Version 1. In force from 1 August 2026.
1. Who we are
The controller of personal data collected through this website, and the operator of personal data for the purposes of Russian Federal Law No. 152-FZ of 27 July 2006 "On Personal Data", is Yalanzhi & Partners LLC (ООО «ЯЛАНЖИ И ПАРТНЕРЫ»), a legal entity registered in the Russian Federation, INN 9717182760, KPP 771701001, OGRN 1257700370641, registered office: Olminskogo proezd 4, office 8n, Moscow 129085, Russian Federation.
Contact for all privacy matters, including requests to exercise your rights: office@lawyersinrussia.com, or by post to the registered office above.
We have not appointed a data protection officer, as we are not required to under Article 37 of the GDPR. We have not appointed a representative in the European Union under Article 27 of the GDPR. Enquiries from data subjects in the EU, the United Kingdom and elsewhere are handled directly by the contact above.
2. What this policy covers
This policy applies to personal data we process through lawyersinrussia.com. It does not cover the processing of client data in the course of providing legal services, which is governed by the retainer agreement, by the Federal Law "On Advocacy and the Legal Profession in the Russian Federation", and by the regime of legal professional privilege under Article 8 of that Law.
Our Russian-language site нуженадвокат.рф has its own separate privacy policy.
3. What data we collect
3.1 Data you give us
Through the enquiry form and by email, telephone or messaging application: your name, telephone number, email address, country, and the content of your enquiry. Because of the nature of our practice, an enquiry frequently contains information about criminal proceedings — see section 6 on special categories.
3.2 Data collected automatically
- IP address, date and time of the request, and information about your device and browser.
- The page from which you arrived (referrer), the page you landed on, and the page from which you submitted an enquiry.
- Advertising parameters in the address of the page — utm_source, utm_medium, utm_campaign, utm_content, utm_term — and advertising system identifiers such as gclid, yclid, fbclid, msclkid.
- A visitor identifier stored in a cookie, and the time spent on the site before submitting an enquiry.
- Where you have consented to analytics, statistical data collected by the analytics services listed in section 8.
3.3 First-touch and last-touch attribution
We record both the source that brought you to the site the first time and the source of the visit on which you submitted an enquiry. The first-touch values are written to a cookie on your first visit and are not overwritten afterwards. This tells us which advertising actually works.
4. Why we process it, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Responding to your enquiry and providing legal services | Contact details, content of the enquiry | Art. 6(1)(b) — steps at your request prior to entering into a contract; Art. 6(1)(f) — legitimate interest in responding to enquiries |
| Recording the fact and version of your consent | Consent timestamp, policy version, visitor identifier | Art. 6(1)(c) — legal obligation; and Art. 152-FZ, which requires the operator to be able to prove consent |
| Web analytics and measuring advertising effectiveness | Behavioural and attribution data | Art. 6(1)(a) — your consent |
| Security of the site, prevention of spam and abuse | IP address, request metadata | Art. 6(1)(f) — legitimate interest |
| Complying with legal obligations | As required | Art. 6(1)(c) |
Under Russian law, processing is carried out on the basis of your consent under Article 6(1)(1) of 152-FZ and, where processing is necessary to perform a contract to which you are a party, under Article 6(1)(5).
5. Technically necessary processing
Some processing happens without consent because the site cannot function otherwise: session handling, the record of your cookie preferences, protection against automated abuse, and the retention of your theme preference. This is a legitimate interest under Article 6(1)(f) of the GDPR and is expressly permitted under the ePrivacy Directive for cookies strictly necessary to provide a service you have requested.
6. Special categories of data
An enquiry about a criminal case will normally contain personal data relating to criminal convictions and offences within the meaning of Article 10 of the GDPR, and may amount to a special category of personal data under Article 4(1) of Russian Federal Law No. 152-FZ.
We process it only because you have chosen to send it to us in order to obtain legal assistance, and we process it on the basis of your explicit consent and for the establishment, exercise or defence of legal claims. We ask you not to include more detail in a web form than is necessary for us to understand what has happened; the substance of a case is better discussed on a confidential channel.
Analytics session-recording is configured so that the fields of the enquiry form are masked and their contents are not recorded. See section 8.
7. Who we share it with
- Our customer relationship management system, operated by a processor in the Russian Federation, which holds enquiries so that they are not lost. It receives your contact details, the content of the enquiry and the attribution data.
- Our hosting provider. The site and its database are hosted on a server located in Singapore.
- The analytics providers listed in section 8, and only where you have consented.
