1. General provisions
1.1. This policy describes how the personal data of participants and visitors of Face Painting League, an online league for face painters (FPL by MAGFACE, the “League”), is processed. It is adopted under Russian Federal Law No. 152-FZ of 27 July 2006 “On Personal Data”.
1.2. Data controller (operator):
| Operator | Individual entrepreneur Svetlana Olegovna Afinogenova |
|---|---|
| Taxpayer number (INN) | 784101042100 |
| Registration number (OGRNIP) | 313784708500435 |
| Postal address | Saint Petersburg, Russia |
| Email for requests | info@maskarad-grim.ru |
1.3. The policy applies to the website https://facepaintingleague.com (including the Russian version at /ru/), the League’s chatbots in Telegram and VK, and the operator’s information resources listed in the consent to publication.
1.4. The policy is publicly available on the website. It does not replace the consents a participant gives in the bot; it explains them and describes how website visitors’ data is processed.
2. What data we process and why
We collect only what is needed to run the Games, calculate the rating, issue certificates and operate the website. We do not process special categories of data (health, beliefs, etc.) or biometric data.
| Whose data | What data | Why |
|---|---|---|
| Game participants | Full name; phone or email; Telegram/VK account ID and name; city and country; link to their social media page; public name; photos of competition works and links to posts with them; profile card photo; scores, places, rating, league, awards, certificate numbers; messages with the manager; records of accepted documents (version, date and time) | Registration and taking part in the Games; receiving and judging works; rating and leagues; certificates and prizes; deadline and result notifications; answering questions; publishing results (section 4) |
| Judges | Full name, messenger account, scores given; for the “Judges” page — photo and credentials with their consent | Judging; presenting the jury |
| Artists in the “Find an artist” directory | In addition: city of work and travel area, contact for clients | Listing in the directory at the artist’s request (section 5) |
| Website visitors | IP address, browser and device data, pages and time of visit; cookies and Yandex Metrica data — only with consent | Website operation and security (server logs); visit statistics (section 6) |
| Parents / legal guardians of participants under 18 | Full name, contact, record of consent | Giving consent on behalf of a minor (section 10) |
Before submitting a work, the participant confirms that they have the consent of the person shown in the photo (the model) to share and publish the image. The League does not collect any data about models other than the image itself.
3. Legal basis and consents
3.1. Participants’ data is processed on the basis of the consents they give in the bot when registering. Each document is shown on a separate screen and accepted with a separate button:
- Game Rules — “I accept the Rules” button.
- Consent to personal data processing — “I give consent” button. Given separately from other documents.
- Consent to processing of personal data permitted for publication (Art. 10.1 of 152-FZ) — “I allow publication” button. It lists the data that may be published and the addresses of resources where this may happen.
- Confirmation of rights to the model’s image — “I confirm” button.
3.2. The date, time and version of each accepted document are stored. The text of an accepted version never changes; a new edition is released as a separate version and the bot asks the participant to accept it again.
3.3. Server logs are kept to ensure the website works and stays secure. Analytics cookies and Yandex Metrica are enabled only after the visitor agrees in the cookie banner.
4. Publishing works and the public profile
4.1. The website and the League’s information resources publish only data the participant has consented to make public:
- public name (chosen by the participant and changeable in the bot);
- city and country;
- photos of competition works credited to the author, and the profile card photo;
- league, rating and its changes, places, awards, TOP WORK marks, FPL points;
- a link to the participant’s social media page, if provided.
4.2. Full names, phone numbers, emails, messenger IDs and messages are not published on the website.
4.3. Certificate check. Using a certificate number (e.g. FPL-S1-01-0247), anyone can see the holder’s public name, the Game, season, league, type of certificate and issue date. Check result pages are not indexed by search engines.
4.4. The resources where publication may happen are listed in the consent to publication: the website https://facepaintingleague.com, https://maskarad-grim.ru, https://t.me/maskarad_grim, https://vk.ru/publicmaskarad, https://www.instagram.com/akvagrim_maskarad*, https://www.instagram.com/facepaintingleague*.
4.5. A participant may withdraw consent to publication (section 9). Their data is then removed from the website within 10 working days; in rating and results tables they remain without name or photo (“Participant No. …”) so that other participants’ results are not distorted.
