Policy on Personal Data Processing

1. General Provisions

This policy on personal data processing is made in accordance with the requirements of Federal Law No. 152 "On Personal Data" dated 27 July 2006 (hereinafter referred to as the “Law on Personal Data”) and defines the procedure for personal data processing and measures to ensure security of personal data undertaken by OOO Mediator (hereinafter referred to as “the Operator”).

• 1.1. The Operator's most important goal and prerequisite for its activities is to observe human and civil rights and freedoms when processing personal data, including the protection of rights to personal and family privacy.
• 1.2. This Operator’s policy on personal data processing (hereinafter referred to as “the Policy”) applies to all information that the Operator may receive about the visitors of the mycustoms.ru website.

2. Basic Concepts Used in the Policy

• 2.1. Automated personal data processing means personal data processing using computer technology.
• 2.2. Blocking of personal data means temporary termination of personal data processing (except when processing is necessary to clarify personal data).
• 2.3. Website means a set of graphics and information, as well as software and databases, available on the internet at the network address: mycustoms.ru.
• 2.4. Information system of personal data means a set of personal data contained in databases, as well as information technologies and technical means for its processing.
• 2.5. Personal data anonymization means actions that make it impossible to determine without the use of additional information as to what personal data belongs to a particular User or other subject of personal data.
• 2.6. Personal data processing means any action (operation) or set of actions (operations), performed with or without the use of automation means for personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, usage, transfer (distribution, provision, access), anonymization, blocking, removal, destruction of personal data.
• 2.7. Operator means a state authority, municipal authority, legal entity or individual, which independently or jointly with other persons organizes and (or) performs personal data processing, as well as determines the purpose of personal data processing, composition of personal data to be processed, actions (operations) performed with personal data.
• 2.8. Personal data means any information related directly or indirectly to a certain User of the mycustoms.ru website.
• 2.9. Personal data authorized by the subject of personal data for distribution means personal data, for which the subject of personal data has granted access to an unlimited number of persons by giving consent to the processing of personal data, authorized by the subject of personal data for distribution in the manner prescribed by the Law on Personal Data (hereinafter referred to as “the personal data authorized for distribution”).
• 2.10. User means any visitor of the mycustoms.ru website.
• 2.11. Personal data provision means actions aimed at disclosure of personal data to a certain person or a certain circle of persons.
• 2.12. Personal data distribution means any action aimed at the disclosure of personal data to the uncertain circle of persons (transfer of personal data) or at the familiarization with personal data of the unlimited number of persons, including the publication of personal data in the media, placing them in information and telecommunications networks or providing access to personal data in any other way.
• 2.13. Cross-border transfer of personal data means the transfer of personal data to a foreign authority, individual or legal entity.
• 2.14. Personal data destruction means any action resulting in the destruction of personal data irretrievably with the inability to further restore the content of personal data in the information system of personal data and (or) in the destruction of the material media bearing personal data.

3. Basic Rights and Obligations of the Operator

• 3.1. The Operator may:
  • — receive reliable information and/or documents containing personal data from the subject of personal data;
  • — в if the subject of personal data withdraws consent to the personal data processing, the Operator may continue personal data processing without the consent of the subject of personal data on the grounds specified in the Law on Personal Data;
  • — determine individually the composition and list of measures necessary and sufficient to ensure the fulfillment of obligations stipulated by the Law on Personal Data and regulations adopted in accordance with it, unless otherwise stipulated by the Law on Personal Data or other federal laws.
• 3.2. The Operator shall:
  • — provide the subject of personal data, upon request, information relating to the processing of the personal data;
  • — organize the personal data processing in the manner established by applicable legislation of the Russian Federation;
  • — respond to inquiries and requests of the subjects of personal data and their legal representatives in accordance with the requirements of the Law on Personal Data;
  • — provide to the authorized body for the protection of the rights of subjects of personal data, upon request of this body, the necessary information within 30 days from the date of receipt of such a request;
  • — publish or otherwise provide unrestricted access to this Policy on personal data processing;
  • — take legal, organizational and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution, as well as other unauthorized actions in relation to personal data;
  • — terminate the transfer (distribution, provision, access) of personal data, terminate processing and destroy personal data in the manner and cases stipulated by the Law on Personal Data;
  • — perform other obligations stipulated by the Law on Personal Data.

