COOKIE POLICY

1.1. Website means the website of the fotonapassport service located on the Internet at: https://fotonapassport.ru/.

1.2. fotonapassport Service / Service means the software and hardware system intended for the automated preparation of photos for documents and the creation of final files for the User.

1.3. Operator (the controller within the meaning of Article 4(7) GDPR) means the fotonapassport organization.

1.4. User means a person who uses the Website and/or the Service.

1.5. Cookies / cookie files means small text files or fragments of data that are stored on the User’s device when the User visits the Website.

1.6. Similar technologies means pixels, tags, browser local storage, device identifiers, SDKs, analytics scripts, and other technologies that make it possible to ensure the operation of the Website, analyze traffic, save settings, evaluate advertising effectiveness, and improve the Service.

1.7. Necessary cookies means cookies without which the correct operation of the Website, the personal account, authorization, payment, security, and the core functions of the Service is impossible.

1.8. Analytics cookies means cookies and similar technologies used to analyze Website traffic, User behavior, interface quality, and the performance of the Service.

1.9. Marketing cookies means cookies, pixels, and similar technologies used to evaluate advertising effectiveness, configure advertising campaigns, carry out retargeting, and display advertising messages.

2.1. This Policy forms part of the set of fotonapassport documents and applies together with:

2.1.1. the fotonapassport Public Offer Agreement;

2.1.2. the fotonapassport Personal Data Processing Policy;

2.1.3. the Consent to the Processing of Personal Data and Facial Images;

2.1.4. the Consent to Receive Advertising and Informational Messages, if the User has given such consent.

2.2. Cookies and similar technologies may contain technical data that by themselves may not identify the User but, in combination with other data, may constitute personal data.

2.3. Data obtained through cookies and similar technologies are processed in accordance with the fotonapassport Personal Data Processing Policy.

2.4. The Operator uses cookies and similar technologies only for the purposes specified in this Policy.

3.1. fotonapassport may use the following categories of cookies and similar technologies:

3.1.1. necessary cookies;

3.1.2. functional cookies;

3.1.3. analytics cookies;

3.1.4. marketing cookies.

3.2. The specific set of cookies may change depending on the Website functions used, updates to the Service, and the analytics and advertising tools connected.

3.3. The Operator may update the list of cookies and similar technologies used without prior notice to the User, provided that such changes do not worsen the User’s position and do not contradict applicable law, including the GDPR and Czech law. If the User has refused a category of cookies, the refusal also applies to new technologies of that category.

4.1. Necessary cookies are used for the correct operation of the Website and the Service.

4.2. Such cookies may be used for the following purposes:

4.2.1. loading the pages of the Website;

4.2.2. ensuring the operation of the personal account;

4.2.3. authorization of the User;

4.2.4. maintaining the User’s session;

4.2.5. placing an order;

4.2.6. uploading photos;

4.2.7. providing access to the result;

4.2.8. ensuring security;

4.2.9. preventing technical errors and abuse;

4.2.10. making payments;

4.2.11. remembering that cookie settings have been chosen.

4.3. Necessary cookies are not used for advertising targeting.

4.4. Disabling necessary cookies may make it impossible to use the Website, the personal account, photo uploading, order placement, payment, or receipt of the result.

4.5. Necessary cookies are used without the User’s consent, since they are strictly necessary for the operation of the Website and the provision of the service expressly requested by the User (exemption under § 89(3) of Czech Act No. 127/2005 Coll. and Article 5(3) of Directive 2002/58/EC). The subsequent processing of the related data is based on the performance of the contract with the User (Article 6(1)(b) GDPR) or on the Operator’s legitimate interest in the security of the Website and the Service (Article 6(1)(f) GDPR).

5.1. Functional cookies are used to save the User’s settings and to make the Website more convenient to use.

5.2. Such cookies may be used for the following purposes:

5.2.1. saving the selected interface language;

5.2.2. saving personal account settings;

5.2.3. remembering the selected order parameters;

5.2.4. saving the User’s preferences;

5.2.5. improving the user experience.

