Personal Data Processing Policy

Version of 26.10.2026 (version 2026-10-26). Effective from the date of publication on the Site.

This is an English translation provided for convenience. Only the Russian version is legally binding.

1. General provisions

1.1. This Policy describes which personal data the Operator (section 2) processes when the website https://108records.com and all its pages (the "Site") are used: whose data it is, why and on what legal basis it is processed, where and for how long it is stored, to whom it is disclosed, and how data subjects can exercise their rights.

1.2. The Policy is drawn up in accordance with Russian Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (the "Law") and published pursuant to Article 18.1(2) of the Law. Terms have the meanings given in the Law.

1.3. Consent to the processing of personal data is a separate document — "Consent to Personal Data Processing". It is given by ticking the box in a form on the Site; a form cannot be sent without it. Consent to Yandex Metrica is given with the "Accept" button in the cookie notice (section 10).

1.4. The Operator does not process special categories of personal data (racial or ethnic origin, political opinions, religious or philosophical beliefs, health) or biometric data, and makes no decisions based solely on automated processing.

2. Operator

Sole proprietor (individual entrepreneur) Alexander Olegovich Titov, INN 770301623108, OGRNIP 319774600078733, address: 1A Pistsovaya St., Moscow 127015, Russia; email for personal data requests: info@108records.com (the "Operator").

The person responsible for organising personal data processing is Alexander Olegovich Titov.

3. Whose data, what data and why

3.1. Release request (page /ru/release)

• Whose data: artists and their representatives who submit a request to release music.
• What data: name (as entered by the data subject); contact — phone number, email address or Telegram username.
• Purposes: to consider the request, contact the data subject and send a personal link to the release questionnaire and the contract details form.
• Legal basis: the data subject's consent (Article 6(1)(1) of the Law).
• Retention: until a licence agreement is signed; if no agreement is signed — 1 year from the date of the request, after which the data is destroyed.

3.2. Release questionnaire (page /ru/release/anketa, opened via a personal link)

• Whose data: the artist filling in the questionnaire; persons whose details the artist enters: authors of the music and lyrics, sound engineers, producers, musicians, a second artist of the release.
• What data: surname, first name, patronymic; contact (phone, email or Telegram); stage name; links to the artist's pages on music platforms; release details (titles, lyrics, genre, language, dates, link to files); names (or names and pseudonyms) of the authors of the music and lyrics, recording participants and the second artist.
• Purposes: preparing and concluding a licence agreement with the Operator; preparing and releasing the release, including crediting authors and recording participants in the release metadata.
• Legal basis: consent (Article 6(1)(1) of the Law); once an agreement is signed — performance of a contract to which the data subject is a party (Article 6(1)(5)). By entering details of other persons, the artist confirms that those persons are aware of their data being provided to the Operator for these purposes.
• Retention: if no agreement is signed — 1 year from the date the questionnaire was submitted; if signed — the term of the agreement plus 5 years after it ends.

3.3. Contract details (page /ru/release/dogovor, opened via a personal link)

• Whose data: the artist who is a party to the licence agreement (licensor).
• What data: surname, first name, patronymic; date of birth; email; phone number; passport details (series and number, issuing authority and date, subdivision code); registered address; SNILS (insurance number); INN (taxpayer number); bank details (bank name, account number, BIC, correspondent account, the bank's INN and KPP); legal form (individual, self-employed, individual entrepreneur, company).
• Purposes: concluding and performing the licence agreement, including signing it with an electronic signature in the Nopaper service; paying royalties; complying with the Operator's legal obligations (including as a tax agent and for accounting).
• Legal basis: consent (Article 6(1)(1)); entering into, at the data subject's request, and performing a contract to which they are a party (Article 6(1)(5)); compliance with legal obligations (Article 6(1)(2)).
• Retention: the term of the agreement plus 5 years after it ends; if no agreement is signed — 1 year from the date the details were sent.

3.4. Donations (page /ru/support)

• Whose data: visitors who make a donation.
• What data: email; amount and frequency of the donation (one-time or monthly); payment details provided by the payment service (date, amount, status and transaction ID, masked card number). The full card number, expiry date and CVC/CVV are entered in the CloudPayments window and are not transferred to the Operator.
• Purposes: accepting the donation, including monthly charges; sending the receipt; answering the donor's requests, including cancellation of a monthly donation.
• Legal basis: consent (Article 6(1)(1)); performance of the donation contract (Article 6(1)(5)); the obligation to issue a receipt under Federal Law No. 54-FZ of 22.05.2003 and to keep accounting and tax records (Article 6(1)(2)).
• Retention: 5 years after the end of the year of payment (retention periods for accounting and tax records).
• Donation terms are on the "Donation Terms" page.

