PERSONAL DATA PROCESSING POLICY
1. General Provisions
This Personal Data Processing Policy (hereinafter referred to as the “Policy”) has been prepared in accordance with the requirements of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (hereinafter referred to as the “Personal Data Law”) and sets out the procedures for processing personal data and the measures taken to ensure its security by [TO BE COMPLETED: full name or legal name of the Data Controller and its legal status], Taxpayer Identification Number (INN): [TO BE COMPLETED] (hereinafter referred to as the “Data Controller”).
1.1. The Data Controller considers the protection of human and civil rights and freedoms in the processing of personal data to be one of its primary objectives and a fundamental condition of its activities, including the protection of the right to privacy and the confidentiality of personal and family matters.
1.2. This Policy governing the processing of personal data applies to all information that the Data Controller may obtain about visitors to the website meta5.ru.
2. Key Terms Used in This Policy
2.1. Automated processing of personal data — the processing of personal data using computer technology.
2.2. Blocking of personal data — the temporary suspension of the processing of personal data, except where processing is necessary to clarify or correct the data.
2.3. Website — a collection of graphic and informational materials, computer programs and databases that ensure their availability on the Internet at meta5.ru.
2.4. Personal data information system — a collection of personal data contained in databases, together with information technologies and technical equipment used to process such data.
2.5. Anonymisation of personal data — actions that make it impossible to identify personal data as belonging to a particular User or other data subject without the use of additional information.
2.6. Processing of personal data — any action or set of actions performed on personal data, with or without the use of automated means, including collection, recording, systematisation, accumulation, storage, updating, modification, retrieval, use, transfer, disclosure, provision of access, anonymisation, blocking, deletion and destruction of personal data.
2.7. Data Controller — a public authority, municipal authority, legal entity or individual that, independently or jointly with others, organises and/or carries out the processing of personal data and determines the purposes of processing, the categories of personal data to be processed and the operations performed on such data.
2.8. Personal data — any information relating directly or indirectly to an identified or identifiable User of the meta5.ru website.
2.9. Personal data authorised for dissemination by the data subject — personal data to which an unrestricted number of persons has been granted access by the data subject through consent to the processing of personal data authorised for dissemination in accordance with the procedure established by the Personal Data Law.
2.10. User — any visitor to the meta5.ru website.
2.11. Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific group of persons.
2.12. Dissemination of personal data — any actions aimed at disclosing personal data to an unrestricted number of persons, including making such data available through mass media, information and telecommunications networks or any other means.
2.13. Cross-border transfer of personal data — the transfer of personal data to a foreign state, including to a foreign public authority, foreign individual or foreign legal entity.
2.14. Destruction of personal data — any actions resulting in the irreversible destruction of personal data, making it impossible to restore the contents of the personal data information system and/or destroying physical media containing personal data.
3. Rights and Obligations of the Data Controller
3.1. The Data Controller has the right to:
4.1. Data subjects have the right to:
5. Principles of Personal Data Processing
5.1. Personal data shall be processed lawfully and fairly.
5.2. The processing of personal data shall be limited to specific, predetermined and lawful purposes. Processing incompatible with the purposes for which the personal data was collected is not permitted.
5.3. Databases containing personal data processed for incompatible purposes shall not be combined.
5.4. Only personal data relevant to the purposes of processing shall be processed.
5.5. The content and scope of the personal data processed shall correspond to the stated purposes of processing. Excessive processing of personal data in relation to those purposes is not permitted.
5.6. The accuracy, sufficiency and, where necessary, relevance of personal data shall be ensured in relation to the purposes of processing. The Data Controller shall take the necessary measures, or ensure that such measures are taken, to delete or correct incomplete or inaccurate data.
5.7. Personal data shall be stored in a form that permits identification of the data subject for no longer than is necessary to achieve the purposes of processing, unless a storage period is established by federal law or a contract to which the data subject is a party, beneficiary or guarantor.
