9/9

Personal data processing policy

1. General Provisions

1.1 This Policy regarding the processing of personal data (hereinafter referred to as the "Policy") has been prepared in accordance with paragraph 2 of part 1 of Art. 18.1 of the Federal Law of the Russian Federation “On Personal Data” No. 152-FZ dated July 27, 2006 (hereinafter referred to as the “Law”) and determines the position of Eurasian Trading Company LLC (hereinafter referred to as the “NAME”) in the field of processing and protecting personal data ( hereinafter referred to as personal data), in relation to the observance of rights and freedoms, describes the features of the collection, storage, use and transfer of personal data, the implemented requirements for their protection, as well as information about the rights of persons to whom the relevant personal data belong.

1.2 Personal data refers to any information relating directly or indirectly to a specific or identifiable natural person (citizen).

1.3 The processing of personal data means any action (operation) or a set of actions (operations) with personal data performed using automation tools and / or without the use of such tools. Such actions (operations) include, in particular: collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (provision, access), comparison, depersonalization, blocking, deletion, destruction of personal data.

1.4 The security of personal data means the protection of personal data from unauthorized and / or unauthorized access to them, destruction, modification, blocking, copying, provision, distribution of personal data, as well as from other illegal actions in relation to personal data.

1.5 The policy applies to all actions related to the processing of personal data on the site www.buy-way.ru (hereinafter referred to as the "Site") and the Contact Center, in the information systems "NAME".  

1.6 The use of the Site or the Contact Center by the User also means their unconditional acceptance of the rules of the Privacy Policy and the conditions for processing personal data specified therein. If the User does not agree with the terms of this Policy, the User should refrain from using the Site and the Contact Center.

1.7 This Policy applies to personal data received both before and after the entry into force of this Policy.

2. Legal grounds and purposes of processing Personal data "NAME"

2.1 "NAME" processes and ensures the security of personal data for the implementation of the functions, powers and duties assigned to "NAME" by the legislation of Russia, including, but not limited to, in accordance with the Constitution of the Russian Federation, federal laws, in particular Federal Law No. 152- Federal Law of July 27, 2006 "On Personal Data", by-laws, other federal laws of the Russian Federation, guidelines and methodological documents of the FSTEC of Russia and the Federal Security Service of Russia, as well as the Civil Code of the Russian Federation, the Tax Code of the Russian Federation that determine the cases and features of processing the specified personal data , Law of the Russian Federation No. 2300-1 dated February 7, 1992 "On Protection of Consumer Rights", Federal Law No. 402-FZ dated December 6, 2011 "On Accounting", as well as personal data operators, the charter and local acts "NAME ".

2.2 "TITLE" is the operator of personal data in accordance with the Law.

2.3 The processing of personal data may be carried out by "TITLE" in the following cases and on the following legal grounds:

  • processing of personal data is carried out only with the consent of the subject of personal data, expressed in any form that allows you to confirm the fact of obtaining consent, including by the methods specified in clause 1.6. this Policy;
  • to achieve the goals stipulated by an international treaty of the Russian Federation or the law, to implement and fulfill the functions, powers and duties assigned by the legislation of the Russian Federation to the operator of personal data;
  • for the execution of the contract for the sale of the Goods between the "NAME" and the user of the Site, which is an individual who has the necessary amount of legal capacity and has the intention to place or place an Order for the Goods through the Site;
  • to exercise the rights and legitimate interests of the operator or third parties or to achieve socially significant goals, provided that this does not violate the rights and freedoms of the subject of personal data;
  • for statistical or other marketing and research purposes, subject to mandatory depersonalization of personal data;
  • for other purposes provided for by this Policy.

2.4. The subjects of personal data processed through the Site and employees of the Contact Center are, among other things, users of the Site, buyers and recipients of the Goods (if the buyer indicated another person as the recipient of the Goods); any other individuals applying to the "TITLE" with applications / appeals.