3.5. Email enquiries

• Whose data: persons who write to the Operator at info@108records.com.
• What data: email address, name and any information the person includes in the message.
• Purposes: replying to the enquiry, including a data subject request.
• Legal basis: consent (Article 6(1)(1)); for data subject requests — compliance with the Law (Article 6(1)(2)).
• Retention: until the purpose of the enquiry is achieved; if related to an agreement — for the retention period of the agreement data.

3.6. All Site visitors

• Technical data sent by the browser when any page is opened: IP address, browser and device details, requested page address, date and time. It is recorded in the hosting web server logs. Purpose — operation and security of the Site. Legal basis — the Operator's legitimate interests, provided the data subject's rights and freedoms are not infringed (Article 6(1)(7)). Logs are kept for no more than 12 months.
• Cookies and Yandex Metrica — only with the visitor's consent, see section 10.
• YouTube videos — only after the "Watch" button is pressed, see section 11.

4. Legal bases

The Operator processes personal data only where at least one of the grounds in Article 6(1) of the Law applies:

• consent of the data subject (clause 1), given separately by ticking the box in a form on the Site under the "Consent to Personal Data Processing" document; for Yandex Metrica — with the "Accept" button in the cookie notice;
• compliance with legal obligations of the Operator (clause 2): Federal Law No. 54-FZ on cash registers, the Tax Code of the Russian Federation, Federal Law No. 402-FZ "On Accounting";
• entering into, at the data subject's request, and performing a contract to which the data subject is a party (clause 5): the licence agreement, the donation contract;
• legitimate interests of the Operator without infringing the data subject's rights and freedoms (clause 7) — for web server logs only (section 3.6).

When a release request, questionnaire or contract details are sent, the Operator records the consent: the version of the "Consent to Personal Data Processing" document, the date and time of consent (UTC) and the form name are written to the request record in the CRM.

5. Processing operations

5.1. The Operator performs the following operations with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion, destruction.

5.2. Processing is mixed — with and without automation.

5.3. The Operator does not sell personal data and does not disclose it to third parties for advertising. Sending a form on the Site does not mean consent to marketing emails — separate consent is required for that.

5.4. After a licence agreement is signed, the artist's stage name and the names (pseudonyms) of the authors and recording participants are published in the release metadata on music platforms, to the extent and on the terms of the licence agreement.

6. Processors

The Operator entrusts processing of personal data to the following persons (Article 6(3) of the Law), to the extent necessary for the purposes in section 3 and subject to confidentiality and security obligations:

• the Site hosting provider (server in Moscow) — hosting the Site, primary receipt of form data, web server logs;
• IQHost (server in Moscow) — the Operator's server that receives requests from the Site over an encrypted channel and passes them to the CRM, and prepares agreements for signature;
• 1C-Bitrix LLC (Bitrix24 service, data stored in Russia) — CRM: records of requests, questionnaires and contract details;
• Nopaper (electronic document service nopaper.ru) — signing the licence agreement with an electronic signature;
• CloudPayments (payment service) — accepting donations, monthly charges, generating receipts;
• Yandex LLC (INN 7736207543, 16 Lva Tolstogo St., Moscow 119021; Yandex Metrica service) — visit statistics, only with the visitor's consent (section 10).

In addition, data is provided without entrustment where required by law: to the fiscal data operator and the Federal Tax Service — as part of the receipt (54-FZ); to the tax authorities and the Social Fund of Russia — in tax agent reporting; to the Operator's bank — when paying royalties; to public authorities — at their request where provided by law.

7. Where data is stored

7.1. Recording, systematisation, accumulation, storage, clarification and retrieval of personal data of Russian citizens are carried out using databases located in the Russian Federation (Article 18(5) of the Law). Form data is received by a server in Moscow and stored in Bitrix24 (Russia), on the Operator's server (IQHost, Moscow) and in the Nopaper service; donation data — in CloudPayments; Yandex Metrica data — on Yandex LLC servers in Russia.

7.2. The Operator does not transfer data received through Site forms outside Russia. The only service on the Site through which a visitor's data may go abroad is the YouTube video player; it loads only after the "Watch" button is pressed (section 11).

8. Retention and destruction

8.1. Retention periods for each category are given in section 3. In summary:

• release requests and questionnaires that did not lead to an agreement — 1 year from the date of the request (questionnaire);
• licence agreement data — the term of the agreement plus 5 years after it ends;
• donation and receipt records — 5 years after the end of the year of payment;
• web server logs — no more than 12 months;
• Yandex Metrica cookies — in the visitor's browser for up to 1 year unless deleted earlier.

