Date of posting on the Site March 7, 2019
This Personal Data Processing Policy (hereinafter referred to as the Policy) defines the general principles and procedure for processing personal data of Users of the online store and measures to ensure their security in the Organization.
TERMS AND DEFINITIONS
The parties use the following terms with the meanings given below:
a) Data – other data about the User (not included in the concept of personal data).
b) Legislation – the current legislation of the Russian Federation.
Operator – An organization that independently or jointly with other persons organizes and (or) carries out the processing of personal data, as well as determines the purposes of processing personal data, the composition of personal data to be processed, actions (operations) performed with personal data.
c) Personal data – any information relating directly or indirectly to a specific or identifiable natural person (User).
User – a person who has access to the Site via the Internet and uses the Site of the online store.
d) Providing personal data – actions aimed at disclosing Personal data to a certain person or a certain circle of persons.
e) Site – a site located on the Internet, where the user leaves personal data.
f) Subject of personal data – the User (individual) to whom the Personal data relates.
g) Transport companies – third parties providing courier services.
Other terms used in the Policy are interpreted in accordance with the Legislation of the Russian Federation.
GENERAL PROVISIONS
1.1. This Personal Data Processing Policy was developed in accordance with the provisions of Federal Law No. 152-FZ of July 27, 2006 “On Personal Data” (with amendments and additions), other legislative and regulatory legal acts and determines the procedure for working with Personal Data of Users and ( or) transmitted by Users and the requirements for ensuring their security.
1.2. Measures to ensure the security of personal data are an integral part of the Operator’s activities.
PRINCIPLES OF PERSONAL DATA PROCESSING
2.1. The processing of Personal Data by the Operator is carried out in accordance with the following principles:
2.1.1. Lawfulness and fair basis for the processing of Personal Data. The Operator takes all necessary measures to comply with the requirements of the Legislation, does not process Personal Data in cases where this is not allowed by the Legislation, does not use Personal Data to the detriment of the User.
2.1.2. Processing only those Personal Data that meet the pre-declared purposes of their processing. Compliance of the content and volume of the processed Personal data with the stated purposes of processing. Prevention of the processing of Personal Data that is incompatible with the purposes of collecting Personal Data, as well as excessive in relation to the stated purposes of their processing.
The Operator processes Personal Data solely for the purpose of fulfilling contractual obligations to the User.
2.1.3. Ensuring the accuracy, sufficiency and relevance of Personal Data in relation to the purposes of processing Personal Data. The Operator takes all reasonable measures to maintain the relevance of the processed Personal Data, including, but not limited to, the exercise of the right of each Subject to receive their Personal Data for review and require the Operator to clarify, block or destroy them if the Personal Data is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the processing purposes stated above.
2.1.4. Storage of Personal Data in a form that allows to identify the User of Personal Data, no longer than required by the purposes of processing Personal Data, if the period of storage of Personal Data is not established by federal law, an agreement to which the User of Personal Data is a party or beneficiary.
2.1.5. The inadmissibility of combining personal data information systems databases created for incompatible purposes.
TERMS OF PROCESSING PERSONAL DATA
3.1. The processing of Personal Data by the Operator is allowed in the following cases:
3.1.1. If the User consents to the processing of his Personal Data. Consent is given by accepting the Public Offer posted on the Site or by placing an Order, in the ways indicated on the Site.
3.1.2. When transferring the Personal Data of the Subject of Personal Data by the User when placing an order on the Site. The User guarantees that he has previously received consent from the Personal Data Subject to transfer data to the Operator.
3.1.3. Personal data is subject to publication or mandatory disclosure in accordance with the Law.
3.2. The Operator does not disclose to third parties and does not distribute Personal Data without the consent of the User, unless otherwise provided by the Legislation. 3.3. The Operator does not process Personal data belonging to special categories and relating to race and nationality, political views
s, religious or philosophical beliefs, health status, intimate life of the Personal Data Subject, membership of the Personal Data Subject in public associations, except as expressly provided by the Legislation.
3.4. The Operator does not carry out Cross-border transfer of Users’ Personal Data.
COLLECTION AND PROCESSING OF PERSONAL DATA AND OTHER DATA
4.1. The Operator collects and stores only those Personal Data that are necessary to provide services to the User for the sale of goods through the Site. At the same time, the collection of Personal Data can be carried out both through the Site and at the Operator’s office.
4.2. The Operator processes Personal Data for the following purposes:
4.2.1. implementation of the activities envisaged? the Articles of Association of the Company, the current legislation of the Russian Federation;
4.2.2. fulfillment of the Operator’s obligations to the User for the sale of goods, including payment processing, delivery of goods.
4.2.3. to contact the Users, if necessary, including for sending a notification?, information and requests related to the provision of services, as well as processing an application?, requests and applications from Users;
4.2.4. to improve the quality of services provided by the Operator;
4.2.5. to promote services on the market by making direct contacts with Users;
4.2.6. for statistical and other research? based on depersonalized personal data.
4.3. For the purposes specified in clause 4.2. The operator processes the following personal data:
Surname, name and patronymic;
E-mail address;
Phone;
IP address of the User;
User’s browser type;
4.4. With regard to Personal Data and other User Data, their confidentiality is maintained, except when the specified data is publicly available.
