Personal data.

1. Data controller and scope

Data controller: Администрация сайта esprio.ru. Контакт по вопросам обработки данных: the request form on this website.

This policy covers Esprio at esprio.ru. When you follow a link to an organiser’s website, email or page, their rules apply. The service does not request sensitive categories of personal data, passport information or payment details.

2. Data we process and why

Registration uses your name, email and password. Passwords are stored as secure hashes. Optional profile details help with communication.

Invitation requests use the guest’s name, contact, party size, note, selected event and review status. The organiser needs this information to invite guests and record attendance. Do not include health information, identity documents or information about other people without an appropriate basis.

Organiser verification uses account details, the salon name, an official resource and an explanation of authority. Correction requests use the page address, issue description and contact provided. Security processing includes session information, request times and outcomes, and limited technical logs.

3. Legal bases and consent

Data is processed to provide requested features, comply with applicable legal requirements, ensure security and, where required, on the basis of separate consent. Analytics consent is separate from essential cookies. Registration or an invitation request does not imply consent to marketing messages.

4. Access and sharing

Requests are visible to the guest, verified representatives of the relevant salon and authorised administrators. Applying for an event means sharing the information the organiser needs to review the request; this is explained before submission. This data is not published in the directory.

Account and request details are stored in the Esprio database with role-based access. If email delivery is connected, the configured delivery services are used; organisers see guest request details after signing in.

5. Retention and ending processing

Invitation contact details, names and notes are anonymised 365 days after both the event and the latest request update. Anonymous counts and statuses may be retained for statistics. Correction request texts are deleted after 365 days and declined organiser applications after 180 days. Rate-limit records and notification queues are cleared after 30 days, and audit logs after 90 days. Profiles remain until account deletion or the end of the lawful processing basis. Local backups have limited retention; deleting a live record does not immediately change an existing backup.

Users may request information about processing, correction, restriction or deletion where provided by law, and withdraw consent. Withdrawal does not automatically end processing where another lawful basis exists. Requests should be sent to the data controller’s contact.

6. Analytics and security

Yandex Metrika is loaded on public pages with visitor consent when analytics is enabled in service settings. It is not loaded in accounts or authentication pages. Form contents, passwords and contacts are not sent to analytics goals. See the cookies page for details.

Access to personal data is limited by role. The live website uses HTTPS. Changes to invitations and access rights are checked on the server. Security measures and documents are updated before the types of processed data change.

Contacts · Contact us about your data · Analytics settings