- Our email provider, for the backup notification channel that ensures an enquiry is not lost if the CRM is unavailable.
- Public authorities, where disclosure is required by law. Information covered by legal professional privilege is not disclosed: under Article 8 of the Federal Law on Advocacy an advocate may not be questioned about circumstances that became known to them in connection with a request for legal assistance, and that regime is indefinite.
We do not sell personal data, and we do not share it for cross-context behavioural advertising, within the meaning of the California Consumer Privacy Act as amended by the CPRA.
8. Analytics and cookies
Subject to your consent, we use Google Analytics 4 and Google Tag Manager (Google Ireland Limited / Google LLC) and Yandex.Metrica (Yandex LLC, Russian Federation).
The Yandex.Metrica configuration includes session recording ("Webvisor"), which records how a page is used. Because that is a record of behaviour rather than a statistic, it is loaded only after you have consented to analytics cookies, and the fields of the enquiry form are masked so that their contents do not appear in a recording.
Until you make a choice in the cookie banner, no analytics script is executed and no analytics cookie is set. If your browser sends a Global Privacy Control signal, we treat it as a refusal of analytics and advertising cookies without showing you a banner. The full list of cookies is in our Cookie Policy, and you can change your choice at any time from the link in the footer.
9. International transfers
We are established in the Russian Federation and our hosting is in Singapore. If you are in the European Economic Area or the United Kingdom, your data will therefore be transferred outside it, to countries that have not been the subject of an adequacy decision by the European Commission.
We rely on Article 49(1)(b) of the GDPR where the transfer is necessary to perform, or to take steps prior to entering into, a contract at your request — which is the situation when you send us an enquiry — and on Article 49(1)(e) where it is necessary for the establishment, exercise or defence of legal claims. Where you consent to analytics, that transfer is made on the basis of your explicit consent under Article 49(1)(a), given after being informed of the risks. We hold your data on servers under our control and apply the security measures described in section 12.
10. How long we keep it
- Enquiries that do not lead to instructions: 3 years from the last contact, then deleted.
- Client files: for the period required by professional rules and by the retainer, and in any event for as long as necessary for the establishment, exercise or defence of legal claims.
- Consent records: 3 years after the consent is withdrawn or expires, because we must be able to prove that consent was given.
- Server logs: 12 months.
- Analytics data: as configured in the relevant service, and not longer than 26 months.
11. Your rights
11.1 If the GDPR or UK GDPR applies to you
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), and the right to withdraw consent at any time without affecting the lawfulness of processing before the withdrawal. You also have the right to lodge a complaint with a supervisory authority in your country of residence.
11.2 If you are a California resident
You have the right to know what personal information is collected, used and disclosed; to delete it; to correct it; to opt out of sale or sharing; and not to be discriminated against for exercising these rights. We do not sell or share personal information, so there is nothing to opt out of — but the request will be honoured if you make it. Residents of other US states with comprehensive privacy laws have equivalent rights and the same mechanism applies.
11.3 If Russian law applies to you
Under Articles 14, 20 and 21 of 152-FZ you have the right to obtain confirmation of processing and information about it, to require correction, blocking or destruction of data that is incomplete, out of date, inaccurate or unlawfully obtained, and to withdraw consent at any time.
11.4 How to exercise them
Write to office@lawyersinrussia.com or to the registered office. Your request must allow us to identify you and must state what you are asking for. We respond within one month of receipt, extendable by two further months for complex requests, and within the periods set by 152-FZ where that law applies. We do not charge for this.
Note one limit: material covered by legal professional privilege cannot be released even to the person it concerns where releasing it would breach the privilege owed to another person, and the privilege regime is indefinite.
12. Security
The site is served exclusively over TLS. Access to the database is restricted to the local interface of the server and is not exposed to the internet. Administrative access requires a separate password-protected account. Secrets and integration keys are held outside the code repository in files readable only by the service account. Enquiry data is transmitted to our CRM over an encrypted connection.
13. Children
This site is not directed at persons under 18 and we do not knowingly collect their personal data. Where an enquiry concerns a minor, we expect it to be made by a parent, guardian or other legal representative, who is then the data subject in respect of the contact details supplied.
14. Automated decision-making
We do not carry out automated decision-making producing legal effects concerning you, and we do not profile you within the meaning of Article 22 of the GDPR.
15. Changes
We may amend this policy. Each amendment increases the version number shown at the top. Where you have given consent, the version in force at that moment is recorded with your consent, so an earlier consent remains tied to the text you actually saw. Material changes are announced on this page.