This policy explains how the M.A. Bulgakov Museum processes personal data received through the public website.
1. Operator
State Budgetary Institution of Culture of Moscow "M.A. Bulgakov Museum".
Address: 123001, Moscow, Bolshaya Sadovaya St., 10, apt. 50
Phone:+7 (495) 699-53-66; Telegram: +7 (906) 006-32-00
Email:museibulgakova@culture.mos.ru
2. Legal basis
Personal data is processed in accordance with Federal Law No. 152-FZ, the visitor's consent, contractual necessity where applicable, and the lawful activities of a public cultural institution.
3. Processing purposes and data categories
| Purpose | Data processed |
|---|---|
| Handle inquiries | Name, email, phone, message text, technical metadata of consent |
| Process group booking requests | Contact name, organization, email, phone, group size, requested date, request notes |
| Publish and moderate reviews | Name or pseudonym, email, review text, rating, location, visit date |
| Newsletter subscriptions | Email, subscription confirmation data, consent metadata |
| Protect public forms from abuse | Technical verification token and limited browser/request data needed for anti-bot checks, if enabled |
| Cookie consent and analytics settings | Consent status, selected categories, technical browser storage keys |
| Website analytics after consent | Anonymized visit statistics, cookie identifiers, technical browser and device data |
The museum does not request special categories of personal data through the public website and asks visitors not to submit excessive information.
4. Storage periods
| Data set | Retention |
|---|---|
| Contact form requests | Up to 3 years after the last interaction, unless a longer term is required by law |
| Group booking requests | Up to 5 years if the request is tied to service delivery, accounting, or claims handling |
| Newsletter subscription data | Until unsubscription or consent withdrawal |
| Published reviews | Until the review is removed or anonymized upon a lawful request |
| Technical analytics identifiers | According to the cookie settings selected by the visitor and the analytics provider retention period |
| Consent records | For the period required to confirm the lawful basis for processing |
5. Third parties and services
Submitted data may be processed by the museum's hosting, email delivery, and infrastructure contractors only to the extent necessary to operate the website and handle the request.
Website analytics tools and external counters are loaded only after the visitor grants analytics consent through the cookie settings.
If anti-bot verification is enabled for public forms, a technical verification token and limited request metadata may be processed by the verification provider solely to prevent automated abuse.
6. Data subject rights
- Receive information about personal data being processed.
- Request correction, blocking, deletion, or restriction of inaccurate or excessive data.
- Withdraw consent for processing that is based on consent.
- Unsubscribe from museum newsletters using the link in the email.
- Challenge the operator's actions before Roskomnadzor or in court.
7. Security measures
- HTTPS is used for public website traffic.
- Public forms require explicit consent and store a consent version together with the request metadata.
- Analytics and external counters are enabled only after the visitor selects the analytics category in the cookie banner.
- Access to submitted data is limited to authorized museum staff and service components.
- Data subjects can contact the museum regarding deletion, clarification, or consent withdrawal.
8. Requests and consent withdrawal
Requests related to access, deletion, clarification, or consent withdrawal may be sent through the dedicated data rights form , to museibulgakova@culture.mos.ru , or through the contacts page.
9. Policy updates
The current version of this policy is published at /privacy. Material changes to the website processing logic are reflected in this page.
Last updated: 18.06.2026