4.5. The Operator has the right to keep an archive copy of Personal Data and other Data, including after deleting the User’s account.
4.6. The Operator has the right to transfer Personal Data and other User Data without the User’s consent to the following persons:
4.6.1. To state bodies, including bodies of inquiry and investigation, and local governments at their reasoned request.
4.6.2. Partners of the Operator in order to fulfill contractual obligations to the User.
4.6.3. In other cases expressly provided for by the current legislation of the Russian Federation.
4.7. The Operator has the right to transfer Personal Data and other Data to third parties not specified in clause 4.6 of this Policy in the following cases:
4.7.1. The user has expressed his consent to such actions.
4.7.2. The transfer is necessary as part of the User’s use of the Site or the sale of goods to the User (including for the purpose of delivering goods);
4.7.3. The transfer occurs as part of the sale or other transfer of the business (in whole or in part), while the acquirer transfers all obligations to comply with the terms of this Policy.
4.8. The Operator carries out automated and non-automated processing of Personal Data and other Data.
4.9. Access to Information systems containing Personal data is provided by a password system. Passwords are set by authorized employees of the Operator and individually communicated to the Operator’s employees who have access to Personal Data/Data.
4.10. The Operator transfers the processed information to transport (courier) companies on the basis of the User’s consent (Article 9 of the Federal Law “On Personal Data”).
4.11. The Operator is not responsible for improper processing of the User’s personal data by Transport Companies.
4.12. Upon receipt by the Operator of personal data of a request containing the withdrawal of the subject of personal data of consent to the processing of personal data, then within 30 (thirty) calendar days from the date of its receipt, he is obliged to delete personal data.
CHANGES TO PERSONAL DATA
5.1. The User can change (update, supplement) Personal data at any time by sending a written application to the Operator.
5.2. The User has the right to delete Personal Data/Data at any time.
PRIVACY OF PERSONAL DATA
6.1.1. Personal data after depersonalization.
6.1.2. Personal data, access of an unlimited number of persons to which is provided by the User or at his request (hereinafter – Personal data made public by the User).
6.1.3. Personal data subject to publication or mandatory disclosure in accordance with the Legislation.
6.1.4. It is not a violation of the confidentiality of Personal Data that the Operator provides information to transport (courier) companies and other third parties acting on the basis of an agreement with the Operator to fulfill obligations to the User.
USER CONSENT TO THE PROCESSING OF PERSONAL DATA
7.1. The User decides to provide his Personal Data to the Operator and agrees to their processing
7.1. The User decides to provide his Personal Data to the Operator and agrees to their processing freely, by his own will and in his own interest. Consent to the processing of Personal Data must be specific, informed and conscious and is provided by the User at the time of his Registration on the Operator’s Website, as well as in any form allowing to confirm the fact of its receipt, unless otherwise provided by the Legislation.
7.2. The personal data of persons who have entered into contractual obligations with the Operator, contained in the unified state registers of legal entities and individual entrepreneurs, are open and publicly available, with the exception of information about the number, date of issue and the authority that issued the identity document of an individual. The protection of their confidentiality and the consent of Users for processing is not required.
7.3. In the event of requests from organizations that do not have the appropriate authority, the Operator is obliged to obtain the User’s prior consent to provide his Personal Data and warn the persons receiving Personal Data that this data can be used only for the purposes for which they are reported, and also require these persons to confirm that this rule will (was) observed.
RIGHTS OF PERSONAL DATA SUBJECTS
ot necessary for the stated purpose of processing, as well as take legal measures to protect their rights.
8.2. If the User believes that the Operator is processing his Personal Data in violation of the requirements of the Legislation or otherwise violates his rights and freedoms, the User has the right to appeal against the actions or inaction of the Operator in the authorized body for the protection of the rights of subjects of Personal data or in court.
8.3. The user has the right to protect his rights and legitimate interests, including damages and (or) compensation for moral damage in court.
THIRD PARTY PERSONAL DATA USED BY USERS
9.1. Using the Site, the User has the right to enter data of third parties for ordering goods.
9.2. The User undertakes to obtain the prior consent of the subject of Personal Data for their use through the Site. The user is solely responsible for the lack of such consent.
9.3. The Operator undertakes to take the necessary measures to ensure the safety of the Personal Data of third parties entered by the User.
OTHER PROVISIONS
10.1. This Policy and the relationship between the User and the Operator arising in connection with the application of the Policy shall be subject to the law of the Russian Federation.
10.2. All possible disputes are subject to resolution in accordance with the Legislation at the place of registration of the Operator.
Before applying to the court, the User must comply with the mandatory pre-trial procedure and send the relevant claim to the Operator in writing. The term for responding to a claim is 30 (thirty) working days.
10.3. If, for one reason or another, one or more provisions of the Policy are declared invalid or unenforceable, this does not affect the validity or applicability of the remaining provisions of the Privacy Policy.
10.4. The Operator has the right at any time to change this Policy (in whole or in part) unilaterally without prior agreement with the User. All changes take effect the day after they are posted on the Site.
10.5. The User undertakes to independently monitor changes to the Privacy Policy by reviewing the current version.
10.6. All information provided on the site is not a public offer.
