- GENERAL PROVISIONS
1.1. This document (hereinafter referred to as the Policy) defines the policy regarding the processing of personal data (hereinafter referred to as the Operator):
Individual Entrepreneur: Milana Vladimirovna Mitroshchenko
Legal and actual address: 630007, Russia, Novosibirsk Region, Novosibirsk, Oktyabrskaya Street, Building 34, Apt. 89
Taxpayer Identification Number (INN): 540322870103
OGRN: 326547600124211
1.2. This Policy has been developed in compliance with the requirements of Clause 2, Part 1, Article 18.1 of Federal Law No. 152-FZ of July 27, 2006, “On Personal Data” (hereinafter referred to as the Personal Data Law).
1.3. Concepts contained in Article Articles 3 of the Personal Data Law are used in this Policy with the same meaning.
1.4. This Policy applies to all operations performed by the Operator with personal data, with or without the use of automated tools, including on the Internet on the Operator’s website:
Internet website (hereinafter referred to as the “Website” or “Operator Website”), the Operator’s resource through which personal data is processed: https://duchezz-atelier.com/
1.5. Pursuant to the requirements of Part 2 of Article 18.1 of the Personal Data Law, this Policy is published and freely accessible on the Internet on the Operator’s Website.
1.6. Main Rights and Obligations of the Operator.
1.6.1. The Operator has the right to:
independently determine the composition and list of measures necessary and sufficient to ensure fulfillment of obligations stipulated by the Personal Data Law and regulatory legal acts adopted in accordance with it, unless otherwise provided by the Personal Data Law or other federal laws;
entrust the processing of personal data to another person with the consent of the personal data subject, unless otherwise provided by federal law, on the basis of an agreement concluded with that person. Any person processing personal data on behalf of the Operator is obligated to comply with the principles and rules for processing personal data stipulated by the Personal Data Law, maintain the confidentiality of personal data, and take the necessary measures to ensure fulfillment of obligations stipulated by the Personal Data Law;
if the personal data subject revokes consent to the processing of personal data, the Operator has the right to continue processing the personal data without the consent of the personal data subject, provided there are grounds specified in the Personal Data Law;
receive reliable information and/or documents containing personal data from the personal data subject;
require the personal data subject to promptly update the personal data provided.
1.6.2. The Operator is obligated to:
process personal data in accordance with the current legislation of the Russian Federation;
consider requests from the personal data subject (their legal representative) regarding the processing of personal data and provide reasoned responses in accordance with Article 14 of the Law on Personal Data;
provide the personal data subject (their legal representative) with free access to their personal data;
take measures to clarify or destroy the personal data of the personal data subject in connection with their (their legal representative’s) submission of legitimate and justified requests;
provide the authorized body for the protection of the rights of personal data subjects (the Federal Service for Supervision of Communications, Information Technology, and Mass Media (Roskomnadzor)) with the necessary information upon request of this body within 10 business days of receipt of such request. This period may be extended, but not more than five business days. To this end, the Operator must send Roskomnadzor a reasoned notification stating the reasons for the extension of the deadline for providing the requested information;
In the manner determined by the federal executive body authorized to ensure security, ensure interaction with the state system for detecting, preventing, and eliminating the consequences of computer attacks on Russian information resources, including informing it of computer incidents that resulted in the unauthorized transfer (provision, distribution, or access) of personal data;
organize the protection of personal data in accordance with the requirements of Russian legislation.
1.7. Basic Rights and Obligations of Personal Data Subjects:
1.7.1. Personal data subjects have the right to:
receive information regarding the processing of their personal data, except in cases stipulated by federal laws. Information is provided to the personal data subject by the Operator in an accessible form and must not contain personal data related to other personal data subjects, unless there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Law on Personal Data;
Access to their personal data, including the right to receive a copy of any record containing their personal data, except in cases provided by federal law;
To have their personal data rectified, blocked, or destroyed if the personal data is incomplete, outdated, inaccurate, illegally obtained, or not necessary for the stated purpose of processing;
To revoke consent to the processing of personal data (by sending a corresponding expression of consent to the Operator’s email address or legal address);
To provide prior consent to the processing of personal data for the purpose of promoting goods, works, and services;
To take measures provided by law to protect their rights;
To appeal to Roskomnadzor or in court against the Operator’s unlawful actions or inaction in the processing of their personal data;
To exercise other rights provided by Russian law.