5.3. Functional cookies and local storage entries store settings chosen by the User or needed for a function requested by the User (for example, the interface language or the selected order parameters); they are not used for analytics or advertising. They are used together with necessary cookies on the same legal basis (clause 4.5) and are not a separate category in the cookie settings.

6.1. Analytics cookies and similar technologies are used to analyze the operation of the Website and to improve the quality of the Service.

6.2. fotonapassport may use the Yandex.Metrica (Яндекс.Метрика) and Webvisor services to collect aggregated or pseudonymized statistics on visits to the Website and actions of Users.

6.3. Analytics cookies may be used for the following purposes:

6.3.1. counting the number of visitors;

6.3.2. analyzing referral sources;

6.3.3. analyzing the pages visited by Users;

6.3.4. evaluating the usability of the interface;

6.3.5. identifying technical errors;

6.3.6. improving the structure of the Website;

6.3.7. analyzing conversions and the effectiveness of the Service.

6.4. Yandex.Metrica and Webvisor may collect technical data, including the IP address and information about the browser, device, operating system, time of visit, referral source, and actions on the Website.

6.5. Data collected using Yandex.Metrica are used by the Operator for analytics and improvement of the Service. Unless the User has refused analytics and marketing cookies, the Operator may transfer from its server to Yandex.Metrica information about a completed payment (the order number, amount, payment time, advertising click identifier and Yandex.Metrica visitor identifier) in order to assess the effectiveness of advertising. The User’s name, email address, phone number and photos are not transferred in this case.

6.6. Yandex.Metrica and Webvisor are enabled by default from the User’s first visit to the Website, unless the User has refused analytics cookies. The User may refuse analytics cookies at any time in the cookie banner (“Customize” → “Necessary only” or by turning off the “Analytics” category) or via the “Cookie settings” link at the bottom of the Website pages; the refusal is saved and applies to subsequent visits from the same browser. The User may also restrict the collection of analytics data by disabling cookies in the browser settings or by using available analytics-blocking tools.

6.7. The processing of data collected through analytics cookies is based on the Operator’s legitimate interest in measuring, improving and promoting the Service (Article 6(1)(f) GDPR). The User may object to this processing and refuse analytics cookies at any time, with effect for the future (Article 21 GDPR), in the ways described in clause 6.6; the refusal is free of charge and does not limit the use of the Service. Yandex.Metrica and Webvisor are provided by Yandex, and the data collected are transferred to and processed in the Russian Federation. The Russian Federation is a third country for which the European Commission has not adopted an adequacy decision. Standard Contractual Clauses apply only where they have been concluded with the provider; the Operator does not claim that such clauses or other appropriate safeguards are in place for this transfer. The User is informed of the possible risks of such transfer: the level of protection of personal data in the third country may be lower than in the European Union, public authorities of that country may be able to access the data, and it may be more difficult for the User to exercise their rights and obtain effective legal remedies. A User who does not wish such data to be transferred may refuse analytics cookies as described in clause 6.6.

6.8. On language versions of the Website other than Russian, the Website may also use Google Analytics 4, provided by Google, through the Google tag (gtag.js). The Google tag is not loaded on the Russian language version of the Website. Google Analytics 4 may set its own cookies (for example, “_ga” and “_ga_<ID>”) and collect technical data, including the IP address and information about the browser, device, operating system, pages visited (page addresses are transferred without access tokens or payment identifiers), referral source, time of visit and actions on the Website.

