PERSONAL DATA PROCESSING POLICY
Individual Entrepreneur Maria Igorevna Shivalina (hereinafter referred to as the "Seller") engages in activities involving the processing of personal data and, as such, acts as a personal data operator. This Policy governs the procedures and conditions for processing the personal data of data subjects, as well as the rights and obligations of said data subjects.
1. GENERAL PROVISIONS
1.1. Terms used in this Policy shall have the meanings established by the Federal Law of the Russian Federation "On Personal Data" and the norms of applicable Russian legislation.
1.2. This Policy has been developed based on the requirements of regulatory and legal documents concerning the protection and processing of personal data, including: the Constitution of the Russian Federation; the Civil Code; the Federal Laws of the Russian Federation "On Personal Data," "On Security," "On Information, Information Technologies and Information Protection," "On Commercial Secrets," "On Communications," "On Limited Liability Companies," and "On Technical Regulation"; Decrees of the Government of the Russian Federation; Orders of the FSTEC of Russia; and other regulatory legal acts of the Russian Federation.
1.3. The basis for processing personal data is the Consent to the processing of personal data, provided in the form set forth in Appendix No. 1 to this Policy.
2. PURPOSES AND PRINCIPLES OF PERSONAL DATA PROCESSING
2.1. The Seller processes personal data for the following purposes:
• user registration/authorization on the website museale.org (hereinafter referred to as the "Site");
• performance of a contract to which the data subject is a party, a beneficiary, or a guarantor;
• evaluation and analysis of the Seller’s performance during the fulfillment of contractual obligations;
• determination of winners in promotional events conducted by the Seller;
• conducting advertising and marketing campaigns, including those of third parties; • identifying users of the Seller’s website on the Internet;
• complying with other requirements of the legislation of the Russian Federation.
2.2. Subject to the consent of the personal data subject, the Seller is entitled to send informational messages, including promotional ones, to the subject's email address, mobile phone, or instant messaging apps. Checking the relevant box when placing an Order or on other forms on the Website constitutes sufficient consent to receive the aforementioned messages. Service messages informing the user about the order and its processing stages are sent automatically and cannot be opted out of by the user.
3. CATEGORIES OF PERSONAL DATA SUBJECTS, THEIR RIGHTS, AND CATEGORIES OF PERSONAL DATA PROCESSED
3.1. The Seller processes the personal data of the following categories of subjects:
• individuals—customers of the Seller who have consented to the processing of their personal data by the Seller;
• visitors to the Seller’s website on the Internet who have consented to the processing of their personal data by the Seller;
• users of the Seller’s applications/services who have consented to the processing of their personal data by the Seller;
• individuals who have contacted the Seller with inquiries (including claims and correspondence)—including via the contact center, chat, or social networks—and who have consented to the processing of their personal data by the Seller;
• representatives of the aforementioned subjects authorized by a power of attorney who have consented to the processing of their personal data by the Seller.
3.2. Rights of personal data subjects:
• to receive full information regarding their personal data processed by the Seller; • have their personal data updated, or request its blocking or destruction if the personal data is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated purpose of processing;
• withdraw consent to the processing of personal data in the manner and according to the procedure established in Section 5 of this Policy;
• exercise other rights provided for by the legislation of the Russian Federation;
• the Data Subject has the right to opt out of receiving promotional and other information at any time without providing a reason. Service messages informing the Data Subject about an order and the stages of its processing are sent automatically and cannot be declined by the Data Subject.
3.3. The Seller is entitled to process the following categories of personal data:
• surname, first name, and patronymic (including previous ones);
• gender;
• date of birth;
• residential address, passport details or details of another identity document (document type, series and number, date of issue, issuing authority, and department code (if applicable));
• contact information (phone number, messenger and social media accounts, email address);
• photographs, as well as other specified information.
4. PROCEDURE AND CONDITIONS FOR PERSONAL DATA PROCESSING
4.1. Personal data processing is carried out both with and without the use of automation tools. Personal data processing includes, among other things: collection; recording; systematization; accumulation; storage; clarification (updating, modification); retrieval; use; transfer (dissemination, provision, granting access); anonymization; blocking; deletion; and destruction.
4.2. Conditions for personal data processing: Consent to the processing of personal data by the Seller may be given by the personal data subject or their representative in any form that allows confirmation of its receipt, unless otherwise established by law.
