Policy Regarding the Processing of Personal Data
| 1 | Abbreviations used |
| 1.1 | PD — personal data |
| 1.2 | PDIS — personal data information system |
| 2 | This Personal Data Processing Policy defines the procedures for processing PD and the measures taken to ensure the security of personal data by Individual Entrepreneur Dmitry Vyacheslavovich Shmykov (hereinafter referred to as the “Operator”). |
| 2.1 | The operator establishes, as its primary objective and a fundamental condition for its operations, the observance of the human and civil rights and freedoms of individuals during the processing of their PD — including the protection of the right to privacy and the confidentiality of personal and family life. |
| 2.2 | A website is a collection of graphical and informational materials, as well as computer programs and databases, that are made accessible on the Internet at the network address https://ipshmykov.ru/ |
| 2.3 | This Policy of the Operator regarding the processing of PD (hereinafter referred to as the “Policy”) applies to all information that the Operator may obtain about website visitors. |
| 2.4 | A user is any visitor to a website. |
| 2.5 | Automated processing of PD — processing of PD using computing equipment. |
| 2.6 | Blocking of PD — the temporary cessation of the processing of PD (except in cases where processing is necessary for the purpose of clarifying the PD). |
| 2.7 | An PDIS is a collection of PD contained in databases, along with the information technologies and technical means used to process such data. |
| 2.8 | Anonymization of PD — actions that make it impossible to determine, without the use of additional information, whether PD belongs to a specific User or another PD subject. |
| 2.9 | Processing of PD — any action (operation) or set of actions (operations) performed upon PD, whether or not by automated means, including the collection, recording, systematization, accumulation, storage, refinement (updating, modification), retrieval, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion, or destruction of PD. |
| 2.10 | PD authorized by the data subject for dissemination — PD to which an unlimited number of persons have been granted access by the data subject, through the provision of consent for the processing of PD authorized by the data subject for dissemination, in accordance with the procedure established by the law on PD (hereinafter referred to as “PD authorized for dissemination”). |
| 2.11 | Provision of PD — actions aimed at disclosing PD to a specific person or a specific group of persons. |
| 2.12 | Dissemination of PD refers to any actions aimed at disclosing PD to an indefinite number of persons (transfer of PD) or making PD available to an unlimited number of persons, including the publication of PD in the mass media, posting it on information and telecommunications networks, or providing access to PD in any other way. |
| 2.13 | Cross-border transfer of PD — the transfer of PD to the territory of a foreign state to a foreign public authority, a foreign individual, or a foreign legal entity. |
| 2.14 | Destruction of PD — any actions that result in the irreversible destruction of PD, making it impossible to subsequently recover the content of such data within a PDIS, and/or the destruction of the physical media on which the PD is stored. |
| 3 | Key Rights and Obligations of the Operator |
| 3.1 | The operator has the right to: |
| — obtain accurate information and/or documents containing PD from the personal data subject; | |
| — in the event that a PD subject withdraws their consent to the processing of their PD, the Operator may continue such processing without the subject’s consent, provided that grounds for doing so exist under the law on PD; | |
| — independently determine the scope and list of measures necessary and sufficient to ensure compliance with the obligations stipulated by the law on PD and the regulatory legal acts adopted pursuant thereto, unless otherwise provided by the law on PD or other laws. | |
| 3.2 | The operator is obligated to: |
| — provide the PD subject, upon their request, with information regarding the processing of their PD; | |
| — organize the processing of PD in accordance with the procedures established by current legislation; | |
| — respond to inquiries and requests from PD subjects and their legal representatives in compliance with the requirements of the law on PD; | |
| — provide the authorized body for the protection of the rights of PD subjects, upon its request, with necessary information within 30 days from the date of receipt of such a request; | |
| — publish or otherwise ensure unrestricted access to this Policy regarding the processing of PD; | |
| — implement legal, organizational, and technical measures to protect PD against unauthorized or accidental access, destruction, alteration, blocking, copying, disclosure, or dissemination, as well as against other unlawful actions involving PD; | |
| — cease the transfer (dissemination, disclosure, provision of access) of PD, stop processing such data, and destroy it in the manner and in the cases stipulated by the law on PD; | |
| — fulfill other obligations as provided for by the law on PD. | |
| 4 | Key rights and obligations of PD subjects |
| 4.1 | PD subjects have the right to: |
| — obtain information regarding the processing of their PD, except in cases provided for by the laws. Such information shall be provided to the PD subject by the Data Controller in an accessible format and must not contain PD pertaining to other individuals, unless there are legal grounds for disclosing such data. The scope of this information and the procedure for obtaining it are established by the law on PD; | |