6.9. The Google tag uses Google Consent Mode (version 2), which sets the following default state before the tag loads:

6.9.1. if the User has made a choice in the cookie banner or in the cookie settings, the Google tag follows that choice: refusal of analytics cookies sets Google analytics storage to “denied”, and refusal of marketing cookies sets Google advertising storage, the use of user data for advertising and ad personalization to “denied”;

6.9.2. if the User has not made a choice and appears to be located in the EU/EEA, the United Kingdom or Switzerland (determined by the country of the IP address, the time zone of the device or, if neither is available, the region of the browser language), all Google storage is set to “denied”. In this state the Google tag does not store or read Google cookies on the User’s device and sends Google only cookieless signals (for example, about a page view or an event, together with technical information about the browser and the consent state), which Google may use for aggregated measurement and modelling; advertising click identifiers in such signals are redacted;

6.9.3. if the User has not made a choice and appears to be located elsewhere, Google storage is “granted” by default until the User refuses the relevant category of cookies. In this case the Operator additionally instructs Google to apply the “denied” state to visitors whom Google itself attributes, by their IP address, to the EU/EEA, the United Kingdom or Switzerland.

6.10. The processing of data collected through Google Analytics 4 is based on the Operator’s legitimate interest in measuring, improving and promoting the Service (Article 6(1)(f) GDPR); the User may refuse and object as described in clauses 6.6 and 6.7. Data collected by Google may be processed outside the EEA, including in the USA. The User may also review Google’s data processing rules on Google’s official websites.

7.1. Marketing cookies, pixels, and similar technologies are used to evaluate advertising effectiveness and to configure advertising campaigns.

7.2. fotonapassport may use VK Pixel to analyze advertising effectiveness, evaluate User actions after clicking on advertisements, build audiences, and configure advertising campaigns.

7.3. Marketing technologies may be used for the following purposes:

7.3.1. evaluating the effectiveness of advertisements;

7.3.2. analyzing advertising click-throughs;

7.3.3. configuring advertising audiences;

7.3.4. retargeting;

7.3.5. excluding irrelevant advertising;

7.3.6. improving advertising materials;

7.3.7. measuring conversions.

7.4. VK Pixel may collect technical data about the User’s actions on the Website, including page visits, completion of target actions, and information about the browser, device, and referral source.

7.5. The Operator does not transfer to VK Pixel the User’s uploaded photos, final PDF/JPG/ZIP files, payment data, the content of support requests, or other sensitive data not required for advertising analytics.

7.6. VK Pixel and other marketing cookies and pixels are enabled by default from the User’s first visit to the Website, unless the User has refused marketing cookies. The User may refuse marketing cookies at any time in the cookie banner (“Customize” → “Necessary only” or by turning off the “Marketing” category) or via the “Cookie settings” link at the bottom of the Website pages; the refusal is saved and applies to subsequent visits from the same browser.

7.7. The processing of data collected through marketing cookies and pixels is based on the Operator’s legitimate interest in measuring, improving and promoting the Service, including evaluating the effectiveness of its advertising (Article 6(1)(f) GDPR). The User may object to this processing and refuse marketing cookies at any time, with effect for the future (Article 21 GDPR), in the ways described in clause 7.6; the refusal is free of charge and does not limit the use of the Service. VK Pixel is provided by VK, and the data collected are transferred to and processed in the Russian Federation, a third country without an adequacy decision of the European Commission. Standard Contractual Clauses apply only where they have been concluded with the provider; the Operator does not claim that such clauses or other appropriate safeguards are in place for this transfer. The risks of such transfer are described in clause 6.7; a User who does not wish such data to be transferred may refuse marketing cookies as described in clause 7.6.

7.8. On language versions of the Website other than Russian, the Website may also use Google Ads conversion measurement and advertising features, provided by Google, through the Google tag (gtag.js). Google Ads may set its own cookies (for example, “_gcl_au” and “_gcl_aw”) and process technical data about clicks on Google advertisements, visits and actions on the Website in order to measure conversions, evaluate the effectiveness of advertising and configure advertising audiences. The default state of the Google tag and the effect of the User’s choice are described in clause 6.9; refusal of marketing cookies sets Google advertising storage, the use of user data for advertising and ad personalization to “denied”.

