PRIVACY POLICY

1. General Provisions

This policy on the processing of personal data is formulated in accordance with the requirements of Federal Law No. 152-FZ "On Personal Data" dated July 27, 2006 (hereinafter referred to as the Personal Data Law) and outlines the procedures for handling personal data and the security measures taken by LLC "KHANEDAN LUKUM" (hereinafter referred to as the Operator).
1.1. The Operator sets as its paramount objective and condition for carrying out its activities the observance of the rights and freedoms of individuals when processing their personal data, including safeguarding the rights to privacy, personal, and family secrecy.
1.2. This Operator's policy on the processing of personal data (hereinafter referred to as the Policy) applies to all information that the Operator may obtain about visitors to the website https://hanedanlukum.ru.

2.Key Definitions Used in the Policy
2.1. Automated Processing of Personal Data: The handling of personal data using computer technology.
2.2. Blocking of Personal Data: The temporary suspension of personal data processing (except in cases where processing is necessary for data clarification).
2.3. Website: The collection of graphic and informational materials, as well as computer programs and databases that make them accessible on the internet at the web address https://hanedanlukum.ru.
2.4. Information System of Personal Data: The aggregate of databases containing personal data and providing their processing through information technologies and technical means.
2.5. De-Identification of Personal Data: Actions that make it impossible, without the use of additional information, to determine the association of personal data with a specific User or another subject of personal data.
2.6. Processing of Personal Data: Any action (operation) or a set of actions (operations) carried out with personal data, whether automated or not, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transmission (distribution, provision, access), de-identification, blocking, erasure, or destruction of personal data.
2.7. Operator: A government agency, municipal authority, legal entity, or individual, either independently or jointly with others, who organizes and/or conducts personal data processing and determines the purposes of personal data processing, the composition of personal data subject to processing, and the actions (operations) performed with personal data.
2.8. Personal Data: Any information directly or indirectly related to a specific or identifiable User of the website https://hanedanlukum.ru.
2.9. Personal Data Permitted for Distribution by the Data Subject: Personal data to which an unlimited number of individuals have access, as authorized by the data subject through consent for the processing of personal data, in accordance with the Personal Data Law (hereinafter referred to as personal data permitted for distribution).

2.Basic Rights and Obligations of the Operator:
2.10. User: Any visitor to the website https://hanedanlukum.ru.
2.11. Provision of Personal Data: Actions aimed at disclosing personal data to a specific individual or a specific group of individuals.
2.12. Distribution of Personal Data: Any actions aimed at disclosing personal data to an undefined group of individuals (personal data transmission) or making personal data accessible to an unlimited group of individuals, including the publication of personal data in mass media, posting in information and telecommunication networks, or providing access to personal data by any other means.
2.13. Cross-border Transfer of Personal Data: The transfer of personal data to the territory of a foreign state to the authority of a foreign state, a foreign individual, or a foreign legal entity.
2.14. Destruction of Personal Data: Any actions resulting in the irrevocable destruction of personal data with no possibility of further recovery of the content of personal data in the information system of personal data and/or the destruction of material carriers of personal data.


3.Basic Rights and Obligations of the Operator
3.1. The Operator has the right to:

• Obtain from the data subject accurate information and/or documents containing personal data.
• In the event of the data subject's withdrawal of consent for the processing of personal data, the Operator may continue processing personal data without the data subject's consent if there are legal grounds specified in the Personal Data Law.
• Independently determine the scope and list of measures necessary and sufficient to ensure the fulfillment of obligations as stipulated by the Personal Data Law and regulatory legal acts adopted in accordance with it, unless otherwise provided by the Personal Data Law or other federal laws.

3.2. The Operator is obligated to:

• Provide the data subject with information regarding the processing of their personal data upon the subject's request.
• Organize the processing of personal data in accordance with the current legislation of the Russian Federation.
• Respond to requests and inquiries from data subjects and their legal representatives in accordance with the requirements of the Personal Data Law.
• Provide the necessary information to the authorized authority for the protection of the rights of data subjects upon the request of this authority within 30 days from the date of receiving such a request.
• Publish or otherwise provide unrestricted access to this Policy on the processing of personal data.
• Implement legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, alteration, blocking, copying, provision, and distribution of personal data, as well as other unlawful actions in relation to personal data.
• Cease the transmission (distribution, provision, access) of personal data, terminate the processing, and destroy personal data in accordance with the procedures and cases stipulated by the Personal Data Law.
• Fulfill other obligations as provided by the Personal Data Law.

4.Basic Rights and Obligations of Data Subjects
4.1. Data subjects have the right to:

• Receive information about the processing of their personal data, with the exception of cases provided by federal laws. The information is provided to the data subject by the Operator in an accessible form and should not contain personal data related to other data subjects, except in cases where there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Personal Data Law.
• Demand that the Operator clarifies their personal data, blocks or destroys it if their personal data is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated purpose of processing, and take the legal measures provided by law to protect their rights.
• Imposing a precondition of obtaining their prior consent for the processing of personal data for the purpose of promoting goods, works, and services on the market.
• Withdraw their consent to the processing of personal data.
• Challenge the unlawful actions or omissions of the Operator in the processing of their personal data through the authorized authority for the protection of the rights of data subjects or in court.
• Exercise other rights provided by the legislation of the Russian Federation.

