Privacy policy
and personal data processing

1. Personal data operator details

The personal data operator is:

• Full name: Kuznetsova Agnessa Sergeevna
• Address: 28 V.I. Lenin Avenue, Volgograd, 400066
• Email: poas@vstu.ru

2. Purposes of personal data processing

Personal data on the Site is processed for the following purposes:

• ensuring correct operation of the Site and its individual features;
• ensuring security of the Site, administrative panel, and personal account;
• providing visitors with information about the POAS department, degree programmes, scientific activities, contacts, and schedules;
• registering users and providing access to the personal account;
• reviewing and approving user accounts by the Site administrator;
• receiving, storing, reviewing, and supporting scientific publication materials uploaded through the publication tracking service;
• generating and providing publication conclusions as part of the Site’s internal document workflow;
• publishing information on signed scientific publications in the “Education and Science” section;
• providing localized (English-language) Site content;
• publishing teacher schedules and retake timetables;
• providing access to the Site’s administrative panel;
• server-side logging of authorization events may be performed.

3. Legal grounds for personal data processing

Legal grounds for personal data processing include:

• consent of the data subject to personal data processing, expressed by completing personal account forms and/or uploading publication materials (Article 9 of Federal Law No. 152-FZ);
• processing necessary to perform the user agreement and provide the registered user with access to the personal account and publication tracking service (Article 6(1)(1) of Federal Law No. 152-FZ);
• the operator’s legitimate interest in ensuring correct operation and security of the Site regarding technical data automatically transmitted when visiting the Site, and in logging authorization events (Article 6(1)(5) of Federal Law No. 152-FZ);
• the operator’s legitimate interest in providing access to the administrative panel, protecting the administrative part of the Site, and preventing unauthorized access (Article 6(1)(5) of Federal Law No. 152-FZ).

Terms of Site use are defined by the Terms of Use published on the Site as a separate document.

4. Categories of data subjects

The operator processes personal data of the following categories of data subjects:

• Site visitors;
• registered personal account users;
• teachers whose details appear in schedules and retake timetables;
• authors and co-authors of scientific publications whose details are uploaded by users to the publication tracking service;
• users of the Site’s administrative panel.

5. List of processed personal data

The following personal data may be processed in the operation of the Site:

5.1. Site visitor data and cookies

• IP address;
• date and time of access to the Site;
• addresses of requested pages;
• technical information contained in the HTTP request and required for Site operation;
• session cookie (sessionid) — identifier of an authorized user session;
• CSRF cookie (csrftoken) — to protect forms from request forgery;
• interface language selection cookie (django_language);
• theme selection stored in browser local storage (theme), which does not contain personal data.

Web analytics services (including Yandex.Metrica, Google Analytics, and similar) are not used on the Site.

5.2. Registered personal account user data

• username (login);
• email address;
• first name;
• last name;
• password hash;
• date and time of last sign-in;
• registration date;
• administrator account approval flag;
• authorized user session data.

Phone number, postal address, and other contact details are not requested during registration. Email address verification during registration is not performed.

5.3. Data processed in the scientific publication tracking service

• publication authors’ full names;
• publication title;
• publication title in English (if provided);
• publication type;
• publication venue;
• publication description;
• uploaded publication file (PDF, DOC, DOCX formats);
• publication processing status;
• administrator comment (if any);
• record creation date;
• link between the record and the account of the user who uploaded the materials;
• conclusion files generated or uploaded as part of publication processing.

Upload access is granted only to users with administrator-approved accounts. Publications with the “Signed” status and related information (including authors’ full names, description, and file) may be available to an unlimited audience in the “Education and Science” section. Conclusion files for unsigned publications are available only to the record author, administrators, and authorized Site users. When English fields are autofilled automatically, information contained in publication text fields (including authors’ full names) may be processed by the local Argos Translate module on the Site server.

5.4. Data contained in schedules and retake timetables

• teacher’s full name;
• course name;
• retake date, time, and classroom;
• information contained in uploaded teacher schedule files (XLSX format), including group names and other data present in the file.

5.5. Administrative panel user data

• username;
• email address;
• first and last name (if provided);
• password hash;
• access rights flags (including access to the administrative panel);
• two-factor authentication data (if enabled for the administrative panel);
• IP address (or other network identifier of the request source) during authorization events;
• sign-in attempts and actions in the administrative panel to the extent provided by standard Django mechanisms.

Two-factor authentication for personal account users is not used. Two-factor authentication for the administrative panel may be enabled technically when the corresponding server setting is in place.

5.6. Other data that may appear in Site content

News materials, historical notes, event texts, uploaded PDF and presentation files, and content inside uploaded publication and schedule files may contain full names and other information about individuals as part of editorial or documentary content. Such information is processed solely for the purpose of publishing the relevant materials on the Site. When records are saved in the administrative panel, corresponding text fields may additionally be processed by Argos Translate to automatically fill empty English fields.

A separate feedback or application form collecting visitors’ personal data is not provided on the Site. Personal messages to users by email through the Site are not sent.