4. Basic Rights and Obligations of Subjects of Personal Data

• 4.1. Subjects of personal data may:
  • — receive information concerning the processing of their personal data, except in cases stipulated by federal laws. The information shall be provided to the subject of personal data by the Operator in an accessible form, and it shall not contain personal data relating to other subjects of personal data, except in cases where there are legitimate grounds for the disclosure of such personal data. The list of information and its obtaining procedure is established by the Law on Personal Data;
  • — require the Operator to clarify their personal data, block or destroy them if the personal data is incomplete, outdated, inaccurate, illegally obtained or unnecessary for the stated purpose of processing, as well as take other statutory measures to protect their rights;
  • — impose the condition of preliminary consent when processing personal data for the purpose of promoting goods, works and services in the market;
  • — на withdraw consent to personal data processing;
  • — appeal to the authorized body for the protection of the rights of subjects of personal data or court against unauthorized actions or omissions of the Operator related the to processing of their personal data;
  • — на exercise other rights stipulated by the legislation of the Russian Federation.
• 4.2. The subjects of personal data shall:
  • — provide the Operator with reliable personal data;
  • — inform the Operator about the need to clarify (update, change) their personal data.
• 4.3. Persons who provided the Operator with false personal data or provided personal data of another subject of personal data without the consent of the latter shall be liable in accordance with the legislation of the Russian Federation.

5. The Operator may process the following personal data of the User

• 5.1. Surname, name, patronymic.
• 5.2. Email.
• 5.3. Phone numbers.
• 5.4. The website also collects and processes anonymized data about visitors (including cookies) using internet statistics services (Yandex.Metrika, Google Analytics and others).
• 5.5. The abovementioned data is hereinafter collectively referred to as “Personal Data”.
• 5.6. The Operator shall not process special categories of personal data relating to race, ethnicity, political views, religious or philosophical beliefs, or personal life.
• 5.7. The processing of personal data authorized for distribution, from among the special categories of personal data specified in Part 1, Article 10 of the Law on Personal Data is allowed if the prohibitions and conditions specified in Article 10.1 of the Law on Personal Data Law are observed.
• 5.8. The User's consent to the processing of personal data authorized for distribution shall be executed separately from the other consents to the processing of their personal data. In this case, the conditions stipulated, in particular, by Article 10.1 of the Law on Personal Data shall be observed. The requirements for the content of such consent are established by the authorized body for the protection of the rights of subjects of personal data.
  • 5.8.1 The User shall provide consent to the processing of personal data authorized for distribution directly to the Operator.
  • 5.8.2 The Operator shall within three working days from the date of receipt of the above consent of the User publish information about the conditions of processing, the existence of prohibitions and conditions on the processing of personal data authorized for distribution by the unlimited number of persons.
  • 5.8.3 The transfer (distribution, provision, access) of personal data authorized by the subject of personal data for distribution shall be terminated at any time upon request of the subject of personal data. This request shall include the surname, name, patronymic (if any), contact information (phone number, email or postal address) of the subject of personal data, as well as a list of personal data, the processing of which is subject to termination. The personal data specified in this request may only be processed by the Operator to whom it is sent.
  • 5.8.4 The consent to the processing of personal data authorized for distribution shall be terminated on receipt by the Operator of the request specified in Clause 5.8.3 of this Policy on personal data processing.