4.2. Data subjects are obliged to:

• Provide accurate information about themselves to the Operator.
• Inform the Operator about the clarification (update, change) of their personal data.

4.3. Individuals who provide the Operator with false information about themselves or information about another data subject without their consent shall be held liable in accordance with the legislation of the Russian Federation.


5.Operator may process the following User's personal data:
5.1. Surname, name, patronymic.
5.2. Email address.
5.3. Phone numbers.
5.4. Year, month, date, and place of birth.
5.5. Identity document details.
5.6. Address information.
5.7. The website also collects and processes anonymized data about visitors (including "cookie" files) using internet analytics services (Yandex.Metrica, Google Analytics, and others).
5.8. The aforementioned data, as referred to in this Policy, are collectively referred to as "Personal Data."
5.9. The processing of special categories of personal data concerning race, nationality, political views, religious or philosophical beliefs, intimate life is not carried out by the Operator.
5.10. The processing of personal data allowed for distribution, which includes special categories of personal data specified in Article 10.1 of the Personal Data Law, is permissible provided that the prohibitions and conditions set forth in Article 10.1 of the Personal Data Law are observed.
5.11. The User's consent for the processing of personal data allowed for distribution is documented separately from other consents for the processing of their personal data. The conditions provided for in Article 10.1 of the Personal Data Law, among other things, are observed. Requirements for the content of such consent are established by the authorized authority for the protection of the rights of data subjects.
5.11.1. The User provides consent for the processing of personal data allowed for distribution directly to the Operator.
5.11.2. Within a period not exceeding three business days from the moment of receiving the User's consent, the Operator must publish information about the terms of processing, the presence of prohibitions and conditions on the processing of personal data allowed for distribution.
5.11.3. The transfer (distribution, provision, access) of personal data allowed by the data subject for distribution must be terminated at any time upon the data subject's request. This request must include the data subject's full name, first name, patronymic (if any), contact information (phone number, email address, or mailing address), and a list of personal data, the processing of which is to be terminated. The personal data specified in this request can only be processed by the Operator to whom it is addressed.
5.11.4. The consent for the processing of personal data allowed for distribution ceases to be in effect from the moment the Operator receives the request as specified in section 5.11.3 of this Policy regarding the processing of personal data.


6.Data Processing Principles
6.1. The processing of personal data is carried out on a legal and fair basis.
6.2. The processing of personal data is limited to the achievement of specific, predefined, and lawful purposes. Processing of personal data that is incompatible with the purposes of data collection is not allowed.
6.3. Combining databases containing personal data for processing purposes that are incompatible with each other is not allowed.
6.4. Only personal data that meets the purposes of their processing are subject to processing.
6.5. The content and volume of processed personal data correspond to the declared purposes of data processing. Redundancy of processed personal data concerning the stated purposes of their processing is not allowed.
6.6. When processing personal data, the accuracy, sufficiency, and, where necessary, the relevance of the personal data to the purposes of data processing are ensured. The Operator takes necessary measures and/or ensures that such measures are taken to delete or clarify incomplete or inaccurate data.
6.7. The storage of personal data is carried out in a form that allows the identification of the data subject for no longer than is required by the purposes of personal data processing, unless the data storage period is established by federal law, a contract, a party of which, the beneficiary or the guarantor of which is the data subject. Processed personal data is destroyed or anonymized upon reaching the purposes of processing or in case the need to achieve these purposes is lost, unless otherwise provided by federal law.

7.Purposes of Processing Personal Data
7.1. The purpose of processing User's personal data includes:

• Informing the User by sending emails;
• Entering into, executing, and terminating civil contracts;
• Providing the User with access to services, information, and/or materials contained on the website https://hanedanlukum.ru;
• Delivering ordered goods.

7.2. The Operator also has the right to send notifications to the User about new products and services, special offers, and various events. The User can always opt out of receiving informational messages by sending an email to the Operator at privacy@hanedanlukum.ru with the subject "Opting out of notifications about new products and services and special offers."
7.3. De-identified user data collected through internet statistics services are used to gather information about user actions on the site, improve the quality of the site, and its content.

1. Legal Bases for Processing Personal Data

8.1. The legal bases for processing personal data by the Operator include:

• List the regulatory legal acts that regulate relationships related to your activities. For example, if your activities are related to information technology, particularly the creation of websites, you can mention Federal Law "On Information, Information Technologies, and Information Protection" No. 149-FZ of July 27, 2006;
• The Operator's constituent documents;
• Contracts between the Operator and the data subject;
• Federal laws, other regulatory legal acts in the field of personal data protection;
• User consents to the processing of their personal data, including personal data permitted for distribution.