8.2. When the purposes are achieved, the retention period expires, or consent is withdrawn (if there are no other grounds for processing), the Operator destroys the personal data within 30 days (Article 21(4) and (5) of the Law), unless another period is required by law or contract.

9. Rights of the data subject

9.1. The data subject has the right (Articles 14–17 and 21 of the Law) to:

• obtain the information on processing of their personal data listed in Article 14(7) of the Law;
• demand that personal data be clarified, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose;
• demand that processing of personal data be stopped (Article 21(5.1) of the Law);
• withdraw consent to processing;
• appeal against the Operator's actions or omissions to Roskomnadzor or in court.

9.2. Requests are sent to info@108records.com or by post to the Operator's address (section 2). A request must contain the information listed in Article 14(3) of the Law: details of the identity document of the data subject or their representative; information confirming the relationship with the Operator (for example, the email or phone entered in the form, the date of the request); the signature of the data subject or their representative. An electronic request is signed with an electronic signature in accordance with Russian law.

9.3. The Operator replies within 10 working days of receiving the request. This period may be extended by no more than 5 working days if the Operator sends a reasoned notice stating the reasons (Article 20(1) and Article 21(5.1) of the Law).

10. Cookies and Yandex Metrica

10.1. The Site uses the Yandex Metrica web analytics service. It processes: cookies and the browser identifier assigned with them; IP address; browser and device details (browser type and version, operating system, screen size, language); the visitor's actions on the Site — pages viewed, referring address, clicks, scrolling, time on page, and a recording of actions on the page (Webvisor).

10.2. Yandex Metrica is not used on the release questionnaire and contract details pages (/ru/release/anketa, /ru/release/dogovor), even if the visitor has pressed "Accept".

10.3. Purpose — collecting visit statistics and improving the Site.

10.4. The data is processed by Yandex LLC on the Operator's instructions and under the Yandex Metrica terms of use. The servers storing the data are located in the Russian Federation.

10.5. Legal basis — the visitor's consent (Article 6(1)(1) of the Law), given with the "Accept" button in the cookie notice at the bottom of the page. Until consent is given, Yandex Metrica is not loaded, its cookies are not set and no data is sent to it.

10.6. How to refuse: press "Decline" in the cookie notice, or at any time reopen the notice with the "Cookie settings" link in the Site footer and press "Decline". After that, Yandex Metrica is not loaded from the next page opened. The choice is stored only in the visitor's browser (local storage) and is not sent to the Operator; if the Site data is cleared in the browser, the notice will appear again. Previously stored cookies can be deleted and new ones blocked in the browser settings. Refusing Yandex Metrica does not affect how the Site works.

10.7. The Site does not set cookies of its own.

11. YouTube videos

11.1. Some pages of the Site contain videos hosted on YouTube. Until the "Watch" button is pressed, a placeholder loaded from the Site is shown and no data is sent to YouTube.

11.2. After "Watch" is pressed, the video player is loaded into the visitor's browser from youtube-nocookie.com servers owned by Google LLC (USA). Google then receives the visitor's IP address, browser and device details and the page address, and may store its identifiers in the browser. Processing of this data is governed by Google's rules. By pressing "Watch", the visitor agrees to the player being loaded. To avoid this, do not start the video on the Site and watch it directly on YouTube.

12. Security measures

The Operator takes legal, organisational and technical measures to protect personal data against unauthorised access, destruction, modification, blocking, copying, provision and dissemination (Articles 18.1 and 19 of the Law), including:

• data between the browser and the Site is transmitted over HTTPS;
• form data is received by a server in Russia and passed to the CRM over an encrypted channel with verification of the receiving server's certificate;
• CRM access keys are not published and are stored only on the Operator's servers;
• access to the CRM, servers and services is limited to persons who need it for their work, via personal accounts;
• passport and bank details are not sent by email and are not written to error logs;
• no web analytics services are loaded on the questionnaire and contract details pages;
• a person responsible for organising personal data processing has been appointed (section 2).

13. Final provisions

13.1. The Operator may amend this Policy. A new version takes effect when published on the Site at https://108records.com/ru/politika, unless stated otherwise. The version and date are given at the beginning of the document.

13.2. Matters not covered by this Policy are governed by the laws of the Russian Federation.

13.3. Related documents: "Consent to Personal Data Processing", "Donation Terms".