Consent to data processing

This is an unofficial translation provided for convenience. The Russian version of this document is the legally binding one; in case of any discrepancy, the Russian text prevails.

1. Who processes the data

The operator of personal data is the ARSOVENTUS project team (the “Operator”), which runs the open art history tournament and the educational programmes connected with it.

You can reach the Operator on any data processing matter at arsoventus@arsoventus.com. We answer such requests within 30 days — the period set by Article 20 of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”.

This consent supplements the Privacy Policy and covers specifically the data you provide when registering for the tournament.

2. What data we collect

When a participant registers we process: email address, surname, first name and — if you choose to give it — patronymic, city, and an age interval if you choose to give one: the lower and upper bounds you select yourself. We do not ask for an exact age.

The account password is not stored in its original form but as an irreversible cryptographic hash: the password cannot be recovered from it, including by the Operator.

Participation itself generates further data: submitted answers, scores, grading results, decisions on appeals, and issued certificates.

Technically, the IP address is recorded when the site is accessed — it is needed to protect the registration form against automated abuse and is not used to build a participant profile.

The age interval is requested solely for internal statistics: it helps us understand which audience we are preparing tasks for. It has no effect on admission to the tournament, on scoring, or on final placings, and giving it is optional.

We do not request or process special categories of personal data: information on health, ethnicity, or religious or political beliefs.

3. Why we process it

The purposes of processing are limited to running the tournament: creating and maintaining the participant’s personal account; admission to rounds and storage of answers; grading and producing results; handling appeals; preparing and issuing certificates and diplomas; sending service notifications about the tournament (a round opening, results being published, a certificate becoming available).

A separate purpose is internal analytics in anonymised form: the distribution of participants across age intervals and cities, statistics on task difficulty. Such datasets contain nothing that would identify an individual.

The tournament newsletter is sent only where separate consent has been given via a separate toggle in the form, and it can be withdrawn independently of the main consent.

4. What is done with the data

The Operator carries out collection, recording, systematisation, accumulation, storage, updating, retrieval, use, blocking, deletion and destruction of personal data — both by automated means and otherwise.

Data is not shared with third parties, except where directly required by the legislation of the Russian Federation and where sharing is necessary for the service to function (for example, the hosting provider on whose servers the database resides).

No cross-border transfer of personal data takes place. No automated decision-making producing legal effects for the participant is applied: tournament results are determined by grading, including by the jury.

5. How long data is kept

Participant data is kept for as long as the personal account exists, and for three years after the end of the last tournament the participant took part in — this period allows results to be confirmed and a certificate to be reissued.

Records confirming the issue of certificates and diplomas may be kept longer, to the extent needed to confirm participation and placing.

Once the retention period expires, or the purposes of processing are achieved, the data is deleted or anonymised.

6. How to withdraw consent

Consent may be withdrawn at any time by writing to arsoventus@arsoventus.com from the email address given at registration. No special form is required: it is enough to state the intention to withdraw consent unambiguously.

After withdrawal, processing stops and the data is deleted or anonymised within 30 days, unless the Operator has another lawful basis to continue processing.

Withdrawing consent means participation in the tournament cannot continue: without processing the registration data, a participant cannot be admitted to a round, have their work graded, or be issued a certificate. Certificates already issued remain valid.

Consent to the newsletter is withdrawn separately and does not affect participation in the tournament.

7. Participant rights

A participant has the right to obtain confirmation that their data is being processed, together with information on the legal grounds and purposes of processing, the methods used, the periods of processing and storage, and who the data may be shared with.

A participant has the right to demand that their personal data be corrected, blocked or destroyed if it is incomplete, out of date, inaccurate, obtained unlawfully, or not necessary for the stated purpose of processing.

A participant has the right to appeal the Operator’s actions to the authority responsible for protecting the rights of personal data subjects (Roskomnadzor) or in court.

8. How we protect the data

The connection to the site is protected by TLS: form data is transmitted encrypted. Passwords are stored as hashes, and access to the database is restricted to the server’s internal network and not exposed publicly.

Access to participants’ personal data within the team is limited by role: only tournament administrators work with it. Task authors and jury members see the answers they need in order to grade, but have no access to the personal data of the people who wrote them.

9. Changes to this document

The Operator may amend this consent. The current version is always available at this address.

If changes affect the composition of the data processed or the purposes of processing, participants will be invited to review the new version — continuing to take part after that constitutes acceptance of it.