8.2. The Operator processes the User's personal data only if they are filled out and/or sent by the User voluntarily through special forms on the website https://hanedanlukum.ru or sent to the Operator via email. By filling out the respective forms and/or sending their personal data to the Operator, the User expresses their consent to this Policy.
8.3. The Operator processes de-identified data about the User if it is allowed in the User's browser settings (the storage of "cookie" files and the use of JavaScript technology are enabled).
8.4. The data subject voluntarily decides to provide their personal data and gives consent freely, by their own will, and in their own interest.


9.Conditions for Processing Personal Data
9.1. The processing of personal data is carried out with the consent of the data subject for the processing of their personal data.
9.2. The processing of personal data is necessary for the fulfillment of the purposes provided for by an international treaty of the Russian Federation or the law, for the exercise of functions, powers, and duties imposed by the legislation of the Russian Federation on the operator.
9.3. The processing of personal data is necessary for the administration of justice, the execution of a court decision, an act of another authority or official that must be executed in accordance with the legislation of the Russian Federation on enforcement proceedings.
9.4. The processing of personal data is necessary for the performance of a contract of which the data subject is a party or for entering into a contract at the initiative of the data subject or a contract under which the data subject will be a beneficiary or a guarantor.
9.5. The processing of personal data is necessary for the exercise of the rights and legitimate interests of the operator or third parties or for achieving socially significant purposes, provided that the rights and freedoms of the data subject are not violated.
9.6. Processing is carried out for personal data made publicly available by the data subject or upon their request (hereinafter referred to as publicly available personal data).
9.7. Processing is carried out for personal data that must be published or disclosed in accordance with federal law.


10.Procedure for Collecting, Storing, Transmitting, and Other Processing of Personal Data
The security of personal data processed by the Operator is ensured through the implementation of legal, organizational, and technical measures necessary to fully comply with the requirements of the current legislation in the field of personal data protection.
10.1. The Operator ensures the safety of personal data and takes all possible measures to prevent unauthorized access to personal data.
10.2. Personal data of the User will never, under any circumstances, be transferred to third parties, except in cases related to the fulfillment of the current legislation or if the data subject has given consent to the Operator to transfer the data to a third party for the performance of obligations under a civil law contract.
10.3. In case inaccuracies in personal data are discovered, the User may update them independently by notifying the Operator at the email address privacy@hanedanlukum.ru with the subject "Updating Personal Data."
10.4. The period of processing personal data is determined by the achievement of the purposes for which personal data was collected, unless a different period is specified in the contract or current legislation. The User may revoke their consent to the processing of personal data at any time by sending a notification to the Operator by email at privacy@hanedanlukum.ru with the subject "Withdrawal of Consent to Process Personal Data."
10.5. All information collected by third-party services, including payment systems, communication services, and other service providers, is stored and processed by these entities (Operators) in accordance with their User Agreement and Privacy Policy. The data subject and/or User are responsible for reviewing these documents in a timely manner. The Operator is not responsible for the actions of third parties, including the service providers mentioned in this section.
10.6. Prohibitions imposed by the data subject on the transfer (except for providing access), as well as on the processing or conditions of processing (except for obtaining access) of personal data permitted for distribution, do not apply in cases of processing personal data in the state's, public, and other public interests as determined by the legislation of the Russian Federation.
10.7. The Operator ensures the confidentiality of personal data during processing.
10.8. The Operator stores personal data in a form that allows the identification of the data subject for no longer than is necessary for the purposes of processing the personal data, unless the storage period of personal data is determined by federal law, a contract, or an agreement to which the data subject is a party.
10.9. The termination of personal data processing may occur when the purposes of processing personal data have been achieved, the consent of the data subject has expired, the data subject has withdrawn their consent, or when unlawful processing of personal data is discovered.

11.List of Actions Taken by the Operator with Obtained Personal Data
11.1. The Operator performs the collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transmission (distribution, provision, access), anonymization, blocking, deletion, and destruction of personal data.
11.2. The Operator carries out automated processing of personal data with the receipt and/or transfer of the obtained information through information and telecommunication networks or without them.

12.Cross-Border Transfer of Personal Data
12.1. Before commencing the cross-border transfer of personal data, the Operator must ensure that a foreign state to which the transfer of personal data is intended provides reliable protection of the rights of data subjects.
12.2. Cross-border transfer of personal data to the territories of foreign states that do not meet the above-mentioned requirements can be carried out only with the written consent of the data subject for the cross-border transfer of their personal data and/or the performance of a contract in which the data subject is a party.

13.Confidentiality of Personal Data
The Operator and other persons who have access to personal data are obliged not to disclose personal data to third parties and not to distribute personal data without the consent of the data subject, unless otherwise provided by federal law.

14.Final Provisions
14.1. The User can obtain any clarifications on matters related to the processing of their personal data by contacting the Operator via email at privacy@hanedanlukum.ru.
14.2. Any changes to the policy of processing personal data by the Operator will be reflected in this document. The policy is in effect indefinitely until it is replaced by a new version.
14.3. The current version of the Policy is freely available on the Internet at the address https://hanedanlukum.ru/privacy.