PERSONAL DATA PROCESSING POLICY
1. General ProvisionsThis Personal Data Processing Policy has been prepared in accordance with the requirements of Federal Law No. 152-FZ of July 27, 2006, “On Personal Data” (hereinafter referred to as the “Personal Data Law”) and establishes the procedure for processing personal data and the measures taken by TO YOU PROJECT Limited Liability Company (LLC «ТУ Ю ПРОДЖЕКТ») (hereinafter referred to as the “Operator”) to ensure the security of personal data.
1.1. The Operator regards the observance of human and civil rights and freedoms in the processing of personal data, including the protection of the rights to privacy and to personal and family confidentiality, as a primary objective and a fundamental prerequisite for carrying out its activities.
1.2. This policy of the Operator concerning the processing of personal data (hereinafter referred to as the “Policy”) applies to all information that the Operator may obtain concerning visitors to the website 2upro.ru.
2. Key Definitions Used in This Policy2.1. Automated Processing of Personal Data means the processing of personal data using computing equipment.
2.2. Blocking of Personal Data means the temporary suspension of personal data processing, except where processing is necessary to clarify or rectify personal data.
2.3. Website means the collection of graphic and informational materials, computer software and databases that make such materials available on the Internet at 2upro.ru.
2.4. Personal Data Information System means a set of personal data contained in databases, together with the information technologies and technical equipment used to process such data.
2.5. Depersonalization of Personal Data means actions that render it impossible to determine, without the use of additional information, whether personal data relates to a particular User or other personal data subject.
2.6. Processing of Personal Data means any operation or set of operations performed on personal data, with or without automated means, including collection, recording, systematization, accumulation, storage, clarification (updating or modification), retrieval, use, transfer (dissemination, provision or granting of access), depersonalization, blocking, deletion and destruction of personal data.
2.7. Operator means a state authority, municipal authority, legal entity or individual that, independently or jointly with other persons, organizes and/or carries out the processing of personal data and determines the purposes of such processing, the categories of personal data to be processed, and the operations to be performed on such data.
2.8. Personal Data means any information relating directly or indirectly to an identified or identifiable User of the website 2upro.ru.
2.9. Personal Data Authorized by the Data Subject for Dissemination means personal data made accessible to an unlimited number of persons by the personal data subject through consent to the processing of personal data authorized for dissemination, in accordance with the procedure established by the Personal Data Law (hereinafter referred to as “Personal Data Authorized for Dissemination”).
2.10. User means any visitor to the website 2upro.ru.
2.11. Provision of Personal Data means actions aimed at disclosing personal data to a specified person or a specified group of persons.
2.12. Dissemination of Personal Data means any actions aimed at disclosing personal data to an unspecified group of persons (transfer of personal data) or making personal data available to an unlimited number of persons, including publication in the mass media, placement on information and telecommunications networks, or provision of access to personal data by any other means.
2.13. Cross-Border Transfer of Personal Data means the transfer of personal data to the territory of a foreign state, to a foreign state authority, a foreign individual or a foreign legal entity.
2.14. Destruction of Personal Data means any actions whereby personal data is irreversibly destroyed, making it impossible to subsequently restore the content of such personal data in a personal data information system, and/or whereby physical media containing personal data are destroyed.
3. Principal Rights and Obligations of the Operator3.1. The Operator has the right to:
–obtain accurate information and/or documents containing personal data from the personal data subject;
–continue processing personal data without the consent of the personal data subject where grounds provided for by the Personal Data Law exist, even if the personal data subject withdraws consent to processing or submits a request to cease processing personal data;
–independently determine the nature and scope of measures necessary and sufficient to ensure compliance with the obligations imposed by the Personal Data Law and regulations adopted pursuant thereto, unless otherwise provided by the Personal Data Law or other federal laws.