Personal data shall be destroyed or anonymised once the purposes of processing have been achieved or when the need to achieve those purposes no longer exists, unless otherwise provided by federal law.
6. Purposes of Personal Data Processing
Purpose of processing: Providing information to the User by sending emails.
Personal data processed: Surname, first name, patronymic (if applicable) and email address.
Legal basis: The constitutional and organisational documents of the Data Controller.
Types of processing: Collection, recording, systematisation, accumulation, storage, destruction and anonymisation of personal data; sending informational emails to the User’s email address.
7. Conditions for Processing Personal Data
7.1. Personal data shall be processed with the data subject’s consent to the processing of their personal data.
7.2. Processing is necessary to achieve purposes established by an international treaty of the Russian Federation or by law, or to perform the functions, powers and obligations imposed on the Data Controller by the legislation of the Russian Federation.
7.3. Processing is necessary for the administration of justice or the enforcement of a judicial decision or an act of another authority or official subject to enforcement proceedings under the legislation of the Russian Federation.
7.4. Processing is necessary for the performance of a contract to which the data subject is a party, beneficiary or guarantor, or for entering into a contract at the data subject’s initiative or a contract under which the data subject will be a beneficiary or guarantor.
7.5. Processing is necessary to exercise the lawful interests of the Data Controller or third parties, or to achieve socially significant purposes, provided that the rights and freedoms of the data subject are not infringed.
7.6. Processing concerns personal data that has been made publicly available to an unrestricted number of persons by the data subject or at their request.
7.7. Processing concerns personal data that must be published or disclosed in accordance with federal law.
8. Procedures for the Collection, Storage, Transfer and Other Processing of Personal Data
The security of personal data processed by the Data Controller is ensured through the implementation of legal, organisational and technical measures necessary to comply fully with the applicable personal data protection legislation.
8.1. The Data Controller ensures the security of personal data and takes all reasonable measures to prevent unauthorised persons from accessing it.
8.2. Users’ personal data shall not be transferred to third parties except where such transfer is required by applicable law or where the data subject has consented to the Data Controller transferring the data to a third party for the performance of obligations under a civil law contract.
8.3. If inaccuracies in personal data are identified, the User may request that the data be updated by sending a notification to the Data Controller at meta-5@bk.ru with the subject line “Personal Data Update”.
8.4. The period of personal data processing is determined by the achievement of the purposes for which the data was collected, unless a different period is established by contract or applicable law. The User may withdraw their consent to the processing of personal data at any time by sending an email to meta-5@bk.ru with the subject line “Withdrawal of Consent to Personal Data Processing”.
8.5. All information collected by third-party services, including payment systems, communication services and other service providers, is stored and processed by those parties (data controllers) in accordance with their respective terms of service and privacy policies. Data subjects are responsible for reviewing those documents themselves. The Data Controller shall not be liable for the actions of third parties, including the service providers referred to in this clause.
8.6. Restrictions imposed by the data subject on the transfer of personal data authorised for dissemination, except for granting access to such data, as well as restrictions on its processing or conditions of processing, except for obtaining access to such data, shall not apply where personal data is processed in the public, governmental or other public interests established by the legislation of the Russian Federation.
8.7. The Data Controller shall ensure the confidentiality of personal data during processing.
8.8. The Data Controller shall store personal data in a form that permits identification of the data subject for no longer than is necessary to achieve the purposes of processing, unless a storage period is established by federal law or a contract to which the data subject is a party, beneficiary or guarantor.
8.9. Personal data processing may be terminated upon achievement of the purposes of processing, expiration of the data subject’s consent, withdrawal of consent, receipt of a request to cease processing, or identification of unlawful processing of personal data.
9. List of Operations Performed on Personal Data
9.1. The Data Controller performs the following operations on personal data: collection, recording, systematisation, accumulation, storage, updating, modification, retrieval, use, transfer, dissemination, provision, granting access, anonymisation, blocking, deletion and destruction.
9.2. The Data Controller carries out automated processing of personal data, including with or without the receipt and/or transmission of information through information and telecommunications networks.