1.7.2. Personal data subjects are obligated to:
provide the Operator with only accurate information about themselves;
Provide documents containing personal data to the extent necessary for the processing purpose;
Notify the Operator of any clarifications (updates, changes) to their personal data.
1.7.3. Persons who provide the Operator with inaccurate information about themselves or about another personal data subject without the latter’s consent are liable in accordance with Russian legislation.
1.7.4. Compliance with the requirements of this Policy is monitored by the authorized person responsible for organizing the processing of personal data at the Operator.
1.7.5. By completing the relevant forms and/or sending their personal data to the Operator, consent to the processing of personal data is deemed to have been granted by the Subject through the performance of implicit actions, namely, by placing a special sign – a “web mark” – in a special field on the Website next to the text: “I consent to the processing of my personal data under the terms of the Personal Data Processing Policy,” provided that the Subject is provided with the opportunity to review the full text of the Policy at each point where personal data is collected.
- VOLUME AND CATEGORIES OF PROCESSED PERSONAL DATA, CATEGORIES OF PERSONAL DATA SUBJECTS
2.1. The content and volume of processed personal data must correspond to the stated processing purposes, as provided in Section 3 of the Policy. Processed personal data must not be excessive in relation to the stated processing purposes.
2.2. The Operator may process the personal data of the following categories of personal data subjects:
2.2.1. The Operator’s clients (individuals);
2.2.2. Representatives (employees) of the Operator’s clients and contractors;
2.2.3. Visitors to the Operator’s Website (Users).
2.3. The Operator does not process special categories of personal data related to race, nationality, political views, religious or philosophical beliefs, health, or intimate life, except in cases provided for by Russian Federation law.
2.4. The Operator does not process biometric personal data.
2.5. The Operator does not transfer personal data across borders.
2.6. About Cookie Technology:
A cookie is a fragment of data sent by the Operator’s server and stored on the User’s device. The contents of such a file may or may not be considered personal data, depending on whether the file contains personal data or anonymized technical data.
The User has the right to prohibit their equipment from receiving this data or to limit its reception. If they refuse to receive such data or limit its reception, some functions of the Website may not function properly. The User undertakes to configure their equipment to ensure the operating mode and level of protection for cookie data that meets their requirements. The Operator does not provide technological or legal advice on such matters.
The Operator may use the following types of cookies for the following purposes:
Technical cookies: These cookies are necessary for the proper operation of the Website and the provision of its functions; among other things, they allow us to identify hardware and software, including the browser type, so that the Website functions correctly on a specific User’s device. For example, if you create an account, we will use cookies to manage the registration process and for general administration. When you log in to your account, we will use cookies to allow the Website to remember this fact. This eliminates the need for you to log in to your account every time you visit a new page on the Website;
Cookies for storing settings and preferences: These cookies allow us to store the User’s preferences, such as the selected language, location, and external settings.
Website. To remember your preferences, we need to use cookies so that this information can be recalled each time you interact with a page on the Website and to ensure your settings are not lost;
Statistical/analytical cookies: These cookies allow us to recognize users, count their number, and collect information such as transactions performed on the Website, including information about the pages visited and the content that is most interesting to the User. These cookies are used by the Operator to collect, analyze, and organize statistics and analytics for the Website and to improve the Website;
Behavioral cookies: These cookies collect information about how users interact with the Website, which allows us to identify errors and test new features to improve the Website’s performance;
Form cookies: When you submit data through a form, such as those found on contact pages, feedback forms, or comment forms, cookies may be used to remember you for future correspondence;
Third-party and advertising cookies: These cookies collect information about users, traffic sources, pages visited, advertisements displayed to a specific user or user groups, and the advertisement that led the user to the advertised page. They allow the display of advertisements that may be of interest to a specific user based on an analysis of their personal information, behavior, and preferences.
The use of cookies is regulated as follows:
a) Cookies, the content of which is determined and processed exclusively by the Operator, are processed in accordance with the terms of this Policy;
b) Cookies whose content is determined and processed by a third party—for example, a provider of third-party software or services used by the Operator—are processed in accordance with the terms of this Policy, as well as the privacy policies of such third party, which contain, among other things, the name of the third party, the terms and conditions for working with cookies, and contact information for inquiries from personal data subjects.
To analyze Site usage, we use the following third-party tools, which may use cookie technology:
Yandex Metrica https://yandex.ru/legal/confidential/
To disable data transfer to Yandex Metrica on all websites visited, the Visitor has the right to install the Yandex Metrica blocker: https://yandex.ru/support/metrica/general/opt-out.html#opt-out.
