Personal Data Processing Policy

This Personal Data Processing Policy (hereinafter — the Policy) defines the purposes and establishes the procedure and conditions for processing personal data, as well as measures aimed at protecting personal data at [Name of organization / individual entrepreneur] (OGRN [Number], INN [Number]) (hereinafter — the Operator) when processing personal data on the website [Website link] (hereinafter — the Website) and in the mobile application [Application name (if any)] (hereinafter — the Application).

The Operator processes personal data in accordance with the requirements of Federal Law of the Russian Federation No. 152-FZ of 27 July 2006 “On Personal Data” (hereinafter — the Federal Law “On Personal Data”) and other regulatory legal acts of the Russian Federation governing legal relations in the field of personal data processing.

This Policy applies to all personal data of the subjects specified in Section No. 5 of this Policy.

This Policy enters into force on the date of its approval by the head of the Operator and may be revised unilaterally by the Operator. Unless otherwise provided by the Policy, all amendments made to it enter into force on the date specified in the Policy. This Policy applies to relations in the field of personal data processing that arose for the Operator both before and after the approval of this Policy.

This Policy must be followed by all employees of the Operator who process personal data or have access to them.

The key terms used in this Policy are as follows:

Personal data (PD)

any information relating directly or indirectly to an identified or identifiable natural person (personal data subject);

Personal data operator (Operator)

a person that, independently or jointly with other persons, organizes and/or carries out the processing of personal data, and also determines the purposes of personal data processing, the content of the personal data to be processed, and the actions (operations) performed with personal data;

Personal data subject

a natural person directly or indirectly identified or identifiable on the basis of personal data relating to that person;

Personal data processing

any action (operation) or set of actions (operations) performed on personal data with or without the use of automation tools;

Automated processing of personal data

the processing of personal data using computer technology;

Dissemination of personal data

actions aimed at disclosing personal data to an indefinite group of persons;

Provision of personal data

actions aimed at disclosing personal data to a specific person or a specific group of persons;

Blocking of personal data

the temporary suspension of personal data processing (except where processing is necessary to clarify personal data);

Destruction of personal data

actions as a result of which it becomes impossible to restore the contents of personal data in the personal data information system and/or as a result of which physical media containing personal data are destroyed;

User

a legally capable natural person using the Website and/or the Application.

Other terms are used in this Policy with the meanings assigned to them by the applicable legislation of the Russian Federation, unless otherwise expressly specified in the Policy.

The Operator processes personal data in accordance with the following principles:

• Personal data are processed on a lawful and fair basis.
• Personal data processing is limited to achieving specific, predetermined, and lawful purposes.
• Databases containing personal data that are processed for mutually incompatible purposes may not be combined.
• The personal data processed are not excessive in relation to the stated processing purposes.
• When personal data are processed, their accuracy, sufficiency and, where necessary, relevance to the stated purposes of their processing are ensured. The Operator takes the necessary measures to delete or clarify incomplete and/or inaccurate PD.
• Personal data are stored in a form that permits identification of the personal data subject for no longer than required by the purposes of personal data processing, unless the personal data retention period is established by federal law or by a contract to which the personal data subject is a party, beneficiary, or guarantor. Personal data being processed shall be destroyed or depersonalized upon achievement of the processing purposes or if the need to achieve those purposes ceases to exist, unless otherwise provided by federal law.