10. Cross-Border Transfer of Personal Data
10.1. Before commencing activities involving the cross-border transfer of personal data, the Data Controller is obliged to notify the authorised personal data protection authority of its intention to carry out such transfers. This notification must be submitted separately from the notification of the intention to process personal data.
10.2. Before submitting the above notification, the Data Controller is obliged to obtain the relevant information from the public authorities, individuals or legal entities of the foreign state to which the personal data is intended to be transferred.
11. Confidentiality of Personal Data
The Data Controller and any other persons who gain access to personal data are obliged not to disclose such data to third parties or disseminate it without the data subject’s consent, unless otherwise provided by federal law.
12. Final Provisions
12.1. Users may obtain clarification on any questions concerning the processing of their personal data by contacting the Data Controller by email at meta-5@bk.ru.
12.2. Any changes made by the Data Controller to this Personal Data Processing Policy shall be reflected in this document. The Policy remains in force indefinitely until it is replaced by a new version.
12.3. The current version of the Policy is freely available online at: https://meta5.ru/politika
This Personal Data Processing Policy (hereinafter referred to as the “Policy”) has been prepared in accordance with the requirements of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (hereinafter referred to as the “Personal Data Law”) and sets out the procedures for processing personal data and the measures taken to ensure its security by [TO BE COMPLETED: full name or legal name of the Data Controller and its legal status], Taxpayer Identification Number (INN): [TO BE COMPLETED] (hereinafter referred to as the “Data Controller”).
1.1. The Data Controller considers the protection of human and civil rights and freedoms in the processing of personal data to be one of its primary objectives and a fundamental condition of its activities, including the protection of the right to privacy and the confidentiality of personal and family matters.
1.2. This Policy governing the processing of personal data applies to all information that the Data Controller may obtain about visitors to the website meta5.ru.
2. Key Terms Used in This Policy
2.1. Automated processing of personal data — the processing of personal data using computer technology.
2.2. Blocking of personal data — the temporary suspension of the processing of personal data, except where processing is necessary to clarify or correct the data.
2.3. Website — a collection of graphic and informational materials, computer programs and databases that ensure their availability on the Internet at meta5.ru.
2.4. Personal data information system — a collection of personal data contained in databases, together with information technologies and technical equipment used to process such data.
2.5. Anonymisation of personal data — actions that make it impossible to identify personal data as belonging to a particular User or other data subject without the use of additional information.
2.6. Processing of personal data — any action or set of actions performed on personal data, with or without the use of automated means, including collection, recording, systematisation, accumulation, storage, updating, modification, retrieval, use, transfer, disclosure, provision of access, anonymisation, blocking, deletion and destruction of personal data.
2.7. Data Controller — a public authority, municipal authority, legal entity or individual that, independently or jointly with others, organises and/or carries out the processing of personal data and determines the purposes of processing, the categories of personal data to be processed and the operations performed on such data.
2.8. Personal data — any information relating directly or indirectly to an identified or identifiable User of the meta5.ru website.
2.9. Personal data authorised for dissemination by the data subject — personal data to which an unrestricted number of persons has been granted access by the data subject through consent to the processing of personal data authorised for dissemination in accordance with the procedure established by the Personal Data Law.
2.10. User — any visitor to the meta5.ru website.
2.11. Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific group of persons.
2.12. Dissemination of personal data — any actions aimed at disclosing personal data to an unrestricted number of persons, including making such data available through mass media, information and telecommunications networks or any other means.
2.13. Cross-border transfer of personal data — the transfer of personal data to a foreign state, including to a foreign public authority, foreign individual or foreign legal entity.
2.14. Destruction of personal data — any actions resulting in the irreversible destruction of personal data, making it impossible to restore the contents of the personal data information system and/or destroying physical media containing personal data.
3. Rights and Obligations of the Data Controller
3.1. The Data Controller has the right to:
- Obtain accurate information and/or documents containing personal data from the data subject.