5. “Find an artist” directory
5.1. Only participants who have turned on “Taking bookings” in the bot and given separate consent to show a contact for clients appear in the directory.
5.2. A directory card shows the public name, city of work and travel area, league, rating, awards, works and the contact the artist has provided for clients.
5.3. An artist can turn off “Taking bookings” at any time — the card disappears from the directory at the next website update.
5.4. The League is not party to arrangements between an artist and a client and does not receive the data of clients who contact an artist directly.
6. Cookies and Yandex Metrica
6.1. The website works without registration or user accounts. Fonts and style files are loaded from our own server, without third-party services. Your browser may store your language choice and your answer to the cookie banner — this is necessary data without which the website cannot remember your choice.
6.2. Visit statistics are collected with Yandex Metrica (Yandex LLC). It is enabled only after you click “Allow” in the cookie banner. Metrica receives anonymised information about the visit: pages, referral source, device, approximate location. Webvisor (session recording) is not enabled.
6.3. You can withdraw consent to analytics cookies via the “Cookie settings” link in the website footer or by clearing cookies in your browser.
7. Storage, retention and security
7.1. Recording, systematisation, accumulation and storage of the data of Russian citizens take place in databases located in Russia (Art. 18(5) of 152-FZ):
| Where | What is stored | Country |
|---|---|---|
| SaleBot chatbot builder | Registration forms, consents, works, scores, rating, messages | Russia |
| Selectel server and storage (Saint Petersburg) | Website, public rating and gallery data, server logs | Russia |
| Yandex Metrica | Visit statistics (with consent) | Russia |
7.2. Cross-border transfer. The bot runs in Telegram, and with the participant’s consent works may be published in a Telegram channel and on Instagram*. These are foreign platforms, so such transfer follows Art. 12 of 152-FZ.
7.3. Retention periods:
- participant’s registration form and contacts — while consent is in force, but no longer than 3 years after their last Game;
- results, rating and certificate numbers — for as long as the League exists (certificates must stay verifiable); after consent is withdrawn — without name or photo;
- records of consents given and withdrawn — 3 years after processing ends (proof of consent);
- website server logs — up to 30 days.
7.4. Security. Only the operator and the managers and judges appointed by the operator have access to the data (judges see works without the authors’ names). The website uses HTTPS. Data transfer from the bot to the website is protected by a key, and only the public data from section 4 is sent to the website.
8. Sharing data with others
8.1. We do not sell data or share it for advertising.
8.2. Data is processed on the operator’s behalf or received for technical purposes by: SaleBot (bot builder), Selectel (server and storage), Yandex (Metrica), and the Telegram and VK messengers the bot runs in.
8.3. Sponsors and partners awarding prizes receive only the data needed to deliver the prize, and only with the winner’s consent.
8.4. Upon a lawful request from public authorities — in cases provided for by law.
9. Your rights and how to contact us
9.1. You have the right to: find out what data of yours we process; ask us to correct, block or delete it; withdraw any consent; demand that we stop publishing your data; appeal our actions to Roskomnadzor (the Russian data protection authority) or in court.
9.2. How to contact us: write to info@maskarad-grim.ru or to the manager in the bot (“Ask the manager”). Please include your full name, the contact from your registration form and your request.
9.3. Response times: requests about your data — within 10 working days; demands to stop publication — within 3 working days.
9.4. Withdrawing consent to data processing means leaving the current Game: works cannot be received or judged without the participant’s data.
10. Participants under 18
10.1. Participants under 18 may take part only with the consent of a parent or other legal guardian. Consents to the processing and publication of such a participant’s data are given by the legal guardian.
10.2. Before participation begins, the legal guardian sends their consent to info@maskarad-grim.ru or to the manager in the bot. Without such consent a participant under 18 is not admitted to the Game.
11. Changes to this policy
11.1. The operator may update this policy. A new version is published on this page with its effective date; previous versions are available on request.
11.2. If changes affect the scope of data or the purposes covered by a consent, the bot will ask you to accept the new version of the consent.
Version 1.0, effective from 6 October 2026. This is a translation of the Russian version; in case of discrepancy, the Russian version prevails.
* Instagram is owned by Meta, which is recognised as extremist and banned in Russia.