Personal Data Processing Policy

1.1. This Personal Data Processing Policy (hereinafter – the Policy) has been developed in fulfilment of the requirements of clause 2 of part 1 of article 18.1 of Federal Law No. 152-FZ of 27.07.2006 «On Personal Data» (hereinafter – the Personal Data Law) in order to ensure the protection of human and civil rights and freedoms in the processing of personal data, including the protection of the rights to inviolability of private life and to personal and family secrecy, and defines the procedure for processing personal data and the measures taken to ensure the security of personal data by Sole Proprietor Marin Ian Aleksandrovich (hereinafter – the Operator).

1.2. The Policy applies to all personal data processed by the Operator in connection with the use of the website and services at https://veriongroup.ru, as well as in interactions with Users, clients, representatives of counterparties and other personal data subjects.

1.3. The Policy extends to relations in the field of personal data processing that arose for the Operator both before and after the approval of this Policy.

1.4. In fulfilment of the requirements of part 2 of article 18.1 of the Personal Data Law, this Policy is published with free access on the information and telecommunications network Internet on the Operator's website at https://veriongroup.ru/privacy-policy.

2.1. Automated processing of personal data – the processing of personal data by means of computer technology.

2.2. Blocking of personal data – the temporary cessation of the processing of personal data (except where the processing is necessary in order to clarify the personal data).

2.3. Website – a set of graphic and informational materials, as well as computer programs and databases, that ensures their availability on the Internet at the network address https://veriongroup.ru and its subdomains.

2.4. Personal data information system – a set of personal data contained in databases together with the information technologies and technical facilities that ensure its processing.

2.5. Depersonalisation of personal data – actions as a result of which it becomes impossible, without the use of additional information, to determine whether personal data belongs to a particular User or other personal data subject.

2.6. Processing of personal data – any action (operation) or set of actions (operations) performed with personal data with or without the use of automation tools, including collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (dissemination, provision, access), depersonalisation, blocking, deletion and destruction of personal data.

2.7. Operator – Sole Proprietor Marin Ian Aleksandrovich, as well as other persons to whom the Operator may entrust the processing of personal data on the basis of contracts.

2.8. Personal data – any information relating directly or indirectly to an identified or identifiable natural person (a User, client, representative of a counterparty and the like).

2.9. Personal data authorised by the personal data subject for dissemination – personal data to which access by an unlimited number of persons has been granted by the personal data subject by giving a separate consent to the processing of personal data authorised for dissemination, in the manner provided for by the Personal Data Law (hereinafter – personal data authorised for dissemination).

2.10. User – any visitor of the website https://veriongroup.ru and its subdomains, as well as any user of the Operator's services.

2.11. Provision of personal data – actions aimed at disclosing personal data to a particular person or a particular group of persons.

2.12. Dissemination of personal data – any actions aimed at disclosing personal data to an indefinite number of persons (transfer of personal data) or at making personal data available to an unlimited number of persons, including the publication of personal data in the mass media, the placement of personal data on information and telecommunications networks, or the provision of access to personal data in any other way.

2.13. Cross-border transfer of personal data – the transfer of personal data to the territory of a foreign state to an authority of a foreign state, to a foreign natural person or to a foreign legal entity.

2.14. Destruction of personal data – any actions as a result of which personal data is destroyed irrevocably, with the impossibility of further recovery of the content of the personal data in the personal data information system and (or) as a result of which the material carriers of the personal data are destroyed).

2.15. Personal data subject – a natural person to whom the personal data being processed relates, including Users, clients, purchasers, customers, representatives of counterparties and other persons whose personal data is processed by the Operator.

2.16. Consent of the personal data subject to the processing of personal data – a voluntary, specific, informed and conscious expression of the will of the personal data subject permitting the processing of their personal data, given in a form that allows the fact of obtaining the consent to be confirmed (including by way of implied actions on the website).

