the purposes of processing.

22. Final provisions

22.1.Matters not covered by this Policy are governed by the legislation of the Russian Federation.

22.2.Any questions about the processing of personal data may be sent to psy@psy.one.