2.5 "TITLE" processes personal data of buyers for:

2.5.1. conclusion and execution of contracts, one of the parties to which is the User, in accordance with the Terms of Order and Delivery of the Site, including the contract for the retail sale of the Goods, including those concluded remotely on the Site, the contract for the provision of services for a fee;

2.5.2. providing information about Products, Promotions and special offers;

2.5.3 informing about the status of the Order;

2.5.4. assistance in the settlement of claims;

2.5.5. organizing the process of returning the Goods;

2.5.6. providing the opportunity to leave reviews about the Products;

2.5.7. analysis of the quality of the service provided by "NAME" and improvement of the quality of customer service "NAME";

2.5.8. identification of Users and Buyers in Promotions, ensuring the accrual procedure, accounting, use of bonus points of loyalty programs of Users and Buyers.

3. Categories of personal data processed by "TITLE"

3.1 "TITLE" processes the following categories of personal data of Users, recipients of the Goods:

- information received during registration, authorization and placing an order (last name, first name, patronymic, date of birth, gender, phone number, email address, registration address, work address, delivery address, cookie);

- information obtained in the course of interaction with the Buyers (gender, age of the Buyer, passport data, data of means of payment, city of residence and/or address);

- information received in connection with the placement or execution of the Buyer's Orders (information about the method of delivery of the Goods, the method and status of payment for the Goods, and if the final recipient of the Goods differs from the Buyer, also the last name, first name, patronymic, delivery address and telephone number of the consignee);

- information about the Buyer's claims (transferred by the Buyer using the Site, the Contact Center or otherwise);

- reviews posted by the Buyer about the Goods;

- geolocation information.

3.2 "NAME" processes the following categories of personal data of personal data subjects applying to "NAME" with statements about the alleged violation of their rights: last name, first name, patronymic, passport data (data of another identity document), contact information (telephone numbers and ( or) fax, email address) of the right holder or other person whose right has allegedly been violated, and (or) the applicant, if he acts as an authorized representative of the right holder or other person whose right has allegedly been violated, information about the applications received, the progress and the result of their consideration.

3.3 The personal data specified in the paragraphs of this Section above can be obtained by the "TITLE" in the course of providing the BUYER with personal data by filling out the appropriate forms on the Site, by sending correspondence or emails to the e-mail addresses of the "TITLE".

4. Principles and conditions for the processing of Personal Data

4.1 When processing personal data, "NAME" adheres to the following principles:

the processing of personal data is carried out on a legal basis;

personal data are not disclosed to third parties and are not distributed without the consent of the subject of personal data, except for cases provided for by the legislation of Russia;

determination of specific legitimate purposes prior to the processing (including collection) of personal data;

merging of databases, including databases containing personal data, the processing of which is carried out for purposes incompatible with each other, is not allowed;

the processing of personal data is limited to the achievement of specific, predetermined and legitimate purposes;

processed personal data are subject to destruction or depersonalization upon withdrawal of consent to their processing by the subject of personal data, upon achievement of the purposes of processing or in case of loss of the need to achieve these purposes, unless otherwise provided by federal law;

the content and scope of the processed personal data correspond to the stated purposes of processing. The processed personal data is not excessive in relation to the stated purposes of processing;

· etcand the processing of personal data, the accuracy of personal data and their sufficiency, if necessary, and the relevance of personal data in relation to the stated purposes of their processing are ensured;

the storage of personal data is carried out in a form that allows determining the subject of personal data no longer than required by the purposes of processing personal data, if the period for storing personal data is not established by federal law, an agreement to which the subject of personal data is a party, beneficiary or guarantor.

4.2 "TITLE" does not process personal data relating to race, nationality, political views, religious, philosophical and other beliefs, health status, personal life, membership in public associations, including trade unions, biometric data. "TITLE" does not perform voice input and verification of personal data using insecure data transmission channels. The transfer of data by personal data subjects to employees of the Contact Center is voluntary and implies that the data received will be used in accordance with this Policy.

4.3 "TITLE" ensures the recording, systematization, accumulation, storage, clarification (updating, changing), retrieval of personal data using databases located on the territory of Russia, and does not carry out cross-border transfer of personal data.

4.4 "NAME" has the right to entrust the processing of personal data by performing the actions specified in clause 1.3. of this Policy to third parties, including third parties listed in clause 4.5. of this Policy, with the consent of the subject of personal data, expressed by providing consent, on the basis of an agreement concluded with such third parties, in the following cases:

to process requests from Buyers and (or) Users, third parties through voice and non-voice communication channels, including email, online chat, applications for mobile devices and (or) social networks;

for the purpose of delivering the Goods to the Buyers and Recipients;

· in order to analyze the quality of the service provided by "NAME" and improve the quality of customer service "NAME" (Users and Buyers);

in order to prepare personal offers and terms of service;

for the purpose of personalizing advertising;

for the purpose of sending advertising and informational messages;

for the purpose of conducting statistical or other marketing research.