4.3. Personal data processing periods: Consent to the processing of personal data and the performance of the aforementioned actions regarding the Seller’s clients is provided by the personal data subject without a time limit. The processing period for the personal data of other subjects is determined by the Seller as the time necessary to achieve the processing purposes, unless otherwise specified in the consent provided by the personal data subject.
4.4. Personal data is collected in the following ways:
· entry or other communication of personal data directly by the personal data subject on the Seller’s website, via the Mobile Application, contact center, or social networks;
· collection of personal data by the Seller’s counterparties when a personal data subject visits a retail store with the intention of joining the loyalty program;
· collection via email or other electronic communication channels, questionnaires, and other documents in the form prescribed by the Seller that contain the subjects' personal data; · collection of questionnaires and other documents bearing the personal signature of the personal data subject—using the form prescribed by the Seller—that contain the subjects' personal data.
· The Seller reserves the right to use "cookie" technology. "Cookies" do not contain confidential information and are not transferred to third parties. The policy regarding "cookies" is governed by Appendix No. 1 to this Policy.
· The Seller obtains information regarding the IP address of the Site user. This information is not used to identify the user.
· The Seller reserves the right to record telephone conversations with users. In doing so, the Seller undertakes to prevent unauthorized access to information obtained during telephone conversations and/or the transfer thereof to third parties.
· Checking the box on the museale.org Site indicating that the user has read and agrees to this Policy—following prior review of said Policy—constitutes sufficient consent for the processing of the Site user's personal data. Thus, the user confirms that their consent is specific, informed, and voluntary. The subject is required to provide accurate information about themselves and to promptly report any changes to their personal data. The Seller has the right to verify the accuracy of the data provided by the subject by cross-referencing it with documents already in the Seller's possession.
4.5. Personal Data is stored in the following ways:
· on paper media;
· in the form of questionnaires and other documents bearing the personal signature of the personal data subject—using the form prescribed by the Seller—on paper media; · on electronic media; on electronic media located on the Seller’s servers and in backup systems;
· on electronic media located on servers leased by the Seller from hosting providers. During the storage of personal data, the Seller ensures their security and restricts access to personal data exclusively to authorized persons.
4.6. Confidentiality and security of personal data
The Seller does not disclose personal data to third parties or disseminate it without the consent of the personal data subject, unless otherwise provided by the legislation of the Russian Federation. The Seller takes all necessary measures to ensure the security of personal data as established by the legislation of the Russian Federation, including:
· identifying threats to the security of personal data during their processing;
· adopting internal regulations and other documents governing relations in the sphere of personal data processing and protection;
· appointing persons responsible for ensuring the security of personal data within the Operator’s structural units and information systems;
· creating the necessary conditions for handling personal data;
· organizing the record-keeping of documents containing personal data;
· organizing the operation of information systems in which personal data is processed;
· storing personal data under conditions that ensure their preservation and prevent unauthorized access;
· organizing training for the Operator’s employees who process personal data.
4.7. In the course of its activities, the Seller may transfer the personal data of subjects in strict compliance with the requirements of the legislation of the Russian Federation and internal regulations, and provided that the security of such data is properly ensured. The transfer of personal data may be carried out either with or without the use of automation tools.
4.8. The processing of personal data for the purpose of promoting goods, works, or services on the market through direct contact with a potential consumer using means of communication may be carried out by the Seller only with the prior consent of the personal data subject and shall cease upon their request.
4.9. Blocking of Personal Data. The Seller blocks personal data in the following cases:
— upon a request from the personal data subject regarding the observance of their statutory rights. The method of blocking personal data is determined by the designated employee based on the specific conditions of personal data processing, including the capabilities of the software used for processing.
4.10. Cessation of Processing and Destruction of Personal Data
Personal data processing ceases (or the Seller ensures its cessation if processing is performed by another party acting on the Seller’s behalf), and the collected personal data are destroyed within the timeframes established by the legislation of the Russian Federation, in the following cases (unless otherwise provided by the legislation of the Russian Federation):
· upon the expiration of the established personal data processing period;
· upon the achievement of the processing purposes or when the need to achieve them no longer exists;
· upon the request of the personal data subject or the authorized body for the protection of personal data subjects' rights—if the personal data are incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated processing purpose;
· upon the withdrawal of consent to the processing of personal data by the personal data subject, if such consent is required under federal legislation;
· if the Seller is unable to remedy violations committed during the processing of personal data.
