Policy on Processing Personal Data
1. General Provisions
This policy on processing personal data is prepared in accordance with the requirements of the Federal Law of July 27, 2006, No. 152-FZ "On Personal Data" (hereinafter - the Law on Personal Data) and defines the procedure for processing personal data and measures to ensure the security of personal data, taken by LLC "Stavros" (hereinafter - the Operator).
1.1. The Operator considers compliance with the rights and freedoms of the individual and citizen during processing of their personal data, including the protection of rights to inviolability of private life, personal and family secrets, as its primary goal and condition for carrying out its activities.
This Operator's policy on processing personal data (hereinafter - the Policy) applies to all information that the Operator may obtain about visitors of the website https://stavros.ru.
2. Key Terms Used in the Policy
2.1. Automated Processing of Personal Data - processing of personal data using computer equipment.
2.2. Blocking of Personal Data - temporary suspension of processing personal data (except in cases where processing is necessary to verify personal data).
2.3. Website - a collection of graphic and informational materials, as well as computer programs and databases, ensuring their accessibility over the internet via the network address https://stavros.ru.
2.4. Information System for Personal Data - a collection of personal data stored in databases, and information technologies and technical means ensuring their processing.
2.5. Anonymization of Personal Data - actions resulting in the impossibility of identifying the specific User or other subject of personal data without using additional information.
2.6. Processing of Personal Data - any action (operation) or set of actions (operations) performed with personal data using automated means or without such means, including collection, recording, systematization, accumulation, storage, updating (updating, modification), extraction, use, transmission (distribution, provision, access), anonymization, blocking, deletion, destruction of personal data.
2.7. Operator - a state body, municipal body, legal or physical person, independently or jointly with other persons, organizing and (or) carrying out processing of personal data, as well as determining the purposes of processing personal data, the composition of personal data subject to processing, actions (operations) performed with personal data.
2.8. Personal Data - any information relating directly or indirectly to a specific or identifiable User of the website https://stavros.ru.
2.9. Personal Data Authorized for Dissemination by the Data Subject - personal data to which access is granted to an unlimited circle of persons by the data subject through consent to processing of personal data authorized for dissemination in accordance with the Law on Personal Data (hereinafter - personal data authorized for dissemination).
2.10. User - any visitor of the website https://stavros.ru.
2.11. Provision of Personal Data - actions aimed at disclosing personal data to a specific person or a specific group of persons.
2.12. Dissemination of Personal Data - any actions aimed at disclosing personal data to an unspecified group of persons (transmission of personal data) or making personal data accessible to an unlimited group of persons, including publishing personal data in mass media, posting in information and telecommunications networks, or providing access to personal data by any other means.
2.13. Cross-border Transfer of Personal Data - transfer of personal data to the territory of a foreign state to an authority of a foreign state, a foreign physical or legal person.
2.14. Destruction of Personal Data - any actions resulting in irreversible destruction of personal data, making it impossible to restore the content of personal data in the information system for personal data and (or) destruction of physical carriers of personal data.
3. Main Rights and Obligations of the Operator
3.1. The Operator has the right:
– to obtain from the data subject accurate information and/or documents containing personal data;
– in case the data subject withdraws consent to processing of personal data, the Operator may continue processing personal data without consent of the data subject if the grounds specified in the Law on Personal Data are present;
– to independently determine the composition and list of measures necessary and sufficient to ensure fulfillment of obligations provided for by the Law on Personal Data and adopted normative legal acts in accordance with it, unless otherwise provided by the Law on Personal Data or other federal laws.
3.2. The Operator is obliged:
– to provide the data subject with information concerning processing of his personal data upon request;
– to organize processing of personal data in accordance with the current legislation of the Russian Federation;
– to respond to requests and inquiries from data subjects and their lawful representatives in accordance with the requirements of the Law on Personal Data;
– to provide the authorized body responsible for protecting the rights of personal data subjects with the necessary information within 30 days from the date of receipt of such a request;
– to publish or otherwise ensure unrestricted access to this Policy on the processing of personal data;
– to take legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, alteration, blocking, copying, disclosure, or dissemination of personal data, as well as from other unlawful actions concerning personal data;
– to cease transmission (dissemination, disclosure, access) of personal data, to cease processing, and to destroy personal data in accordance with and under the circumstances provided by the Law on Personal Data;
– to fulfill other obligations established by the Law on Personal Data.
4. Main rights and obligations of personal data subjects
4.1. Personal data subjects have the right:
– to obtain information regarding the processing of their personal data, except in cases provided by federal laws. Such information is provided to the personal data subject by the Operator in an accessible form, and shall not contain personal data relating to other personal data subjects, except in cases where there are lawful grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Law on Personal Data;
– to request the Operator to correct their personal data, block or delete it if the personal data is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing, as well as to take the measures provided by law to protect their rights;
– to require prior consent for processing personal data for the purpose of promoting goods, services, or products on the market;
– to withdraw consent for processing personal data;
– to challenge in the authorized body responsible for protecting the rights of personal data subjects or in court any unlawful actions or omissions by the Operator in processing their personal data;
– to exercise other rights provided by Russian Federation legislation.