- Continue processing personal data without the data subject’s consent following withdrawal of consent or receipt of a request to cease processing, provided that the grounds specified in the Personal Data Law apply.
- Independently determine the scope and list of measures necessary and sufficient to fulfil its obligations under the Personal Data Law and the regulations adopted pursuant to it, unless otherwise provided by the Personal Data Law or other federal laws.
- Provide the data subject, upon request, with information concerning the processing of their personal data.
- Organise the processing of personal data in accordance with the procedure established by the applicable legislation of the Russian Federation.
- Respond to requests and enquiries from data subjects and their legal representatives in accordance with the requirements of the Personal Data Law.
- Provide the authorised personal data protection authority, upon request, with the necessary information within 10 days of receiving such request.
- Publish this Policy or otherwise ensure unrestricted access to it.
- Take legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination and other unlawful actions.
- Cease the transfer, dissemination or provision of access to personal data, terminate processing and destroy personal data in the cases and in accordance with the procedures prescribed by the Personal Data Law.
- Fulfil other obligations established by applicable law.
4.1. Data subjects have the right to:
- Obtain information concerning the processing of their personal data, except in cases provided for by federal law. Such information must be provided in an accessible form and must not contain personal data relating to other data subjects unless there are lawful grounds for disclosing such data. The scope of information and the procedure for obtaining it are established by the Personal Data Law.
- Request that the Data Controller correct, block or destroy their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose of processing, and take other measures provided by law to protect their rights.
- Require prior consent for the processing of personal data for the promotion of goods, works or services on the market.
- Withdraw their consent to the processing of personal data and submit a request to cease such processing.
- Appeal unlawful actions or omissions by the Data Controller to the authorised personal data protection authority or to a court.
- Exercise other rights provided for by the legislation of the Russian Federation.
- Provide the Data Controller with accurate information about themselves.
- Notify the Data Controller of any updates or changes to their personal data.
5. Principles of Personal Data Processing
5.1. Personal data shall be processed lawfully and fairly.
5.2. The processing of personal data shall be limited to specific, predetermined and lawful purposes. Processing incompatible with the purposes for which the personal data was collected is not permitted.
5.3. Databases containing personal data processed for incompatible purposes shall not be combined.
5.4. Only personal data relevant to the purposes of processing shall be processed.
5.5. The content and scope of the personal data processed shall correspond to the stated purposes of processing. Excessive processing of personal data in relation to those purposes is not permitted.
5.6. The accuracy, sufficiency and, where necessary, relevance of personal data shall be ensured in relation to the purposes of processing. The Data Controller shall take the necessary measures, or ensure that such measures are taken, to delete or correct incomplete or inaccurate data.
5.7. Personal data shall be stored in a form that permits identification of the data subject for no longer than is necessary to achieve the purposes of processing, unless a storage period is established by federal law or a contract to which the data subject is a party, beneficiary or guarantor.
Personal data shall be destroyed or anonymised once the purposes of processing have been achieved or when the need to achieve those purposes no longer exists, unless otherwise provided by federal law.
6. Purposes of Personal Data Processing
Purpose of processing: Providing information to the User by sending emails.
Personal data processed: Surname, first name, patronymic (if applicable) and email address.
Legal basis: The constitutional and organisational documents of the Data Controller.
Types of processing: Collection, recording, systematisation, accumulation, storage, destruction and anonymisation of personal data; sending informational emails to the User’s email address.
7. Conditions for Processing Personal Data
7.1. Personal data shall be processed with the data subject’s consent to the processing of their personal data.
7.2. Processing is necessary to achieve purposes established by an international treaty of the Russian Federation or by law, or to perform the functions, powers and obligations imposed on the Data Controller by the legislation of the Russian Federation.
7.3. Processing is necessary for the administration of justice or the enforcement of a judicial decision or an act of another authority or official subject to enforcement proceedings under the legislation of the Russian Federation.
7.4. Processing is necessary for the performance of a contract to which the data subject is a party, beneficiary or guarantor, or for entering into a contract at the data subject’s initiative or a contract under which the data subject will be a beneficiary or guarantor.