The Yandex Metrica terms of service do not provide for the transfer of information that could identify a specific individual (full name, contact information, document and bank card details, passwords, and other information considered personal data).
2.7. Processing of Data Received via Messengers, Social Media, and Phone Calls
Personal data transmitted by the User via messengers (Telegram) is processed by the Operator from the moment the User initiates a request through the relevant communication service, the link to which is posted on the Website.
As part of such interactions, the Operator may receive and process the following data: telephone number, name (nickname), information provided by the User in the relevant service profile, as well as information contained in the User’s message.
This data is processed solely for the purposes of reviewing the User’s request, providing advice, responding to requests, and concluding and executing contracts.
If personal data needs to be used for other purposes, including sending advertising and informational mailings, the data is processed only with the separate consent of the data subject in accordance with the procedure established by the legislation of the Russian Federation.
When the User uses the phone call function, the Operator has the right to process the telephone number and other data obtained during the interaction to the extent necessary to process the request. If telephone conversations are recorded, the User will be notified of this prior to the conversation.
Personal data obtained via instant messaging apps, social media, and telephone calls are stored for no longer than necessary to achieve the purposes for which they are processed, unless otherwise specified by the legislation of the Russian Federation.
- PURPOSES OF PERSONAL DATA COLLECTION
3.1. The processing of personal data is limited to achieving specific, predetermined, and legitimate purposes. Processing of personal data incompatible with the purposes for which it is collected is prohibited.
3.2. Only personal data that is relevant for the purposes for which it is processed may be processed.
3.3. Personal data is processed by the Operator for the following purposes:
3.3.1. Purpose 1: preparation, conclusion, and execution of a civil law contract
List of processed data Personal data of another category: last name, first name, patronymic; email address; telephone number.
Categories of subjects whose personal data is processed: counterparties; counterparty representatives; clients; beneficiaries under contracts.
Actions with personal data: collection; recording; systematization; accumulation; storage; clarification (updating, modification); retrieval; use; transfer (provision, access); depersonalization; blocking; deletion; destruction of personal data.
Processing period: until the purpose is achieved, but no more than three years.
Processing method: mixed
Grounds for personal data processing: The processing of personal data is necessary for the performance of an agreement to which the personal data subject is a party, beneficiary, or guarantor, as well as for the conclusion of an agreement initiated by the personal data subject or an agreement under which the personal data subject will be a beneficiary or guarantor. An agreement concluded with a personal data subject may not contain provisions that restrict the rights and freedoms of the personal data subject.
The procedure for destroying personal data upon achieving the processing purpose or upon the occurrence of other legal grounds: the person responsible for processing the personal data erases the data by overwriting it (replacing all storage units with “0”) and drawing up a personal data destruction report – in information systems; physical destruction of the personal data and drawing up a personal data destruction report – on tangible media.
Additional information: Personal data may be processed if the contract provides for the transfer of documents. Other data (bank card details) may be processed if necessary to refund funds.
3.3.2. Purpose 2: Promotion of goods, works, and services on the market
List of other categories of personal data processed: last name, first name, patronymic; email address; telephone number; photo, video image of the face.
Categories of subjects whose personal data is processed: clients; website visitors.
Actions with personal data: collection; recording; systematization; accumulation; storage; Clarification (updating, modification); retrieval; use; transfer (provision, access); depersonalization; blocking; deletion; destruction; distribution of personal data.
Processing period: until the purpose is achieved or until the subject revokes consent (but no more than three years).
Processing method: mixed
Grounds for personal data processing: Personal data is processed with the consent of the subject of the personal data.
Procedure for the destruction of personal data upon achieving the purpose of processing or upon the occurrence of other legal grounds: the person responsible for processing the personal data erases the data by overwriting (replacing all storage units with “0”) and drawing up a personal data destruction report for information systems; physical destruction of personal data and drawing up a personal data destruction report for tangible media.
Additional information: The dissemination of personal data (full name, photo) is permitted only with the corresponding consent of the subject in the form of the publication of a review by such subject. Reviews can be left by clients or website visitors.
- LEGAL BASIS FOR PERSONAL DATA PROCESSING
4.1. The legal basis for the processing of personal data by the Operator are:
The Constitution of the Russian Federation;
The Civil Code of the Russian Federation;
- PROCEDURE AND CONDITIONS FOR PERSONAL DATA PROCESSING
5.1. The Operator processes personal data in accordance with the requirements of Russian legislation.
5.2. Personal data is processed with the consent of personal data subjects to the processing of their personal data, and without such consent in cases stipulated by Russian legislation.
