Confidentiality and Personal Data Processing Policy
1. General Provisions
1.1 Personal Data Processing Policy (hereinafter referred to as "Policy") is aimed at protection of rights and freedoms of individuals whose personal data is being processed by the White Widow OÜ LLC (hereinafter referred to as "Operator").
1.2 This Policy was developed in conformity with clause 2, part 1 of article 18.1 of the Federal Law of July 27, 2006 No.152-FL "Of personal data" (hereinafter referred to as FL "Of personal data").
1.3 This Policy contains data to be disclosed in compliance with part 1 of article 14 of the Federal Law "Of personal data", and is a publicly available document.
2. Information about the Operator
2.1. The Operator performs its activity at the following address: Harju maakond, Tallinn, Lasnamäe linnaosa, Pikri tn 8-78, Estonia, 13624.
3. Information about Personal Data Processing
3.1. The Operator shall process personal data on a lawful and equitable basis, in order to fulfil its functions, powers, and obligations entrusted to it by law, as well as to exercise the rights and lawful interests of the Operator, Operator's employees, or third parties.
3.2. The Operator shall receive personal data directly from the personal data subjects (hereinafter referred to as PersData).
3.3. The Operator shall process personal data by automated or non-automated means, with or without the use of computer equipment.
3.4. The actions for processing of personal data include collection, recording, systematization, accumulation, storage, rectification (update, modification), extraction, use, transfer (distribution, granting, access), anonymization, blocking, deleting, and elimination.
4. Customers' Personal Data Processing
4.1. The Operator shall process the Customers' personal data within the limits of its legal relationship with the Operator regulated by part two of the Civil Code of the Russian Federation of January 26, 1996, and article 14 of the FL Of personal data (hereinafter referred to as Customers).
4.2. The Operator shall process the Customers' personal data within the frame of compliance with the legislation of the Russian Federation, as well as with the purpose of:
Accepting requests and claims from the PersData subject;
Informing about the new goods, services, special promotions or offers;
Concluding a contract and fulfilling its terms and conditions;
Sending an electronic receipt (form of strict accounting) in a digital form.
4.3. The Operator shall process the Customers' personal data upon their consent given by the customers and/or their legal representatives and evidenced by course of conduct at the present website, including, but not limited to, making an order, signing in to My account, subscribing to the mailing list, acting in compliance with the present Policy.
4.4. The Operator shall process the Customers' personal data no longer than required by the purposes of personal data processing, except if otherwise provided by requirements of the legislation of the Russian Federation.
4.5. The Operator can process the following Customers' personal data:
Last name, first name, patronymic;
4.6. The following specific categories of personal data shall not be processed:
Data relating to ethnicity or nationality;
Political opinions, religious or philosophical beliefs or views;
Health and personal life.
5. Information about personal data safety and security arrangements
5.1. When processing personal data, the Operator shall make all necessary lawful, organizational, or technical arrangements or shall have them taken in order to protect personal data from unlawful or accidental access to them, as well as from elimination, modification, blocking, copying, provision, or distribution of personal data, as well as from other unlawful actions related with the personal data.
5.2. The safety and security arrangements for processing of personal data taken by the Operator are to be planned and implemented in order to provide compliance with the requirements of article 19 of the FL On personal data.
5.3. In compliance with article 18.1 of the FL Of personal data, the Operator shall independently determine the contents and list of arrangements necessary and appropriate to comply with requirements of the legislation. In particular, the following arrangements were made by the Operator:
Assignment of a person responsible for organization of PersData processing;
Development and implementation of local standards relating to issues of PersData processing, as well as of local standards establishing procedures aimed at prevention and detection of violations of the procedures established for PersData processing and at elimination of consequences of such violations;
Application of lawful, organizational and technical measures for provision of PersData safety and security in compliance with article 19 of the FL Of personal data;
Internal control of compliance of the PersData processing with the FL Of personal data and regulatory legal acts, requirements to PersData protection, Operator's policy relating to the PersData processing, and local standards of the Operator approved in conformity with the said FL;
Assessment of damage that can be done to the personal data subjects in case of violation of the FL Of personal data, of compliance of the said damage to the measures taken by the Operator and aimed at fulfilment of obligations foreseen by the FL Of personal data;
Familiarization of the Operator's employees directly involved in PersData processing with provisions of the legislation of the Russian Federation relating to the PersData, including requirements of the PersData protection, documents determining the Operator's policy as to the PersData processing, and local standards relating to the PersData processing issues.
5.4. In addition to requirements of the FL Of personal data, the Operator also implements a range of measures aimed at protection of information about the customers, employees, and contractors.
6. Rights of the personal data subjects
6.1. A personal data subject has the right to:
Receive personal data relating to the subject and information about the processing thereof;
Rectify, block, or eliminate its personal data in case it is uncomplete, outdated, unprecise, unlawfully obtained or not necessary for the announced purposes of processing;
Revoke its consent for processing of personal data;
Expect protection of its rights and lawful interests, including indemnification and compensation of moral injury through the courts;
Appeal against actions or absence of action of the Operator at an authorized body responsible for protection of rights of the personal data subjects or through the courts.
6.2. In order to exercise their rights or lawful interests, the personal data subjects have the right to address the Operator in person or through their representative, in the order of submission of a written request. Such request must include information listed in part 3 of article 14 of the FL Of personal data and can be sent in a digital form to email@example.com.
7. Details of the Operator
White Widow OÜ
Address: Harju maakond, Tallinn, Lasnamäe linnaosa, Pikri tn 8-78, Estonia, 13624