1. General provisions
This Personal Data Processing Policy has been prepared in accordance with Federal Law No. 152-FZ of 27 July 2006, On Personal Data (the Personal Data Law). It sets out the personal data processing procedures and security measures applied by ZVEZDA LLC (the Controller).
1.1. The Controller considers respect for human and civil rights and freedoms in personal data processing, including privacy and personal and family confidentiality, a primary objective and a condition of its operations.
1.2. This personal data processing policy of the Controller (the Policy) applies to all information the Controller may obtain about visitors to the website https://zvezda-zavod.ru.
2. Terms used in the Policy
2.1. Automated personal data processing means processing personal data using computing equipment.
2.2. Blocking personal data means temporarily suspending its processing, except where processing is necessary to clarify the data.
2.3. Website means the collection of graphic and informational materials, computer programs and databases that make them available online at https://zvezda-zavod.ru.
2.4. Personal data information system means the personal data held in databases together with the information technology and technical equipment used to process it.
2.5. Anonymisation of personal data means actions that make it impossible to associate personal data with a particular User or other data subject without additional information.
2.6. Personal data processing means any action or set of actions performed on personal data, with or without automated tools, including collection, recording, organisation, accumulation, storage, clarification (updating or amendment), retrieval, use, transfer (distribution, provision or access), anonymisation, blocking, deletion and destruction.
2.7. Controller means a state or municipal authority, legal entity or individual that, independently or jointly with others, organises and/or carries out personal data processing and determines its purposes, the data to be processed and the actions to be performed on that data.
2.8. Personal data means any information directly or indirectly relating to an identified or identifiable User of the website https://zvezda-zavod.ru.
2.9. Personal data authorised by the data subject for distribution means personal data to which the data subject grants access to an unlimited number of persons by giving consent to the processing of personal data authorised for distribution under the procedure established by the Personal Data Law (data authorised for distribution).
2.10. User means any visitor to the website https://zvezda-zavod.ru.
2.11. Provision of personal data means actions intended to disclose personal data to a particular person or defined group of persons.
2.12. Distribution of personal data means actions intended to disclose personal data to an undefined group of persons or make it available to an unlimited number of persons, including publication in the media, placement on information and telecommunications networks, or provision of access by any other means.
2.13. Cross-border transfer of personal data means transferring personal data to a foreign state, to its authority, foreign individual or foreign legal entity.
2.14. Destruction of personal data means actions that irreversibly destroy personal data so that its content cannot subsequently be restored in the personal data information system and/or destroy the physical media containing it.
3. Main rights and obligations of the Controller
3.1. The Controller has the right to:
— obtain accurate information and/or documents containing personal data from the data subject;
— continue processing personal data without the data subject's consent after consent is withdrawn or a request to stop processing is received, where grounds provided by the Personal Data Law apply;
— independently determine the measures necessary and sufficient to fulfil the obligations established by the Personal Data Law and regulations adopted under it, unless otherwise provided by that Law or other federal laws.
3.2. The Controller is obliged to:
— provide the data subject, upon request, with information concerning the processing of their personal data;
— organise personal data processing in accordance with current Russian legislation;
— respond to requests from data subjects and their legal representatives in accordance with the Personal Data Law;
— provide the authorised personal data protection authority with the information it requests within 10 days of receiving the request;
— publish this Policy or otherwise provide unrestricted access to it;
— take legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, distribution and other unlawful actions;
— stop the transfer (distribution, provision or access) and processing of personal data and destroy it in the manner and circumstances established by the Personal Data Law;
— fulfil other obligations established by the Personal Data Law.
4. Main rights and obligations of data subjects
4.1. Data subjects have the right to:
— obtain information concerning the processing of their personal data, except in cases established by federal law. The Controller must provide this information in an accessible form. It must not contain other data subjects' personal data unless there are lawful grounds for disclosing that data. The Personal Data Law establishes the information to be provided and the procedure for obtaining it;
— require the Controller to clarify, block or destroy their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated processing purpose, and take measures provided by law to protect their rights;
— require prior consent for personal data processing intended to promote goods, works or services;
— withdraw consent to personal data processing and submit a request to stop processing;
— challenge unlawful actions or omissions by the Controller in personal data processing before the authorised personal data protection authority or a court;
— exercise other rights provided by Russian legislation.
4.2. Data subjects are obliged to:
— provide the Controller with accurate information about themselves;
— inform the Controller of clarifications (updates or amendments) to their personal data.
4.3. Persons who provide the Controller with inaccurate information about themselves or information about another data subject without that person's consent are liable in accordance with Russian legislation.
5. Personal data processing principles
5.1. Personal data is processed on a lawful and fair basis.
5.2. Personal data processing is limited to specific, predetermined and lawful purposes. Processing that is incompatible with the purposes for which the data was collected is not permitted.
5.3. Databases containing personal data processed for mutually incompatible purposes must not be combined.
5.4. Only personal data that meets the processing purposes may be processed.
5.5. The content and volume of personal data processed must correspond to the stated processing purposes. Processing excessive data in relation to those purposes is not permitted.
