Personal data processing policy
Personal Data Processing Policy for visitors located in the Russian Federation.
Privacy statement
1. General provisions
This personal data processing policy has been drawn up in accordance with the requirements of the European Union’s General Data Protection Regulation (effective date: 25 May 2018) and local legislation (Federal Law No. 152-ФЗ of 27.07.2006 “On Personal Data”, hereinafter the “Personal Data Law”). It sets out the procedure for processing personal data and the measures taken by Cheleto LLC (hereinafter the “Operator”) to ensure the security of personal data. This personal data processing policy supplements the Privacy Statement, which is available at:www.cheleto.com/general-privacy/.
If there are any discrepancies between the Privacy Statement and this Personal Data Processing Policy, the Privacy Statement shall prevail.
1.1. The Operator’s foremost objective and a prerequisite for its activities is to respect human and civil rights and freedoms when processing personal data, including the protection of the rights to privacy and personal and family confidentiality.
1.2. This Personal Data Processing Policy of the Operator (hereinafter the Policy) applies to all information that the Operator may obtain about visitors to the websitewww.cheleto.com.
2. Key terms used in this Policy
2.1. Automated processing of personal data means the processing of personal data using computer equipment.
2.2. Blocking of personal data means the temporary suspension of personal data processing, except where processing is necessary to clarify the personal data.
2.3. Website means a collection of graphic and informational materials, computer programs and databases that make them available on the Internet at the web addresswww.cheleto.com.
2.4. Personal data information system means the personal data contained in databases together with the information technologies and technical resources used to process it.
2.5. De-identification of personal data means actions that make it impossible to determine, without additional information, whether personal data relates to a particular User or other data subject.
2.6. Personal data processing means any action (operation) or set of actions (operations) performed on personal data, with or without automated means, including collection, recording, systematisation, accumulation, storage, clarification (updating, alteration), retrieval, use, transfer (dissemination, provision, access), anonymisation, blocking, deletion and destruction.
2.7. Operator means a state authority, municipal authority, legal entity or individual that, independently or jointly with others, organises and/or carries out personal data processing and determines the purposes of processing, the personal data to be processed and the actions (operations) performed on personal data.
2.8. Personal data means any information relating directly or indirectly to an identified or identifiable User of the websitewww.cheleto.com.
2.9. Personal data authorised by the data subject for dissemination means personal data to which the data subject has granted access to an unlimited number of persons by consenting to the processing of personal data authorised for dissemination in accordance with the procedure established by the Personal Data Law (hereinafter personal data authorised for dissemination).
2.10. User means any visitor to the websitewww.cheleto.com.
2.11. Provision of personal data means actions intended to disclose personal data to a specific person or a defined group of persons.
2.12. Dissemination of personal data means any action intended to disclose personal data to an unspecified group of persons (transfer of personal data) or to make personal data available to an unlimited group of persons, including publishing personal data in the mass media, placing it on information and telecommunications networks or providing access to it by any other means.
2.13. Cross-border transfer of personal data means the transfer of personal data to the territory of a foreign state, to a public authority of that state or to a foreign individual or legal entity.
2.14. Destruction of personal data means any actions that irreversibly destroy personal data, making it impossible to subsequently restore its content in the personal data information system, and/or destroy physical media containing personal data.
3. Principal rights and obligations of the Operator
3.1. The Operator has the right to:
- obtain accurate information and/or documents containing personal data from the data subject;
- if a data subject withdraws consent to the processing of personal data, the Operator may continue to process it without that consent where grounds provided for in the Personal Data Law exist;
- independently determine the scope and list of measures necessary and sufficient to fulfil the obligations under the Personal Data Law and the regulations adopted pursuant to it, unless otherwise provided by the Personal Data Law or other federal laws.
- provide the data subject, on request, with information concerning the processing of their personal data;
- organise the processing of personal data in accordance with the applicable legislation of the Russian Federation;
- respond to enquiries and requests from data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
- provide the competent authority for the protection of data subjects’ rights with the information it requests within 30 days of receiving the request;
- publish or otherwise provide unrestricted access to this Personal Data Processing Policy;
- take legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision or dissemination, and against other unlawful actions involving personal data;
- cease the transfer (dissemination, provision, access) and processing of personal data, and destroy it, in the manner and circumstances provided for in the Personal Data Law;
- fulfil other obligations provided for by the Personal Data Law.
