Unofficial translation. The Russian version of the document has legal force.
Open the Russian versionPlatform «Найди Йогу» (website: naidiyogu.ru)
Version: v1.2 Publication Date: February 1, 2026 Date Updated: August 6, 2026
1.1. This Privacy Policy (hereinafter – “Policy”) has been developed in accordance with Federal Law of 27.07.2006 No. 152-FZ “On Personal Data” (hereinafter – “152-FZ”), as well as other normative legal acts of the Russian Federation in the field of processing and protection of personal data.
1.2. The Policy defines the procedure for processing personal data and the measures to ensure their security undertaken by the Operator, and applies to all personal data that the Operator processes when using the platform «Найди Йогу», located at naidiyogu.ru (hereinafter – “Platform”).
1.3. Personal Data Operator:
Brenzovich Evgenii Aleksandrovich;
Status: individual entrepreneur (sole trader / IP);
INN: 310802761300;
OGRNIP: 326310000057774;
Mailing address: Belgorod Region, Grayvoronskiy District, village Pervaya-Novostroevka, Pervomayskaya Street, building 96;
Email address of the Operator: info@naidiyogu.ru.
1.4. Contact for Personal Data Processing Issues. For any questions related to personal data processing, as well as to exercise the rights of a data subject, you may contact: info@naidiyogu.ru.
1.5. This Policy is publicly available and is posted freely on the website naidiyogu.ru in accordance with Part 2 of Article 18.1 of 152-FZ.
1.6. By using the Platform, registering on it, and/or providing your personal data, the subject confirms that they have read this Policy. Consent to process personal data, which requires separate expression by law, is formalized through independent consent forms.
This Policy uses terms as defined in Article 3 of 152-FZ:
Other terms related to the operation of the Platform:
3.1. The Operator processes personal data on the following legal basis (Article 6 of 152-FZ):
Consent of the data subject to process their personal data (clause 1 of Part 1 of Article 6, Article 9 of 152-FZ) – formalized through separate consent forms (including marketing consent, consent for use of images/videos in advertising and others);
Performance of a contract to which the data subject is a party (clause 5 of Part 1 of Article 6 of 152-FZ) – the User Agreement (offer) governing the use of the Platform;
Achievement of purposes provided by law, and fulfillment of functions assigned to the Operator (fulfillment of operator obligations, maintenance of records, etc.);
Exercise of rights and legitimate interests of the Operator or third parties, provided that the rights and freedoms of the subject are not violated (clause 7 of Part 1 of Article 6 of 152-FZ) – in the part concerning ensuring the functionality and security of the Platform, preventing abuse.
3.2. Consent to process personal data is specific, substantive, informed, conscious and unambiguous. A subject has the right to withdraw consent in accordance with section 14 of this Policy.
The Operator processes personal data in accordance with the principles established by Article 5 of 152-FZ:
The Operator processes personal data of the following categories of subjects:
6.1. Account Data (common to all users):
Email address;
Password (stored exclusively in hash form; the Operator does not have access to it in open form);
Interface language;
Fact of email address confirmation (verification).
6.2. Personal Data of Students:
Name;
Phone number;
Telegram identifier/username;
Photograph;
Profile description (bio);
City;
Year of birth;
Month when yoga practice started;
Mark of marketing consent;
Selected yoga directions (styles);
History of class bookings;
Favorites list;
Time of last activity.
6.2.1. Personal Data of Buyers (when purchasing courses, webinars, memberships):
order and purchase history (service name, date and amount of payment, payment identifier);
email address for sending the fiscal receipt;
information on acceptance of offers (date and time, document version, IP address, device technical data);
information on webinar registration and participation (including the guest name when signing up without registration, join and leave times);
information on claims for withdrawal from a service and refunds.
6.3. Personal Data of Instructors:
First and last name;
Phone number;
Telegram identifier/username;
Email address;
Photograph;
Video materials;
Certificates (qualification documents);
Profile texts (description, methodology, etc.);
Class schedule;
Own student data in Instructor’s CRM: contact data, private notes, tags, visit history.
6.4. Personal Data of Studio Representatives:
Studio name;
Address;
Phone number;
Email address;
Website;
Social media links;
Prices;
Photographs;
Access to data of students who attended the Studio’s classes (in the scope provided by functionality and consents, see section 11).
