Personal Data Processing Policy
1. General provisions
This Personal Data Processing Policy has been prepared in accordance with Federal Law No. 152-FZ of 27 July 2006, On Personal Data (the Personal Data Law), and sets out the procedures for processing personal data and the measures taken by PIEFF (the Operator) to protect personal data.
1.1. The Operator regards respect for human and civil rights and freedoms when processing personal data, including the protection of privacy and personal and family confidentiality, as a fundamental objective and a condition of its activities.
1.2. This Personal Data Processing Policy of the Operator (the Policy) applies to all information that the Operator may obtain about visitors to https://pieff.pro/
2. Key terms used in this Policy
2.1. Automated processing of personal data means processing personal data using computer equipment.
2.2. Blocking personal data means temporarily suspending its processing, except where processing is necessary to rectify the data.
2.3. Website means the collection of graphic and informational materials, computer programs and databases that make those materials accessible on the internet at https://pieff.pro/
2.4. Personal data information system means the personal data held in databases, together with the information technologies and technical resources used to process it.
2.5. Depersonalisation of personal data means actions that make it impossible, without additional information, to determine whether personal data relates to a particular User or other data subject.
2.6. Processing personal data means any action or set of actions performed on personal data, with or without automated means, including collection, recording, organisation, accumulation, storage, rectification (updating or amendment), retrieval, use, transfer (dissemination, provision or access), depersonalisation, blocking, deletion and destruction.
2.7. Operator means a state or municipal authority, legal entity or individual that, independently or jointly with others, organises and/or processes personal data and determines the purposes of processing, the personal data to be processed and the actions to be performed on it.
2.8. Personal data means any information relating directly or indirectly to an identified or identifiable User of https://pieff.pro/
2.9. Personal data authorised by the data subject for dissemination means personal data to which the data subject has granted access to an unrestricted group of persons by consenting to its processing for dissemination in accordance with the Personal Data Law (personal data authorised for dissemination).
2.10. User means any visitor to https://pieff.pro/
2.11. Provision of personal data means actions intended to disclose personal data to a particular person or a defined group of persons.
2.12. Dissemination of personal data means any action intended to disclose personal data to an undefined group of persons (transfer of personal data) or otherwise make it available to an unrestricted group, including publication in the media, placement on information and telecommunications networks or provision of access by any other means.
2.13. Cross-border transfer of personal data means transferring personal data to the territory of a foreign state, to a foreign public authority, individual or legal entity.
2.14. Destruction of personal data means any action that irreversibly destroys personal data so that its content cannot be restored in a personal data information system and/or destroys the physical media containing it.
3. Principal rights and obligations of the Operator
3.1. The Operator has the right to:
– obtain accurate information and/or documents containing personal data from the data subject;
– continue processing personal data without the data subject's consent after consent has been withdrawn, where grounds provided for by the Personal Data Law apply;
– determine independently the measures necessary and sufficient to meet its obligations under the Personal Data Law and regulations adopted pursuant to it, unless otherwise provided by that law or other federal laws.
3.2. The Operator must:
– provide the data subject, upon request, with information concerning the processing of their personal data;
– organise personal data processing in accordance with applicable Russian legislation;
– respond to enquiries and requests from data subjects and their legal representatives in accordance with the Personal Data Law;
– provide the authority responsible for protecting data subjects' rights with the information it requests within 30 days of receiving the request;
– publish or otherwise provide unrestricted access to this Personal Data Processing Policy;
– take legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful actions;
– cease the transfer (dissemination, provision or access) and processing of personal data, and destroy it, in the manner and circumstances prescribed by the Personal Data Law;
– fulfil other obligations prescribed by the Personal Data Law.
4. Principal rights and obligations of data subjects
4.1. Data subjects have the right to:
– obtain information concerning the processing of their personal data, except in cases provided for by federal law. The Operator must provide this information in an accessible form, without including personal data relating to other data subjects unless there are lawful grounds for its disclosure. The information to be provided and the procedure for obtaining it are established by the Personal Data Law;
– require the Operator to rectify, block or destroy personal data that is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated processing purpose, and take measures provided for by law to protect their rights;
– require prior consent to the processing of personal data for the marketing of goods, works and services;
– withdraw consent to the processing of personal data;
– challenge unlawful acts or omissions by the Operator in processing personal data before the authority responsible for protecting data subjects' rights or in court;
– exercise other rights provided for by Russian legislation.
