Policy on Personal Data Processing
1. General Provisions
This personal data processing policy is prepared in accordance with the requirements of Federal Law No. 152-FZ of July 27, 2006, 'On Personal Data' (hereinafter referred to as the 'Personal Data Law') and defines the procedure for processing personal data and measures to ensure the security of personal data taken by Data Under Control Technologies (hereinafter referred to as the 'Operator').
1.1. The Operator sets compliance with the rights and freedoms of man and citizen when processing his personal data, including protecting the rights to privacy, personal and family secrets, as its most important goal and condition for carrying out its activities.
1.2. This Policy of the Operator regarding the processing of personal data (hereinafter referred to as the 'Policy') applies to all information that the Operator may receive about visitors to the website https://duc-technologies.ru.
2. Basic terms used in the Policy
2.1. Automated processing of personal data - processing of personal data using computer technology.
2.2. Blocking of personal data - temporary suspension of the processing of personal data (except for cases where processing is necessary to clarify personal data).
2.3. Website - a set of graphic and information materials, as well as computer programs for electronic computing machines and databases providing their availability on the Internet at the network address https://duc-technologies.ru.
2.4. Information system of personal data - a set of personal data contained in databases and providing their processing of information technologies and technical means.
2.5. Depersonalization of personal data - actions that make it impossible to determine, without the use of additional information, the belonging of personal data to a specific User or other subject of personal data.
2.6. Processing of personal data - any action (operation) or a set of actions (operations) performed with personal data using automation tools or without using such tools, including collection, recording, systematization, accumulation, storage, refinement (update, change), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.
2.7. Operator - a state body, municipal body, legal entity or individual, independently or jointly with other persons, organizing and (or) processing personal data, as well as determining the purposes of processing personal data, the composition of personal data to be processed, actions (operations) performed with personal data.
2.8. Personal data - any information directly or indirectly related to a specific or identifiable User of the website https://duc-technologies.ru.
2.9. Personal data allowed for distribution by the subject of personal data - personal data, access of an unlimited number of persons to which is provided by the subject of personal data by giving consent to the processing of personal data allowed for distribution in accordance with the procedure provided for by the Personal Data Law (hereinafter - personal data allowed for distribution).
2.10. User - any visitor to the website https://duc-technologies.ru.
2.11. Provision of personal data - actions aimed at disclosing personal data to a specific person or a certain circle of persons.
2.12. Distribution of personal data - any actions aimed at disclosing personal data to an indefinite circle of persons (transfer of personal data) or at acquainting personal data with an unlimited number of persons, including the disclosure of personal data in the media, placing in information and telecommunication networks or providing access to personal data in any other way.
2.13. Cross-border transfer of personal data - the transfer of personal data to the territory of a foreign state to the authority of a foreign state, to a foreign individual or to a foreign legal entity.
2.14. Destruction of personal data - any actions that result in the destruction of personal data with the impossibility of further restoring the content of personal data in the information system of personal data and (or) the destruction of material carriers of personal data.
3. Basic Rights and Obligations of the Operator
3.1. The Operator has the right to:
- receive from the data subject accurate information and/or documents containing personal data;
- in case of withdrawal of consent by the data subject to the processing of personal data, the Operator has the right to continue processing personal data without the consent of the data subject if there are grounds specified in the Personal Data Law;
- independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of the obligations provided for by the Personal Data Law and adopted in accordance with it, unless otherwise provided by the Personal Data Law or other federal laws.
3.2. The Operator is obliged to:
- provide the data subject, at his request, with information regarding the processing of his personal data;
- organize the processing of personal data in the manner established by the current legislation of the Russian Federation;
- respond to requests and inquiries of data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
- provide the necessary information to the authorized body for the protection of the rights of data subjects at the request of this authority within 30 days from the date of receipt of such request;
- publish or otherwise ensure unlimited access to this Policy regarding the processing of personal data;
- take legal, organizational, and technical measures to protect personal data from unauthorized or accidental access to them, destruction, alteration, blocking, copying, provision, dissemination of personal data, as well as from other unlawful actions with respect to personal data;
- terminate the transfer (distribution, provision, access) of personal data, terminate the processing and destroy personal data in the manner and cases provided for by the Personal Data Law;
- perform other obligations provided for by the Personal Data Law.
4. Basic Rights and Obligations of Data Subjects
4.1. Data subjects have the right to:
- receive information about the processing of their personal data, except for cases provided for by federal laws. Information is provided to the data subject by the Operator in an accessible form and should not contain personal data related to other data subjects, except in cases where there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Personal Data Law;
- demand from the Operator the clarification of his personal data, their blocking, or destruction in case personal data are incomplete, outdated, inaccurate, illegally obtained, or not necessary for the stated purpose of processing, as well as take measures provided for by law to protect their rights;
- impose a preliminary consent condition when processing personal data for marketing purposes;
- withdraw their consent to the processing of personal data;
- appeal to the authorized body for the protection of the rights of data subjects or in court in case of unlawful actions or inaction of the Operator when processing his personal data;
- exercise other rights provided by the legislation of the Russian Federation.