3.2. The Operator is obliged to:
–provide a personal data subject, upon request, with information concerning the processing of their personal data;
–organize the processing of personal data in accordance with the applicable laws of the Russian Federation;
–respond to inquiries and requests from personal data subjects and their legal representatives in accordance with the Personal Data Law;
–provide the competent authority for the protection of the rights of personal data subjects, upon its request, with the necessary information within 10 days of receipt of such request;
–publish this Personal Data Processing Policy or otherwise ensure unrestricted public access to it;
–implement legal, organizational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful actions involving personal data;
–cease the transfer (dissemination, provision or granting of access) and processing of personal data, and destroy personal data, in the manner and circumstances prescribed by the Personal Data Law;
–fulfil any other obligations imposed by the Personal Data Law.
4. Principal Rights and Obligations of Personal Data Subjects4.1. Personal data subjects have the right to:
–obtain information concerning the processing of their personal data, except as otherwise provided by federal laws. Such information shall be provided by the Operator in an accessible form and shall not contain personal data relating to other personal data subjects unless there are lawful grounds for disclosing such data. The scope of the information and the procedure for obtaining it are established by the Personal Data Law;
–require the Operator to rectify, block or destroy their personal data if such data is incomplete, outdated, inaccurate, unlawfully obtained or no longer necessary for the stated purposes of processing, and to take any measures provided by law to protect their rights;
–require prior consent as a condition for the processing of their personal data for the purpose of promoting goods, works and services on the market;
–withdraw consent to the processing of personal data and submit a request to cease such processing;
–challenge the Operator’s unlawful actions or omissions in connection with the processing of their personal data before the competent authority for the protection of the rights of personal data subjects or in court;
–exercise any other rights provided for by the legislation of the Russian Federation.
4.2. Personal data subjects are obliged to:
–provide the Operator with accurate information about themselves;
–notify the Operator of any clarification, updating or modification of their personal data.
4.3. Persons who provide the Operator with inaccurate information about themselves, or information about another personal data subject without that subject’s consent, shall be liable in accordance with the legislation of the Russian Federation.
5. Principles Governing the Processing of Personal Data5.1. Personal data shall be processed on a lawful and fair basis.
5.2. Personal data processing shall be limited to the achievement of specific, predetermined and lawful purposes. Processing of personal data that is incompatible with the purposes for which such data was collected is prohibited.
5.3. The consolidation of databases containing personal data processed for mutually incompatible purposes is prohibited.
5.4. Only personal data that is relevant to the purposes of processing shall be processed.
5.5. The content and volume of personal data processed shall correspond to the stated purposes of processing. The processing of personal data that is excessive in relation to such purposes is prohibited.
5.6. When processing personal data, the Operator shall ensure that such data is accurate, sufficient and, where necessary, up to date in relation to the purposes of processing. The Operator shall take, or ensure that appropriate measures are taken, to delete or rectify incomplete or inaccurate data.
5.7. Personal data shall be stored in a form permitting identification of the personal data subject for no longer than is necessary for the purposes of processing, unless a retention period is established by federal law or by an agreement to which the personal data subject is a party, beneficiary or guarantor. Personal data being processed shall be destroyed or depersonalized once the purposes of processing have been achieved or the need to achieve those purposes has ceased, unless otherwise provided by federal law.
6. Purposes of Personal Data ProcessingPurpose of processing:
–Providing information to the User by sending emails.
Personal data processed:
–Surname, first name and patronymic;
–Email address;
–Telephone numbers.
Legal basis:
–Federal Law No. 149-FZ of July 27, 2006, “On Information, Information Technologies and Information Protection”.
Types of personal data processing:
–Collection, recording, systematization, accumulation, storage, destruction and depersonalization of personal data;
–Sending informational emails to an email address.
7. Conditions for Processing Personal Data7.1. Personal data shall be processed with the consent of the personal data subject to the processing of their personal data.
7.2. Personal data processing is necessary to achieve the purposes stipulated by an international treaty of the Russian Federation or by law, or for the performance of functions, the exercise of powers and the fulfilment of duties imposed on the Operator by the legislation of the Russian Federation.
7.3. Personal data processing is necessary for the administration of justice or the enforcement of a judicial decision or an act of another authority or official that is enforceable in accordance with the legislation of the Russian Federation on enforcement proceedings.
