Personal Data Processing Policy
1. General provisions
This Personal Data Processing Policy has been prepared in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (the Personal Data Law). It sets out the procedure for processing personal data and the measures taken to protect personal data by ООО «Чеховская Кондитерская Мануфактура» (the Operator).
1.1. The Operator regards respect for human and civil rights and freedoms when processing personal data, including the protection of privacy and personal and family confidentiality, as a principal objective and condition of its activities.
1.2. This Policy applies to all information that the Operator may obtain about visitors to https://chocolada.ru.
2. Definitions used in this Policy
2.1. Automated processing of personal data means processing personal data using computing equipment.
2.2. Blocking of personal data means temporarily suspending its processing, except where processing is necessary to clarify the data.
2.3. Website means the collection of graphic and informational materials, computer programs and databases that make them available on the internet at https://chocolada.ru.
2.4. Personal data information system means the collection of personal data held in databases and the information technologies and technical means used to process it.
2.5. Depersonalisation of personal data means actions that make it impossible, without additional information, to determine whether personal data relates to a specific User or another personal data subject.
2.6. Processing of personal data means any action or set of actions performed on personal data, with or without automated means, including collection, recording, systematisation, accumulation, storage, clarification (updating or alteration), retrieval, use, transfer (dissemination, provision or access), depersonalisation, blocking, deletion and destruction.
2.7. Operator means a state authority, municipal authority, legal entity or individual that, independently or jointly with others, organises or performs the processing of personal data and determines the purposes of processing, the personal data to be processed and the actions to be performed on that data.
2.8. Personal data means any information relating directly or indirectly to an identified or identifiable User of https://chocolada.ru.
2.9. Personal data authorised by its subject for dissemination means personal data to which the subject has granted access to an unlimited number of persons by giving consent to its processing for dissemination in the manner prescribed by the Personal Data Law.
2.10. User means any visitor to https://chocolada.ru.
2.11. Provision of personal data means actions aimed at disclosing personal data to a specific person or a specified group of persons.
2.12. Dissemination of personal data means actions aimed at disclosing personal data to an unspecified group of persons (transferring personal data) or making it available to an unlimited number of persons, including publication in the media, placement on information and telecommunications networks or any other form of access.
2.13. Cross-border transfer of personal data means the transfer of personal data to the territory of a foreign state, to an authority of that state, a foreign individual or a foreign legal entity.
2.14. Destruction of personal data means actions that irreversibly destroy personal data so that its content cannot be restored in the personal data information system, and/or destroy physical media containing personal data.
3. Principal rights and obligations of the Operator
3.1. The Operator is entitled to:
- receive accurate information and/or documents containing personal data from the personal data subject;
- continue processing personal data after the subject withdraws consent or requests that processing cease, where grounds for doing so are provided by the Personal Data Law;
- independently determine the measures necessary and sufficient to fulfil its obligations under the Personal Data Law and regulations adopted pursuant to it, unless otherwise provided by that Law or other federal laws.
3.2. The Operator must:
- provide the personal data subject, upon request, with information concerning the processing of their personal data;
- organise the processing of personal data in accordance with applicable legislation of the Russian Federation;
- respond to enquiries and requests from personal data subjects and their legal representatives in accordance with the Personal Data Law;
- provide the authorised body for the protection of personal data subjects’ rights with the necessary information within 10 days of receiving its request;
- publish this Policy or otherwise ensure unrestricted access to it;
- take legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful actions;
- cease the transfer (dissemination, provision or access) and processing of personal data and destroy it in the manner and in the cases prescribed by the Personal Data Law;
- fulfil other obligations established by the Personal Data Law.
4. Principal rights and obligations of personal data subjects
4.1. Personal data subjects are entitled to:
- receive information about the processing of their personal data, except in cases provided for by federal laws. The Operator must provide this information in an accessible form. It must not contain personal data relating to other subjects unless there are lawful grounds for disclosure. The scope of information and the procedure for obtaining it are established by the Personal Data Law;
- require the Operator to clarify, block or destroy personal data that is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated processing purpose, and take the measures prescribed by law to protect their rights;
- require prior consent as a condition for the processing of personal data to promote goods, works or services on the market;
- withdraw consent to the processing of personal data and request that processing cease;
- challenge unlawful actions or omissions by the Operator in processing their personal data before the authorised body for the protection of personal data subjects’ rights or in court;
- exercise other rights provided for by the legislation of the Russian Federation.
4.2. Personal data subjects must:
- provide the Operator with accurate information about themselves;
- inform the Operator of any clarification, update or change to their personal data.
4.3. Persons who provide the Operator with inaccurate information about themselves, or with information about another person without that person’s consent, are liable in accordance with the legislation of the Russian Federation.
5. Principles of personal data processing
5.1. Personal data is processed lawfully and fairly.
5.2. Processing is limited to the achievement of specific, predetermined and lawful purposes. Processing incompatible with the purposes for which personal data was collected is not permitted.
5.3. Databases containing personal data processed for mutually incompatible purposes must not be combined.
5.4. Only personal data relevant to the processing purposes is processed.
5.5. The content and volume of personal data processed must correspond to the stated processing purposes. Personal data must not be excessive in relation to those purposes.