2.17. Personal data mandatory for provision – personal data the provision of which is mandatory by virtue of law and which the subject is not entitled to refuse to provide where legal relations have arisen between the subject and the Operator.

2.18. Breach of personal data security – acts or omissions that have resulted in unlawful or accidental access to personal data, its destruction, modification, blocking, copying, provision or dissemination, as well as in other unlawful actions in relation to personal data.

2.19. Protection of personal data – a set of legal, organisational and technical measures aimed at ensuring the confidentiality, integrity and availability of personal data and at preventing unauthorised access to it.

2.20. Confidentiality of personal data – a requirement, binding on the Operator and on other persons who have obtained access to personal data, not to allow its dissemination without the consent of the personal data subject or another lawful basis.

3.1. The Operator has the right:

– to receive from the personal data subject accurate information and/or documents containing personal data;

– where the personal data subject withdraws consent to the processing of personal data, to continue processing the personal data without the subject's consent where the grounds specified in the Personal Data Law are present;

– to determine independently the composition and list of measures necessary and sufficient to ensure the fulfilment of the obligations provided for by the Personal Data Law and by the regulatory legal acts adopted in accordance with it, unless otherwise provided by the Personal Data Law or by other federal laws;

– to process personal data (collection, use, transfer to third parties) for the purposes of promoting goods, works and services by making direct contact with the personal data subject, subject to the necessary consents;

– to entrust the processing of personal data to another person on the basis of a contract concluded with that person, subject to compliance with the requirements of the Personal Data Law; a person processing personal data on behalf of the Operator is obliged to observe the principles and rules of personal data processing and to ensure the confidentiality of personal data;

– to request and receive from the personal data subject explanations and clarifications regarding the personal data provided, in order to ensure that it is up to date and accurate;

– in the cases established by law, to transfer the personal data of personal data subjects without their consent to state authorities, local self-government bodies, judicial authorities and other authorised organisations in the cases expressly provided for by the legislation of the Russian Federation;

– to store the personal data of the personal data subject for the period necessary to achieve the purposes of the processing, or for the period established by the legislation of the Russian Federation and/or by the contract with the personal data subject;

– to refuse to provide the personal data subject with information about their personal data in the cases provided for by the legislation of the Russian Federation, including where the provision of such information would infringe the rights and legitimate interests of third parties;

– to keep records of enquiries from personal data subjects and their representatives, including requests for access, rectification, deletion and withdrawal of consents to the processing of personal data.

3.2. The Operator is obliged:

– to provide the personal data subject, at their request, with information concerning the processing of their personal data, in the manner and to the extent provided for by the legislation of the Russian Federation;

– to organise the processing of personal data in the manner established by the applicable legislation of the Russian Federation and by this Policy;

– to respond to enquiries and requests from personal data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;

– to publish or otherwise ensure unrestricted access to this Policy;

– to take legal, organisational and technical measures to protect personal data against unlawful or accidental access to it, destruction, modification, blocking, copying, provision or dissemination of personal data, as well as against other unlawful actions in relation to personal data;

– to cease the transfer (dissemination, provision, access) of personal data, to cease the processing and to destroy the personal data in the manner and in the cases provided for by the Personal Data Law;

– to obtain the consent of the personal data subject to the processing of their personal data in the cases provided for by law, before such processing begins, except in the cases expressly established by law;

– to clarify the personal data being processed, to block or destroy it at the request of the personal data subject where the personal data is incomplete, inaccurate, out of date, unlawfully obtained or not necessary for the stated purpose of the processing;

– to notify the personal data subject of the fact that violations committed in the processing of their personal data have been remedied, upon their enquiry or request;

– to store personal data in a form that allows the subject to be identified for no longer than the purposes of its processing require, or for the period established by the legislation of the Russian Federation, by contracts or on other grounds;

– where unlawful processing of personal data is identified, to cease such processing or to ensure its cessation by the person processing the data on behalf of the Operator, and within a period not exceeding three business days from the date of such identification, to destroy the personal data or to ensure its destruction, unless otherwise required by law;

– to appoint a person responsible for organising the processing of personal data and for implementing the requirements of the legislation in the Operator's activities;

– to assess regularly the harm that may be caused to personal data subjects in the event of a breach of the requirements for the processing and protection of personal data, and to assess the adequacy of the measures taken to protect personal data;

– to fulfil other obligations provided for by the Personal Data Law.