7.4. Personal data processing is necessary for the performance of an agreement to which the personal data subject is a party, beneficiary or guarantor, or for the conclusion, at the initiative of the personal data subject, of an agreement or an agreement under which the personal data subject will be a beneficiary or guarantor.
7.5. Personal data processing is necessary for the exercise of the rights and lawful interests of the Operator or third parties, or for the achievement of socially significant objectives, provided that the rights and freedoms of the personal data subject are not thereby infringed.
7.6. Personal data made accessible to an unlimited number of persons by the personal data subject or at their request (hereinafter referred to as “Publicly Available Personal Data”) is processed.
7.7. Personal data subject to publication or mandatory disclosure under federal law is processed.
8. Procedures for the Collection, Storage, Transfer and Other Processing of Personal DataThe security of personal data processed by the Operator is ensured through the implementation of legal, organizational and technical measures necessary to comply fully with the requirements of applicable personal data protection legislation.
8.1. The Operator ensures the security of personal data and takes all possible measures to prevent unauthorized persons from accessing such data.
8.2. The User’s personal data shall not be transferred to third parties under any circumstances, except where required to comply with applicable law or where the personal data subject has consented to the Operator transferring such data to a third party for the performance of obligations under a civil-law agreement.
8.3. If any inaccuracies in personal data are identified, the User may arrange for such data to be updated by sending a notification to the Operator at info@2upro.ru with the subject line “Актуализация персональных данных” (“Personal Data Update”).
8.4. The period for which personal data is processed shall be determined by the achievement of the purposes for which such data was collected, unless a different period is established by agreement or applicable law.
The User may withdraw their consent to the processing of personal data at any time by sending a notification to the Operator at info@2upro.ru with the subject line “Отзыв согласия на обработку персональных данных” (“Withdrawal of Consent to Personal Data Processing”).
8.5. Any information collected by third-party services, including payment systems, communications services and other service providers, shall be stored and processed by such persons (operators) in accordance with their respective user agreements and privacy policies. [The Russian original contains an incomplete sentence concerning the personal data subject and the foregoing documents.] The Operator shall not be liable for the actions of third parties, including the service providers referred to in this clause.
8.6. Restrictions imposed by a personal data subject on the transfer (other than the granting of access) or on the processing or conditions of processing (other than obtaining access) of personal data authorized for dissemination shall not apply where such data is processed in state, social or other public interests as defined by the legislation of the Russian Federation.
8.7. The Operator shall ensure the confidentiality of personal data during its processing.
8.8. The Operator shall store personal data in a form permitting identification of the personal data subject for no longer than is necessary for the purposes of processing, unless a retention period is established by federal law or by an agreement to which the personal data subject is a party, beneficiary or guarantor.
8.9. Grounds for terminating personal data processing may include the achievement of the purposes of processing, expiry of the validity period of the personal data subject’s consent, withdrawal of consent by the personal data subject, receipt of a request to cease processing personal data, or identification of unlawful processing of personal data.
9. Operations Performed by the Operator on Personal Data Obtained9.1. The Operator collects, records, systematizes, accumulates, stores, clarifies (updates or modifies), retrieves, uses, transfers (disseminates, provides or grants access to), depersonalizes, blocks, deletes and destroys personal data.
9.2. The Operator carries out automated processing of personal data, with or without the receipt and/or transmission of the information obtained via information and telecommunications networks.
10. Cross-Border Transfer of Personal Data10.1. Before commencing any activity involving the cross-border transfer of personal data, the Operator shall notify the competent authority for the protection of the rights of personal data subjects of its intention to engage in cross-border transfers of personal data (such notification shall be submitted separately from the notification of the intention to process personal data).
10.2. Before submitting the above notification, the Operator shall obtain relevant information from the foreign state authorities, foreign individuals and foreign legal entities to which personal data is intended to be transferred across borders.
11. Confidentiality of Personal DataThe Operator and any other persons granted access to personal data shall not disclose such data to third parties or disseminate it without the consent of the personal data subject, unless otherwise provided by federal law.
12. Final Provisions12.1. The User may obtain clarification of any matters concerning the processing of their personal data by contacting the Operator by email at info@2upro.ru.
