Personal Data Processing Policy
1. General Provisions
This Personal Data Processing Policy is established in compliance with the requirements of Federal Law No. 152-FZ of July 27, 2006, “On Personal Data” (hereinafter referred to as the “Personal Data Law”) and defines the procedure for processing personal data and the measures undertaken by
Horns & Hooves (hereinafter referred to as the “Operator”) to ensure the security of personal data.
1.1. The Operator’s primary objective and a fundamental condition for carrying out its activities is to respect and protect the rights and freedoms of individuals and citizens in the course of processing their personal data, including safeguarding the right to privacy, personal and family confidentiality.
1.2. This Operator’s Personal Data Processing Policy (hereinafter referred to as the “Policy”) applies to all information that the Operator may obtain about visitors to the website https://example.com.
2. Key Terms Used in the Policy
2.1. Automated Personal Data Processing – processing personal data by means of computing equipment.
2.2. Blocking of Personal Data – temporary suspension of personal data processing (except in cases where processing is necessary to clarify personal data).
2.3. Website – a collection of graphic and informational materials, computer programs, and databases that ensure accessibility via the internet at the network address https://example.com.
2.4. Personal Data Information System – a set of personal data contained in databases, along with the information technologies and technical means used to process such data.
2.5. Anonymization of Personal Data – actions rendering it impossible to attribute personal data to a specific User or other data subject without the use of additional information.
2.6. Processing of Personal Data – any action (operation) or set of actions (operations) performed with or without automated means relating to personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, usage, transmission (dissemination, provision, access), anonymization, blocking, deletion, or destruction of personal data.
2.7. Operator – a state authority, municipal body, legal entity, or natural person that independently or jointly with others organizes and/or carries out personal data processing, and determines the purposes of processing, the scope of personal data to be processed, and the actions (operations) performed with such data.
2.8. Personal Data – any information relating directly or indirectly to a specific or identifiable User of the website https://example.com.
2.9. Personal Data Authorized by the Data Subject for Dissemination – personal data for which the data subject has granted consent to unrestricted third-party access by providing consent to the processing of such data in the manner prescribed by the Personal Data Law (hereinafter referred to as “personal data authorized for dissemination”).
2.10. User – any visitor to the website https://example.com.
2.11. Provision of Personal Data – actions aimed at disclosing personal data to a specific person or a defined group of persons.
2.12. Dissemination of Personal Data – any actions aimed at disclosing personal data to an undefined group of persons (data transmission) or making such data accessible to an unlimited audience, including publication in mass media, placement in information and telecommunication networks, or provision of access by any other means.
2.13. Cross-Border Transfer of Personal Data – transmission of personal data to the territory of a foreign state to a foreign government authority, foreign individual, or foreign legal entity.
2.14. Destruction of Personal Data – any actions resulting in the irreversible elimination of personal data, rendering restoration impossible within the personal data information system and/or the physical destruction of the data storage media.
3. Principal Rights and Obligations of the Operator
3.1. The Operator is entitled to:
– Obtain accurate information and/or documents containing personal data from the data subject;
– Continue processing personal data without the data subject’s consent if the data subject withdraws consent or submits a request to cease processing, provided grounds exist for such processing as stipulated in the Personal Data Law;
– Independently determine the scope and list of measures necessary and sufficient to fulfill obligations under the Personal Data Law and related regulatory legal acts, unless otherwise specified by the Personal Data Law or other federal laws.
3.2. The Operator is obligated to:
– Provide the data subject, upon request, with information concerning the processing of their personal data;
– Organize personal data processing in accordance with applicable Russian Federation legislation;
– Respond to inquiries and requests from data subjects and their legal representatives in accordance with the Personal Data Law;
– Provide the authorized body for the protection of data subjects’ rights, upon its request, with the required information within ten (10) days of receiving such request;
– Publish or otherwise ensure unrestricted public access to this Personal Data Processing Policy;
– Implement legal, organizational, and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination, or any other unlawful actions;
– Cease transmission (dissemination, provision, access), terminate processing, and destroy personal data in the manner and cases prescribed by the Personal Data Law;
– Fulfill any other obligations stipulated by the Personal Data Law.
4. Principal Rights and Obligations of Data Subjects
4.1. Data subjects are entitled to:
– Obtain information regarding the processing of their personal data, except in cases provided by federal laws. The information shall be provided by the Operator in an accessible form and shall not include personal data relating to other data subjects, unless legal grounds exist for such disclosure. The list of information to be provided and the procedure for obtaining it are established by the Personal Data Law;
– Demand from the Operator the correction, blocking, or destruction of personal data if such data are incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated processing purpose, and to take lawful measures to protect their rights;
– Require prior consent for processing personal data for direct marketing purposes (promotion of goods, works, or services);
– Withdraw consent to personal data processing and/or submit a request to discontinue processing;
– File a complaint with the authorized body for the protection of data subjects’ rights or seek judicial recourse against unlawful actions or omissions by the Operator in processing their personal data;
– Exercise any other rights granted under Russian Federation legislation.
4.2. Data subjects are obligated to:
– Provide the Operator with accurate information about themselves;
– Notify the Operator of any corrections (updates or changes) to their personal data.
4.3. Individuals who provide the Operator with inaccurate information about themselves or disclose another data subject’s personal data without their consent shall bear liability in accordance with Russian Federation legislation.
5. Principles of Personal Data Processing
5.1. Personal data processing shall be lawful and fair.
5.2. Personal data processing shall be limited to specific, predetermined, and lawful purposes. Processing incompatible with the purposes for which personal data were collected is prohibited.