4.1. Data subjects have the right to:
- obtain information concerning the processing of their personal data, except in cases provided for by federal laws. The Operator shall provide this information to the data subject in an accessible form. It must not contain personal data relating to other data subjects, unless there are lawful grounds for disclosing such data. The list of information and the procedure for obtaining it are established by the Personal Data Law;
- require the Operator to rectify, block or destroy their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose of processing, and take the measures provided by law to protect their rights;
- require prior consent to the processing of personal data for the purpose of promoting goods, works and services on the market;
- withdraw consent to the processing of personal data;
- appeal to the authorised body for the protection of data subjects’ rights, or to a court, against unlawful acts or omissions by the Operator in processing their personal data;
- exercise other rights provided for by the legislation of the Russian Federation.
- provide the Operator with accurate information about themselves;
- inform the Operator of any clarification (update or change) to their personal data.
5. The Operator may process the following personal data of the User
5.1. Surname, first name and patronymic.
5.2. Email address.
5.3. Telephone number (mobile, home or work);
5.4. Photographs.
5.5. Information about the identifier (IP address) of the website visitor’s device connected to a local network and/or the Internet, and other technical parameters, including the web browser version and details of the device used to access the Cheleto LLC website.
5.6. Other information received by the Operator from the User with the latter’s consent.
5.7. The website also collects and processes de-identified visitor data, including cookies, through web analytics services such as Yandex Metrica, Google Analytics and others. Further information about the technical aspects of collecting and processing de-identified visitor data is provided in the Privacy Statement.
5.8. The data listed above is hereinafter referred to collectively in this Policy as Personal Data.
5.9. The Operator does not process special categories of personal data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, or intimate life.
5.10. The User’s consent to the processing of personal data authorised for dissemination is given separately from other consents to the processing of their personal data. The conditions laid down in the applicable legislation must be observed. The requirements for the content of this consent are established by the competent authority for the protection of data subjects’ rights.
5.10.1 The User provides consent to the processing of personal data authorised for dissemination directly to the Operator.
5.10.2 Within three working days of receiving the User’s specified consent, the Operator must publish information on the processing conditions and on any prohibitions or conditions applying to the processing, by an unlimited group of persons, of personal data authorised for dissemination.
5.10.3 The transfer of personal data authorised by the data subject for dissemination, including dissemination, provision and access, must cease at any time upon the data subject’s request. The request must include the data subject’s surname, first name and patronymic, if any, contact details (telephone number, email address or postal address), and a list of the personal data whose processing must cease. The personal data specified in this request may be processed only by the Operator to whom it is addressed.
5.10.4 Consent to the processing of personal data authorised for dissemination ceases to be valid when the Operator receives the request referred to in clause 5.10.3 of this Personal Data Processing Policy.
6. Principles of personal data processing
6.1. Personal data is processed lawfully and fairly.
6.2. Personal data processing is limited to achieving specific, predetermined and lawful purposes. Processing that is incompatible with the purposes for which the personal data was collected is not permitted.
6.3. Databases containing personal data processed for mutually incompatible purposes must not be combined.
6.4. Only personal data that is relevant to the purposes of its processing may be processed.
6.5. The content and volume of personal data processed correspond to the stated purposes of processing. The personal data processed must not be excessive in relation to those purposes.
6.6. When processing personal data, its accuracy, sufficiency and, where necessary, relevance to the purposes of processing must be ensured. The Operator takes the necessary measures and/or ensures that such measures are taken to delete or rectify incomplete or inaccurate data.
6.7. Personal data shall be stored in a form that allows the data subject to be identified for no longer than is required for the purposes of processing, unless a retention period is established by federal law or by a contract to which the data subject is a party, beneficiary or guarantor. The personal data being processed shall be destroyed or de-identified once the purposes of processing have been achieved or are no longer required, unless federal law provides otherwise.
6.8. The personal data we collect and/or receive may be stored and processed in Russia or in any other country where we or our service providers have facilities, where local law permits. The servers and databases on which Personal Data is stored may be located outside the country from which you access this website, including in a country without personal data protection laws equivalent to those of your country of permanent residence. The Personal Data you provide to us may be sent abroad in accordance with legal requirements. We will collect, process and use Personal Data only in accordance with this Privacy Statement.
6.9. Personal Data is collected, processed and stored to improve the operation of the website www.cheleto.com, provide visitors with information about products under the Cheleto, ME:LO:DY am and Speciō trademarks, inform them about new products, promotions and special offers, and maintain communication with consumers, including when questions and/or complaints about products arise.
7. Purposes of personal data processing
7.1. Personal Data is collected, processed and stored to improve the operation of the CHELETO LLC website, provide Users with information about products under the Cheleto, ME:LO:DY am and Speciō trademarks, inform them about new products, promotions and special offers, and maintain communication with consumers, including in the event of questions and/or complaints about products.
