Documents · edition 7 of 13 September 2026

Personal-data processing policy

Edition date: 13 September 2026, edition 7. Personal data are processed in accordance with Federal Law of 27.07.2006 No. 152-FZ “On Personal Data” (hereinafter — 152-FZ).

1. General provisions

This policy describes what data are processed on the diff.legal website, including its server-side pages of the enquiry form and the subscription form (hereinafter — the “Site”), in email correspondence with the Operator and in correspondence with the Operator on Telegram, for what purposes, and how to submit a request. Processing is carried out by the personal-data operator, registration number 77-26-560740 in the Roskomnadzor operator register, Moscow (hereinafter — the “Operator”).

For personal-data processing matters and withdrawal of consent: support@diff.legal. To discuss a legal task: hello@diff.legal or the Telegram bot @diff_legal_bot (section 6.1).

Viewing the Site does not by itself mean consent to web analytics or to receiving mailings. Analytics are enabled only after you select “Accept” in the cookie window; enquiry data are processed after a separate consent checkbox before the form is submitted; mailings are sent only after a separate, optional consent checkbox for receiving them.

2. What data are processed

• Choice in the cookie window. A technically necessary record of whether you accepted or rejected analytics. Stored in the browser's local storage and in the choice log on the server (section 5.1). Does not require separate consent.
• Web-analytics data. Only after you select “Accept” does the Yandex Metrica service collect cookies, the IP address, information about the device and browser, the referral source, the pages viewed and actions on them (section 5.2).
• Enquiry data. One contact: an email address, phone number or Telegram username; the selected communication channel; the enquiry subject; a description of the task (optional). After submission you can add an optional brief: the project stage, the desired outcome and timelines.
• Email correspondence. Only if you write to the Operator by email yourself, including replying to the Operator's letter about an enquiry: the sender's address and the content of letters sent to hello@diff.legal or support@diff.legal (section 6).
• Correspondence on Telegram. Only if you write to the @diff_legal_bot yourself or specified Telegram as the communication channel in the enquiry form: the Telegram username, profile name and account identifier, the content of the messages you sent, and, when you follow a link from the Site, also the tag of that link's location on the Site (section 6.1).
• Mailing data. Only with separate consent to mailings: one contact (email address, phone number or Telegram username) and the selected channel; if consent is checked in the enquiry form, also the link between the consent and that enquiry.
• Proof of consent. Together with the enquiry, the edition and checksum of the consent text, the time of confirmation and the method of form submission are stored. For consent to mailings, the edition and checksum of its text, the time, the method (enquiry form or subscription form), the contact and the channel are stored, and on withdrawal from the mailing — the time of withdrawal.
• Form-protection data. The request referrer address is used to rate-limit requests; to limit submissions of enquiries and subscriptions, its hash is stored. This information serves form protection, not advertising.

Operations on data: collection, recording, systematisation, accumulation, storage, clarification, retrieval, use, provision of access to authorised persons, transfer (provision of access) to the persons specified in section 7, blocking, deletion, destruction. The processing method is mixed: both with and without the use of automation tools. Special categories and biometric data are not requested. Data are not collected covertly: web analytics operate only after your consent.

Do not submit through the open form, by email or on Telegram any documents, special categories of personal data, third-party information or confidential materials. The document-exchange channel is agreed by the parties separately. An enquiry can also be sent through your AI assistant: the assistant shows you the draft and the consent text and submits the enquiry only after your explicit confirmation; the transmitted enquiry details pass through the service in which the assistant operates and are stored with a mark that they were sent via an assistant. An enquiry is informational in nature: it does not oblige the sender to purchase services, or the Operator to provide them; rights and obligations arise only upon conclusion of an agreement.

3. Processing purposes

Data are processed for the purposes entered in the operator register:

• Preparation, conclusion and performance of an agreement — consideration of the enquiry, communication via the specified contact, clarification of the task and discussion of possible cooperation (enquiry and brief data, email correspondence and correspondence on Telegram).
• Collection and analysis of traffic statistics, improvement of the Site's operation — cookies and Yandex Metrica, only with your consent.
• Promotion of services — sending diff.legal's informational and advertising messages: reviews of legislative developments and practice for technology businesses, invitations to events, and information about services (mailing data). Only with your separate consent, given by an optional checkbox in the enquiry form or in the subscription form on the diff.legal/newsletter page, and only via the selected channel: email, SMS to the specified phone number (messenger messages are not sent to phone numbers), or messages on Telegram to the specified username.

