Personal data processing policy
This personal data procession policy of GUTA-DEVELOPMENT JSC (hereinafter referred to as “this Policy”) is drawn up in accordance with the requirements of the Personal Data Federal Law No. 152-ФЗ dated July 27, 2006 (hereinafter referred to as “the Personal Data Law”) to determine the personal data procession procedure and the measures of ensuring the personal data security to be taken by GUTA-DEVELOPMENT JSC (hereinafter referred to as “the Operator”).
1.1. The Operator’s most important goal conditioning its activity is observance of the human and civil rights and liberties in the course of personal data procession, including protection of the rights to privacy and to keeping personal and family secrets.
1.2. This Policy applies to all information about the https://gutadevelopment.ru/ website visitors obtainable by the Operator.
2.1. Personal Data Automated Procession: procession of personal data with computer machines.
2.2. Personal data blocking: temporary termination of personal data procession (save such procession is necessary to specify personal data).
2.3. Website: the whole of graphic and informational materials available at https://gutadevelopment.ru/ together with the software and databases ensuring their availability.
2.4. Personal Data Information System: the whole of personal data contained in the databases together with the information technologies and technical means ensuring their procession.
2.5. Personal data depersonalization: actions resulting in the impossibility of determination, without using additional information, the specific User owning personal data or another Personal Data Subject.
2.6. Personal data procession: any action (operation) or a set of actions (operations) with personal data performed with or without the use of automation tools, including collection, recording, systematization, accumulation, keeping, correction (updating, amending), retrieval, use, transfer (distribution, provision, giving access), depersonalization, blocking, deletion and destruction of personal data.
2.7. Operator: a state authority, municipal body, legal entity or individual organizing and/or carrying out personal data procession, as well as determining the purposes of personal data procession, the composition of personal data to be processed and the actions (operations) to be performed with personal data, either independently or jointly with other persons.
2.8. Personal data: any information relating directly or indirectly to a specific or identifiable individual User of the website https://gutadevelopment.ru/.
2.9. Personal data allowed to be distributed by their subject: personal data of universal accessibility granted by the Personal Data Subject by consenting to process the personal data allowed to be distributed by their subject in the manner prescribed by the Personal Data Law (hereinafter referred to as “the personal data allowed to be distributed”).
2.10. User: any visitor of the website https://gutadevelopment.ru/.
2.11. Personal data provision: actions aimed at disclosing personal data to a certain person or a certain circle of persons.
2.12. Personal data distribution: any actions aimed at disclosing personal data to an indefinite circle of persons (personal data transfer) or familiarizing an unlimited circle of persons with personal data, in particular disclosing personal data in the media, placing them into information and telecommunication networks or providing access to personal data in any other way.
2.13. Cross-border transfer of personal data: personal data transfer to a foreign territory or any authority of a foreign state, as well as to a foreign individual or legal entity.
2.14. Personal data destruction: any actions resulting in the destruction of personal data with the impossibility of further restoration of their content in the Personal Data Information System and/or destruction of their material carriers.
The other terms regulated by this Policy shall be determined in accordance with the Personal Data Law.
3.1. The Operator has the right to:
· Obtain reliable information and/or documents containing personal data from the subjects of such data.
· Continue processing personal data without consent of their subjects, in the event of withdrawal of such consent by such subjects, when the data procession is well-grounded by the Personal Data Law.
· Determine independently measures necessary and sufficient to ensure the fulfillment of the obligations provided for by the Personal Data Law and the regulatory legal acts adopted in accordance therewith, unless the Personal Data Law or other federal laws provide otherwise.
3.2. The Operator is obliged to:
· Provide Personal Data Subjects at their requests with information regarding procession of their personal data.
· Organize processing personal data in the manner prescribed by the current legislation of the Russian Federation.
· Respond to inquiries and requests of Personal Data Subjects and their legal representatives in accordance with the requirements of the Personal Data Law.