6.5. Cross-cutting Data (applicable to different categories of users):
User private messages – are private; are not processed by artificial intelligence;
Private notes in Instructor’s CRM – are not transferred to Studios;
User activity log (log);
Device identifiers and notification subscriptions (device push tokens, web-push subscription addresses) — for push notification delivery;
Advertising attribution parameter yclid (Yandex advertising click tag);
Cookies and session data (including JWT authorization tokens) – see section 10.
6.6. The Operator does not request and deliberately does not process special categories of personal data (regarding racial, national origin, political views, religious or philosophical beliefs, health status, intimate life). If a subject independently places such information in free fields of their profile or in correspondence, they do so voluntarily and accept associated risks.
The Operator processes personal data for the following purposes:
yclid parameter, transmission of data to advertising systems (see section 9).8.1. Personal data is stored no longer than required by the purposes of their processing, unless a different period is set by federal law or contract.
8.2. Personal data is processed during the entire period of validity of the user’s account on the Platform. Specific storage periods for the main data categories:
| Data category | Storage period |
|---|---|
| Account and profile data | Entire period of validity of the account; after its deletion — deletion or depersonalization within 30 days |
| Chat correspondence | Entire period of validity of the accounts of the correspondence participants |
| Information on offer acceptances and granted consents (date, text version, IP address, device technical data) | At least 5 years from the date of acceptance (withdrawal) — to confirm the fact and content of the consent/acceptance |
| Payment and fiscal documents (fiscal receipts, payment information), agent reports | At least 5 years (Federal Law No. 54-FZ, Tax Code of the Russian Federation) |
| Versions of offer contracts accepted by the user | 3 years from the date of termination of the relevant version |
| User activity log | Up to 6 months in the operational database; thereafter — archiving in depersonalized form or deletion |
| Device push tokens and notification subscriptions | Until the user disables the subscription or deletes the account |
| Database backups | Up to 7 days; data of deleted accounts disappears from backups as they are rotated |
8.3. Cessation of Processing and Deletion. Processing of personal data ceases in the following cases:
Deletion of the user’s account by the user;
Withdrawal of consent by the subject, if processing was carried out solely on the basis of consent and there are no other legal grounds;
Achievement of processing purposes or loss of necessity in their achievement;
Detection of unlawful personal data processing.
8.4. Upon achievement of processing purposes, withdrawal of consent (in the absence of other grounds), or deletion of an account, personal data shall be deleted or depersonalized within a reasonable time, except for data whose storage obligation is established by law.
8.5. Individual information (for example, data necessary to comply with legal requirements, or data whose deletion would violate the rights of third parties) may be stored for periods established by the legislation of the Russian Federation.
8.6. A request for deletion of personal data is sent to info@naidiyogu.ru. The Operator’s response procedure – see section 14.
8.7. Data that Instructor or Studio process as independent operators (including student data in Instructor’s CRM, student data at the Studio) are stored and deleted by such persons in accordance with their own policies and obligations (see section 11).
9.1. The Operator does not sell personal data and does not distribute it to an indefinite circle of persons. Transfer (provision) of personal data is carried out only in the scope and for the purposes described below.
9.2. Instructors. Upon booking a Student for a class, the relevant Instructor is provided with Student data necessary to conduct the class and maintain contact (name, contact data, booking information). Instructor uses CRM tools to work with their students.
9.2.1. Service Providers (Teachers and Studio Sellers). When a Buyer purchases an online course, paid webinar or membership, the relevant Provider is provided with the data necessary for the performance of the contract (name, contact data, order information). The Provider is an independent operator of the received personal data to the extent of its own processing purposes.
9.2.2. Acquiring Bank (JSC “TBank”). To process the payment and generate the fiscal receipt (Federal Law No. 54-FZ), the data necessary for the payment (including the email address for sending the receipt) is transferred to the acquiring bank. Bank card payment data is entered on the bank’s secure page and is not transferred to the Operator.
9.3. Studios – Independent Personal Data Operators. Studios (legal entities or sole proprietors) receive access to data of students who attended their classes, in the scope provided by Platform functionality and relevant consents.