7.9. On language versions of the Website other than Russian, after a payment in a currency other than the Russian rouble (via Norelio), the Google tag may send Google information about the completed purchase (the payment identifier, amount and currency), subject to the Google Consent Mode state described in clause 6.9. In addition, the Operator may transfer from its server to Google Ads information about such a payment (the payment identifier, amount, currency, payment time and the Google advertising click identifier) in order to assess the effectiveness of advertising. Such a server-side transfer is not made if the User has refused marketing cookies, and for Users in the EU/EEA, the United Kingdom or Switzerland (or whose country cannot be determined) it is made only if the User has accepted marketing cookies in the cookie banner or in the cookie settings. Payments made on the Russian language version of the Website and payments in Russian roubles are never transferred to Google. The User’s name, email address, phone number and photos are not transferred to Google.

7.10. The legal basis and the User’s right to object described in clause 7.7 also apply to Google Ads. Data collected by Google may be processed outside the EEA, including in the USA.

8.1. When cookies and similar technologies are used, the following data may be processed:

8.1.1. IP address;

8.1.2. User-Agent;

8.1.3. browser type;

8.1.4. device type;

8.1.5. operating system;

8.1.6. screen resolution;

8.1.7. browser language;

8.1.8. date and time of the visit;

8.1.9. addresses of the pages visited;

8.1.10. source of referral to the Website;

8.1.11. actions of the User on the Website;

8.1.12. information about clicks, views, click-throughs, and events;

8.1.13. session identifiers;

8.1.14. information about the selected cookie settings;

8.1.15. information about the version of the cookie notice and the User’s decision: “OK”, “necessary only”, or “customize”;

8.1.16. an anonymous browser identifier or a session identifier, if it is used to record the cookie choice;

8.1.17. other technical data necessary for the purposes specified in this Policy.

8.2. Cookies are not used to independently obtain the User’s photos, the contents of uploaded files, final PDF/JPG/ZIP files, payment data, or correspondence with support.

8.3. Data obtained through cookies may be matched with account or order data only to the extent necessary for the operation of the Service, analytics (unless the User has refused it), security, performance of the agreement, or protection of the Operator’s rights.

8.4. The User’s choice of cookie settings is recorded not only in the browser’s local storage but also in the Operator’s server-side consent log. Such log may include the selected cookie categories, the date and time of the choice, the IP address, User-Agent, page address, referral source, anonymous browser identifier, session identifier, and user identifier, if the User is signed in.

8.5. The server-side consent log is used to record and demonstrate the User’s choice, including a refusal of analytics or marketing cookies, and to make sure that the choice is respected, to ensure security, to prevent abuse, and to protect the Operator’s rights. The legal basis for keeping the log is the Operator’s legitimate interest (Article 6(1)(f) GDPR).

9.1. Third-party services that use their own cookies and similar technologies may be used on the Website.

9.2. Such services may include:

9.2.1. Yandex.Metrica;

9.2.2. Webvisor;

9.2.3. VK Pixel;

9.2.4. Google Analytics 4 and Google Ads (the Google tag; only on language versions of the Website other than Russian);

9.2.5. the Platega, UnitPay and Norelio payment services;

9.2.6. authorization services;

9.2.7. feedback and support services, including the Talk-Me online chat;

9.2.8. other technical, analytics, or advertising services necessary for the operation of the Website.

9.3. Third-party services may independently determine the procedure for using their cookies in accordance with their own rules and policies.

9.4. The Operator does not fully control the operation of third-party cookies where such cookies are set by the respective third-party services.

9.5. The User may review the data processing rules of the respective third-party services on their official websites.

10.1. The retention period of cookies depends on their type and purpose.

10.2. Session cookies are stored temporarily and are deleted after the browser is closed or the session ends.

10.3. Persistent cookies may be stored on the User’s device for a set period or until they are deleted by the User.

10.4. Cookies used to remember the User’s settings may be stored until the settings are changed or until they are deleted by the User.

10.5. Analytics and marketing cookies may be stored for the periods established by the respective analytics services and advertising platforms.