12.2. Any amendments to the Operator’s Personal Data Processing Policy shall be reflected in this document. The Policy shall remain in force indefinitely until replaced by a new version.
12.3. The current version of the Policy is publicly available on the Internet at info@2upro.ru.
1.1. The Operator regards the observance of human and civil rights and freedoms in the processing of personal data, including the protection of the rights to privacy and to personal and family confidentiality, as a primary objective and a fundamental prerequisite for carrying out its activities.
1.2. This policy of the Operator concerning the processing of personal data (hereinafter referred to as the “Policy”) applies to all information that the Operator may obtain concerning visitors to the website 2upro.ru.
2. Key Definitions Used in This Policy2.1. Automated Processing of Personal Data means the processing of personal data using computing equipment.
2.2. Blocking of Personal Data means the temporary suspension of personal data processing, except where processing is necessary to clarify or rectify personal data.
2.3. Website means the collection of graphic and informational materials, computer software and databases that make such materials available on the Internet at 2upro.ru.
2.4. Personal Data Information System means a set of personal data contained in databases, together with the information technologies and technical equipment used to process such data.
2.5. Depersonalization of Personal Data means actions that render it impossible to determine, without the use of additional information, whether personal data relates to a particular User or other personal data subject.
2.6. Processing of Personal Data means any operation or set of operations performed on personal data, with or without automated means, including collection, recording, systematization, accumulation, storage, clarification (updating or modification), retrieval, use, transfer (dissemination, provision or granting of access), depersonalization, blocking, deletion and destruction of personal data.
2.7. Operator means a state authority, municipal authority, legal entity or individual that, independently or jointly with other persons, organizes and/or carries out the processing of personal data and determines the purposes of such processing, the categories of personal data to be processed, and the operations to be performed on such data.
2.8. Personal Data means any information relating directly or indirectly to an identified or identifiable User of the website 2upro.ru.
2.9. Personal Data Authorized by the Data Subject for Dissemination means personal data made accessible to an unlimited number of persons by the personal data subject through consent to the processing of personal data authorized for dissemination, in accordance with the procedure established by the Personal Data Law (hereinafter referred to as “Personal Data Authorized for Dissemination”).
2.10. User means any visitor to the website 2upro.ru.
2.11. Provision of Personal Data means actions aimed at disclosing personal data to a specified person or a specified group of persons.
2.12. Dissemination of Personal Data means any actions aimed at disclosing personal data to an unspecified group of persons (transfer of personal data) or making personal data available to an unlimited number of persons, including publication in the mass media, placement on information and telecommunications networks, or provision of access to personal data by any other means.
2.13. Cross-Border Transfer of Personal Data means the transfer of personal data to the territory of a foreign state, to a foreign state authority, a foreign individual or a foreign legal entity.
2.14. Destruction of Personal Data means any actions whereby personal data is irreversibly destroyed, making it impossible to subsequently restore the content of such personal data in a personal data information system, and/or whereby physical media containing personal data are destroyed.
3. Principal Rights and Obligations of the Operator3.1. The Operator has the right to:
–obtain accurate information and/or documents containing personal data from the personal data subject;
–continue processing personal data without the consent of the personal data subject where grounds provided for by the Personal Data Law exist, even if the personal data subject withdraws consent to processing or submits a request to cease processing personal data;
–independently determine the nature and scope of measures necessary and sufficient to ensure compliance with the obligations imposed by the Personal Data Law and regulations adopted pursuant thereto, unless otherwise provided by the Personal Data Law or other federal laws.
3.2. The Operator is obliged to:
–provide a personal data subject, upon request, with information concerning the processing of their personal data;
–organize the processing of personal data in accordance with the applicable laws of the Russian Federation;
–respond to inquiries and requests from personal data subjects and their legal representatives in accordance with the Personal Data Law;
–provide the competent authority for the protection of the rights of personal data subjects, upon its request, with the necessary information within 10 days of receipt of such request;
–publish this Personal Data Processing Policy or otherwise ensure unrestricted public access to it;
–implement legal, organizational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful actions involving personal data;
–cease the transfer (dissemination, provision or granting of access) and processing of personal data, and destroy personal data, in the manner and circumstances prescribed by the Personal Data Law;
–fulfil any other obligations imposed by the Personal Data Law.