4.2. Personal data subjects are obligated:
– to provide the Operator with accurate information about themselves;
– to notify the Operator of any correction (update, change) to their personal data.
4.3. Persons who have provided the Operator with inaccurate information about themselves, or information about another personal data subject without the latter’s consent, shall be liable in accordance with Russian Federation legislation.
5. The Operator may process the following personal data of the User
5.1. Last name, first name, middle name.
5.2. Email address.
5.3. Phone numbers.
5.4. Photographs.
5.5. Taxpayer Identification Number, date of registration with tax authorities, details of the registration certificate issued by the tax authority.
5.6. Address of actual residence and registration at the place of residence and (or) at the place of stay.
5.7. Additionally, the website collects and processes anonymous data about visitors (including "cookie" files) using internet statistics services (Yandex.Metrica and Google Analytics and others).
5.8. The above-listed data are collectively referred to as "Personal Data" throughout this Policy.
5.9. The Operator does not process special categories of personal data relating to race, nationality, political opinions, religious or philosophical beliefs, or intimate life.
5.10. Processing of personal data permitted for dissemination, from among the special categories of personal data specified in paragraph 1 of Article 10 of the Law on Personal Data, is permitted if the prohibitions and conditions provided in Article 10.1 of the Law on Personal Data are observed.
5.11. Consent of the User for processing personal data permitted for dissemination is obtained separately from other consents for processing their personal data. In this case, the conditions provided in particular by Article 10.1 of the Law on Personal Data are observed. Requirements regarding the content of such consent are established by the authorized body responsible for protecting the rights of personal data subjects.
5.11.1. The User directly provides consent to the Operator for processing personal data permitted for dissemination.
5.11.2 The Operator shall, within three working days from the date of receipt of the User's consent, publish information on the processing conditions, on the presence of restrictions and conditions on processing personal data permitted for dissemination, to an unlimited circle of persons.
5.11.3 The processing (distribution, provision, access) of personal data permitted for dissemination by the data subject shall be terminated at any time upon request by the data subject. Such a request shall include the surname, first name, and patronymic (if applicable), contact information (phone number, email address, or postal address) of the data subject, as well as a list of personal data whose processing is to be terminated. The personal data indicated in such a request may be processed only by the Operator to whom the request is addressed.
5.11.4 Consent to process personal data permitted for dissemination shall cease upon receipt by the Operator of the request specified in paragraph 5.11.3 of this Policy regarding the processing of personal data.
6. Principles of personal data processing
6.1. Processing of personal data is carried out on a lawful and fair basis.
6.2. Processing of personal data is limited to achieving specific, previously defined, and lawful purposes. Processing of personal data incompatible with the purposes of collecting such data is not permitted.
6.3. It is not permitted to combine databases containing personal data whose processing is carried out for purposes incompatible with each other.
6.4. Only personal data that correspond to the purposes of their processing are subject to processing.
6.5. The content and volume of processed personal data correspond to the stated purposes of processing. Excessiveness of processed personal data relative to the stated purposes of their processing is not permitted.
6.6. When processing personal data, accuracy, adequacy, and, where necessary, relevance of such data relative to the purposes of processing personal data are ensured. The Operator takes necessary measures and/or ensures their adoption to remove or correct incomplete or inaccurate data.
6.7. Personal data are stored in a form enabling identification of the data subject, no longer than necessary for the purposes of processing personal data, unless the storage period is established by federal law, a contract, the data subject being a party, beneficiary, or guarantor thereof. Processed personal data are destroyed or anonymized upon achieving the purposes of processing or in case of loss of necessity to achieve such purposes, unless otherwise provided by federal law.
7. Purposes of processing personal data
7.1. Purpose of processing the User's personal data:
– informing the User by sending emails;
– concluding, performing, and terminating civil law contracts;
– providing the User access to services, information, and/or materials contained on the website https://stavros.ru.
7.2. The Operator also has the right to send the User notifications about new products and services, special offers, and various events. The User may always refuse to receive informational messages by sending an email to the Operator at the email address [email protected] with the note "Refusal to receive notifications about new products and services and special offers".
7.3. Anonymized data of Users collected via internet statistics services are used to gather information about User actions on the site, improve the quality of the site and its content.
8. Legal bases for processing personal data
8.1. Legal bases for processing personal data by the Operator are:
– Federal Law of July 27, 2006, No. 152-FZ "On Personal Data";";;EN;; 938766;"– федеральные законы, иные нормативно-правовые акты в сфере защиты персональных данных;
– federal laws and other regulatory legal acts in the field of personal data protection;
– consent of Users to processing their personal data, and processing personal data permitted for dissemination.