5.6. Personal data must be accurate, sufficient and, where necessary, up to date in relation to its processing purposes. The Operator takes or ensures the necessary steps to delete or clarify incomplete or inaccurate data.
5.7. Personal data is stored in a form that permits identification of its subject for no longer than necessary for the processing purposes, unless a storage period is established by federal law or by a contract to which the subject is a party, beneficiary or guarantor.
Personal data being processed is destroyed or depersonalised once the processing purposes have been achieved or the need to achieve them has ceased, unless otherwise provided by federal law.
6. Purposes of personal data processing
| Processing purpose | Providing the User with access to services, information and/or materials available on the Website |
|---|---|
| Personal data |
|
| Legal grounds | The Operator’s charter and constituent documents |
| Types of processing | Collection, recording, systematisation, accumulation, storage, destruction and depersonalisation of personal data |
7. Conditions for personal data processing
7.1. Personal data is processed with the subject’s consent.
7.2. Processing is necessary to achieve purposes provided for by an international treaty of the Russian Federation or by law, or to fulfil functions, powers and obligations imposed on the Operator by the legislation of the Russian Federation.
7.3. Processing is necessary for the administration of justice or the enforcement of a judicial act, or an act of another body or official that must be enforced under the legislation of the Russian Federation on enforcement proceedings.
7.4. Processing is necessary to perform a contract to which the personal data subject is a party, beneficiary or guarantor, or to enter into a contract at the subject’s initiative or a contract under which the subject will be a beneficiary or guarantor.
7.5. Processing is necessary to exercise the rights and legitimate interests of the Operator or third parties, or to achieve objectives of public significance, provided that the rights and freedoms of the personal data subject are not infringed.
7.6. Personal data made accessible to an unlimited number of persons by its subject or at the subject’s request (publicly available personal data) is processed.
7.7. Personal data that must be published or disclosed under federal law is processed.
8. Collection, storage, transfer and other processing of personal data
The security of personal data processed by the Operator is ensured through legal, organisational and technical measures necessary to fully comply with applicable personal data protection legislation.
8.1. The Operator safeguards personal data and takes all possible measures to prevent unauthorised persons from accessing it.
8.2. The User’s personal data will never, under any circumstances, be transferred to third parties, except where this is required to comply with applicable legislation or where the subject has consented to the transfer to a third party for the performance of obligations under a civil-law contract.
8.3. If personal data is found to be inaccurate, the User may update it by sending the Operator a notification at info@chocolada.ru with the subject line “Актуализация персональных данных” (Update of personal data).
8.4. The processing period is determined by the achievement of the purposes for which the personal data was collected, unless another period is prescribed by a contract or applicable legislation.
The User may withdraw consent at any time by emailing the Operator at info@chocolada.ru with the subject line “Отзыв согласия на обработку персональных данных” (Withdrawal of consent to personal data processing).
8.5. All information collected by third-party services, including payment systems, communication services and other service providers, is stored and processed by those persons (operators) in accordance with their user agreements and privacy policies. The Operator is not responsible for the actions of third parties, including the service providers referred to in this clause.
8.6. Prohibitions imposed by the subject on transfer (other than granting access), and on processing or processing conditions (other than obtaining access), of personal data authorised for dissemination do not apply where processing serves state, social or other public interests defined by the legislation of the Russian Federation.
8.7. The Operator maintains the confidentiality of personal data during processing.
8.8. The Operator stores personal data in a form that permits identification of its subject for no longer than necessary for the processing purposes, unless a storage period is established by federal law or by a contract to which the subject is a party, beneficiary or guarantor.
8.9. Processing may cease when its purposes have been achieved, the period of consent has expired, the subject has withdrawn consent or requested that processing cease, or unlawful processing has been identified.
9. Actions performed on personal data received
9.1. The Operator collects, records, systematises, accumulates, stores, clarifies (updates or alters), retrieves, uses, transfers (disseminates, provides or grants access to), depersonalises, blocks, deletes and destroys personal data.
9.2. The Operator performs automated processing of personal data, with or without receiving and/or transmitting information through information and telecommunications networks.
10. Cross-border transfer of personal data
10.1. Before commencing cross-border transfers of personal data, the Operator must notify the authorised body for the protection of personal data subjects’ rights of its intention to make such transfers. This notification is submitted separately from the notification of the intention to process personal data.
10.2. Before submitting that notification, the Operator must obtain the relevant information from the authorities of foreign states, foreign individuals and foreign legal entities to which personal data is to be transferred.
11. Confidentiality of personal data
The Operator and other persons who obtain access to personal data must not disclose it to third parties or disseminate it without the subject’s consent, unless otherwise provided by federal law.
12. Final provisions
12.1. The User may obtain clarification on any matters concerning the processing of their personal data by contacting the Operator at info@chocolada.ru.
12.2. Any changes to the Operator’s personal data processing policy will be reflected in this document. This Policy remains in effect until replaced by a new version.
12.3. The current version of this Policy is freely available at https://chocolada.ru/en/privacy/.