4.5. "TITLE" has the right, through the Internet, in compliance with the provisions of the current legislation of the Russian Federation, to transfer personal data of Buyers and Users (full name; date of birth, e-mail; mobile phone number; information about the actions of Buyers and Users committed within the framework of use of the Site) to third parties listed in this clause of the Policy, in order to provide such third parties (independently or jointly) to Buyers and Users with offers, promotional and informational materials on the products of such third parties, in order to prepare personal offers and form individual conditions for servicing Buyers and Users, as well as for the purpose of conducting marketing research and mailings.

The list of third parties to whom personal data is transferred for the purpose of their processing in accordance with this paragraph includes: List SDEK LLC and the Insurance service (if expected in the course of work)

4.5.1. Persons processing personal data on the basis of an agreement concluded with "NAME" (operator's instruction), including delivery services, undertake to comply with the principles and rules for the processing and protection of personal data provided for by applicable law. For each third party, the contract defines a list of actions (operations) with personal data that will be performed by a third party processing personal data, the purposes of processing, establishes the obligation of such a person to maintain confidentiality and ensure the security of personal data during their processing, specifies the requirements for protecting the processed personal data in accordance with applicable law.

4.6 "NAME" has the right to transfer personal data to third parties with the consent of the subject of personal data in the following cases:

4.6.1 Delivery services for the purposes of fulfilling the Buyer's Order, including in the event of a request for the return of the Goods purchased on the Site, in order to review the requirements and return and return, in cases provided for in the Order Rules and other sections of the Site, including including on condition that the NAME receives a statement about the violation of intellectual or other rights of third parties, in order to settle the received claims, in case of receiving other statements, reviews, claims, complaints, messages or documentscops, in other cases and purposes, as described in the Order Rules;

4.6.2 in order to be able to protect the rights and legitimate interests of the "NAME" or third parties in cases where the subject of personal data violates any terms of the user documents of the Site and (or) this Policy;

4.6.3 by a court decision that has entered into force or in cases established by the current legislation;

4.7 In order to improve the quality of service for Users and Buyers, for statistical or other marketing and research purposes, "TITLE" develops, improves, optimizes and introduces new functionality of the Site. To ensure this, the User or the Buyer agrees and instructs the "NAME" to carry out, in compliance with applicable law, processing (including collection, recording, systematization, accumulation, storage, clarification (updating, changing), comparison, extraction, use, depersonalization, blocking, deletion and destruction) of the account and any other personal data of the User or the Buyer, including those at the disposal of the partner acting on behalf of the "NAME", the transfer of the account and any other personal data of the User or the Buyer available at the disposal of the "NAME" and any other personal data of the User or the Buyer to partners in pursuance of such an instruction for processing and receiving from partners as a result of processing analytical information, including the results of automated processing of such data, including in the form of integer and/or text values and identifiers.

4.8 "TITLE" has the right to transfer personal data to third parties with the consent of the subject of personal data, as well as in cases where the possibility of transferring personal data to third parties is expressly provided for by the legislation of Russia does not require the consent of the subject of personal data.

4.9 In order to fulfill the requirements of the current legislation of Russia and its contractual obligations, the processing of personal data "NAME" is carried out both with and without the use of automation tools. The set of processing operations includes the collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (provision, access), depersonalization, blocking, deletion, destruction of personal data.

4.10 "TITLE" does not make decisions that give rise to legal consequences in relation to the subject of personal data or otherwise affect his rights and legitimate interests, based solely on automated processing of personal data.

4.11 "TITLE" does not check and, as a rule, is not able to check the relevance and reliability of the information provided by the subjects of personal data received through the Site. "TITLE" proceeds from the fact that personal data subjects, acting reasonably and in good faith, provide reliable and sufficient personal data and keep them up to date.