The terms of the mailing are set out in a separate document — Consent to informational and advertising mailings. Consent to the mailing is not part of consent to processing the enquiry and is not a condition for submitting an enquiry or providing services. You can withdraw from the mailing at any time (section 9).

4. Legal grounds

The record of the choice in the cookie window is processed as necessary for the operation of the Site and does not require consent. Web analytics are conducted on the basis of your consent, expressed by selecting “Accept” in the cookie window (cl. 1 pt. 1 of Art. 6 of 152-FZ). Enquiry data are processed on the basis of consent, confirmed by a separate checkbox before the form is submitted, under the terms of the Consent to Personal-Data Processing (cl. 1 pt. 1 of Art. 6, Art. 9 of 152-FZ); for the preparation, conclusion and performance of an agreement, processing is also necessary for its conclusion and performance (cl. 5 pt. 1 of Art. 6 of 152-FZ). Email correspondence and correspondence on Telegram are processed to answer an enquiry and discuss an agreement concluded at your initiative (cl. 5 pt. 1 of Art. 6 of 152-FZ); requests about personal data — to perform the Operator's obligations under 152-FZ (cl. 2 pt. 1 of Art. 6 of 152-FZ). Mailings are sent on the basis of separate consent to personal-data processing for that purpose and to receiving advertising over telecommunications networks (cl. 1 pt. 1 of Art. 6, Art. 9, pt. 1 of Art. 15 of 152-FZ; pt. 1 of Art. 18 of Federal Law of 13.03.2006 No. 38-FZ “On Advertising”) under the terms of the Consent to Receiving Information and Advertising Mailings. After withdrawal from the mailing, information about the consent and the withdrawal is stored to confirm compliance with the law (pt. 2 of Art. 9, cl. 7 pt. 1 of Art. 6 of 152-FZ). Each consent can be withdrawn at any time (section 9).

5. Cookies and analytics

Cookies are small records that the Site stores in your browser. The Site has technically necessary records of your settings — the choice in the cookie window and the colour theme — and analytics cookies, which are created only after consent.

5.1. Technically necessary records of settings

The choice in the cookie window is stored in the browser's local storage (localStorage), not in cookies: this record is not sent to the server with every request. Without it, the cookie window would be shown on every visit. The record is created without separate consent. Yandex Metrica's records in the browser storage are created only after consent (section 5.2).

If you select the colour theme with the button in the Site header, the choice (“light” or “dark”) is stored in the browser's local storage and is not sent to the server. In “follow the system” mode no record is created, and on returning to that mode the record is deleted. The record is created without separate consent.

The fact of the choice is also written to a log on the Operator's server: the type of choice (cookie), the status (“accepted” or “rejected”) and the time. The IP address and other information about you do not enter the log; the log is not linked to enquiries.

5.2. Analytics cookies (Yandex Metrica)

The Yandex Metrica service (operator — YANDEX LLC) measures traffic and behaviour on the Site. The Metrica script is loaded, and its cookies and records in the browser storage are created, only after you select “Accept”. If you select “Reject”, they are not created. When consent is withdrawn, the Site deletes Metrica's first-party cookies (on the diff.legal domain, listed in the table below) and Metrica's records in the browser storage; the Site cannot delete cookies on Yandex's domains.