8.2. The Operator processes the User's personal data only if the User voluntarily fills out and/or submits such data through special forms located on the website https://stavros.ru or sent to the Operator via email. By filling out the appropriate forms and/or submitting personal data to the Operator, the User expresses consent to this Policy.
8.3. The Operator processes anonymized data of the User if this is permitted by the browser settings of the User (cookies are enabled and JavaScript technology is used).
8.4. The data subject independently decides whether to provide their personal data and gives consent freely, of their own will, and in their own interest.
9. Conditions for processing personal data
9.1. Processing of personal data is carried out with the consent of the data subject to process their personal data.
9.2. Processing of personal data is necessary to achieve purposes provided for by an international treaty of the Russian Federation or a law, to implement functions, powers, and obligations assigned to the Operator by legislation of the Russian Federation.
9.3. Processing of personal data is necessary to ensure justice, to execute a court decision, an act of another body or official, subject to execution in accordance with the legislation of the Russian Federation on enforcement proceedings.
9.4. Processing of personal data is necessary to fulfill a contract in which the data subject is a party, or a beneficiary or guarantor thereof, as well as to conclude a contract initiated by the data subject or a contract in which the data subject will be a beneficiary or guarantor.
9.5. Processing of personal data is necessary to fulfill the rights and legitimate interests of the operator or third parties, or to achieve socially significant objectives, provided that such processing does not violate the rights and freedoms of the data subject.
9.6. Processing of personal data that is accessible to an unlimited number of persons, either by the data subject or at their request (hereinafter – publicly accessible personal data).
9.7. Processing of personal data subject to publication or mandatory disclosure in accordance with federal law.
10. Procedure for collecting, storing, transmitting, and other types of processing of personal data
Security of personal data processed by the Operator is ensured by implementing legal, organizational, and technical measures necessary to fully comply with the requirements of current legislation in the field of personal data protection.
10.1. The Operator ensures the preservation of personal data and takes all possible measures to prevent unauthorized access by unqualified persons.
10.2. The User’s personal data will never be transferred to third parties under any circumstances, except in cases related to compliance with applicable legislation or if the data subject has given consent to the Operator to transfer data to a third party to fulfill obligations under a civil law contract.
10.3. In case of inaccuracies in personal data, the User may update them themselves by sending a notification to the Operator at the email address [email protected] with the note "Updating personal data".
10.4. The processing period of personal data is determined by the achievement of the purposes for which the personal data were collected, unless a different period is provided by the contract or applicable legislation. The User may at any time withdraw consent to the processing of personal data by sending a notification via email to the Operator at [email protected] with the note "Withdrawal of consent to processing personal data".
10.5. All information collected by third-party services, including payment systems, communication tools, and other service providers, is stored and processed by the respective parties (Operators) in accordance with their Terms of Service and Privacy Policy. The data subject and/or User is obligated to independently and promptly review these documents. The Operator is not liable for actions of third parties, including those mentioned in this paragraph as service providers.
10.6. Restrictions set by the data subject on the transfer (except for access provision), as well as on processing or processing conditions (except for access) of personal data permitted for dissemination, do not apply in cases where personal data is processed in the interests of the state, public, or other public interests as defined by Russian Federation legislation.
10.7. The Operator ensures the confidentiality of personal data when processing it.
10.8. The Operator stores personal data in a form that allows identification of the data subject for no longer than necessary to achieve the purposes of processing personal data, unless the storage period is established by federal law, a contract, or by the data subject as a party, beneficiary, or guarantor thereof.
10.9. Termination of personal data processing may occur upon achievement of the processing objectives, expiration of the data subject’s consent, withdrawal of consent by the data subject, or discovery of unlawful processing of personal data.
11. List of actions performed by the Operator with the received personal data
11.1. The Operator performs collection, recording, systematization, accumulation, storage, updating (updating, modification), extraction, use, transmission (distribution, provision, access), anonymization, blocking, deletion, and destruction of personal data.
11.2. The Operator performs automated processing of personal data with the receipt and/or transmission of the obtained information via information and telecommunications networks or without such transmission.
12. Cross-border transfer of personal data
12.1. Before initiating cross-border transfer of personal data, the Operator must ensure that the foreign state to which the data is to be transferred provides adequate protection of the rights of data subjects.
12.2. Cross-border transfer of personal data to foreign states that do not meet the aforementioned requirements may occur only if the data subject provides written consent to the cross-border transfer of their personal data and/or if the data subject is a party to a contract.
13. Confidentiality of personal data
The Operator and other persons who have access to personal data are obligated not to disclose or disseminate personal data to third parties without the consent of the data subject, unless otherwise provided by federal law.
14. Final provisions
14.1. The User may obtain any clarifications regarding questions concerning the processing of their personal data by contacting the Operator via email at [email protected].
14.2. Any changes to the Operator’s personal data processing policy will be reflected in this document. The policy remains in effect indefinitely until replaced by a new version.
14.3. The current version of the Policy is freely accessible on the Internet at https://stavros.ru/privacy.
Get the benefits of cooperation with us