· Provide the authorized body on protection of the rights of the Personal Data Subjects, at the instance of this body, with the necessary information within 30 days from the date of receipt of such a request.
· Publish or otherwise provide unrestricted access to this Policy regarding personal data procession.
· Take legal, organizational and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution of personal data, as well as from other illegal actions in relation to personal data.
· Stop transfer (distribution, provision, access) of personal data, stop procession and destroy personal data in the manner and cases provided for by the Personal Data Law.
· Perform other duties stipulated by the Personal Data Law.
4.1. The Personal Data Subjects have the right to:
· Obtain information regarding their personal data procession, except as otherwise provided by federal laws. The Operator shall provide the Personal Data Subjects with such information in an accessible form and this information shall not contain personal data of any other subjects, unless there are legal grounds for disclosing such data. The specification of such information and the procedure of its obtaining are established by the Personal Data Law.
· Summon the Operator to correct, block or destroy their personal data, in case the personal data is incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of procession, as well as take legal measures to protect their rights.
· Put forward the condition of prior consent when personal data are to be processed in order to promote goods, works or services on the market.
· Withdraw their consent to the personal data procession.
· Appeal to the authorized body on protection of the rights of the Personal Data Subjects or through the courts against any illegal actions or inaction of the Operator in the context of procession of their personal data;
· Exercise the other rights provided for by the legislation of the Russian Federation.
4.2. The Personal Data Subjects are obliged to:
· Provide the Operator with reliable data about them.
· Notify the Operator about any alteration (updates, changes) of their personal data.
4.3. Persons who have provided the Operator with false information about themselves or information about another Personal Data Subject without the latter’s consent shall bear liability in accordance with the legislation of the Russian Federation.
5.1. Surname, first name and patronymic.
5.2. E-mail address.
5.3. Phone numbers.
5.4. Other personal data provided by Users and necessary for entering into and performing contracts.
5.5. Besides, the site collects and processes depersonalized data about visitors (including cookies) through web statistics services (Yandex Metrics, Google Analytics and others).
5.6. The above data are hereinafter combined by the common concept of “personal data”.
5.7. The Operator shall not process special categories of personal data relating to race, nationality, political views, religious or philosophical beliefs and intimate life.
5.8. Procession of personal data allowed to be distributed and associated with special categories of personal data specified in Art.10.1 of the Personal Data Law shall be allowed if the prohibitions and conditions provided for in Art. 10.1 of the Personal Data Law are met.
5.9. Consent of Users to process personal data allowed to be distributed shall be formalized separately from the other consents to process their personal data, provided the conditions established, in particular, by Art. 10.1 of the Personal Data Law are met. Requirements for the content of such consent shall be established by the authorized body on protection of the rights of the Personal Data Subjects.
5.9.1. Consent to process personal data allowed to be distributed shall be directly provided by the User to the Operator.
5.9.2. Within three working days from the date of receiving the specified User’s consent, the Operator is obliged to publish the information about the terms and conditions of processing the personal data allowed to be distributed, as well as the prohibitions and conditions of processing such data by general public.
5.9.3 Transfer of personal data allowed to be distributed by their subjects (distribution or provision of such data or access to them) must be terminated at any time at the request of the Personal Data Subjects. Such request should include the surname, name, patronymic (if any), contact information (telephone number, e-mail address or postal address) of a Personal Data Subject, as well as the specification of the personal data not to be processed any more. The personal data specified in such request may only be processed by the Operator to whom the request is sent.
5.9.4 Consent to process personal data allowed to be distributed shall cease to have effect immediately when the Operator receives the request specified in clause 5.9.3 hereof.
6.1. Personal data procession shall be carried out on a legal and fair basis.
6.2. Personal data procession shall be limited to achievement of specific, predetermined and legitimate purposes. Personal data procession incompatible with the purposes of its collecting is disallowed.