10.6. The User may delete cookies at any time through the browser settings.

11.1. When the User first visits the Website, the User is shown a notice about the use of cookies (cookie banner).

11.2. The cookie banner is a notice. Analytics and marketing cookies are used by default from the User’s first visit until the User refuses them (subject to clause 6.9.2 for the Google tag). By clicking “OK”, the User closes the notice and saves the choice to use all categories of cookies in accordance with this Policy; the User may refuse them later at any time.

11.3. The Website may provide the option to choose cookie categories, including:

11.3.1. necessary cookies;

11.3.2. analytics cookies;

11.3.3. marketing cookies.

11.4. The cookie banner offers the options “OK” and “Customize”; in the settings window, the User may turn off individual categories of cookies or select the “Necessary only” option. Refusing non-essential cookies is free of charge and does not limit the use of the Service. The User may change their choice at any time via the “Cookie settings” link at the bottom of the Website pages.

11.5. The User may manage cookies in the following ways:

11.5.1. through the browser settings;

11.5.2. through the device settings;

11.5.3. through tracker-blocking tools;

11.5.4. through the settings of advertising platforms, if such settings are available;

11.5.5. through the “Cookie settings” link at the bottom of the Website pages, which allows the User to change previously selected settings or to refuse non-essential cookies at any time.

11.6. Disabling or deleting cookies may cause certain functions of the Website to work incorrectly, including authorization, the personal account, order placement, payment, and access to the result.

12.1. The User may independently disable or delete cookies in the settings of the browser used.

12.2. Cookie management is usually available in the following browser sections:

12.2.1. “Settings”;

12.2.2. “Privacy”;

12.2.3. “Security”;

12.2.4. “Cookies”;

12.2.5. “Site data”.

12.3. The procedure for disabling cookies depends on the specific browser and device of the User.

12.4. If the User disables cookies completely, certain functions of the Website may become unavailable or work incorrectly.

13.1. Data obtained through cookies and similar technologies may constitute personal data if they make it possible to directly or indirectly identify the User.

13.2. Such data are processed in accordance with Regulation (EU) 2016/679 (GDPR), Czech Act No. 110/2019 Coll., on Personal Data Processing, and the fotonapassport Personal Data Processing Policy.

13.3. The User may send the Operator a request regarding the processing of data obtained through cookies to support@fotonapassport.ru.

13.4. The User has the right of access, rectification, erasure, restriction of processing, data portability and the right to object at any time to processing based on the Operator’s legitimate interests, including analytics and marketing cookies (Articles 15–22 GDPR). The User may lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, www.uoou.cz) or with the supervisory authority of the EU/EEA member state of their habitual residence, place of work or place of the alleged infringement (Article 77 GDPR).

13.5. Data obtained through necessary cookies and the server-side consent log are stored on the Service’s infrastructure located in the Russian Federation. Information about this transfer and its safeguards is set out in the fotonapassport Personal Data Processing Policy.

14.1. The User may refuse the use of non-essential (analytics and marketing) cookies and object to the related processing at any time, with effect for the future (Article 21 GDPR).

14.2. Refusal of non-essential cookies does not prevent the use of the Website or of the core functions of the Service.

14.3. Refusal of necessary cookies may make it impossible to use the Website or certain functions of the Service.

14.4. If the User does not agree to the use of non-essential cookies, the User may refuse them in the cookie banner (“Customize” → “Necessary only”), through the “Cookie settings” link on the Website or change the browser settings.

15.1. The Operator may amend this Cookie Policy unilaterally.

15.2. A new version of the Cookie Policy enters into force upon its publication on the Website, unless a different effective date is specified in the new version.

15.3. The User shall independently monitor changes to this Cookie Policy.

15.4. Continued use of the Website after publication of a new version of the Cookie Policy means that the User has read the new version. If the new version introduces new purposes or new categories of non-essential cookies, the User may refuse them in the same ways as described in section 14.

For questions related to the use of cookies and data processing, the User may contact the Operator:

Organization:

fotonapassport

Website:

https://fotonapassport.ru/

Email:

support@fotonapassport.ru