Personal Data Processing Policy

1. General provisions

1.1. This Personal Data Processing Policy (the "Policy") has been developed to comply with clause 2 of part 1 of article 18.1 of Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" ("Law No. 152-FZ") and defines the policy of GrinKEP LLC (the "Operator") regarding the processing of personal data.

1.2. Operator details:

1.3. The Policy applies to all personal data of subjects that the Operator receives in connection with the use of the websites vsekolonki.com and vsekolonki.net (the "Site"), and also in the course of pre-contract correspondence and the performance of supply contracts.

1.4. The person responsible for organising the processing of personal data at the Operator is the head of the company, Cуфьянов Тимур Фанурович.

1.5. The current version of the Policy is publicly available at vsekolonki.com/en/personal-data. Information on what data is collected on the Site and how cookies are used is set out in the privacy policy.

2. Key definitions

Personal data

any information relating to a directly or indirectly identified or identifiable natural person.

Data subject

the natural person to whom the personal data relates.

Operator

GrinKEP LLC, which organises and carries out the processing of personal data and determines the purposes and the composition of the data processed.

Processing of personal data

any action or set of actions performed on personal data: collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer, blocking, deletion and destruction.

Destruction of personal data

actions as a result of which it becomes impossible to restore the content of personal data in the information system and as a result of which the physical media are destroyed.

3. Principles of processing personal data

The Operator processes personal data on the following principles:

• processing is carried out on a lawful and fair basis;
• processing is limited to achieving specific, predetermined and lawful purposes;
• databases containing personal data processed for mutually incompatible purposes are not combined;
• only data that corresponds to the purposes of processing is processed — its composition and volume are not excessive;
• the accuracy and sufficiency of the data is ensured, and where necessary its currency;
• data is stored in a form permitting identification of the subject for no longer than the purposes of processing require.

4. Categories of subjects and composition of the data processed

4.1. The Operator processes the personal data of the following categories of subjects:

• users of the Site who have submitted a request through the order form;
• representatives of counterparties — legal entities and sole traders.

4.2. Composition of the personal data of Site users processed:

• surname and given name (to the extent stated by the subject when completing the form);
• contact telephone number;
• information voluntarily supplied by the subject in the "Comment" field;
• information on the contents and total value of the order;
• IP address, browser data, date and time of access to the Site — recorded automatically in the server logs.

4.3. The Operator does not process the special categories of personal data referred to in article 10 of Law No. 152-FZ, nor biometric personal data. The Operator does not process the personal data of minors.

4.4. The Operator does not take decisions producing legal effects concerning the subject solely on the basis of automated processing of personal data.

5. Purposes of processing personal data

Personal data is processed for the following purposes:

• handling requests received through the Site and communicating with the subject;
• preparing commercial offers, invoices and accompanying documents;
• concluding and performing contracts for the supply of equipment;
• arranging delivery of the products;
• discharging the obligations imposed on the Operator by Russian law, including in the field of accounting and taxation;
• maintaining the operability and information security of the Site.

The Operator does not process data for the purpose of promoting goods and services by making direct contact with the subject by means of communication.

6. Legal grounds for processing

The legal grounds for processing personal data are:

• the consent of the data subject to the processing of their personal data (clause 1 of part 1 of article 6 of Law No. 152-FZ), given when submitting the order form on the Site;
• the need to perform a contract to which the subject is a party or a beneficiary, and the need to conclude a contract at the subject's initiative (clause 5 of part 1 of article 6 of Law No. 152-FZ);
• the Civil Code of the Russian Federation, the Tax Code of the Russian Federation, Federal Law No. 402-FZ of 6 December 2011 "On Accounting" and other regulations imposing on the Operator obligations whose performance requires the processing of personal data;
• the Operator's articles of association and contracts concluded between the Operator and the subject.

7. Procedure and conditions of processing

7.1. Personal data is processed by mixed means: both with and without the use of automation.

7.2. Personal data is collected when the subject voluntarily completes the order form on the Site. The "Name" and "Telephone" fields are mandatory in order to handle the request; the "Comment" field is completed at the subject's discretion.

7.3. The form can only be submitted once the subject has ticked the box consenting to the processing of personal data. Ticking the box constitutes the subject's informed and deliberate agreement to this Policy.