6.3. Combining databases containing personal data processed for different incompatible purposes is disallowed.
6.4. Personal data not meeting the purposes of their procession shall not be processed.
6.5. Content and scope of the personal data to be processed shall comply with the stated procession purposes. Redundancy of the personal data to be processed in relation to the stated purposes of its procession is disallowed.
6.6. Accuracy and sufficiency of personal data, as well as, if necessary, their applicability to the purposes of their procession shall be ensured. The Operator shall adopt and/or ensure adoption of the necessary measures to delete or correct the incomplete or inaccurate data.
6.7. Personal data shall be kept in a form enabling to identify Personal Data Subjects no longer than required for the purposes of the personal data procession, unless the period of personal data keeping is established by the federal legislation and/or by a contract/agreement where a Personal Data Subject is a party, beneficiary or guarantor. The processed personal data shall be destroyed or depersonalized upon achievement of the procession purposes or if such achievement becomes unnecessary, unless federal law provides otherwise.
7.1. Purposes of processing personal data of the Users:
· informing the Users by sending e-mails;
· concluding, performing and terminating civil law contracts;
· providing the Users with access to the services, information and/or materials contained on the website https://gutadevelopment.ru/.
7.2. The Operator has also the right to send notifications to the Users about new products and services, special offers and various events. The Users may always refuse to receive informational messages by sending an email to the Operator to [email protected] with a note “Waiver of notifications about new products, services and special offers”.
7.3. Depersonalized data of Users collected through web statistics services shall be used to collect information about the Users’ activity on the website, as well as improve the quality and content of the website.
8.1. Legal grounds of the personal data procession by the Operator are:
· the Operator’s statutory documents;
· the Contracts entered into by the Operator and the Personal Data Subjects;
· federal laws and other regulatory acts of personal data protection;
· the Users’ consents to process their personal data, as well as the personal data allowed to be distributed.
8.2. The Operator shall only process the Users' personal data if they are filled in and/or sent by the User itself via special forms displayed on the website https://gutadevelopment.ru/ or sent to the Operator by e-mail. By filling in appropriate forms and/or sending their personal data to the Operator, the Users agree with this Policy.
8.4. Personal Data Subjects shall on their own decide on providing their personal data and give their consent of their own free will and volition and in their own interest.
9.1. Personal data shall be processed if the Personal Data Subjects consent to process their personal data.
9.2. Personal data procession is necessary to achieve purposes provided for by an international treaty of the Russian Federation or the legislation and to carry out functions, powers and obligations assigned by the Russian Federation legislation to the Operator.
9.3. Personal data procession is necessary to implement justice, as well as to fulfill court orders and orders of other bodies or officials to be fulfilled in accordance with the Russian Federation legislation on the enforcement proceedings.
9.4. Personal data procession is necessary to perform contracts/agreements where a Personal Data Subject is a party, beneficiary or guarantor, as well as to conclude a contract/agreement at the instance of a Personal Data Subject or a contract/agreement where a Personal Data Subject should be a beneficiary or guarantor.
9.5. Personal data procession is necessary to exercise the rights and legitimate interests of the Operator or third parties, or to achieve socially significant purposes, provided that the rights and freedoms of the Personal Data Subjects are not violated.
9.6. Personal data made publicly available either by Personal Data Subjects or at their instance (hereinafter referred to as “publicly available personal data”) shall be processed.
9.7. Personal data to be published or mandatorily disclosed in accordance with the federal legislation shall be processed.
Personal data processed by the Operator shall be secured through implementation of legal, organizational and technical measures necessary to meet all the requirements of the current legislation on the personal data protection.
10.1. The Operator shall ensure the safety of the personal data and take all possible measures to preclude any access of unauthorized persons to personal data.
10.2. Personal data of the Users may never (under no circumstances) be transferred to third parties, except in cases of applicable law implementation or if a Personal Data Subject has given his/her consent to the Operator to transfer data to a third party to fulfill obligations under a civil contract.
