1. General provisions
1.1. This Personal Data Processing Policy (the Policy) is intended to protect the rights and freedoms of individuals whose personal data is processed by Individual Entrepreneur Meri Ashotovna Kaplanyan (the Controller).
1.2. The Policy has been prepared in accordance with Article 18.1, Part 1, Clause 2 of Federal Law No. 152-FZ of 27 July 2006, On Personal Data (the Personal Data Law).
1.3. The Policy contains information required to be disclosed under Article 14, Part 1 of the Personal Data Law and is a publicly available document.

2. Information about the Controller
2.1. The Controller operates at: 4 Kutuzovsky Prospekt, Moscow.
2.2. General Director Meri Ashotovna Kaplanyan has been appointed responsible for organizing personal data processing.
2.3. The database containing the personal data of citizens of the Russian Federation is held in the email account burokaplan@mail.ru. burokaplan@mail.ru.

3. Information about personal data processing
3.1. The Controller processes personal data lawfully and fairly to perform statutory functions, powers and duties, and to exercise the rights and legitimate interests of the Controller, its employees and third parties.
3.2. The Controller obtains personal data directly from the data subjects.
3.3. The Controller processes personal data by automated and non-automated means, with and without computer equipment.
3.4. Processing includes collection, recording, organization, accumulation, storage, updating or amendment, retrieval, use, transfer (dissemination, provision or access), anonymization, restriction, deletion and destruction.
3.5. Databases containing the personal data of citizens of the Russian Federation are located within the Russian Federation.

4. Processing customers’ personal data
4.1. The Controller processes the personal data of customers in connection with relationships governed by Part Two of the Civil Code of the Russian Federation, No. 14-FZ of 26 January 1996.
4.2. The Controller processes customers’ personal data to comply with Russian legislation and for the following purposes:
— to enter into and perform agreements with customers;
— to carry out the activities specified in the constituent documents of Individual Entrepreneur Meri Ashotovna Kaplanyan;
— to provide information about new products, promotions and offers;
— to provide information about new articles, videos and events;
— to identify product needs;
— to assess satisfaction with our work.
4.3. The Controller processes customers’ personal data with their consent for the duration of the agreements concluded with them. Where required by the Personal Data Law, consent is given in writing. In other cases, consent is deemed to have been given when an agreement is concluded or through conduct indicating consent.
4.4. The Controller processes customers’ personal data for the duration of their agreements. After an agreement expires, data may be processed for the periods specified in Article 24, Part 3, Clause 5 of Part One of the Russian Tax Code, Article 29, Part 1 of the Federal Law On Accounting, and other applicable regulations.
4.5. The Controller processes the following categories of customers’ personal data:
surname, first name and patronymic, email address, order delivery address, contact telephone number and payment details
— Surname, first name and patronymic;
— Postal address for order delivery;
— Contact telephone number;
— Email address;
— Company registered address;
— Payment details.
4.6. To achieve the purposes of processing and with customers’ consent, the Controller provides personal data to, or entrusts its processing to, the following persons:
— sales department employees;
— marketing department employees.

5. Personal data security
5.1. The Controller appoints a person responsible for organizing personal data processing and performing the duties prescribed by the Personal Data Law and regulations adopted under it.
5.2. The Controller uses legal, organizational and technical measures to keep personal data confidential and protect it against unlawful actions:
— provides unrestricted access to the Policy; a copy is available at the Controller’s address and may also be published on its website, if any;
— adopts and implements Personal Data Processing Regulations (the Regulations) and other internal policies;
— familiarizes employees with personal data legislation, the Policy and the Regulations;
— gives employees access to personal data in the Controller’s information system and on physical media only as needed to perform their duties;
— sets rules for access to personal data in its information system and records all actions involving the data;
— assesses the harm that data subjects could suffer if the Personal Data Law is violated;
— identifies security threats arising from personal data processing in its information system;
— applies organizational and technical measures and information security tools necessary to achieve the required level of personal data protection;
— detects unauthorized access to personal data and responds to incidents, including restoring data modified or destroyed as a result of unauthorized access;
— assesses the effectiveness of personal data security measures before its information system is put into operation;
— conducts internal checks of compliance with the Personal Data Law, regulations adopted under it, personal data security requirements, the Policy, the Regulations and other internal policies, including checks of security measures and the level of protection provided.

6. Rights of data subjects
6.1. A data subject has the right:
— to obtain their personal data and information about how it is processed;
— to request correction, restriction or destruction of data that is incomplete, outdated, inaccurate, obtained unlawfully or unnecessary for the stated processing purpose;
— to withdraw their consent to personal data processing;
— to protect their rights and legitimate interests, including by seeking compensation for losses and non-pecuniary damage through the courts;
— to challenge the Controller’s actions or failure to act before the competent personal data protection authority or the courts.
6.2. To exercise their rights and legitimate interests, data subjects may contact the Controller or submit a request in person or through a representative. The request must include the information specified in Article 14, Part 3 of the Personal Data Law.