The Operator may inform the User by email, provide the User with access to services, information and/or materials available on the websitewww.cheleto.comand/or other websites under the Operator’s control, in particular dedicated promotional campaign pages, answer consumers’ questions about products, including by telephone or messaging apps, and interact with Users in any other manner not prohibited by law.
7.2. The Operator also has the right to send the User notifications about new products and services, special offers and various events. The User may opt out of receiving informational messages at any time by emailing the Operator atinfo@cheleto.comwith the subject line “Opt out of notifications about new products and services and special offers”.
7.3. De-identified User data collected through web analytics services is used to gather information about Users’ actions on the website and to improve the quality of the website and its content.
8. Legal grounds for personal data processing
8.1. The legal grounds for the Operator’s processing of personal data are:
- the European Union’s General Data Protection Regulation (effective date: 25 May 2018);
- Federal Law No. 152-ФЗ of 27.07.2006 “On Personal Data”;
- the Operator’s constitutional documents;
- contracts concluded between the Operator and the data subject;
- other laws and regulations governing personal data protection;
- Users’ consents to the processing of their personal data and of personal data authorised for dissemination.
8.3. The Operator processes anonymised User data if this is permitted by the User’s browser settings, with cookies and JavaScript enabled.
8.4. The data subject independently decides whether to provide their personal data and gives consent freely, of their own will and in their own interest.
9. Procedure for collecting, storing, transferring and otherwise processing personal data
The security of personal data processed by the Operator is ensured through the legal, organisational and technical measures necessary to fully comply with the requirements of applicable personal data protection legislation.
9.1. The Operator ensures the security of personal data and takes all possible measures to prevent unauthorised persons from accessing it.
9.2. The User’s personal data will never, under any circumstances, be transferred to third parties, except where required to comply with applicable legislation or where the data subject has consented to the Operator transferring the data to a third party for the performance of obligations under a civil-law contract.
9.3. If the User discovers inaccuracies in their personal data, they may update it by sending a notification to the Operator at the Operator’s email addressinfo@cheleto.comwith the subject line “Personal data update”.
9.4. The personal data processing period is determined by the achievement of the purposes for which the data was collected, unless a different period is specified by contract or applicable law. The User may withdraw their consent to the processing of personal data at any time by sending a notification to the Operator at the Operator’s email addressinfo@cheleto.comwith the subject “Withdrawal of consent to personal data processing”.
9.5. All information collected by third-party services, including payment systems, communication services and other service providers, is stored and processed by those parties (Operators) in accordance with their User Agreements and Privacy Policies. The data subject and/or User must independently familiarise themselves with these documents in a timely manner. The Operator is not liable for the actions of third parties, including the service providers referred to in this clause.
9.6. Prohibitions on transfer (other than the provision of access), and prohibitions or conditions on processing (other than obtaining access), imposed by the data subject on personal data authorised for dissemination do not apply where personal data is processed in state, societal or other public interests defined by the legislation of the Russian Federation.
9.7. The Operator ensures the confidentiality of personal data during its processing.
9.8. The Operator stores personal data in a form that permits identification of the data subject for no longer than required by the purposes of processing, unless a retention period is established by federal law or by a contract to which the data subject is a party, beneficiary or guarantor.
9.9. Processing of personal data may cease when the purposes of processing have been achieved, the data subject’s consent has expired or been withdrawn, or unlawful processing of personal data has been identified.
10. Actions performed by the Operator on the personal data received
10.1. The Operator collects, records, organises, accumulates, stores, clarifies (updates, amends), retrieves, uses, transfers (disseminates, provides, grants access to), anonymises, blocks, deletes and destroys personal data.
10.2. The Operator carries out automated processing of personal data, with or without receiving and/or transmitting the information obtained over information and telecommunications networks.
11. Cross-border transfer of personal data
11.1. Before beginning a cross-border transfer of personal data, the Operator must ensure that the foreign state to whose territory the data is to be transferred provides reliable protection for the rights of data subjects.
11.2. Cross-border transfers of personal data to foreign countries that do not meet the above requirements may be carried out only with the data subject’s written consent to the cross-border transfer of their personal data and/or for the performance of a contract to which the data subject is a party.
12. Confidentiality of personal data
The Operator and other persons who obtain access to personal data must not disclose it to third parties or disseminate it without the data subject’s consent, unless otherwise provided by federal law.
13. Final provisions
13.1. The User may obtain clarification on any questions concerning the processing of their personal data by contacting the Operator by email atinfo@cheleto.com.
13.2. Any changes to the Operator’s personal data processing policy will be reflected in this document. This Policy remains in force indefinitely until it is replaced by a new version.
13.3. The current version of the Policy is freely available on the Internet atwww.cheleto.com/privacy/.