4.2. Data subjects must:
– provide the Operator with accurate information about themselves;
– notify the Operator of rectifications, updates or changes to their personal data.
4.3. Persons who provide the Operator with inaccurate information about themselves, or information about another data subject without that person's consent, are liable in accordance with Russian legislation.
5. Personal data the Operator may process
5.1. Surname, first name and patronymic.
5.2. Email address.
5.3. Telephone numbers.
5.4. The website also collects and processes depersonalised visitor data, including cookies, through web analytics services such as Yandex Metrica, Google Analytics and others.
5.5. The data listed above is referred to collectively as Personal Data throughout this Policy.
5.6. The Operator does not process special categories of personal data concerning racial or ethnic origin, political views, religious or philosophical beliefs, or private sexual life.
5.7. Personal data authorised for dissemination that falls within the special categories listed in Article 10(1) of the Personal Data Law may be processed subject to the prohibitions and conditions established by Article 10.1 of that law.
5.8. The User's consent to processing personal data authorised for dissemination is obtained separately from other consents to processing their personal data. The conditions prescribed, in particular, by Article 10.1 of the Personal Data Law must be observed. Requirements for the content of this consent are established by the authority responsible for protecting data subjects' rights.
5.8.1. The User provides consent to processing personal data authorised for dissemination directly to the Operator.
5.8.2. Within three working days of receiving this consent, the Operator must publish information on the processing conditions and any prohibitions or conditions applicable to processing personal data authorised for dissemination by an unrestricted group of persons.
5.8.3. The transfer (dissemination, provision or access) of personal data authorised by the data subject for dissemination must cease whenever the data subject requests it. The request must state the data subject's surname, first name, patronymic (if any), contact details (telephone number, email address or postal address) and the personal data whose processing must cease. The personal data specified in the request may be processed only by the Operator to whom it is addressed.
5.8.4. Consent to processing personal data authorised for dissemination ceases to have effect when the Operator receives the request specified in clause 5.8.3 of this Policy.
6. Principles of personal data processing
6.1. Personal data is processed lawfully and fairly.
6.2. Processing is limited to specific, predetermined and lawful purposes. Processing incompatible with the purposes for which the data was collected is not permitted.
6.3. Databases containing personal data processed for incompatible purposes must not be combined.
6.4. Only personal data relevant to the processing purposes may be processed.
6.5. The content and volume of personal data processed must correspond to the stated purposes. Processing excessive personal data in relation to those purposes is not permitted.
6.6. Personal data must be accurate, sufficient and, where necessary, up to date for the purposes of processing. The Operator takes, and/or ensures that others take, the measures necessary to delete or rectify incomplete or inaccurate data.
6.7. Personal data is retained in a form that permits identification of the data subject for no longer than required by the processing purposes, unless a retention period is established by federal law or by a contract to which the data subject is a party, beneficiary or guarantor. Unless otherwise provided by federal law, personal data is destroyed or depersonalised when the processing purposes have been achieved or are no longer necessary.
7. Purposes of processing personal data
7.1. The purposes of processing the User's personal data are:
– informing the User by email;
– entering into, performing and terminating civil-law contracts;
– providing the User with access to services, information and/or materials available at https://pieff.pro/
7.2. The Operator may also send the User notifications about new products and services, special offers and events. The User may opt out at any time by emailing info@pieff.pro with the subject line ‘Opt out of notifications about new products, services and special offers’.
7.3. Depersonalised User data collected through web analytics services is used to understand Users' activity on the website and improve the website and its content.
8. Legal grounds for processing personal data
8.1. The legal grounds on which the Operator processes personal data are:
– the Operator's constitutional documents;
– contracts between the Operator and data subjects;
– federal laws and other regulations concerning personal data protection;
– Users' consent to processing their personal data and personal data authorised for dissemination.
8.2. The Operator processes the User's personal data only when the User enters and/or submits it through the forms at https://pieff.pro/ or sends it to the Operator by email. By completing the relevant forms and/or sending personal data to the Operator, the User expresses agreement with this Policy.