5. APPEALS AND REQUESTS REGARDING PERSONAL DATA PROCESSING
5.1. The personal data subject has the right to obtain information about the Seller, its location, and the Seller’s possession of personal data relating to the respective subject, as well as to access such personal data. The personal data subject is entitled to request that the Seller update, block, or destroy their personal data if such data is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated purpose of processing, and to take measures provided by law to protect their rights.
5.2. Information regarding the existence of personal data shall be provided to the personal data subject in an accessible format and free of charge. Furthermore, such information must not contain personal data relating to other personal data subjects.
The personal data subject has the right to receive information concerning the processing of their personal data, including:
· confirmation of the fact that the Seller is processing personal data, as well as the purpose of such processing;
· the methods of personal data processing employed by the Seller;
· details regarding persons who have access to the personal data or to whom such access may be granted;
· the list of personal data being processed and the source from which it was obtained;
· the timeframes for personal data processing, including the periods for which the data is stored.
5.3. Access to their personal data shall be granted to the personal data subject or their legal representative upon a personal visit or upon receipt of a request from the personal data subject or their legal representative (hereinafter referred to as the "Request"). Requests from subjects are accepted by the Seller during business hours.
The Request must contain the number of the primary identity document of the personal data subject or their legal representative, details regarding the date of issuance of said document and the issuing authority, and the handwritten signature of the personal data subject or their legal representative. A statement regarding the withdrawal of personal data may be sent at any time to the following address: 127549, Moscow, Altufyevskoye Shosse 70, bldg. 1.
5.4. The Seller is required to send a response to the personal data subject's Request within a period not exceeding thirty business days from the date of receipt of the Request. In the event of the withdrawal of consent for the processing of Personal Data, participation in the loyalty program will be automatically terminated, and the loyalty program client card will be blocked; such blocking will render the discount unusable. Furthermore, the client will be required to provide renewed consent for the processing of personal data should they decide to utilize the Seller’s services or products that necessitate the completion of forms, applications, or similar documents containing personal data.
6. LIABILITY FOR VIOLATION OF REGULATIONS GOVERNING THE PROCESSING AND PROTECTION OF PERSONAL DATA
6.1. Persons found liable for violating regulations governing the processing and protection of personal data within the Seller’s personal data information systems shall bear civil, criminal, administrative, disciplinary, and other forms of liability as prescribed by the legislation of the Russian Federation. Disclosure of information in compliance with legitimate and applicable legal requirements shall not be deemed a breach of obligations. The Seller shall not be held liable for information provided by the user on the Website in a publicly accessible manner.
Appendix No. 1 to the Seller’s Personal Data Processing Policy
Of my own free will and in my own interest, I hereby consent to the processing, including... to the collection, systematization, accumulation, storage, (updating, renewal, modification), use, transfer to third parties (a list of third parties is available at the link), depersonalization, blocking, and destruction of my personal data, which, depending on the document (questionnaire, application, etc.), include but are not limited to the following personal data:
· surname;
· first name;
· patronymic;
· gender;
· date of birth;
· residential address;
· passport details or details of another identity document (type, series and number of the document, date of issue, name of the issuing authority, department code (if applicable));
· contact information (phone number, email address, accounts in instant messengers and social networks);
photographs, as well as other specified information, to Individual Entrepreneur Maria Igorevna Shivalina (OGRNIP 325508100407794), for the purpose of providing me with goods and services (products), including but not limited to: identifying the participant in the loyalty program, managing the process of tracking the accumulation and use of discounts, arranging delivery, providing service-related support, distributing promotional messages (including regarding ongoing promotions and special offers via any communication channels, such as mail, SMS, email, telephone, and other means of communication), and gathering feedback on the operations of IE Shivalina M.I.
I agree to the processing of my personal data by methods consistent with the purposes of such processing, including both automated and non-automated means. I also acknowledge that the consent provided electronically on the website fully complies with personal data legislation and allows for confirmation of its receipt by Individual Entrepreneur M.I. Shivalina. This consent remains valid for the entire duration of the Program. I am informed and agree that withdrawing this consent will automatically terminate my participation in the Loyalty Program; my Loyalty Program client card will be blocked, rendering the discount unusable; and I will be required to provide fresh consent for the processing of my personal data should I decide to use services or products offered by Individual Entrepreneur M.I. Shivalina that require the completion of forms, applications, or similar documents containing my personal data.