This Personal Data Processing Policy has been prepared in accordance with the requirements of Federal Law No. 152-FZ of 27 July 2006, “On Personal Data” (hereinafter, the “Personal Data Law”), and sets out the procedures for processing personal data and the measures taken by Anastasia Andreevna Mostovaya (hereinafter, the “Operator”) to ensure the security of personal data.
1.1. The Operator considers respect for human and civil rights and freedoms when processing personal data, including protection of the right to privacy and the confidentiality of personal and family matters, to be its foremost objective and a prerequisite for carrying out its activities.
1.2. This Personal Data Processing Policy of the Operator (hereinafter, the “Policy”) applies to all information that the Operator may obtain about visitors to the website http://anastasia-adss.com/en.

2.1. Automated processing of personal data means the processing of personal data using computer equipment.
2.2. Blocking of personal data means the temporary suspension of the processing of personal data, except where processing is necessary to rectify personal data.
2.3. Website means a collection of graphic and informational materials, computer programs, and databases that make such materials available on the internet at http://anastasia-adss.com/en.
2.4. Personal data information system means a collection of personal data held in databases and the information technologies and technical resources used to process them.
2.5. Depersonalization of personal data means actions that make it impossible, without additional information, to determine whether personal data relate to a particular User or another personal data subject.
2.6. Processing of personal data means any action (operation) or set of actions (operations) performed on personal data, with or without automated means, including collection, recording, systematization, accumulation, storage, rectification (updating, amendment), retrieval, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion, and destruction of personal data.
2.7. Operator means a state authority, municipal authority, legal entity, or individual that, independently or jointly with others, organizes and/or carries out the processing of personal data and determines the purposes of processing, the personal data to be processed, and the actions (operations) to be performed on personal data.
2.8. Personal data means any information relating directly or indirectly to an identified or identifiable User of the website http://anastasia-adss.com/en.
2.9. Personal data authorized by the personal data subject for dissemination means personal data to which the personal data subject has granted access to an unlimited number of persons by consenting to the processing of personal data authorized for dissemination, in accordance with the procedure established by the Personal Data Law (hereinafter, “personal data authorized for dissemination”).
2.10. User means any visitor to the website http://anastasia-adss.com/en.
2.11. Provision of personal data means actions intended to disclose personal data to a specific person or a specific group of persons.
2.12. Dissemination of personal data means any actions intended to disclose personal data to an unspecified group of persons (transfer of personal data) or to make personal data available to an unlimited number of persons, including publication of personal data in the mass media, placement on information and telecommunications networks, or granting access to personal data by any other means.
2.13. Cross-border transfer of personal data means the transfer of personal data to the territory of a foreign state, to an authority of that foreign state, a foreign individual, or a foreign legal entity.
2.14. Destruction of personal data means any actions that result in the irreversible destruction of personal data, making it impossible to restore their content in a personal data information system, and/or the destruction of physical media containing personal data.

3.1. The Operator has the right to:
— receive accurate information and/or documents containing personal data from the personal data subject;
— continue processing personal data without the personal data subject’s consent if the subject withdraws their consent to processing or submits a request to cease processing, provided that grounds specified in the Personal Data Law exist;
— independently determine the scope and list of measures necessary and sufficient to fulfill the obligations imposed by the Personal Data Law and the regulations adopted pursuant to it, unless otherwise provided by the Personal Data Law or other federal laws.
3.2. The Operator is required to:
— provide the personal data subject, upon request, with information concerning the processing of their personal data;
— organize the processing of personal data in accordance with the procedures established by the applicable legislation of the Russian Federation;
— respond to inquiries and requests from personal data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
— provide the authority responsible for protecting the rights of personal data subjects with the necessary information upon its request, within 10 days of receiving that request;
— publish this Personal Data Processing Policy or otherwise make it accessible without restriction;
— take legal, organizational, and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination, and other unlawful actions involving personal data;
— cease the transfer (dissemination, provision, access) and processing of personal data and destroy personal data in the manner and circumstances prescribed by the Personal Data Law;
— fulfill other obligations imposed by the Personal Data Law.

4.1. Personal data subjects have the right to:
— receive information concerning the processing of their personal data, except in cases provided for by federal laws. The Operator must provide this information in an accessible form. It must not contain personal data relating to other personal data subjects, unless there are lawful grounds for disclosing such personal data. The scope of the information and the procedure for obtaining it are established by the Personal Data Law;
— require the Operator to rectify, block, or destroy their personal data if the data are incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated purpose of processing, and take measures provided for by law to protect their rights;
— require prior consent for the processing of personal data for the purpose of promoting goods, works, and services on the market;
— withdraw consent to the processing of personal data and submit a request to cease processing;
— challenge the Operator’s unlawful actions or omissions in processing their personal data before the authority responsible for protecting the rights of personal data subjects or in court;
— exercise other rights provided for by the legislation of the Russian Federation.
4.2. Personal data subjects are required to:
— provide the Operator with accurate personal data about themselves;
— notify the Operator of any rectification (updating, amendment) of their personal data.
4.3. Persons who provide the Operator with inaccurate information about themselves or information about another personal data subject without that subject’s consent shall be liable in accordance with the legislation of the Russian Federation.

