Personal data policy

1. General provisions

This policy describes personal data processing on the Yakutsk International Film Festival (YIFF) information website, https://yktfilmfest.online, including its Russian, English and Chinese versions. It takes account of Russian Federal Law No. 152-FZ of 27 July 2006, On Personal Data.

The data controller is the Autonomous Institution of the Republic of Sakha (Yakutia) “State National Film Company Sakhafilm”, the festival organiser. Correspondence address: 45 Lenin Avenue, Yakutsk, Republic of Sakha (Yakutia), Russia. Email: sakhafilm@yandex.ru. Telephone: +7 (4112) 36-08-14.

The website provides films, programme information, participant profiles and festival news. Browsing does not require registration. There are no audience accounts, payment forms, newsletter subscriptions or accreditation application forms on this website. Votes are not accepted on this website. Links for audience voting lead to our partner’s MOST app.

2. Key terms

Personal data means information that identifies a person directly or indirectly. Processing includes handling that information, from collection and storage to correction and deletion. A user is a website visitor; a data subject is the person to whom information relates. Disclosure to a particular recipient differs from publication that makes information available to an unrestricted audience.

3. The controller’s rights and responsibilities

The controller processes only information needed for the stated purposes, restricts access, considers requests, and takes steps to correct, restrict or delete data. It may request information necessary to verify a requester’s identity and understand the request. Information about processing and responses to lawful requests from individuals and authorities are provided within applicable statutory deadlines.

4. Your rights

You may ask about the processing of your data and request correction, restriction or deletion where the law provides for it. Where processing relies on consent, you may withdraw that consent. You may also request that processing stop and complain to Roskomnadzor or a court. Withdrawal does not prevent processing supported by an independent lawful basis.

Send a request to sakhafilm@yandex.ru, explaining your concern and how you would like to receive a response. Please do not send passport details or unnecessary information. Identity checks are limited to what is needed to protect data and deal with the request.

5. Processing principles

Data is used for specific lawful purposes and limited to what those purposes require. The controller maintains accuracy and does not combine information for incompatible purposes. Retention is limited by the need for processing and applicable legal requirements. Once the basis for processing ends, information is deleted, destroyed or anonymised under the applicable procedure.

6. Purposes, people concerned and data categories

Visitors. To deliver pages and protect the service, the server processes connection information: IP address, request time and path, and browser information included in the request. These parameters support operation and error detection. This version contains no advertising pixels, third-party audience analytics or behavioural profiling.

Website administrator. Editorial access uses a username, a protected password representation, a session identifier and records of actions in the panel. Login attempts use a hashed IP address and request counters to limit password guessing. This account is for managing festival content only.

People contacting the organiser. If you contact the published email address or telephone number, the organiser processes your return address or number, your name if supplied, message content and necessary attachments to consider and answer the enquiry. Sending an enquiry does not subscribe you to a mailing list.

Festival participants and filmmakers. The programme, news and profiles may publish names, professional roles, biographies, photographs, participation and creative-work details to report on the festival. Publication requires consent covering public disclosure or another applicable lawful basis. Photographs are not used for facial recognition or identity verification by the website.

7. Legal bases and conditions

The basis is determined for each purpose: compliance with law; entering into or performing a contract where necessary; legitimate interests of the controller while respecting individual rights; or consent where required. Publication of information about a person requires a separate assessment of the basis for public disclosure.

Visiting the website or reading this policy does not constitute consent to all processing. If a new function requires consent, it must be obtained separately and identify the purpose, information and processing conditions. The website does not request health information, religious or political views, or other special categories of personal data.

8. Storage, retention and cookies

The application does not set advertising or analytics cookies for visitors to public pages. A successful administrator login sets the essential festival_session cookie for up to 8 hours. It maintains authenticated access and is removed on logout. It can also be deleted in browser settings; accessing the panel again will require another login.

Login rate-limit counters apply for 15 minutes. Expired counters and sessions are removed during regular database cleanup. Administrative actions are kept in a bounded audit log; technical server logs are limited by rotation settings. These mechanisms do not create browsing histories for advertising.

Correspondence is kept while an enquiry is being handled and related obligations are being fulfilled; longer retention requires a lawful basis. Participant materials remain published while their publication basis applies, including documentation of festival history. When a basis ends, the controller arranges deletion or restricted access within statutory periods, including the handling of backup copies.

9. Processing operations and recipients

Depending on the purpose, processing includes collection, recording, storage, correction, use, access, restriction and deletion. Public disclosure is limited to material intended for publication. Processing may be automated or performed by authorised personnel handling enquiries.

People providing website operations, hosting, technical support and communications may access data only as needed for their tasks and on an appropriate lawful basis. Information is disclosed to public authorities where the law requires it. Data is not sold or shared for third parties’ independent advertising.

Ticket, trailer, social-media and partner links lead to external websites. Their own rules apply once you follow a link. This festival website does not receive payment details entered into an external ticketing service. Voting takes place in the MOST app; personal data processing when using that app is governed by MOST’s own rules and privacy policy.

10. Data location and international transfers

The production website is intended to run on a Timeweb server in the Russian Federation. It does not provide for sending visitor information to overseas advertising or analytics systems. Before arranging an international transfer, the controller must satisfy Article 12 of the Personal Data Law, including required notifications and assessment of transfer conditions. A normal external link does not transfer the festival database to that destination.

11. Confidentiality and security

Editorial access is restricted to an administrator account. The production version uses HTTPS, protected password storage, authorisation checks for changes and safeguards against forged requests. The controller organises access controls, backups and incident handling. Those with access to non-public information must keep it confidential unless disclosure has a lawful basis.

12. Contact and changes

For data enquiries, corrections to published information or withdrawal of consent, email sakhafilm@yandex.ru. You may use “Personal data — YIFF” as the subject. Postal address: 45 Lenin Avenue, Yakutsk, Republic of Sakha (Yakutia), Russia.

The current policy is available without registration at https://yktfilmfest.online/ru/privacy. A new version is published when website functions or processing conditions change. English and Chinese translations are provided for convenience; the Russian version prevails if they differ. Revision date: 2 November 2026.