| — request that the Data Controller update, block, or destroy their PD if such data is incomplete, outdated, inaccurate, obtained unlawfully, or is no longer necessary for the stated purpose of processing; they may also take measures provided for by law to protect their rights; | |
| — stipulate a requirement for prior consent when their PD is processed for the purpose of promoting goods, works, or services in the market; | |
| — withdraw their consent to the processing of their PD; | |
| — challenge any unlawful actions or omissions by the Data Controller during the processing of their PD, either by filing a complaint with the authorized data protection authority or by seeking judicial recourse; | |
| — exercise other rights as provided for by legislation. | |
| 4.2 | Data subjects are required to: |
| — provide the Operator with accurate information about themselves; | |
| — notify the Operator of any updates (corrections, changes) to their PD. | |
| 4.3 | Individuals who provide the Operator with inaccurate information about themselves, or information about another PD subject without the latter’s consent, shall be held liable in accordance with the law. |
| 5 | The Operator may process the following PD of the User: |
| — surname, first name, patronymic; | |
| — email address; | |
| — telephone number. | |
| 5.1 | The website also collects and processes anonymized data about visitors (including cookies) using web analytics services (such as Yandex Metrica and others). |
| 5.2 | If a visitor makes requests on the site, we collect the visitor’s IP address and browser user-agent data for the purpose of spam detection. |
| 5.3 | If you are a registered user and upload photos to the site, you may want to avoid uploading images that contain EXIF metadata, as this can include GPS location data. Visitors to the site could extract this information by downloading the images. |
| 5.4 | If you fill out web forms on our website, you may choose to have the information you entered saved in cookies. This is for your convenience, so that you do not have to re-enter your details when submitting forms again. These cookies are stored for one year. |
| 5.5 | If you have an account on the site and you log in, we will set a temporary cookie to determine whether your browser supports cookies; this cookie contains no personal information and is discarded when you close your browser. |
| 5.6 | When you sign in to your account, we will also set several cookies with your login information and screen preferences. Login cookies last for two days, screen settings cookies last for a year. If you select the “Remember Me” option, your login information will be retained for two weeks. Signing out of your account will remove your login cookies. |
| 5.7 | When you edit or publish an article, an additional cookie will be saved in your browser; it contains no PD, only the ID of the post you edited, and expires after 1 day. |
| 5.8 | Articles on this site may include embedded content (e.g., videos, images, articles, etc.); such content behaves in the same way as it would if the visitor had accessed the other website directly. |
| 5.9 | These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with embedded content—including tracking your interaction if you have an account and are logged in to that website. |
| 5.10 | For users who register on our website, we store the personal information they provide in their user profile. All users can view, edit, or delete their profile information at any time (except for their username). Website administrators can also view and modify this information. |
| 5.11 | The data listed above are collectively referred to as PD throughout the remainder of this Policy. |
| 6 | Principles for the processing of PD |
| 6.1 | PD processing is carried out on a lawful and fair basis. |
| 6.2 | The processing of PD is limited to the achievement of specific, predetermined, and legitimate purposes. Processing of PD that is incompatible with the purposes for which the data was collected is not permitted. |
| 6.3 | It is not permitted to combine databases containing PD if such data are processed for purposes that are incompatible with one another. |
| 6.4 | Only PD that are relevant to the purposes of their processing may be processed. |
| 6.5 | The content and scope of the PD being processed correspond to the stated purposes of processing. The personal data processed must not be excessive in relation to the stated purposes for which they are processed. |
| 6.6 | During the processing of PD, the accuracy and sufficiency of such data are ensured, as is their relevance to the purposes of the processing, where necessary. The operator takes and/or ensures the implementation of the necessary measures to delete or rectify incomplete or inaccurate data. |
| 6.7 | PD shall be stored in a form that permits identification of the data subject for no longer than is required for the purposes for which the PD are processed, unless a different storage period is established by federal law or by a contract to which the data subject is a party, a beneficiary, or a guarantor. Once the processing purposes have been achieved, or if there is no longer a need to achieve such purposes, the personal data being processed shall be destroyed or anonymized, unless otherwise provided by law. |
| 7 | Purposes of PD processing |
| 7.1 | Purpose of processing the User’s PD: |
| — informing the User by sending emails; | |
| — providing consultations and calculating the cost of the Operator’s work and services based on the User’s data. | |
