Privacy policy
Version of 23 October 2026
This English text is a translation provided for convenience. If it differs from the Russian version, the Russian version prevails.
1. General
This policy explains what personal data the estate.surf website (the “Site”) receives, why and to whom we pass it, how we protect it and how you can control your data. It is based on Russian Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (the “Law”).
The data controller (operator) is Individual Entrepreneur Alexey Alexandrovich Sorochan, Russian Federation, INN 632135171257, OGRNIP 318774600120860 (“we”). Location: Moscow, Russian Federation. Privacy e‑mail: hello@estate.surf. The person responsible for organising personal data processing is Alexey Alexandrovich Sorochan.
Your consent to the processing of the data you send through the Site’s forms is a separate document — the Consent to personal data processing. The rules for using the Site are in the Terms of use.
The Site is intended for adults. If you are under 18, please do not send us your data.
2. What we collect
Request form data — only what you enter yourself: name, phone number, e‑mail, messenger and your handle in it, your message. Stored together with details of the request: the project, the apartment or villa type, the developer and manager shown in the form, the Site language.
Technical request data — IP address and the country derived from it, browser details (user agent), the page the request was sent from, the referring site, campaign UTM tags, the browser identifier from the estatesurf_cid cookie.
Web analytics data — cookies and information about your actions on the Site collected by Yandex Metrica and Google Analytics (section 7).
We do not ask for or process passport or payment details, special categories of personal data (health, beliefs, etc.) or biometric data. Please do not include them in your message.
3. Purposes and legal grounds
| Purpose | Data | Legal ground |
|---|---|---|
| Handle your request: contact you, clarify what you need, arrange a call with the developer’s sales manager and pass the request to them | form data, request details | your consent (Art. 6(1)(1) of the Law) |
| Advise you and shortlist projects if you asked for it | form data, request details | your consent |
| Protect the Site against spam and abuse, rate-limit requests | technical request data | your consent; our legitimate interest (Art. 6(1)(7) of the Law) |
| Measure traffic, evaluate advertising and improve the Site | cookies, analytics data, UTM tags | your consent, expressed by continuing to use the Site with cookies enabled; it can be withdrawn (section 7) |
| Answer your request about your personal data | data from the request | our obligations under the Law (Art. 6(1)(2)) |
4. How we process data
- Operations: collection, recording, systematisation, accumulation, storage, clarification (updating, changing), retrieval, use, transfer (provision, access), blocking, deletion, destruction.
- Method: mixed — automated and manual (for example, when a member of our team calls you about your request).
- Where the data is stored: in the Site’s database on a server in the Russian Federation (hosting provider Kontel LLC, Moscow). Personal data of Russian citizens is recorded, systematised, accumulated, stored, clarified and retrieved in databases located in Russia (Art. 18(5) of the Law).
- Who works with the data: we and the team members who need access to handle requests. After you send a request, an assistant contacts you — a member of the estate.surf team who works with the developer’s sales department: they clarify your request and arrange the manager’s call. Everyone with access must keep the data confidential.
- We make no decisions with legal effects for you based solely on automated processing.
5. Who receives your data
- The developer of the project you asked about — its sales department (the developer’s name is shown on the project page and in the request form). If you asked us to shortlist projects — the developers of the projects you ask to be contacted about. We pass on your name, contact details, message and request details. The developer uses them to contact you and prepare an offer, and further processes them as an independent controller under its own rules.
- Telegram — a notification about a new request is sent to our team’s working Telegram chat.
- Yandex LLC (Yandex Metrica) and Google LLC (Google Analytics) — web analytics data (section 7).
- Kontel LLC — the hosting provider of the server that runs the Site and stores its database.
- Public authorities — only where the law requires it.
We do not sell your data or share it for mailings.
6. International transfers
The developers whose projects are listed on the Site are located outside Russia (currently in Thailand), and Telegram’s and Google Analytics’ servers are abroad too. Passing a request to a developer, the Telegram notification and Google Analytics are therefore cross-border transfers of personal data, including to countries that may not ensure adequate protection of data subjects’ rights. They are made on the basis of your consent, in the manner set out in Art. 12 of the Law, and only to the extent needed for the purposes in section 3.
7. Cookies and web analytics
Cookies are small files that the Site and analytics services store in your browser.
| Cookie | Purpose | Lifetime |
|---|---|---|
i18n_redirected |
remembers the Site language | 1 year |
estatesurf_currency |
remembers the chosen currency | 1 year |
estatesurf_cid |
anonymous browser identifier attached to requests | 1 year |
estatesurf_utm, estatesurf_ref |
where you came from: UTM tags, referring site | 30 days |
_ym_*, yandexuid etc. |
Yandex Metrica | up to 1 year |
_ga, _ga_* |
Google Analytics | up to 2 years |
Yandex Metrica (Yandex LLC, Russia) with Webvisor records how visitors use pages: navigation, scrolling, clicks, cursor movement; Webvisor does not record what you type into the request form. Google Analytics (Google LLC, USA) counts visits and traffic sources. We do not send the contents of requests to these services.
How to opt out: delete or block cookies in your browser settings — the Site keeps working, only the language and currency won’t be remembered. You can also turn off statistics collection with the Yandex Metrica blocker and the Google Analytics opt-out add-on.
8. Retention and destruction
- We keep request data while it is needed to handle the request, but no longer than 3 years from your last contact, then destroy or anonymise it.
- If you withdraw your consent, we stop processing and destroy the data within 30 days unless we have another legal ground to keep it.
- Cookie lifetimes are listed in section 7; analytics data is kept under Yandex’s and Google’s rules.
- Data is destroyed in the Site’s database and in backups; destruction is documented as required by Roskomnadzor (the Russian data protection authority).
9. Your rights
You can:
- find out whether we process your data and get information about that processing (Art. 14 of the Law);
- ask us to correct, block or destroy data that is incomplete, outdated, inaccurate or unlawfully processed;
- withdraw your consent;
- complain about our actions to Roskomnadzor or to a court.
Write to hello@estate.surf. Give your name and the contact you used in the request (phone, e‑mail or messenger) and the approximate date, so we can find your data. We reply within 10 business days; this may be extended by another 5 business days, in which case we will tell you why.
Withdrawing consent does not undo a transfer already made: for a request already passed on, we will notify the developer of the withdrawal, and you can also contact the developer directly.
10. How we protect data
- The Site works over HTTPS only.
- Requests are visible only to team members with personal accounts and roles that need this access; passwords are stored as hashes.
- The database is not reachable directly from the internet.
- We have appointed a person responsible for organising personal data processing and check that processing complies with this policy and the Law.
11. Changes
We may update this policy, for example when the Site or the law changes. A new version applies from its publication on this page; the version date is shown at the top.