5.3. Only the Operator’s employees whose job responsibilities include the processing of personal data are allowed to process personal data.
5.4. Personal data is processed for each processing purpose specified in Section 3.3 of the Policy by:
receiving personal data orally and in writing directly from personal data subjects;
entering personal data into the Operator’s logs, registers, and information systems;
The User’s entry of personal data into specialized information collection forms posted on the Operator’s Website;
Using other methods of processing personal data.
5.5. Disclosure and distribution of personal data to third parties is prohibited without the consent of the personal data subject, unless otherwise provided by federal law. Consent to the processing of personal data authorized for distribution by the personal data subject is issued separately from other consents of the personal data subject.
The data subject consents to the processing of their personal data. Requirements for the content of consent to the processing of personal data, permitted for distribution by the data subject, are approved by Order No. 18 of Roskomnadzor dated February 24, 2021.
5.6. The transfer of personal data to inquiry and investigative bodies, the Federal Tax Service, the Social Fund of Russia, and other authorized executive bodies and organizations is carried out in accordance with the requirements of the legislation of the Russian Federation.
5.7. The operator takes the necessary legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, distribution, and other unauthorized actions, including:
A Personal Data Processing Policy has been developed and approved;
A person responsible for organizing the processing of personal data has been appointed;
Internal regulations on personal data processing have been developed;
Internal control is exercised to ensure that personal data processing complies with Federal Law No. 152-FZ of July 27, 2006, “On Personal Data” and the regulatory legal acts adopted pursuant thereto, as well as personal data protection requirements.
Employees directly involved in personal data processing are familiar with the provisions of Russian Federation legislation on personal data, including personal data protection requirements, documents defining the organization’s policy on personal data processing, and internal regulations on personal data processing.
Rules for accessing personal data processed in the personal data information system have been developed, and all actions performed with personal data in the personal data information system are registered and recorded.
5.8. The operator stores personal data in a form that allows for identification of the personal data subject for no longer than required for each purpose of personal data processing, unless the personal data retention period is specified by federal law or an agreement.
5.8.1. Personal data on paper media is stored by the Operator for the document retention periods specified by Russian Federation archival legislation (Federal Law No. 125-FZ of October 22, 2004, “On Archival Affairs in the Russian Federation” and the List of Standard Management Archival Documents Generated in the Course of Activities of State Bodies, Local Governments, and Organizations, with Indication of Their Retention Periods (approved by Order of the Federal Archival Agency No. 236 of December 20, 2019)).
5.8.2. The retention period for personal data processed in personal data information systems corresponds to the retention period for personal data on paper media.
5.9. The Operator terminates the processing of personal data in the following cases:
unlawful processing is detected. The period is three business days from the date of detection;
the purpose of processing is achieved;
The personal data subject’s consent to the processing of such data has expired or has been revoked, where, according to the Personal Data Law, the processing of such data is permitted only with consent.
5.10. Once the purposes of personal data processing have been achieved, or if the personal data subject revokes consent to its processing, the Operator shall cease processing such data unless:
otherwise provided by an agreement to which the personal data subject is a party, beneficiary, or guarantor;
The Operator shall not process personal data without the consent of the personal data subject on the grounds stipulated by the Personal Data Law or other federal laws;
otherwise provided by another agreement between the Operator and the personal data subject.
5.11. If the personal data subject requests the Operator to cease processing personal data within 10 business days from the date the Operator receives the relevant request, the processing of the personal data shall cease, except in cases stipulated by the Personal Data Law. This period may be extended, but by no more than five business days. To do this, the Operator must send the personal data subject a reasoned notice stating the reasons for the extension.
5.12. When collecting personal data, including via the Internet, the Operator ensures the recording, systematization, accumulation, storage, clarification (updating, modification), and retrieval of personal data of citizens of the Russian Federation using databases located in the Russian Federation, except in cases specified in the Law on Personal Data.
- UPDATING, CORRECTION, DELETION, AND DESTRUCTION OF PERSONAL DATA, RESPONSES TO REQUESTS FROM PERSONAL DATA SUBJECTS FOR ACCESS TO PERSONAL DATA
6.1. Confirmation of the fact of personal data processing by the Operator, legal basis The purpose and purpose of personal data processing, as well as other information specified in Part 7 of Article 14 of the Personal Data Law, shall be provided by the Operator to the personal data subject or their representative within 10 business days of the request or receipt of the personal data subject’s or their representative’s request. This period may be extended, but not more than by five business days. To this end, the Operator must send the personal data subject a reasoned notice stating the reasons for extending the deadline for providing the requested information.