4. Principal Rights and Obligations of Personal Data Subjects4.1. Personal data subjects have the right to:
–obtain information concerning the processing of their personal data, except as otherwise provided by federal laws. Such information shall be provided by the Operator in an accessible form and shall not contain personal data relating to other personal data subjects unless there are lawful grounds for disclosing such data. The scope of the information and the procedure for obtaining it are established by the Personal Data Law;
–require the Operator to rectify, block or destroy their personal data if such data is incomplete, outdated, inaccurate, unlawfully obtained or no longer necessary for the stated purposes of processing, and to take any measures provided by law to protect their rights;
–require prior consent as a condition for the processing of their personal data for the purpose of promoting goods, works and services on the market;
–withdraw consent to the processing of personal data and submit a request to cease such processing;
–challenge the Operator’s unlawful actions or omissions in connection with the processing of their personal data before the competent authority for the protection of the rights of personal data subjects or in court;
–exercise any other rights provided for by the legislation of the Russian Federation.
4.2. Personal data subjects are obliged to:
–provide the Operator with accurate information about themselves;
–notify the Operator of any clarification, updating or modification of their personal data.
4.3. Persons who provide the Operator with inaccurate information about themselves, or information about another personal data subject without that subject’s consent, shall be liable in accordance with the legislation of the Russian Federation.
5. Principles Governing the Processing of Personal Data5.1. Personal data shall be processed on a lawful and fair basis.
5.2. Personal data processing shall be limited to the achievement of specific, predetermined and lawful purposes. Processing of personal data that is incompatible with the purposes for which such data was collected is prohibited.
5.3. The consolidation of databases containing personal data processed for mutually incompatible purposes is prohibited.
5.4. Only personal data that is relevant to the purposes of processing shall be processed.
5.5. The content and volume of personal data processed shall correspond to the stated purposes of processing. The processing of personal data that is excessive in relation to such purposes is prohibited.
5.6. When processing personal data, the Operator shall ensure that such data is accurate, sufficient and, where necessary, up to date in relation to the purposes of processing. The Operator shall take, or ensure that appropriate measures are taken, to delete or rectify incomplete or inaccurate data.
5.7. Personal data shall be stored in a form permitting identification of the personal data subject for no longer than is necessary for the purposes of processing, unless a retention period is established by federal law or by an agreement to which the personal data subject is a party, beneficiary or guarantor. Personal data being processed shall be destroyed or depersonalized once the purposes of processing have been achieved or the need to achieve those purposes has ceased, unless otherwise provided by federal law.
6. Purposes of Personal Data ProcessingPurpose of processing:
–Providing information to the User by sending emails.
Personal data processed:
–Surname, first name and patronymic;
–Email address;
–Telephone numbers.
Legal basis:
–Federal Law No. 149-FZ of July 27, 2006, “On Information, Information Technologies and Information Protection”.
Types of personal data processing:
–Collection, recording, systematization, accumulation, storage, destruction and depersonalization of personal data;
–Sending informational emails to an email address.
7. Conditions for Processing Personal Data7.1. Personal data shall be processed with the consent of the personal data subject to the processing of their personal data.
7.2. Personal data processing is necessary to achieve the purposes stipulated by an international treaty of the Russian Federation or by law, or for the performance of functions, the exercise of powers and the fulfilment of duties imposed on the Operator by the legislation of the Russian Federation.
7.3. Personal data processing is necessary for the administration of justice or the enforcement of a judicial decision or an act of another authority or official that is enforceable in accordance with the legislation of the Russian Federation on enforcement proceedings.
7.4. Personal data processing is necessary for the performance of an agreement to which the personal data subject is a party, beneficiary or guarantor, or for the conclusion, at the initiative of the personal data subject, of an agreement or an agreement under which the personal data subject will be a beneficiary or guarantor.