5.3. Merging databases containing personal data processed for incompatible purposes is prohibited.
5.4. Only personal data relevant to the processing purposes may be processed.
5.5. The content and volume of processed personal data shall correspond to the stated processing purposes. Excessive personal data processing relative to the stated purposes is prohibited.
5.6. The Operator shall ensure the accuracy, sufficiency, and, where necessary, the relevance of personal data in relation to the processing purposes. The Operator shall take necessary measures, or ensure such measures are taken, to delete or correct incomplete or inaccurate data.
5.7. Personal data shall be stored in a form that permits identification of the data subject only for as long as necessary to achieve the processing purposes, unless a longer retention period is established by federal law, or by a contract to which the data subject is a party, beneficiary, or guarantor. Processed personal data shall be destroyed or anonymized upon achievement of the processing purposes or if such purposes are no longer relevant, unless otherwise provided by federal law.
6. Purposes of Personal Data Processing
|
Processing Purpose |
Conclusion, performance, and termination of civil law contracts |
|---|---|
|
Personal Data |
Full name (first name, patronymic, last name) |
|
Legal Basis |
Contracts concluded between the Operator and the data subject |
|
Types of Processing |
Collection, recording, systematization, accumulation, storage, destruction, and anonymization of personal data; |
7. Conditions for Personal Data Processing
7.1. Personal data processing is carried out with the data subject’s consent to the processing of their personal data.
7.2. Personal data processing is necessary to fulfill objectives stipulated by an international treaty of the Russian Federation or by law, or to perform functions, powers, and duties assigned to the Operator by Russian Federation legislation.
7.3. Personal data processing is necessary for the administration of justice, enforcement of a court ruling, or execution of decisions by other authorized bodies or officials as required under Russian enforcement legislation.
7.4. Personal data processing is necessary for the performance of a contract to which the data subject is a party, beneficiary, or guarantor, or for concluding a contract at the data subject’s initiative or under which the data subject will be a beneficiary or guarantor.
7.5. Personal data processing is necessary to protect the legitimate rights and interests of the Operator or third parties, or to achieve publicly significant objectives, provided such processing does not infringe upon the rights and freedoms of the data subject.
7.6. Processing concerns personal data the data subject has made publicly available or requested to be made publicly available (hereinafter referred to as “publicly available personal data”).
7.7. Processing concerns personal data required to be published or disclosed pursuant to federal law.
8. Procedure for Collection, Storage, Transmission, and Other Forms of Personal Data Processing
The security of personal data processed by the Operator is ensured through legal, organizational, and technical measures necessary to fully comply with current personal data protection legislation.
8.1. The Operator ensures the confidentiality of personal data and takes all feasible measures to prevent unauthorized access by third parties.
8.2. The User’s personal data shall never be disclosed to third parties under any circumstances, except where required by applicable law or where the data subject has expressly consented to such disclosure for the purpose of fulfilling obligations under a civil law contract.
8.3. If inaccuracies are identified in personal data, the User may update such data independently by sending a notification to the Operator’s email address itishkin@example.com with the subject line “Personal Data Update.”
8.4. The duration of personal data processing shall be determined by the purposes for which the data were collected, unless otherwise stipulated by contract or applicable law.
The User may withdraw consent to personal data processing at any time by sending a notice to the Operator’s email address itishkin@example.com with the subject line “Withdrawal of Consent to Personal Data Processing.”
8.5. All information collected by third-party services—including payment systems, communication platforms, and other service providers—is stored and processed by such entities (Operators) in accordance with their own User Agreements and Privacy Policies. The data subject is deemed to have reviewed and agreed to such documents. The Operator bears no responsibility for the actions of such third parties, including the service providers mentioned herein.
8.6. Restrictions imposed by the data subject on the transfer (except for granting access), processing, or processing conditions (except for access granting) of personal data authorized for dissemination shall not apply when processing is carried out in state, public, or other legally recognized public interests as defined by Russian Federation legislation.
8.7. The Operator ensures the confidentiality of personal data during processing.
8.8. The Operator shall retain personal data in an identifiable form only for as long as necessary to achieve the processing purposes, unless a longer retention period is established by federal law or by a contract to which the data subject is a party, beneficiary, or guarantor.
8.9. Grounds for terminating personal data processing include: achievement of processing purposes; expiration of the data subject’s consent period; withdrawal of consent or submission of a request to cease processing; or identification of unlawful processing.
9. List of Actions Performed by the Operator on Personal Data
9.1. The Operator performs the following actions with personal data: collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, usage, transmission (dissemination, provision, access), anonymization, blocking, deletion,
and destruction.
9.2. The Operator carries out automated personal data processing, with or without the use of information and telecommunication networks for receipt and/or transmission of information.
10. Cross-Border Transfer of Personal Data
10.1. Prior to initiating cross-border personal data transfers, the Operator must notify the authorized body for the protection of data subjects’ rights of its intention to carry out such transfers (this notification is submitted separately from the notification of intent to
process personal data).
10.2. Before submitting the aforementioned notification, the Operator must obtain relevant assurances from the foreign government authorities, foreign individuals, or foreign legal entities to which the personal data will be transferred.
11. Confidentiality of Personal Data
The Operator and any other parties granted access to personal data are obligated not to disclose or disseminate such data to third parties without the data subject’s consent, unless otherwise required by federal law.
12. Final Provisions
12.1. The User may obtain clarifications on any questions concerning the processing of their personal data by contacting the Operator via email at itishkin@example.com.
12.2. This document will reflect any amendments to the Operator’s personal data processing policy. The Policy remains in effect indefinitely until superseded by a new version.
12.3. The current version of the Policy is publicly accessible on the internet at https://example.com/privacy.