5. Rights of personal data subjects

5.1 The subject of personal data, whose personal data is processed by "NAME", has the right:

  • at any time, change (update, supplement) the personal data provided by him by going to the Personal Account in cases where this allows the functionality of the Site;
  • delete the personal data provided by him by sending a written notice to "NAME" indicating the personal data that must be deleted;
  • receive from "TITLE":

confirmation of the fact of processing personal data and information about the availability of personal data relating to the relevant subject of personal data;

information about the legal grounds and purposes of processing personal data;

information about the methods of processing personal data used by the "TITLE";

information about the name and location of the "TITLE";

information about persons (with the exception of employees of "TITLE") who have access to personal data or to whom personal data may be disclosed on the basis of an agreement with "TITLE" or on the basis of federal law;

processed personal data related to the subject of personal data, and information about the source of their receipt, unless a different procedure for providing such personal data is provided by law;

information about the terms of processing personal data, including the terms of their storage;

information on the procedure for the exercise by the subject of personal data of the rights provided for by the legislation on personal data;

the name and address of persons processing personal data on behalf of "NAME";

Other information provided by the Law;

  • require from "TITLE" to clarifydenial of their personal data, their blocking or destruction if the personal data is incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing;
  • withdraw your consent to the processing of personal data at any time by sending an electronic message with an electronic signature to the email addresses: aiwetk@yandex.ru or by sending a written notification to the address "NAME". Upon receipt of such a message, the processing of personal data of the subject of personal data will be terminated, and his personal data will be deleted, except in cases where processing can be continued in accordance with the legislation of the Russian Federation. At the same time, sending such a message about the withdrawal of consent by the User and (or) the Buyer should also be considered a notification of a unilateral refusal to execute the relevant Order and entail the impossibility of its execution;
  • demand the elimination of illegal actions of "NAME" in relation to his personal data;
  • take legal measures to protect their rights and legitimate interests, including compensation for losses and (or) compensation for moral damage in court.

5.2 The rights provided for in the subparagraphs of this Section above may be limited in accordance with the requirements of the legislation of Russia and (or) in cases where the "NAME" processes personal data on other legal grounds than the consent of the subject of personal data.

6. Responsibilities "TITLE"

In accordance with the requirements of the Law, "TITLE" is obliged to:

1) provide the subject of personal data, at his request, with information regarding the processing of his personal data, or legally provide a refusal within thirty days from the date of receipt of the request of the subject of personal data or his representative;

2) at the request of the subject of personal data, clarify, block or delete the personal data being processed, if the personal data is incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing within a period not exceeding seven working days from the date of provision by the subject of personal data or his representative information confirming these facts;

3) keep a register of requests from subjects of personal data, which should record requests from subjects of personal data to obtain personal data, as well as the facts of providing personal data on these requests;

4) notify the subject of personal data about the processing of personal data in the event that personal data was not received from the subject of personal data. The following cases are an exception:  

- the subject of personal data is notified about the processing of the "NAME" of his personal data;  

- personal data was obtained by "TITLE" in connection with the execution of an agreement to which the party or beneficiary or guarantor is the subject of personal data or based on the requirements of the current legislation;

- personal data is made publicly available by the subject of personal data or obtained from a publicly available source;

- "TITLE" carries out the processing of anonymized personal data for statistical or other research purposes, if the rights and legitimate interests of the subject of personal data are not violated;

- providing the subject of personal data with the information contained in the notification on the processing of personal data violates the rights and legitimate interests of third parties;

5) if the purpose of processing personal data is achieved, immediately stop processing personal data and destroy the relevant personal data within a period not exceeding thirty days from the date of achieving the purpose of processing personal data, unless otherwise provided by the agreement, the party to which, the beneficiary or the guarantor of which is the subject personal data, another agreement between the "TITLE" and the subject of personal data, or if the "TITLE" is not entitled to process personal data without the consent of the subject of personal data on the grounds provided for by the Law or other federal laws;

6) in the event that the subject of personal data withdraws consent to the processing of his personal data, stop processing personal data and destroy personal data within a period not exceeding thirty days from the date of receipt of the said withdrawal, unless otherwise provided by the agreement between the "TITLE" and the subject of personal data. About the destruction of personal data, "NAME" is obliged to notifyto kill the subject of personal data;

7) in the event of a request from the subject of personal data to stop processing personal data obtained in order to promote goods, works, services on the market, immediately stop processing personal data;

8) when collecting personal data, including through the Internet, "NAME" ensures the recording, systematization, accumulation, storage, clarification (update, change), extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation.