Disclosure by Studio of Instructor’s student data is carried out with Instructor’s consent to disclosure of student data to the Studio.
The Studio acts as an independent personal data operator in respect of the received data: it independently determines the purposes and methods of their further processing, has its own personal data processing policy and independently bears responsibility for compliance with legal requirements. The Platform Operator is not responsible for personal data processing carried out by the Studio after its receipt.
9.4. Advertising and Analytics Systems (Yandex). For the purpose of evaluating advertising effectiveness, traffic analytics and attribution of transitions, the Operator uses Yandex services (Yandex.Metrica, Yandex.Direct) and transmits technical identifiers and the yclid advertising attribution parameter to them. Processing of such data is also governed by documents of the relevant services.
9.4.1. Email Delivery Service. For sending emails (service notifications and, with marketing consent, mailings), the Mail.ru email service (VK) is used; the recipient’s address and the content of the email are transferred to it.
9.4.2. Push Notification Delivery Services. For delivering push notifications to devices, notification delivery gateways are used (including RuStore Push (VK)), to which the device token and the content of the notification are transferred.
9.4.3. Reference Data Verification Services (DaData, Federal Tax Service of Russia). For address input suggestions and verification of service providers’ details (INN, BIC, tax status), the DaData services and the Federal Tax Service of Russia service “Verification of the NPD taxpayer status” are used, to which the corresponding entered values are transferred.
9.4.4. Video Services. For conducting webinars and online classes, video conferencing infrastructure on servers in the Russian Federation (Clodo) is used; when participants connect, the displayed name and connection parameters are processed.
9.5. Infrastructure Providers. To store and process data, the Operator uses infrastructure in the territory of the Russian Federation (see section 12): server infrastructure and databases, Cloud.ru and Yandex Cloud object storages. Infrastructure providers process data on the Operator’s behalf in accordance with Part 3 of Article 6 of 152-FZ and do not determine processing purposes.
9.6. Artificial Intelligence Services for Content Translation (UGC). Translation of user content is performed with the involvement of external artificial intelligence services acting on the Operator’s behalf (Part 3 of Article 6 of 152-FZ) with confidentiality and data security conditions. Before transfer, texts undergo automatic depersonalization (email addresses, phone numbers and account identifiers are removed from them). The services process data exclusively for translation purposes and do not determine processing purposes.
10.1. The Platform uses cookies and similar technologies (including JWT authorization tokens, session data) to ensure Platform functionality, user authentication, remember settings, analytics and advertising attribution.
10.2. A detailed procedure for using cookies, their categories and methods of managing them are described in a separate document – the «Cookie Policy», posted on the website naidiyogu.ru.
11.1. Platform Operator (clause 1.3) processes personal data for the purposes specified in section 7 and ensures the functioning of the Platform.
11.2. Instructor in respect of data of their own students, which they maintain in CRM (contacts, private notes, tags, visit history), acts independently and bears responsibility for the lawfulness of their processing. Private notes of Instructor are not transmitted to Studios. In respect of storage and technical processing of students’ data in CRM, the Platform Operator acts on the Instructor’s instruction (Part 3 of Article 6 of 152-FZ): it ensures confidentiality and security of storage and does not determine the purposes of processing such data (terms of the instruction — section 5 of the Terms for Teachers).
11.3. Studio is an independent personal data operator in respect of data of students who it receives in connection with attendance of its classes. The Studio:
independently determines the purposes and methods of further processing of the received data;
is obliged to have its own personal data processing policy and ensure compliance with 152-FZ requirements;
independently bears responsibility to subjects and controlling bodies for data processing after its receipt.
11.4. The Platform Operator is not responsible for personal data processing carried out by Instructors and Studios as independent operators beyond the scope of Platform functionality.
12.1. In accordance with Part 5 of Article 18 of 152-FZ, when collecting personal data, including via the Internet, the Operator ensures recording, systematization, accumulation, storage, clarification (update, modification), extraction of personal data of Russian Federation citizens using databases located in the territory of the Russian Federation.
12.2. The Platform databases are hosted on server infrastructure in the territory of the Russian Federation; media files (photos, videos) — in object storages of Russian providers (Cloud.ru, Yandex Cloud).