8.3. The Operator processes depersonalised data about the User where the User's browser settings permit cookies to be stored and JavaScript to be used.
8.4. Data subjects decide independently whether to provide their personal data and give consent freely, of their own will and in their own interests.
9. Conditions for processing personal data
9.1. Personal data is processed with the data subject's consent.
9.2. Processing is necessary to achieve purposes established by an international treaty of the Russian Federation or by law, or to perform functions, powers and duties imposed on the Operator by Russian legislation.
9.3. Processing is necessary for the administration of justice or enforcement of a judicial act, or an act of another authority or official, enforceable under Russian legislation on enforcement proceedings.
9.4. Processing is necessary to perform a contract to which the data subject is a party, beneficiary or guarantor, or to enter into a contract at the data subject's request or under which the data subject will be a beneficiary or guarantor.
9.5. Processing is necessary to exercise the rights and legitimate interests of the Operator or third parties, or to achieve objectives of public significance, provided that the data subject's rights and freedoms are not infringed.
9.6. Processing concerns personal data to which an unrestricted group of persons has been granted access by, or at the request of, the data subject (publicly available personal data).
9.7. Processing concerns personal data that must be published or disclosed under federal law.
10. Collection, storage, transfer and other processing procedures
The security of personal data processed by the Operator is ensured through the legal, organisational and technical measures necessary to comply fully with applicable personal data protection legislation.
10.1. The Operator safeguards personal data and takes all possible measures to prevent access by unauthorised persons.
10.2. The User's personal data will not be transferred to third parties under any circumstances, except where required to comply with applicable legislation or where the data subject has consented to the Operator transferring it to a third party to fulfil obligations under a civil-law contract.
10.3. If the User identifies inaccuracies in their personal data, they may update it by notifying the Operator at info@pieff.pro with the subject line ‘Personal data update’.
10.4. The processing period is determined by the achievement of the purposes for which the personal data was collected, unless a different period is specified by contract or applicable legislation.
The User may withdraw consent at any time by notifying the Operator at info@pieff.pro with the subject line ‘Withdrawal of consent to personal data processing’.
10.5. Information collected by third-party services, including payment systems, communications providers and other service providers, is stored and processed by those parties (Operators) in accordance with their user agreements and privacy policies. Data subjects and/or Users must familiarise themselves with those documents independently and in a timely manner. The Operator is not responsible for third-party actions, including those of the service providers referred to in this clause.
10.6. Prohibitions imposed by the data subject on the transfer (other than provision of access) or processing of personal data authorised for dissemination, and conditions on its processing (other than obtaining access), do not apply where processing serves state, societal or other public interests defined by Russian legislation.
10.7. The Operator maintains the confidentiality of personal data during processing.
10.8. The Operator retains personal data in a form that permits identification of the data subject for no longer than required by the processing purposes, unless a retention period is established by federal law or by a contract to which the data subject is a party, beneficiary or guarantor.
10.9. Processing may cease when its purposes have been achieved, the data subject's consent expires or is withdrawn, or unlawful processing is identified.
11. Actions performed by the Operator on personal data received
11.1. The Operator collects, records, organises, accumulates, stores, rectifies (updates or amends), retrieves, uses, transfers (disseminates, provides or grants access to), depersonalises, blocks, deletes and destroys personal data.
11.2. The Operator processes personal data by automated means, with or without receiving and/or transmitting the information over information and telecommunications networks.
12. Cross-border transfer of personal data
12.1. Before making a cross-border transfer, the Operator must ensure that the foreign state to whose territory the personal data is to be transferred provides reliable protection of data subjects' rights.
12.2. Cross-border transfers to foreign states that do not meet the above requirements may take place only with the data subject's written consent to the transfer and/or for performance of a contract to which the data subject is a party.
13. Confidentiality of personal data. The Operator and other persons who obtain access to personal data must not disclose it to third parties or disseminate it without the data subject's consent, unless otherwise provided by federal law.
14. Final provisions
14.1. The User may request clarification on any matter concerning the processing of their personal data by contacting the Operator at info@pieff.pro.
14.2. Any changes to the Operator's Personal Data Processing Policy will be reflected in this document. The Policy remains in effect indefinitely until replaced by a new version.
14.3. The current version of the Policy is publicly available at https://pieff.pro/.