7. Protection of personal data

7.1 When processing personal data, "NAME" takes the necessary legal, organizational and technical measures to protect personal data from unauthorized and (or) unauthorized access to them, destruction, modification, blocking, copying, provision, distribution of personal data, as well as from other illegal actions in relation to personal data.

7.2 Such measures include, in particular:

  • appointment of a person responsible for organizing the processing of personal data and a person responsible for ensuring data security;
  • development and approval of local acts on the processing and protection of personal data;
  • application of legal, organizational and technical measures to ensure the security of personal data.
  • control over the measures taken to ensure the security of personal data and the level of security of personal data information systems;
  • assessment of the harm that may be caused to the subjects of personal data in case of violation of the requirements of the legislation on personal data, the ratio of the specified harm and the measures taken by the "TITLE" aimed at ensuring the fulfillment of the obligations stipulated by the legislation on personal data;
  • compliance with the conditions that exclude unauthorized access to material carriers of personal data and ensure the safety of personal data;
  • familiarization of NAME employees directly involved in the processing of personal data with the provisions of Russian legislation on personal data, including the requirements for the protection of personal data, local acts on the processing and protection of personal data, and training of employees of NAME

8. Terms of processing (storage) of Personal Data

8.1 The terms of processing (storage) of personal data are determined based on the purposes of processing personal data, in accordance with the validity period of contracts with subjects of personal data, the requirements of the current legislation:

- personal data of registered Users is stored for the entire duration of the User Account;  

- personal data of an unregistered User and the recipient of the Goods (if another person is indicated as the recipient of the Goods) is stored for three years from the date of execution of the Order of such a User;  

- Personal data of other persons applying to "TITLE" with statements about the alleged violation of their rights, during the entire period of processing and consideration of the relevant claims and within three years from the date of completion of the processing and (or) consideration of the claim, unless otherwise provided by law statute of limitations for relevant disputes.

8.2 Personal data whose processing (storage) period has expired must be destroyed, unless otherwise provided by the legislation of the Russian Federation. Storage of personal data after the termination of their processing is allowed only after their depersonalization.

9. Procedure for obtaining clarifications on the processing of Personal Data

9.1 Personal data subjects whose personal data is processed by "TITLE" can obtain clarifications on the processing of their personal data by contacting "TITLE" personally or by sending a corresponding written request to the location of "TITLE".

10. Automatically collected information

10.1 "TITLE" may collect and process the following information, including information that is not personal data:

- information about the interests of the Users on the Site based on the entered search queries of the Site users about the goods sold and offered for sale in order to provide relevant information to the Users when using the Site, as well as to summarize and analyze information about whichthe Site sections and products are in the greatest demand among the Site Users;

- information about the interests of the Users of the Contact Center based on the received requests from the Users of the Contact Center in order to provide up-to-date information to the Users when using the Contact Center, as well as to summarize and analyze information about which features of the Contact Center are most in demand among the Users of the Contact Center ;

10.2 "TITLE" processes and stores search queries of Users of the Site in order to summarize and create client statistics on the use of sections of the Site.

10.3 "TITLE" automatically receives certain types of information obtained in the course of interaction of Users with the Site, correspondence by e-mail, etc. These include technologies and services such as web protocols, cookies, web tags, as well as third party applications and tools. At the same time, Web marks, Cookies and other monitoring technologies do not make it possible to automatically receive personal data. If the Site User, at his own discretion, provides his personal data, for example, when filling out a feedback form or when sending an email, then only then will automatic collection of detailed information start for the convenience of using the websites and (or) to improve interaction with users.

10.4 If the “NAME” can reasonably correlate the information specified in this Section with the Account of a particular User, then such information may be processed together with Personal Data and other personal information of such User.

11. Policy Changes. Other provisions

11.1 "TITLE" may amend this Policy from time to time, including to reflect changes in the scope of services provided by "TITLE" or changes in the functionality of the Site, as well as changes in legislation. The new version of the above provisions and confidentiality shall take effect from the moment of its publication, unless it specifies a different date for its entry into force.