12.3. All persons engaged by the Operator to process personal data on its behalf (including artificial intelligence services for user content translation – see clause 9.6) act on the basis of instructions with conditions of confidentiality and ensuring the security of personal data in accordance with Part 3 of Article 6 of 152-FZ and do not determine processing purposes.
13.1. The Operator takes necessary legal, organizational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, distribution, as well as from other unlawful actions, in accordance with Articles 18.1 and 19 of 152-FZ.
13.2. Such measures include, in particular:
Appointment of a person responsible for organizing personal data processing and determination of processing procedure;
Issuance of this Policy and other internal documents regarding personal data processing and protection;
Limitation and differentiation of access to personal data (access is provided only to authorized persons in the scope necessary to perform their functions);
Storage of passwords in hash form; use of secure data transmission protocols (channel encryption);
Application of information protection means, backup, maintenance of access and activity logs;
Placement of data on infrastructure located in the territory of the Russian Federation (section 12);
Assessment of harm that may be caused to subjects and control of measures taken.
13.3. Upon detection of incidents related to unlawful personal data processing or unauthorized access to it, the Operator takes measures to eliminate them and acts in accordance with Article 21.1 of 152-FZ: notifies Roskomnadzor of the detected incident within 24 hours, and within 72 hours submits information on the results of the internal investigation; if there is a risk of harm to data subjects — informs the subjects of the incident that occurred.
14.1. In accordance with Articles 14, 20 and 21 of 152-FZ, a data subject has the right to:
Receive information concerning the processing of their personal data (fact of processing, purposes, methods, terms, composition of data, information on persons having access and recipients);
Require clarification of personal data (correction, addition) if they are incomplete, inaccurate or outdated;
Require blocking or deletion (destruction) of personal data if they are incomplete, outdated, inaccurate, unlawfully obtained or are not necessary for the stated processing purpose;
Withdraw consent to process personal data;
Object to processing in cases established by law;
Appeal the actions or inaction of the Operator to the competent authority for the protection of data subject rights (Roskomnadzor) or in court.
14.2. A subject may exercise part of their rights independently through the Platform interface (profile editing, settings changes, withdrawal of marketing consent, account deletion). For other requests, the subject contacts info@naidiyogu.ru.
14.3. Operator’s Response Procedure and Time Limits:
Information about processing is provided to the subject in an accessible form within 10 working days from the date of request receipt (the period may be extended, but not more than 5 working days, with notice to the subject);
Upon confirmation of data inaccuracy, the Operator clarifies it within 7 working days and removes the blocking (if present);
Upon confirmation of unlawful processing, the Operator ceases it and destroys the data within 10 working days;
Upon withdrawal of consent and absence of other legal grounds, processing ceases and data is destroyed within 30 days, unless otherwise provided by law.
14.4. The subject’s request must contain information allowing identification of the subject and their account (to confirm identity the Operator may request additional information).
15.1. By posting data of third parties on the Platform (for example, when maintaining CRM or entering student information), Instructor/Studio guarantee the existence of legal grounds for such processing and independently bear responsibility for their compliance (section 11).
15.2. User private messages are private and are not used by the Operator for purposes not related to ensuring the functioning of the messaging feature; messages are not processed by artificial intelligence.
16.1. The Platform processes personal data only of adult users: registration is available from age 18. The Platform does not collect personal data of minors upon registration.
16.2. Processing of data of minors attending classes is carried out by Instructor/Studio on the basis of consent of their legal representatives and outside the scope of this Policy (section 11).
16.3. If the Operator becomes aware that personal data of a minor was provided during Platform registration, the Operator will take measures to cease processing and delete such data.
17.1. The Operator has the right to make changes to this Policy. The current version of the Policy is posted on the website naidiyogu.ru and is available to an unlimited circle of persons in accordance with Part 2 of Article 18.1 of 152-FZ.
17.2. A new version of the Policy enters into force from the moment of its posting on the website, unless otherwise provided by the new version.
17.3. In case of substantial changes affecting the conditions of personal data processing, the Operator, if possible, additionally informs users through available means.
17.4. Continued use of the Platform after changes enter into force means the user’s agreement with the current version of the Policy. Consents that require separate expression by law may be requested again in case of substantial changes to conditions.