4.1. Personal data subjects have the right:

– to receive information concerning the processing of their personal data, except in the cases provided for by federal laws. Such information is provided to the personal data subject by the Operator in an accessible form, to the extent and in the manner established by the Personal Data Law;

– to demand that the Operator clarify their personal data, block it or destroy it where the personal data is incomplete, out of date, inaccurate, unlawfully obtained or not necessary for the stated purpose of the processing, and also to take the measures provided for by law to protect their rights;

– to stipulate prior consent as a condition of the processing of personal data for the purposes of promoting goods, works and services on the market;

– to withdraw consent to the processing of personal data;

– to appeal against the unlawful acts or omissions of the Operator in the processing of their personal data to the authorised body for the protection of the rights of personal data subjects or in court;

– to exercise other rights provided for by the legislation of the Russian Federation.

4.2. Personal data subjects are obliged:

– to provide the Operator with accurate data about themselves;

– to inform the Operator in good time of the clarification (updating, modification) of their personal data, where necessary providing supporting documents;

– when withdrawing consent to the processing of personal data, to send the Operator a notice (in writing or by email) specifying the personal data and the types of processing that are to cease;

– to exercise the rights connected with the processing of personal data in good faith and within the limits provided for by the legislation of the Russian Federation, and not to make unfounded demands for the cessation of the processing of personal data where such processing is carried out on lawful grounds that do not require consent.

4.3. Persons who have provided the Operator with inaccurate information about themselves, or with information about another personal data subject without the latter's consent, bear liability in accordance with the legislation of the Russian Federation.

4.4. Liability for a breach of the requirements of the legislation of the Russian Federation and of this Policy in the field of the processing and protection of personal data arises in the manner established by the applicable legislation of the Russian Federation.

5.1. The processing of personal data is carried out on a lawful and fair basis.

5.2. The processing of personal data is limited to the achievement of specific, predetermined and lawful purposes. The processing of personal data incompatible with the purposes of its collection is not permitted.

5.3. It is not permitted to combine databases containing personal data the processing of which is carried out for purposes that are incompatible with one another.

5.4. Only personal data that corresponds to the purposes of its processing is subject to processing.

5.5. The content and scope of the personal data being processed correspond to the stated purposes of the processing. Excessiveness of the personal data in relation to the stated purposes of its processing is not permitted.

5.6. In the processing of personal data, the accuracy of the personal data, its sufficiency and, where necessary, its relevance in relation to the purposes of the processing are ensured. The Operator takes the necessary measures and/or ensures that they are taken to delete or clarify incomplete or inaccurate data.

5.7. Personal data is stored in a form that allows the personal data subject to be identified for no longer than the purposes of the processing of the personal data require, unless the period for storing the personal data is established by federal law, by a contract or on other grounds. The personal data being processed is destroyed or depersonalised upon achievement of the purposes of the processing, or where the need to achieve those purposes is lost, unless otherwise provided by federal law.

6.1. The Operator may process the personal data of the following categories of personal data subjects:

– users of the Operator's website and services;

– clients, purchasers, customers;

– representatives of counterparties;

– subscribers to mailings;

– persons submitting requests, claims and proposals.