7.5. Processing is necessary to exercise the lawful interests of the Data Controller or third parties, or to achieve socially significant purposes, provided that the rights and freedoms of the data subject are not infringed.
7.6. Processing concerns personal data that has been made publicly available to an unrestricted number of persons by the data subject or at their request.
7.7. Processing concerns personal data that must be published or disclosed in accordance with federal law.
8. Procedures for the Collection, Storage, Transfer and Other Processing of Personal Data
The security of personal data processed by the Data Controller is ensured through the implementation of legal, organisational and technical measures necessary to comply fully with the applicable personal data protection legislation.
8.1. The Data Controller ensures the security of personal data and takes all reasonable measures to prevent unauthorised persons from accessing it.
8.2. Users’ personal data shall not be transferred to third parties except where such transfer is required by applicable law or where the data subject has consented to the Data Controller transferring the data to a third party for the performance of obligations under a civil law contract.
8.3. If inaccuracies in personal data are identified, the User may request that the data be updated by sending a notification to the Data Controller at meta-5@bk.ru with the subject line “Personal Data Update”.
8.4. The period of personal data processing is determined by the achievement of the purposes for which the data was collected, unless a different period is established by contract or applicable law. The User may withdraw their consent to the processing of personal data at any time by sending an email to meta-5@bk.ru with the subject line “Withdrawal of Consent to Personal Data Processing”.
8.5. All information collected by third-party services, including payment systems, communication services and other service providers, is stored and processed by those parties (data controllers) in accordance with their respective terms of service and privacy policies. Data subjects are responsible for reviewing those documents themselves. The Data Controller shall not be liable for the actions of third parties, including the service providers referred to in this clause.
8.6. Restrictions imposed by the data subject on the transfer of personal data authorised for dissemination, except for granting access to such data, as well as restrictions on its processing or conditions of processing, except for obtaining access to such data, shall not apply where personal data is processed in the public, governmental or other public interests established by the legislation of the Russian Federation.
8.7. The Data Controller shall ensure the confidentiality of personal data during processing.
8.8. The Data Controller shall store personal data in a form that permits identification of the data subject for no longer than is necessary to achieve the purposes of processing, unless a storage period is established by federal law or a contract to which the data subject is a party, beneficiary or guarantor.
8.9. Personal data processing may be terminated upon achievement of the purposes of processing, expiration of the data subject’s consent, withdrawal of consent, receipt of a request to cease processing, or identification of unlawful processing of personal data.
9. List of Operations Performed on Personal Data
9.1. The Data Controller performs the following operations on personal data: collection, recording, systematisation, accumulation, storage, updating, modification, retrieval, use, transfer, dissemination, provision, granting access, anonymisation, blocking, deletion and destruction.
9.2. The Data Controller carries out automated processing of personal data, including with or without the receipt and/or transmission of information through information and telecommunications networks.
10. Cross-Border Transfer of Personal Data
10.1. Before commencing activities involving the cross-border transfer of personal data, the Data Controller is obliged to notify the authorised personal data protection authority of its intention to carry out such transfers. This notification must be submitted separately from the notification of the intention to process personal data.
10.2. Before submitting the above notification, the Data Controller is obliged to obtain the relevant information from the public authorities, individuals or legal entities of the foreign state to which the personal data is intended to be transferred.
11. Confidentiality of Personal Data
The Data Controller and any other persons who gain access to personal data are obliged not to disclose such data to third parties or disseminate it without the data subject’s consent, unless otherwise provided by federal law.
12. Final Provisions
12.1. Users may obtain clarification on any questions concerning the processing of their personal data by contacting the Data Controller by email at meta-5@bk.ru.
12.2. Any changes made by the Data Controller to this Personal Data Processing Policy shall be reflected in this document. The Policy remains in force indefinitely until it is replaced by a new version.
12.3. The current version of the Policy is freely available online at: https://meta5.ru/politika