6. Methods of personal data processing

Personal data is processed by the following methods:

• collection and recording of personal data during registration, authorization, and use of the personal account;
• storage of personal data in the Site database (PostgreSQL);
• storage of uploaded files on the Site server;
• display of publication, schedule, and other material information on Site pages;
• use of sessions and service cookies for authorization, form protection, and interface language selection;
• caching of certain technical data in Redis;
• automated generation of conclusions from templates based on uploaded publication data;
• automated filling of empty English content fields when saving records in the administrative panel using the local Argos Translate library (ru→en translation is performed on the Site server without calling external services);
• caching of translation results in Redis to reduce server load;
• possible server-side logging of authorization events by the Django framework (if the corresponding configuration is enabled);
• use of the embedded Yandex Maps widget on the “Contacts” page;
• loading of static resources from the jsDelivr CDN and Google Fonts in the user’s browser according to Site settings.

7. Personal data processing and retention periods

Personal data is processed and stored for the following periods:

• user account data — for the lifetime of the account and thereafter to the extent necessary to handle data subject requests;
• publication and conclusion data — for as long as they are stored in the publication tracking service; publicly published information on signed publications is retained until removed from the relevant Site section;
• schedule and retake timetable data — for the period of relevance and publication of the relevant materials on the Site;
• authorized user session data — in accordance with Site settings;
• automatic text translation results cached by Argos Translate in Redis — no more than 24 hours;
• possible Django framework server logs (if the corresponding configuration is enabled) — to the extent and for the period defined by server settings;
• standard Django administrative panel action log entries — to the extent provided by the information system in use.

If information is removed from the Site, the corresponding personal data shall be deleted within no more than 30 calendar days, unless a different period is required by law.

8. Disclosure of personal data to third parties

The operator does not disclose personal data to third parties, except in the following cases:

• when disclosure is necessary for operation of individual Site features;
• when disclosure results from use of embedded third-party services loaded in the user’s browser or calling external APIs;
• when disclosure is required by the legislation of the Russian Federation.

The following third-party services may be used on the Site:

• Yandex Maps — embedded widget on the “Contacts” page;
• jsDelivr — loading Bootstrap and Swiper libraries in the user’s browser;
• Google Fonts — loading the Inter font in the user’s browser.

The Argos Translate library installed and running on the Site server is used for automatic text translation when filling English fields. Personal data is not transferred to external machine translation services. Personal data is not sent by email through the Site.

9. Personal data security measures

The operator takes necessary organizational and technical measures to protect personal data against:

• unauthorized access;
• alteration;
• disclosure;
• destruction;
• other unlawful actions.

In particular, the Site applies the following measures:

• hashing of user passwords;
• use of secure cookies for sessions and CSRF when operating over HTTPS;
• restricted access to publication and conclusion files outside the public section of signed publications;
• validation of the type of uploaded publication files;
• administrator approval of accounts before granting upload access for publications;
• optional restriction of administrative panel access by allowed IP address list (when configured on the server);
• optional two-factor authentication for the administrative panel (when configured on the server);
• configuration of security headers and content security policy (CSP) in the Site’s production configuration.

10. Cross-border transfer of personal data

Cross-border transfer of personal data may occur on the Site in the following cases:

• when resources from the jsDelivr CDN and Google Fonts are loaded in the user’s browser;
• when the Yandex Maps widget is loaded on the “Contacts” page.

Automatic text translation by Argos Translate is performed locally on the Site server and does not involve cross-border transfer of personal data.

11. Contact of the person responsible for personal data processing

Person responsible for organizing personal data processing:

• Full name: Kuznetsova Agnessa Sergeevna
• Email: poas@vstu.ru

12. Handling data subject requests

A data subject may submit a request regarding:

• obtaining information about processing of their personal data;
• correction of personal data;
• blocking or deletion of personal data;
• withdrawal of consent to personal data processing where processing is based on consent.

In addition, a data subject has the right to:

• request information about processing of their personal data, including purposes, methods, and retention periods (Article 14 of Federal Law No. 152-FZ);
• obtain information about disclosure of their personal data to third parties, including the scope and purposes of such disclosure;
• appeal the Operator’s actions or inaction to the Authorized body for protection of the rights of personal data subjects (Roskomnadzor) or in court.

Roskomnadzor contact details:

• website: https://pd.rkn.gov.ru;
• email: list@pd.rkn.gov.ru.

Requests are sent to: poas@vstu.ru. A request must contain information required by the legislation of the Russian Federation and sufficient to identify the applicant.

The operator reviews and fulfils data subject requests within the time limits established by the legislation of the Russian Federation.

A separate request submission form is not provided on the Site.

13. Personal data destruction procedure

Personal data is destroyed by deleting the corresponding records from the Site database and deleting related files from the server file storage.

Personal data shall be destroyed within no more than 30 calendar days from:

• achievement of the processing purpose;
• cessation of publication of the relevant data on the Site;
• receipt of a proper request from the data subject, if no other legal grounds for further processing exist.

14. Policy effective date

The current version of this Policy is effective from 10 July 2026.

15. Policy amendment procedure

The operator may amend this Policy.

The current version of the Policy is always published on the Site on the “Privacy Policy” page.

16. Anonymization of personal data

Anonymization of personal data on the Site is not performed.

17. Automated personal data processing

Automated personal data processing is permitted to the extent necessary for Site operation, user authorization, publication tracking, conclusion generation, automatic text translation by Argos Translate, and content display.

Automated decisions that are legally significant based solely on automated personal data processing are not made.