6.2. Personal data is processed for the following purposes:

– informing the User by sending emails;

– informing the User by means of telephone calls;

– informing the User by sending SMS;

– informing the User by sending messages to instant messengers;

– providing access to the functionality of the website, to the personal cabinet and to other services;

– conclusion, performance and termination of contracts with personal data subjects or with the organisations they represent;

– consideration of enquiries, requests and claims;

– maintenance of the customer database, analytics and improvement of the quality of the service;

– fulfilment of the Operator's obligations provided for by the legislation of the Russian Federation;

– sending advertising and informational messages about the Operator's products and services, where this is permitted by the legislation and subject to the necessary consents of the personal data subject.

7.1. Depending on the category of the subject and on the relationship with the Operator, the following personal data may be processed:

– surname, first name, patronymic;

– date of birth (year, month, day);

– place of birth;

– address of residence or stay;

– contact details (phone number, email address, postal address);

– details of identity documents (where required by law or by contract);

– taxpayer identification number (TIN);

– information about income, length of service and temporary incapacity for work (in cases where this is necessary for the performance of a contract or for compliance with the requirements of the legislation);

– position, profession, information about education and marital status;

– personnel number and other identifiers used in the Operator's record-keeping systems (if any);

– position and information about the organisation represented (for representatives of counterparties);

– account data (login, identifier, other data provided by the subject when registering in the Operator's services);

– technical data automatically transmitted when using the Operator's website and services: IP address, information about the browser (user-agent), device type, operating system, data on actions on the website;

– other data that the subject provides to the Operator on their own initiative and (or) that is required to achieve the processing purposes specified in this Policy.

7.2. The website and the Operator's services also collect and process depersonalised data about visitors (including «cookie» files) by means of internet statistics services (Yandex Metrica, Google Analytics and others).

7.3. The data listed above is hereinafter in the text of the Policy referred to collectively as «Personal Data».

7.4. The Operator does not process special categories of personal data concerning racial or ethnic origin, political views, religious or philosophical beliefs or intimate life.

7.5. The processing of personal data authorised for dissemination from among the special categories of personal data is permitted only subject to compliance with the prohibitions and conditions provided for by article 10.1 of the Personal Data Law, and where there is a separate consent of the personal data subject.

8.1. The legal grounds for the processing of personal data by the Operator are:

– the Law «On Information, Information Technologies and Information Protection» No. 149-FZ of 27.07.2006;

– the Personal Data Law and other regulatory legal acts in the field of personal data protection;

– the provisions of civil, tax, labour and other applicable legislation of the Russian Federation in the part governing the Operator's relations with personal data subjects;

– contracts concluded between the Operator and personal data subjects or the organisations they represent;

– the consents of Users to the processing of their personal data, including to the processing of personal data authorised for dissemination.

8.2. The Operator processes the User's personal data only where the User fills in and/or submits it independently via the special forms located on the website https://veriongroup.ru, or sends it to the Operator by email or through other communication channels. By filling in the relevant forms and/or sending their personal data to the Operator, the User expresses their agreement with this Policy.

8.3. The Operator processes depersonalised data about the User where this is permitted in the settings of the User's browser (the saving of «cookie» files and the use of JavaScript technology are enabled).

8.4. The personal data subject independently decides whether to provide their personal data and gives consent freely, of their own will and in their own interest.

9.1. The processing of personal data is carried out with the consent of the personal data subject to the processing of their personal data.

9.2. The processing of personal data is necessary to achieve the purposes provided for by an international treaty of the Russian Federation or by law, and to carry out the functions, powers and obligations vested in the operator by the legislation of the Russian Federation.

9.3. The processing of personal data is necessary for the administration of justice and for the enforcement of a judicial act or of an act of another body or official that is subject to enforcement in accordance with the legislation of the Russian Federation on enforcement proceedings.

9.4. The processing of personal data is necessary for the performance of a contract to which the personal data subject is a party, a beneficiary or a guarantor, and also for the conclusion of a contract on the initiative of the personal data subject or of a contract under which the personal data subject will be a beneficiary or a guarantor.