Metrica counts views of the Site's public pages and the addresses of the enquiry-form and subscription-form pages without field contents. Of the address parameters, only the utm_* and yclid advertising tags are passed to Metrica; the remaining parameters, including the selected enquiry subject, are removed from the address before the counter starts. Only the following events and information are passed to Metrica, without contacts or form field contents:

• “enquiry sent” (lead_sent) and “subscription completed” (newsletter_subscribed) — on successful submission of an enquiry or completion of a subscription, without the contact, channel, subject or description;
• “form filling started” (form_start) — once per page view on first input into the enquiry form;
• “click-through to Telegram” (telegram_click) — on clicking the bot link, with the tag of the link's location on the Site, for example the header, footer or a service page;
• “click-through to discuss a service” (service_cta) — on clicking the discussion button of a specific service, with the service identifier: deals, ai-ip or support;
• clicks on external links and file downloads — the address of the link or file, for example a link to the bot on Telegram, without form data;
• the click map — click coordinates and the page element, without field contents; it also works on confirmation pages;
• a “non-bounce” mark for an accurate bounce rate — information that the page view lasted at least 15 seconds, without form data.

The Site uses Webvisor: cursor movements, clicks and scrolling are recorded. Form field contents are not stored in the recording. Input fields and selection lists in the forms are marked for exclusion from the recording. Masking hides entered values; technical form labels, for example the selected method of communication, may be visible in the recording. Webvisor is not used on the separate enquiry and subscription confirmation pages (when the form is submitted without JavaScript); when submitting from the home page, the enquiry number and the brief form are hidden from the recording.

In addition to cookies, after you select “Accept”, Metrica stores records in the browser storage on the Site's domain (localStorage and sessionStorage). If you select “Reject”, they are not created; when consent is withdrawn, the Site deletes them together with Metrica's first-party cookies.

After you select “Accept”, the Yandex service may also set cookies on its own domains (third party): yandexuid, i, yuidss, ymex, usst, yabs-sid, is_gdpr, is_gdpr_b. They are set by the Yandex service on its domains under Yandex's terms; the Site does not create them and cannot delete them. These cookies can be managed in the browser settings and with the Yandex Metrica blocker.

• Withdraw consent or change the choice — the “Cookie settings” link in the Site footer; you can also delete the Site's cookies and data in the browser settings.
• The official Yandex Metrica blocker disables Metrica data collection in your browser on all websites.
• The terms on which YANDEX LLC processes data are set out in the Yandex Privacy Policy; Metrica data are stored on servers located in the Russian Federation.

6. Enquiries, the brief and access to data

Enquiries, briefs and proofs of consent are stored in the application database on a server in Russia. Technical storage is provided by the hosting provider. Backup copies of the database are stored on the server and on the Operator's computer in Russia for no longer than 14 days. Access to enquiries is protected by authorisation. Email correspondence with the Operator, including replies to enquiries by email and requests to support@diff.legal, is stored in the Operator's mail service (section 7). The new-enquiry notification, when email sending is enabled, contains the enquiry number, the selected subject and a link to the protected section, without the contact or task description; the notification is sent to the Operator through that mail service.

Consents to mailings and withdrawals from them are stored in the same database; access to them is protected by authorisation.

The brief is optional; it can be added via a temporary link after the enquiry is submitted. The link key is stored hashed and is valid for one hour. An error when submitting the brief does not cancel the enquiry.

The Site's public reference service for AI agents provides a catalogue of services. It does not receive enquiries, briefs or client documents. The Site's form does not transmit this information to public AI services; Yandex Metrica receives only events without form contents (section 5.2).

6.1. Telegram

The Site has “Write on Telegram” links to the @diff_legal_bot bot.

Writing on Telegram is your initiative and voluntary choice: you can also make an enquiry through the Site's form or by email. If you specified Telegram as the communication channel in the enquiry form, the reply will arrive on Telegram at the specified username; such correspondence is likewise conducted by your choice.

Correspondence goes through the Telegram service, which is operated by a foreign company; Telegram's servers may be located outside the Russian Federation. Telegram processes its users' data under its own rules, which the Operator cannot influence. If you selected the Telegram channel for the mailing, its messages are also sent through this service.

From the correspondence, the Operator receives the Telegram username, profile name and account identifier, and the content of the messages you sent. These data are used to answer the enquiry and discuss a possible agreement, and are stored for the periods specified in section 8.

Do not send documents, confidential information or third-party data on Telegram. The channel for transferring documents is agreed by the parties separately.

The bot link contains the start, for example site_footer. The tag shows only the place on the Site from which the click-through was made and contains no personal data. If you accepted analytics, Metrica receives the click-through-to-Telegram event with this tag (section 5.2).