10.3. If any inaccuracies of personal data are revealed, the User may update them independently by sending a notification to the Operator to e-mail [email protected] with a note “Personal data updating.”
10.4. Time period of the personal data procession shall depend on the achievement of the purposes of the personal data collection, unless another period is provided by a contract or applicable law. The Users may withdraw their consent to the personal data procession at any time by sending an e-mail notification to the Operator's e-mail address [email protected] with a note “Withdrawal of consent to the personal data procession”.
10.5. All the information to be collected by third-party services, including by payment systems, communication means and other service providers, shall be kept and processed by them (Operators) in accordance with their User Agreements and Privacy Policies. The Personal Data Subjects and/or the Users shall be obliged to familiarize themselves timely with such documents. The Operator shall not be responsible for actions of third parties, including service providers specified in this clause.
10.6. Prohibitions established by Personal Data Subjects on transferring personal data allowed to be distributed (except for granting access to them), as well as on processing or terms and conditions of processing such personal data (except for obtaining access to them) shall not apply in cases of personal data procession for state/social purposes or for other public purposes as determined by the Russian Federation legislation.
10.7. The Operator shall ensure the confidentiality of the personal data when processing them.
10.8. The Operator shall keep the personal data in a form that allows to identify Personal Data Subjects no longer than it is necessary for purposes of personal data procession, unless the time period for keeping personal data is established by the federal legislation and/or a contract/agreement where a Personal Data Subject is a party, beneficiary or guarantor.
10.9. Achievement of the purposes of the personal data procession, expiration of consent of a Personal Data Subject or withdrawal of consent by the latter, as well as revealing unlawful procession of personal data, may cause termination of the personal data procession.
11.1. The Operator’s terms of reference include collecting, recording, systematizing, accumulating, keeping, correcting (updating/amending), retrieving, using, transferring (distributing/providing/giving access), depersonalizing, blocking, deleting and destroying personal data.
11.2. The Operator’s terms of reference include Personal Data Automated Procession with or without receiving and/or transmitting the received information via telecom networks.
12.1. Before setting to transfer personal data across a border, the Operator is obliged to make sure that the foreign country where such personal data is supposed to be transferred provides reliable protection of the rights of the Personal Data Subjects.
12.2. Any cross-border transfer of personal data to foreign territories not meeting the above requirements may only be carried out in the event of having obtained a written consent of the Personal Data Subject to transfer his/her personal data across the border and/or fulfilling a contract/agreement entered into by the Personal Data Subject.
13.1. The Operator and the other persons who have gained access to personal data are disallowed to disclose to third parties and distribute any personal data without consent of their Users, unless otherwise provided by the federal legislation (Art. 7 of the Personal Data Law).
14.1. When keeping personal data, the Operator is obliged to use databases located on the territory of the Russian Federation, in accordance with Art. 18.5 of the Personal Data Law.
14.2. The Operator shall keep the personal data in a form that allows to identify Personal Data Subjects no longer than it is necessary for the personal data procession purposes, unless the time period for keeping personal data is established by the federal legislation and/or a contract/agreement where a Personal Data Subject is a party, beneficiary or guarantor.
14.3. In the event of evidence of any inaccuracy of personal data or illegality of their procession, such personal data shall be updated by the Operator and their procession shall be terminated respectively (Art. 21 of the Personal Data Law).
14.4. Upon reaching the purposes of processing personal data, as well as in the event of withdrawal by the Users of their consent to process them, such personal data shall be destroyed in accordance with the Personal Data Law.
14.5. The Users may obtain any clarifications of their issues of interest regarding the procession of their personal data by contacting the Operator via e-mail: [email protected].
14.6. This Policy shall be valid without time limit until replaced by a new version or modified.
14.7. The current version of this Policy shall be freely available at https://gutadevelopment.ru/.