| 7.2 | Anonymized user data, collected via web analytics services, is used to gather information about users’ activities on the website and to improve the quality of the website and its content. |
| 8 | Legal grounds for PD processing |
| 8.1 | The legal grounds for the processing of PD by the Operator are: |
| — agreements concluded between the Operator and the PD subject; | |
| — laws and other regulatory legal acts in the field of PD protection; | |
| — consent provided by Users for the processing of their personal data that is permitted for dissemination. | |
| 8.2 | The Operator processes the User’s PD only if the User fills out and/or submits such data either independently via specific forms located on the website or by sending it to the Operator via email. By filling out the relevant forms and/or submitting their PD to the Operator, the User expresses their consent to this Policy. |
| 8.3 | The operator processes anonymized data about the User, provided that this is permitted by the User’s browser settings (i.e., the storage of “cookies” and the use of JavaScript technology are enabled). |
| 8.4 | The PD subject makes the decision to provide their PD independently and grants consent freely, of their own volition, and in their own interest. |
| 9 | Terms for the processing of personal data |
| 9.1 | PD is processed with the consent of the PD subject to the processing of their PD. |
| 9.2 | The processing of PD is necessary for the exercise of the rights and legitimate interests of the Controller or third parties, or for the achievement of socially significant objectives, provided that such processing does not violate the rights and freedoms of the PD subject. |
| 10 | Procedure for the collection, storage, transfer, and other types of processing of PD |
| 10.1 | The security of PD processed by the Operator is ensured through the implementation of legal, organizational, and technical measures necessary to fully comply with the requirements of applicable legislation in the field of PD protection. |
| 10.2 | The operator ensures the security of PD and takes all possible measures to prevent unauthorized persons from accessing such data. |
| 10.3 | The User’s PD shall never, under any circumstances, be transferred to third parties, except in cases required by applicable law or in the event that the PD subject has provided consent to the Operator for the transfer of such data to a third party for the purpose of fulfilling obligations under a civil-law contract. |
| 10.4 | In the event that inaccuracies in PD are discovered, the User may update them personally by sending a notification to the Operator at the email address sales@ipshmykov.ru, with the subject line “Personal Data Update.” |
| 10.5 | The duration for which PD is processed is determined by the achievement of the purposes for which such data was collected, unless a different period is stipulated by a contract or applicable law. A user may withdraw their consent to the processing of PD at any time by sending a notification to the Operator via email at sales@ipshmykov.ru, with the subject line “Withdrawal of consent to the processing of PD.” |
| 10.6 | All information collected by third-party services including communication platforms and other service providers is stored and processed by these entities (referred to as “Operators”) in accordance with their respective User Agreements and Privacy Policies. It is the responsibility of the data subject and/or the user to review these documents in a timely manner. The Operator assumes no liability for the actions of third parties, including the service providers mentioned in this clause. |
| 10.7 | Prohibitions established by a PD subject regarding the transfer (excluding the provision of access) of PD as well as prohibitions or conditions concerning the processing (excluding the granting of access) of PD authorized for dissemination do not apply in cases where PD is processed in the public, societal, or other interests as defined by legislation. |
| 10.8 | When processing PD, the operator ensures the confidentiality of such data. |
| 10.9 | The operator shall store PD in a form that allows for the identification of the data subject for no longer than is required for the purposes of personal data processing, unless a different storage period is established by law. |
| 10.10 | The processing of PD may be terminated upon the achievement of the purposes for which the data is processed, the expiration of the data subject’s consent, the withdrawal of such consent by the data subject, or the discovery of unlawful PD processing. |
| 11 | List of actions performed by the Operator with the PD received |
| 11.1 | The operator carries out the collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, granting access), depersonalization, blocking, deletion, and destruction of PD. |
| 11.2 | The operator carries out automated processing of PD, which may or may not involve the receipt and/or transmission of the obtained information via information and telecommunication networks. |
| 12 | Confidentiality of PD. The operator and other parties who have gained access to PD are obligated not to disclose such data to third parties or disseminate it without the consent of the data subject, unless otherwise provided by law. |
| 13 | Final Provisions |
| 13.1 | The user may obtain any clarifications regarding questions of interest concerning the processing of their PD by contacting the Operator via email at sales@ipshmykov.ru. |
| 13.2 | This document will reflect any changes to the Operator’s PD processing policy. The policy remains in effect indefinitely until it is replaced by a new version. |
| 13.3 | The current version of the Policy is freely available on the Internet at the address of this web page. |