7.4. Databases containing the personal data of citizens of the Russian Federation are located within the territory of the Russian Federation at the point of collection, in accordance with part 5 of article 18 of Law No. 152-FZ.

7.5. The Operator does not place the subject's personal data in publicly available sources without their prior consent.

8. Transfer of personal data

8.1. The Operator may transfer personal data to third parties in the following cases:

• the subject has consented to such actions;
• the transfer is necessary to perform a contract concluded with the subject — in particular, to transport companies to the extent required to arrange delivery;
• the transfer is provided for by Russian law — in response to reasoned requests from authorised state bodies.

8.2. Notification of a request submitted on the Site is delivered to the Operator's staff through the Telegram messaging service. The subject is informed of, and agrees to, the contents of the request being transmitted through the infrastructure of that service, whose servers may be located outside the territory of the Russian Federation. The Operator recommends not entering information in the "Comment" field whose transmission through a messenger would be undesirable.

8.3. Persons who have obtained access to personal data are obliged not to disclose it to third parties and not to distribute it without the subject's consent, unless otherwise provided by law.

9. Processing periods and destruction procedure

9.1. The processing of personal data ceases when the purposes of processing have been achieved, when the consent expires, when the subject withdraws consent, or when unlawful processing is identified.

9.2. The personal data of subjects whose enquiries did not lead to a contract is kept for no more than one year from the date of last interaction.

9.3. Personal data contained in accounting and tax records is kept for the periods established by Russian law.

9.4. Once the purposes of processing have been achieved, or upon withdrawal of consent, personal data is subject to destruction within no more than 30 days, unless the Operator has other lawful grounds for retaining it. The destruction is recorded in a formal act.

10. Rights of the data subject

10.1. The data subject has the right to:

• obtain confirmation that the Operator is processing their personal data, together with the information required by part 7 of article 14 of Law No. 152-FZ: the legal grounds and purposes of processing, the methods applied, the periods of processing and storage, and the names of persons with access to the data;
• review their personal data;
• require that personal data be corrected, blocked or destroyed if it is incomplete, out of date, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;
• withdraw consent to the processing of personal data;
• appeal against the Operator's acts or omissions to the authority responsible for protecting the rights of data subjects — Roskomnadzor — or through the courts;
• protection of their rights and lawful interests, including compensation for losses and for moral harm.

10.2. Withdrawal of consent is submitted in free form to 4070220@mail.ru or by post to the Operator's address. On receiving the withdrawal, the Operator ceases processing and destroys the data within the period stated in clause 9.4, except where processing is permitted without the subject's consent on other lawful grounds.

11. Submitting and handling requests

11.1. A subject's request is sent to the e-mail address 4070220@mail.ru or by post to: 454080, Россия, г. Челябинск, ул. Энгельса, 77а, помещение 3.

11.2. The request must contain the number of the principal identity document of the subject or their representative, the date of issue of that document and the issuing authority, information confirming the subject's involvement in a relationship with the Operator (the request number, the date of the enquiry, the telephone number given in the form), and the signature of the subject or their representative.

11.3. The Operator reviews the request and gives a reasoned response within 30 days of receiving it. This period may be extended by no more than 5 working days, with notice to the subject of the reasons for the extension.

12. Measures to ensure the security of personal data

To protect personal data the Operator takes the following measures:

• appoints a person responsible for organising the processing of personal data;
• limits the number of persons admitted to processing and ensures they are familiar with the requirements of the law and with this Policy;
• uses secure data transfer protocols between the user's browser and the Site;
• maintains segregation of access rights to information systems and keeps a record of actions performed on personal data;
• keeps server software and information protection tools up to date;
• carries out internal monitoring of compliance of processing with the requirements of Law No. 152-FZ;
• ensures the ability to restore data that has been altered or destroyed as a result of unauthorised access.

13. Final provisions

13.1. The Operator may amend this Policy. A new version takes effect from the moment it is published on the Site, unless the version itself provides otherwise.

13.2. In all matters not governed by this Policy, the Operator and data subjects are guided by the law of the Russian Federation.

13.3. For questions relating to the processing of personal data, please contact us at 4070220@mail.ru or by phone on +7 (912) 407-02-20 during working hours: 09.00 - 18.00 (пн - пт).