4.2. Data subjects are obliged to:
- provide the Operator with accurate information about themselves;
- inform the Operator about the clarification (updating, changing) of their personal data.
4.3. Individuals who have provided the Operator with false information about themselves, or information about another data subject without the latter's consent, shall be liable in accordance with the legislation of the Russian Federation.
5. The Operator may process the following User's personal data
5.1. Surname, first name, patronymic.
5.2. Email address.
5.3. Phone numbers.
5.4. The website also collects and processes de-identified data about visitors (including "cookie" files) using Internet statistics services (Yandex Metrics and Google Analytics, among others).
5.5. The above-listed data is further referred to as Personal Data in this Policy.
5.6. The Operator does not process special categories of personal data related to racial or ethnic origin, political opinions, religious or philosophical beliefs, intimate life.
5.7. Processing of personal data allowed for distribution from the special categories of personal data specified in part 1 of Article 10 of the Personal Data Law is allowed if the prohibitions and conditions provided for in Article 10.1 of the Personal Data Law are observed.
5.8. The User's consent to the processing of personal data allowed for distribution is separately formalized from other consents to the processing of his personal data. At the same time, the conditions provided, in particular, in Article 10.1 of the Personal Data Law are observed. The requirements for the content of such consent are established by the authorized body for the protection of the rights of data subjects.
5.8.1. The consent to the processing of personal data allowed for distribution is provided by the User directly to the Operator.
5.8.2. The Operator is obliged, within a period not exceeding three working days from the date of receipt of such consent from the User, to publish information about the conditions for processing, the presence of prohibitions and conditions on the processing of personal data allowed for distribution by an unlimited circle of persons.
5.8.3. The transfer (distribution, provision, access) of personal data allowed for distribution must be terminated at any time at the request of the data subject. This requirement must include the surname, name, patronymic (if any), contact information (telephone number, email address, or mailing address) of the data subject, as well as a list of personal data, the processing of which is subject to termination. The specified personal data included in this requirement can only be processed by the Operator to whom it is addressed.
5.8.4. The consent to the processing of personal data allowed for distribution ceases to be valid from the moment the Operator receives the requirement specified in clause 5.8.3 of this Policy regarding the processing of personal data.
6. Principles of Personal Data Processing
6.1. Personal data processing is carried out on a legal and fair basis.
6.2. The processing of personal data is limited to the achievement of specific, predetermined, and lawful goals. Processing of personal data that is incompatible with the purposes of personal data collection is not allowed.
6.3. The combination of databases containing personal data, the processing of which is carried out for purposes that are incompatible with each other, is not allowed.
6.4. Only personal data that meets the purposes of their processing are subject to processing.
6.5. The content and volume of processed personal data correspond to the stated purposes of processing. Excessiveness of processed personal data in relation to the stated purposes of their processing is not allowed.
6.6. When processing personal data, their accuracy, sufficiency, and, if necessary, relevance in relation to the purposes of processing personal data are ensured. The Operator takes necessary measures and/or ensures their adoption to delete or clarify incomplete or inaccurate data.
6.7. Personal data shall be stored in a form that allows identifying the data subject, no longer than the purposes of personal data processing require, unless otherwise provided by federal law, the contract, the party to which, the beneficiary, or the guarantor under which is the data subject. Processed personal data are destroyed or depersonalized upon reaching the goals of processing or in case of loss of the need to achieve these goals, unless otherwise provided by federal law.
7. Purposes of Processing Personal Data
7.1. The purpose of processing User's personal data is as follows:
- informing the User by sending email messages;
- conclusion, execution, and termination of civil contracts;
- providing access to the User to services, information, and/or materials contained on the website https://duc-technologies.ru.
7.2. The Operator also has the right to send notifications to the User about new products and services, special offers, and various events. The User can always refuse to receive informational messages by sending a letter to the Operator at the email address ductechnologies@yandex.ru with the note "Refusal to receive notifications about new products and services and special offers."
7.3. De-identified data of Users collected using Internet statistics services is used to collect information about Users' actions on the website, improve the quality of the website and its content.
8. Legal Basis for Personal Data Processing
8.1. The legal basis for the processing of personal data by the Operator are:
- Federal Law "On Information, Information Technologies and Information Protection" dated July 27, 2006 N 149-ФЗ;
- Other regulatory legal acts in the field of personal data protection;
- The charter documents of the Operator;
- contracts concluded between the Operator and the data subject;
- consent of Users to the processing of their personal data, for the processing of personal data allowed for distribution.
