Personal data policy

Version of 20 October 2026.

1. Who processes the data

The personal data operator is Sole proprietor Daniil Olegovich Zamkov (INN 772378468917, OGRNIP 318774600334104) (the gallery). Questions about personal data: mashayankovskaya@gmail.com.

This policy covers the gallery website yankovskaya.gallery, the gallery app in Telegram (the mini app and the bot @ym_secret_sale_bot) and the auctions in the Telegram channel “Yankovskaya Secret Sale”. The gallery processes personal data under Russian Federal Law No. 152-FZ “On Personal Data”.

2. What data

• Telegram data when a person logs in with Telegram on the website or opens the app: ID, name, username, language; profile photo if Telegram provides it.
• Auctions: Telegram name, bids (amount and time), comments on lot posts.
• Purchases: reservations, orders, invoices and payments; name, phone, email and delivery address if provided. The gallery does not receive bank card data: payment is handled by a bank or payment service.
• Collection: works and prints owned, certificates of authenticity, transfers and trade-ins.
• Requests: questions to the manager and the concierge, applications, studio viewing bookings, subscriptions to works and auctions.
• Technical data: cookies the site cannot work without (login, language, theme), IP address and browser details in server logs.

3. Why

• selling works, editions and objects: reservation, invoice, payment, delivery;
• running auctions and determining the winner;
• issuing certificates of authenticity and keeping a record of owners;
• answering questions and requests, booking studio viewings;
• messages about orders and auctions and — until switched off — about new works and gallery events;
• performing contracts and legal obligations, including accounting and resale royalty payments to the artist;
• security and operation of the website and the app.

4. Legal grounds

Consent; a contract the person is party to (purchase, trade-in); the gallery’s legal obligations.

5. Where data is stored and who receives it

Data is stored on servers in Russia. Personal data is not transferred across borders.

Questions to the concierge are processed by an artificial intelligence service. It receives the dialogue text and the gallery catalogue — without name, ID or contacts, that is, without personal data.

The gallery does not sell personal data. It shares it only where needed to fulfil an order or a legal requirement: the delivery service (CDEK, Russian Post) — name, phone and address; a bank or payment service — for payment; the accountant — for accounting; public authorities — when required by law.

Telegram processes its users’ data under its own rules. The gallery receives from Telegram only what is listed in section 2.

6. What others see

In a lot’s bid history, other bidders see the Telegram name and the bid amount — as in the channel comments. For a closed lot, the top bid in the history is the winner’s. On the public certificate check page (by code or QR) only the current owner’s initials are shown, so a buyer can check them against the seller; the full name is only in the owner’s account and on the certificate itself. Whoever buys a work, a print or an object from the gallery, or wins a drop, is never named — except the auction winner, whose bid is the top one in the lot’s bid history.

7. How long

As long as needed for the purposes in section 3 or while consent is valid. Purchase records — as long as accounting law requires. Server logs — for a limited time needed for security.

8. Your rights

To find out what data is stored, correct, block or delete it, or withdraw consent, write to mashayankovskaya@gmail.com. The gallery replies within 10 working days. Messages about new works and events can be switched off in the app profile.

9. Protection

Connections to the website and the app are encrypted. Only gallery staff who need the data for their work have access, by role. Backups are made regularly.

10. Changes

The gallery may update this policy. The current version is on this page, dated at the top.

Consent to personal data processing — a separate page.