5.6. Personal data processing must ensure accuracy, adequacy and, where necessary, relevance to the processing purposes. The Controller takes, and/or ensures the taking of, the necessary measures to delete or clarify incomplete or inaccurate data.
5.7. Personal data is stored in a form that identifies the data subject for no longer than required by the processing purposes, unless the storage period is established by federal law or a contract to which the data subject is a party, beneficiary or guarantor. Data is destroyed or anonymised when the processing purposes are achieved or no longer need to be achieved, unless otherwise provided by federal law.
6. Personal data processing purposes:
Personal data:
Processing purpose: informing the User by email
- surname, first name and patronymic
- phone numbers
Legal grounds
- the Controller's constitutional (incorporation) documents
Types of personal data processing
- Collection, recording, organisation, accumulation, storage, destruction and anonymisation of personal data
7. Conditions for personal data processing
7.1. Personal data is processed with the data subject's consent.
7.2. Processing is necessary to achieve purposes established by an international treaty of the Russian Federation or by law, and to perform functions, powers and obligations assigned to the Controller by Russian legislation.
7.3. Processing is necessary for the administration of justice or the execution of a judicial act or an act of another authority or official enforceable under Russian enforcement legislation.
7.4. Processing is necessary to perform a contract to which the data subject is a party, beneficiary or guarantor, or to enter into a contract at the data subject's initiative or a contract under which they will be a beneficiary or guarantor.
7.5. Processing is necessary to exercise the rights and legitimate interests of the Controller or third parties, or to achieve socially significant objectives, provided that the data subject's rights and freedoms are not infringed.
7.6. Personal data made accessible to an unlimited number of persons by the data subject or at their request may be processed (publicly available personal data).
7.7. Personal data subject to publication or mandatory disclosure under federal law may be processed.
8. Collection, storage, transfer and other personal data processing procedures
The security of personal data processed by the Controller is ensured through the legal, organisational and technical measures necessary to fulfil all requirements of current personal data protection legislation.
8.1. The Controller safeguards personal data and takes all possible measures to prevent access by unauthorised persons.
8.2. The User's personal data will never be transferred to third parties except where required to comply with current legislation or where the data subject has consented to the transfer to a third party for the performance of obligations under a civil-law contract.
8.3. If inaccuracies are identified, the User may update their personal data by sending a notification to the Controller at vezdekhod@zavod-vezdekhodov.ru with the subject “Personal data update”.
8.4. The processing period is determined by the achievement of the purposes for which the data was collected, unless another period is provided by a contract or current legislation.
The User may withdraw their consent to personal data processing at any time by emailing a notification to the Controller at vezdekhod@zavod-vezdekhodov.ru with the subject “Withdrawal of consent to personal data processing”.
8.5. All information collected by third-party services, including payment systems, communications services and other service providers, is stored and processed by those parties (Controllers) in accordance with their User Agreements and Privacy Policies. The data subject and/or the aforementioned documents. The Controller is not responsible for third-party actions, including those of the service providers referred to in this clause.
8.6. Restrictions imposed by the data subject on the transfer (except provision of access) or processing, or conditions of processing (except receipt of access), of data authorised for distribution do not apply when data is processed in state, social or other public interests defined by Russian legislation.
8.7. The Controller ensures the confidentiality of personal data during processing.
8.8. The Controller stores personal data in a form that identifies the data subject for no longer than required by the processing purposes, unless the storage period is established by federal law or a contract to which the data subject is a party, beneficiary or guarantor.
8.9. Processing may cease when its purposes have been achieved, consent has expired, the data subject withdraws consent or requests that processing stop, or unlawful processing is identified.
9. Actions performed by the Controller on personal data received
9.1. The Controller collects, records, organises, accumulates, stores, clarifies (updates or amends), retrieves, uses, transfers (distributes, provides or grants access to), anonymises, blocks, deletes and destroys personal data.
9.2. The Controller performs automated personal data processing, with or without receiving and/or transmitting information over information and telecommunications networks.
10. Cross-border transfer of personal data
10.1. Before starting cross-border transfer activities, the Controller must notify the authorised personal data protection authority of its intention to transfer personal data across borders. This notification is submitted separately from the notification of an intention to process personal data.
10.2. Before submitting that notification, the Controller must obtain the relevant information from the foreign authorities, individuals or legal entities to which personal data is to be transferred.
11. Personal data confidentiality
The Controller and other persons who gain access to personal data must not disclose or distribute it to third parties without the data subject's consent, unless otherwise provided by federal law.
12. Final provisions
12.1. The User may obtain clarification on matters concerning the processing of their personal data by emailing the Controller at vezdekhod@zavod-vezdekhodov.ru.
12.2. Any changes to the Controller's Personal Data Processing Policy will be reflected in this document. The Policy remains in effect indefinitely until replaced by a new version.
12.3. The current version of the Policy is freely available online at https://zvezda-zavod.ru/privacy.