9. Conditions for Personal Data Processing
9.1. Personal data processing is carried out with the consent of the data subject to the processing of their personal data.
9.2. Personal data processing is necessary to achieve the purposes provided for by an international treaty of the Russian Federation or by law, to perform the functions, powers, and duties imposed by the legislation of the Russian Federation on the Operator.
9.3. Personal data processing is necessary to administer justice, execute a judicial act, an act of another body, or an official, the performance of which is subject to enforcement in accordance with the legislation of the Russian Federation on enforcement proceedings.
9.4. Personal data processing is necessary to fulfill a contract, under which the data subject is either a party, or a beneficiary, or a surety.
9.5. Personal data processing is necessary to protect the rights and lawful interests of the Operator or third parties, or to achieve socially significant goals, provided that this does not violate the rights and freedoms of the data subject.
9.6. Personal data that is publicly available is processed, with unlimited access to which is provided by the data subject or at his request (hereinafter - publicly available personal data).
9.7. Personal data subject to publication or mandatory disclosure in accordance with federal law is processed.
10. Procedure for Collecting, Storing, Transmitting, and Other Types of Processing of Personal Data
The security of personal data processed by the Operator is ensured by implementing legal, organizational, and technical measures necessary to fully comply with the requirements of current legislation in the field of personal data protection.
10.1. The Operator ensures the safety of personal data and takes all possible measures to prevent unauthorized access to personal data.
10.2. The User's personal data will never, under any circumstances, be transferred to third parties, except for cases related to the execution of current legislation or if the data subject has given consent to the Operator to transfer data to a third party for the performance of obligations under a civil contract.
10.3. In case of inaccuracies in personal data, the User can update them independently by sending a notification to the Operator at the email address ductechnologies@yandex.ru with the note 'Updating personal data.'
10.4. The processing period for personal data is determined by the achievement of the purposes for which personal data were collected, unless another period is provided by a contract or applicable law. The User may withdraw their consent to the processing of personal data at any time by sending a notification to the Operator via email to the Operator's email address ductechnologies@yandex.ru with the note 'Withdrawal of consent to the processing of personal data.'
10.5. All information collected by third-party services, including payment systems, communication tools, and other service providers, is stored and processed by these entities (Operators) in accordance with their User Agreements and Privacy Policies. The data subject and/or User must independently familiarize themselves with these documents in a timely manner. The Operator is not responsible for the actions of third parties, including service providers mentioned in this paragraph.
10.6. Restrictions imposed by the data subject on the transfer (except for providing access), as well as on the processing or conditions of processing (except for obtaining access) of personal data allowed for distribution, do not apply when processing personal data in the interests of the state, public, and other legally significant interests determined by the legislation of the Russian Federation.
10.7. When processing personal data, the Operator ensures the confidentiality of personal data.
10.8. The Operator stores personal data in a form that allows identifying the data subject for no longer than the purposes for which personal data were processed, unless otherwise provided by federal law, a contract, where the data subject is a party, beneficiary, or surety.
10.9. The termination of personal data processing may be the achievement of the processing purposes, expiration of the consent given by the data subject to process their personal data, or the identification of the unlawful processing of personal data.
11. List of Actions Performed by the Operator with Obtained Personal Data
11.1. The Operator carries out collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transmission (distribution, provision, access), de-identification, blocking, deletion, and destruction of personal data.
11.2. The Operator carries out automated processing of personal data with the receipt and/or transmission of information obtained via information and telecommunications networks or without such networks.
12. Cross-Border Transfer of Personal Data
12.1. Before starting cross-border transfer of personal data, the Operator must ensure that a foreign country, to the territory of which the transfer of personal data is supposed to be carried out, provides reliable protection of the rights of data subjects.
12.2. Cross-border transfer of personal data to the territory of foreign states that do not meet the above requirements can only be carried out with the written consent of the data subject to the cross-border transfer of their personal data and/or the performance of a contract where the data subject is a party.
13. Confidentiality of Personal Data
The Operator and other persons who have access to personal data are obliged not to disclose personal data to third parties or distribute personal data without the consent of the data subject, unless otherwise required by federal law.
14. Final Provisions
14.1. The User can obtain any clarifications on issues related to the processing of their personal data by contacting the Operator via email at ductechnologies@yandex.ru.
14.2. Any changes to the policy of personal data processing by the Operator will be reflected in this document. The policy is valid indefinitely until replaced by a new version.
14.3. The current version of the Policy is publicly available on the Internet at https://duc-technologies.ru.