The information provided does not include personal data related to other personal data subjects, except in cases where there are legal grounds for disclosing such personal data.
The request must contain:
the number of the primary identity document of the personal data subject or their representative, the date of issue of this document, and the issuing authority;
Information confirming the personal data subject’s participation in the relationship with the Operator (contract number, contract date, code word, and/or other information), or information otherwise confirming the processing of personal data by the Operator;
Signature of the personal data subject or their representative.
The request may be submitted in the form of an electronic document and signed with an electronic signature in accordance with Russian Federation law.
The Operator shall provide the information specified in Part 7 of Article 14 of the Personal Data Law to the personal data subject or their representative in the form in which the relevant request or inquiry was submitted, unless otherwise specified in the request or inquiry.
If the request or inquiry of the personal data subject does not contain all the necessary information in accordance with the requirements of the Personal Data Law, or if the subject does not have the right to access the requested information, a reasoned refusal will be sent.
The right of the personal data subject to access their personal data may be limited in accordance with Part 8 of Article 14 of the Personal Data Law. 14 of the Law on Personal Data, including if a data subject’s access to their personal data violates the rights and legitimate interests of third parties.
6.2. If inaccurate personal data is discovered upon a request from a data subject or their representative, or at their request, or at the request of Roskomnadzor, the Operator will block the personal data related to that data subject from the moment of such request or receipt of such request for the duration of the verification process, unless blocking the personal data violates the rights and legitimate interests of the data subject or third parties.
If the inaccuracy of personal data is confirmed, the Operator, based on information provided by the data subject or their representative, or Roskomnadzor, or other necessary documents, will update the personal data within seven business days of the date of submission and remove the block on the personal data.
6.3. If unlawful processing of personal data is detected upon request (application) from a personal data subject or their representative, or Roskomnadzor, the Operator will block the unlawfully processed personal data relating to that personal data subject immediately upon receipt of such request.
6.4. If the Operator, Roskomnadzor, or another interested party discovers an unlawful or accidental transfer (provision, distribution) of personal data (access to personal data) that has resulted in a violation of the rights of personal data subjects, the Operator shall:
within 24 hours — notify Roskomnadzor of the incident, the presumed causes that led to the violation of the rights of personal data subjects, the alleged harm caused to the rights of personal data subjects, and the measures taken to eliminate the consequences of the incident, and also provide information about the person authorized by the Operator to interact with Roskomnadzor on matters related to the incident;
Within 72 hours, notifies Roskomnadzor of the results of the internal investigation into the identified incident and provides information on the individuals whose actions caused it (if any).
6.5. Procedure for the Destruction of Personal Data by the Operator.
6.5.1. Conditions and Timeframes for the Destruction of Personal Data by the Operator:
Achievement of the purpose of processing personal data or the loss of the need to achieve this purpose – within 30 days;
Achievement of the maximum retention period for documents containing personal data – within 30 days;
Provision by the personal data subject (or their representative) of confirmation that the personal data was obtained illegally or is not necessary for the stated purpose of processing – within seven business days;
Revocation by the personal data subject of consent to the processing of their personal data, if their retention for the purpose of their
If the processing is no longer required, within 30 days.
6.5.2. Upon achieving the purpose of personal data processing, or if the personal data subject revokes consent to its processing, personal data shall be destroyed unless:
otherwise provided by an agreement to which the personal data subject is a party, beneficiary, or guarantor;
The Operator may not process personal data without the consent of the personal data subject on the grounds stipulated by the Personal Data Law or other federal laws;
unless otherwise provided by another agreement between the Operator and the personal data subject.
6.5.3. The destruction of personal data shall be performed by the Operator.
6.5.4. The methods for the destruction of personal data are established in the Operator’s internal regulations.
- FINAL PROVISIONS
7.1. All relations related to the processing of personal data not reflected in the Policy shall be governed by the provisions of Russian Federation law.
7.2. The Operator reserves the right to amend the Policy. When amending the Policy, the date of the most recent update is indicated in the current version. The new version of the Policy takes effect upon its posting on the Operator’s Website or on the Operator’s information board at its location.