7. Transfer to third parties

The Operator does not sell your data or transfer it to other persons, except:

• YANDEX LLC — processing of web-analytics data to the extent necessary for Metrica to operate, and only with your consent;
• the hosting provider — technical placement of the server and storage of the application database;
• the AI assistant service — if the enquiry is sent through an AI assistant: the enquiry details (contact, channel, subject, description) pass through this service before reaching the Operator;
• the provider of the Operator's mail service — storage and transmission of email correspondence through the hello@diff.legal and support@diff.legal mailboxes, including notifications of new enquiries (section 6) and mailing letters, if email is selected for the mailing;
• the Telegram service — correspondence on Telegram, including the reply to an enquiry if you specified Telegram as the communication channel, and the mailing on Telegram if you selected that channel (section 6.1);
• a mailing service that processes data on the territory of the Russian Federation — if the Operator entrusts it with sending mailing messages; the commission is formalised by an agreement in compliance with pt. 3 of Art. 6 of 152-FZ, and the service receives only the data necessary for sending;
• cases directly provided for by the legislation of the Russian Federation.

Cross-border transfer of personal data is not carried out, except for correspondence on Telegram that you start yourself and the mailing on Telegram if you selected that channel (section 6.1). The data are not published and are not disclosed to an unlimited circle of persons.

8. Retention periods

• Enquiry, brief, email-correspondence and Telegram-correspondence data, and proof of consent — until the processing purposes are achieved, but no longer than 3 years from the date of the last interaction. When consent is withdrawn, processing stops and the data are destroyed within up to 30 days, except where the law requires their storage. If an agreement has been concluded between you and the Operator, the data necessary for its performance are processed on that ground during its term of validity and for the periods established by law.
• Mailing data — until consent to the mailing is withdrawn. After withdrawal, personal-data processing for mailing purposes, including the sending of messages, stops immediately, and the data processed for the mailing are destroyed within up to 30 days; information about the fact, date and edition of the consent and about the withdrawal, together with the contact to which they relate, is stored for no longer than 3 years from the date of withdrawal to confirm compliance with the law and is not used for mailings.
• Web-analytics data — for the periods established by the Yandex Metrica service; cookie lifetimes are specified in section 5.2.
• The record of the choice in the cookie window — until the choice is changed or the browser storage is cleared; the choice log on the server is stored as proof of the choice, without the IP address.
• The hash of the request referrer address — used for rate limiting for an hour after submission; obsolete records are deleted when subsequent form submissions are processed.

Deletion includes the enquiry's related data; restoring a backup copy must not return withdrawn data to operational processing.

9. Your rights and withdrawal of consent

You may request information about the processing of your data, demand that it be clarified, blocked or deleted, and also withdraw consent.

• Withdrawal of consent to enquiry processing — a letter to support@diff.legal with the subject “Consent withdrawal diff.legal” and the contact specified in the enquiry.
• Unsubscribing from the mailing and withdrawal of consent to it — a letter to support@diff.legal with the subject “Mailing opt-out diff.legal” and the contact to which the mailing arrives, the opt-out link if the message contains one, or a reply “Unsubscribe” to the mailing message if the channel allows replies; every mailing message states the opt-out method. Processing of data for mailing purposes, including the sending of messages, stops immediately; the opt-out does not affect consideration of the enquiry.
• Withdrawal of consent to analytics — the “Cookie settings” link in the Site footer and selecting “Reject”, or clearing cookies in the browser.
• Other requests, including for deletion of email correspondence and Telegram correspondence, — to support@diff.legal.

To protect the data, the Operator may ask you to confirm, with minimal information such as a contact from the enquiry, that the request relates to you. The reply is provided within the periods established by 152-FZ.

10. Changes to the policy

The current edition is available on this page and takes effect from the moment it is published. A change to the text does not mean that new consent is obtained: the edition and checksum of the consent confirmed when the enquiry was submitted or the subscription completed are stored separately.

11. Contacts

Personal-data operator, registration number 77-26-560740 in the Roskomnadzor operator register, Moscow. For personal-data matters: support@diff.legal. For services: hello@diff.legal or Telegram @diff_legal_bot.