7.5. Personal data processing is necessary for the exercise of the rights and lawful interests of the Operator or third parties, or for the achievement of socially significant objectives, provided that the rights and freedoms of the personal data subject are not thereby infringed.
7.6. Personal data made accessible to an unlimited number of persons by the personal data subject or at their request (hereinafter referred to as “Publicly Available Personal Data”) is processed.
7.7. Personal data subject to publication or mandatory disclosure under federal law is processed.
8. Procedures for the Collection, Storage, Transfer and Other Processing of Personal DataThe security of personal data processed by the Operator is ensured through the implementation of legal, organizational and technical measures necessary to comply fully with the requirements of applicable personal data protection legislation.
8.1. The Operator ensures the security of personal data and takes all possible measures to prevent unauthorized persons from accessing such data.
8.2. The User’s personal data shall not be transferred to third parties under any circumstances, except where required to comply with applicable law or where the personal data subject has consented to the Operator transferring such data to a third party for the performance of obligations under a civil-law agreement.
8.3. If any inaccuracies in personal data are identified, the User may arrange for such data to be updated by sending a notification to the Operator at info@2upro.ru with the subject line “Актуализация персональных данных” (“Personal Data Update”).
8.4. The period for which personal data is processed shall be determined by the achievement of the purposes for which such data was collected, unless a different period is established by agreement or applicable law.
The User may withdraw their consent to the processing of personal data at any time by sending a notification to the Operator at info@2upro.ru with the subject line “Отзыв согласия на обработку персональных данных” (“Withdrawal of Consent to Personal Data Processing”).
8.5. Any information collected by third-party services, including payment systems, communications services and other service providers, shall be stored and processed by such persons (operators) in accordance with their respective user agreements and privacy policies. [The Russian original contains an incomplete sentence concerning the personal data subject and the foregoing documents.] The Operator shall not be liable for the actions of third parties, including the service providers referred to in this clause.
8.6. Restrictions imposed by a personal data subject on the transfer (other than the granting of access) or on the processing or conditions of processing (other than obtaining access) of personal data authorized for dissemination shall not apply where such data is processed in state, social or other public interests as defined by the legislation of the Russian Federation.
8.7. The Operator shall ensure the confidentiality of personal data during its processing.
8.8. The Operator shall store personal data in a form permitting identification of the personal data subject for no longer than is necessary for the purposes of processing, unless a retention period is established by federal law or by an agreement to which the personal data subject is a party, beneficiary or guarantor.
8.9. Grounds for terminating personal data processing may include the achievement of the purposes of processing, expiry of the validity period of the personal data subject’s consent, withdrawal of consent by the personal data subject, receipt of a request to cease processing personal data, or identification of unlawful processing of personal data.
9. Operations Performed by the Operator on Personal Data Obtained9.1. The Operator collects, records, systematizes, accumulates, stores, clarifies (updates or modifies), retrieves, uses, transfers (disseminates, provides or grants access to), depersonalizes, blocks, deletes and destroys personal data.
9.2. The Operator carries out automated processing of personal data, with or without the receipt and/or transmission of the information obtained via information and telecommunications networks.
10. Cross-Border Transfer of Personal Data10.1. Before commencing any activity involving the cross-border transfer of personal data, the Operator shall notify the competent authority for the protection of the rights of personal data subjects of its intention to engage in cross-border transfers of personal data (such notification shall be submitted separately from the notification of the intention to process personal data).
10.2. Before submitting the above notification, the Operator shall obtain relevant information from the foreign state authorities, foreign individuals and foreign legal entities to which personal data is intended to be transferred across borders.
11. Confidentiality of Personal DataThe Operator and any other persons granted access to personal data shall not disclose such data to third parties or disseminate it without the consent of the personal data subject, unless otherwise provided by federal law.
12. Final Provisions12.1. The User may obtain clarification of any matters concerning the processing of their personal data by contacting the Operator by email at info@2upro.ru.
12.2. Any amendments to the Operator’s Personal Data Processing Policy shall be reflected in this document. The Policy shall remain in force indefinitely until replaced by a new version.
12.3. The current version of the Policy is publicly available on the Internet at info@2upro.ru.