9.5. The processing of personal data is necessary for the exercise of the rights and legitimate interests of the operator or of third parties, or for the achievement of socially significant purposes, provided that the rights and freedoms of the personal data subject are not thereby infringed.

9.6. The processing is carried out of personal data to which access by an unlimited number of persons has been granted by the personal data subject or at their request (hereinafter – publicly available personal data).

9.7. The processing is carried out of personal data that is subject to publication or mandatory disclosure in accordance with federal law.

The security of the personal data processed by the Operator is ensured through the implementation of the legal, organisational and technical measures necessary for full compliance with the requirements of the applicable legislation in the field of personal data protection.

10.1. The Operator ensures the safekeeping of personal data and takes all possible measures to preclude access to personal data by unauthorised persons.

10.2. The User's personal data will never, under any circumstances, be transferred to third parties, except in cases connected with compliance with the applicable legislation, or where the personal data subject has given the Operator consent to the transfer of data to a third party for the performance of obligations under a civil law contract.

10.3. Where inaccuracies in the personal data are identified, the User may update it independently by sending the Operator a notice to the Operator's email address info@veriongroup.ru marked «Updating of personal data».

10.4. The period of processing of personal data is determined by the achievement of the purposes for which the personal data was collected, unless a different period is provided for by contract or by the applicable legislation. The User may withdraw their consent to the processing of personal data at any time by sending the Operator a notice by email to the Operator's email address info@veriongroup.ru marked «Withdrawal of consent to the processing of personal data».

10.5. All information collected by third-party services, including payment systems, means of communication and other service providers, is stored and processed by those persons (Operators) in accordance with their User Agreement and Privacy Policy. The personal data subject and/or the User is obliged to familiarise themselves with those documents independently and in good time. The Operator is not responsible for the actions of third parties, including the service providers referred to in this clause.

10.6. Prohibitions established by the personal data subject on the transfer (other than the provision of access), as well as on the processing or conditions of processing (other than obtaining access) of personal data authorised for dissemination, do not apply in cases of the processing of personal data in state, public and other public interests defined by the legislation of the Russian Federation.

10.7. In the processing of personal data, the Operator ensures the confidentiality of personal data.

10.8. The Operator stores personal data in a form that allows the personal data subject to be identified for no longer than the purposes of the processing of the personal data require, unless the period for storing the personal data is established by federal law or by a contract to which the personal data subject is a party, a beneficiary or a guarantor.

10.9. A condition for the cessation of the processing of personal data may be the achievement of the purposes of the processing of the personal data, the expiry of the term of the consent of the personal data subject or the withdrawal of consent by the personal data subject, as well as the identification of unlawful processing of personal data.

11.1. The Operator carries out the collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (dissemination, provision, access), depersonalisation, blocking, deletion and destruction of personal data.

11.2. The Operator carries out the automated processing of personal data with or without the receipt and/or transfer of the information obtained over information and telecommunications networks.

12.1. Before carrying out a cross-border transfer of personal data, the Operator is obliged to satisfy itself that the foreign state to whose territory the personal data is to be transferred ensures reliable protection of the rights of personal data subjects.

12.2. The cross-border transfer of personal data to the territories of foreign states that do not meet the above requirements may be carried out only where there is the written consent of the personal data subject to the cross-border transfer of their personal data and/or for the performance of a contract to which the personal data subject is a party.

The Operator and other persons who have obtained access to personal data are obliged not to disclose it to third parties and not to disseminate personal data without the consent of the personal data subject, unless otherwise provided by federal law.

14.1. The User may obtain any clarifications on questions of interest concerning the processing of their personal data by contacting the Operator by email at info@veriongroup.ru.

14.2. Any changes to the Operator's personal data processing policy will be reflected in this document. The Policy is valid indefinitely until it is replaced by a new version.

14.3. The current version of the Policy is published with free access on the Internet at https://veriongroup.ru/privacy-policy.