5.1. Personal data are processed lawfully and fairly.
5.2. The processing of personal data is limited to achieving specific, predetermined, and lawful purposes. Processing that is incompatible with the purposes for which personal data were collected is not permitted.
5.3. Databases containing personal data processed for mutually incompatible purposes must not be combined.
5.4. Only personal data that correspond to the purposes of processing may be processed.
5.5. The content and volume of the personal data processed must correspond to the stated purposes of processing. Personal data processed must not be excessive in relation to those purposes.
5.6. When personal data are processed, their accuracy and adequacy must be ensured and, where necessary, they must be kept up to date in relation to the purposes of processing. The Operator takes the necessary measures and/or ensures that such measures are taken to delete or rectify incomplete or inaccurate data.
5.7. Personal data must be stored in a form that permits identification of the personal data subject for no longer than required by the purposes of processing, unless a retention period is established by federal law or by a contract to which the personal data subject is a party or under which they are a beneficiary or guarantor. Personal data being processed must be destroyed or depersonalized once the purposes of processing have been achieved or are no longer necessary, unless otherwise provided by federal law.

6.1. Purpose of processing: handling inquiries and requests from website users, establishing communication with them, providing advice on marketing and advertising services, and discussing the terms of cooperation.
6.2. Personal data:
— surname, first name, and patronymic;
— telephone numbers.
6.3. Legal basis: the personal data subject’s consent to the processing of their personal data (Article 6, Part 1, Clause 1 of Federal Law No. 152-FZ of 27 July 2006, “On Personal Data”).
6.4. Types of personal data processing: collection, recording, systematization, accumulation, storage, destruction, and depersonalization of personal data.

7.1. Personal data are processed with the personal data subject’s consent to the processing of their personal data.
7.2. The processing of personal data is necessary to achieve purposes provided for by an international treaty of the Russian Federation or by law, and to perform the functions, exercise the powers, and fulfill the obligations assigned to the Operator by the legislation of the Russian Federation.
7.3. The processing of personal data is necessary for the administration of justice or the enforcement of a judicial act or an act of another authority or official that is subject to enforcement under the legislation of the Russian Federation on enforcement proceedings.
7.4. The processing of personal data is necessary to perform a contract to which the personal data subject is a party or under which they are a beneficiary or guarantor, or to enter into a contract at the personal data subject’s initiative or a contract under which they will be a beneficiary or guarantor.
7.5. The processing of personal data is necessary to exercise the rights and legitimate interests of the Operator or third parties, or to achieve objectives of public importance, provided that the rights and freedoms of the personal data subject are not infringed.
7.6. Personal data to which access has been granted to an unlimited number of persons by the personal data subject or at their request are processed (hereinafter, “publicly available personal data”).
7.7. Personal data that are subject to publication or mandatory disclosure under federal law are processed.

The security of personal data processed by the Operator is ensured through the implementation of legal, organizational, and technical measures necessary to fully comply with the requirements of applicable legislation on personal data protection.
8.1. The Operator ensures the safekeeping of personal data and takes all possible measures to prevent unauthorized persons from accessing them.
8.2. The User’s personal data will never, under any circumstances, be transferred to third parties, except in cases involving compliance with applicable legislation or where the personal data subject has consented to the Operator transferring the data to a third party for the fulfillment of obligations under a civil-law contract.
8.3. If inaccuracies are identified in personal data, the User may update the data by sending a notification to the Operator at anastasia.adss03@gmail.com with the subject line “Personal Data Update”.
8.4. The duration of personal data processing is determined by the achievement of the purposes for which the personal data were collected, unless a different period is specified by a contract or applicable legislation.
The User may withdraw their consent to the processing of personal data at any time by sending an email notification to the Operator at anastasia.adss03@gmail.com with the subject line “Withdrawal of Consent to Personal Data Processing”.
8.5. All information collected by third-party services, including payment systems, communications services, and other service providers, is stored and processed by those parties (operators) in accordance with their terms of use and privacy policies. [Incomplete sentence in the Russian original: “The personal data subject and/or with the above documents.”] The Operator shall not be liable for the actions of third parties, including the service providers referred to in this clause.
8.6. Prohibitions imposed by the personal data subject on the transfer of personal data authorized for dissemination (except for granting access), as well as prohibitions on processing or conditions for processing such data (except for obtaining access), do not apply where personal data are processed in state, social, or other public interests defined by the legislation of the Russian Federation.
8.7. The Operator ensures the confidentiality of personal data when processing them.
8.8. The Operator stores personal data in a form that permits identification of the personal data subject for no longer than required by the purposes of processing, unless a retention period is established by federal law or by a contract to which the personal data subject is a party or under which they are a beneficiary or guarantor.
8.9. Grounds for ceasing the processing of personal data may include the achievement of the purposes of processing, the expiry of the personal data subject’s consent, the withdrawal of consent by the personal data subject or a request to cease processing, and the identification of unlawful processing of personal data.

9.1. The Operator collects, records, systematizes, accumulates, stores, rectifies (updates, amends), retrieves, uses, transfers (disseminates, provides, grants access to), depersonalizes, blocks, deletes, and destroys personal data.
9.2. The Operator carries out automated processing of personal data with or without receiving and/or transmitting the information obtained through information and telecommunications networks.

10.1. Before commencing cross-border transfers of personal data, the Operator must notify the authority responsible for protecting the rights of personal data subjects of its intention to carry out such transfers. This notification is submitted separately from the notification of the intention to process personal data.
10.2. Before submitting the notification referred to above, the Operator must obtain the relevant information from the authorities of the foreign state, foreign individuals, and foreign legal entities to which the cross-border transfer of personal data is planned.

The Operator and other persons who have obtained access to personal data must not disclose personal data to third parties or disseminate them without the personal data subject’s consent, unless otherwise provided by federal law.

12.1. The User may obtain clarification on any matters relating to the processing of their personal data by contacting the Operator at anastasia.adss03@gmail.com.
12.2. Any changes to the Operator’s Personal Data Processing Policy will be reflected in this document. The Policy remains in effect indefinitely until replaced by a new version.
12.3. The current version of the Policy is freely available on the internet at http://anastasia-adss.com/privacy/en.