6. Principles of Personal Data Processing

• 6.1. The personal data processing shall be lawful and fair.
• 6.2. The personal data processing shall be limited to achieving specific, predetermined and legitimate purposes. It is not allowed to process personal data in a manner inconsistent with the purpose of personal data collection.
• 6.3. It is not allowed to combine databases containing personal data, the processing of which is carried out for purposes that are incompatible with each other.
• 6.4. Only personal data that meets the purposes for which it is processed may be processed.
• 6.5. The content and volume of the processed personal data shall correspond to the stated
• 6.6. When processing personal data, the accuracy of personal data, their adequacy and, where necessary, their relevance in relation to the purposes of personal data processing shall be ensured. The Operator shall take the necessary measures and/or provide that they are taken to remove or clarify incomplete or inaccurate data.
• 6.7. The storage of personal data shall be carried out in a form that makes it possible to identify the subject of personal data, in a time frame no longer than is required by the purposes of personal data processing unless the term of storage of personal data is not established by any federal law or contract to which the subject of personal data is a party, beneficiary or guarantor. The processed personal data shall be destroyed or anonymized upon achieving processing purposes or when it is no longer necessary to achieve those purposes unless otherwise provided by federal law.

7. Purposes of Personal Data Processing

• 7.1. Purposes of the User’s personal data processing:
  • — informing the User by sending emails;
  • — conclusion, performance and termination of civil law contracts;
  • providing the User with access to services, information and/or materials available on the mycustoms.ru website.
• 7.2. The Operator also may send the User notifications about new products and services, special offers and various events. The User may always refuse to receive information messages by sending an email to the Operator at marketing@mycustoms.ru with a note to the effect that "I refuse to receive notifications about new products, services and special offers".
• 7.3. The Users’ anonymized data collected through internet statistics services shall be used to collect information about Users' actions on the website in order to improve the quality of the website and its content.

8. Legal Grounds for Personal Data Processing

• 8.1. Legal grounds for personal data processing by the Operator:
  • — list of legal acts governing relations related to your activities, for example, if your activities are related to information technologies, in particular the creation of websites, you can specify here Federal Law No. 149-FZ "On Information, Information Technologies and Information Protection" dated 27 July 2006;
  • — corporate documents of the Operator;
  • — contracts concluded between the Operator and the subject of personal data;
  • — federal laws and other legal acts in the field of personal data protection;
  • — Users' consent to the processing of personal data and personal data authorized for distribution.
• 8.2. The Operator shall process the User's personal data only in the event that the User fills them in and/or sends them independently through the special forms available on the mycustoms.ru website or to the Operator by email. By filling in the relevant forms and/or sending their personal data to the Operator, the User expresses their consent to this Policy.
• 8.3. The Operator shall process anonymized data about the User if it is allowed in the User's browser settings (cookie saving and the use of JavaScript technology are enabled).
• 8.4. The subject of personal data shall independently decide to provide their personal data and give consent freely, of their own free will and in their own interest.

9. Conditions of Personal Data Processing

• 9.1. The personal data processing shall be carried out with the consent of the subject of personal data to the processing of their personal data.
• 9.2. The personal data processing is necessary to achieve the goals stipulated by any international treaty of the Russian Federation or by law to perform the functions, powers and duties imposed on the Operator by the legislation of the Russian Federation.
• 9.3. The personal data processing is necessary to implement justice, execute judicial acts, acts of other authorities or officials to be executed in accordance with the legislation of the Russian Federation on enforcement proceedings.
• 9.4. The personal data processing is necessary to perform contracts to which the subject of personal data is a party, beneficiary or guarantor, as well as to conclude contracts on the initiative of the subject of personal data or contracts under which the subject of personal data is a beneficiary or guarantor.
• 9.5. The personal data processing is necessary to exercise the rights and legitimate interests of the Operator or third parties or to achieve socially important goals, provided that this does not violate the rights and freedoms of the subject of personal data.
• 9.6. Personal data, access to which is provided to the general public by the subject of personal data or at their request (hereinafter referred to as “the publicly available personal data”), may be processed.
• 9.7. Personal data subject to publication or mandatory disclosure in accordance with federal law may be processed.

10. Procedure for Collection, Storage, Transfer and Other Processing of Personal Data

The security of personal data processed by the Operator shall be ensured by implementing legal, organizational and technical measures necessary to comply fully with the requirements of applicable legislation in the field of personal data protection.

• 10.1. The Operator shall ensure the safety of personal data and take all possible measures to exclude access to personal data by unauthorized persons.
• 10.2. The personal data of the User shall never and under no circumstances be transferred to third parties, except in cases related to the implementation of the current legislation or if the subject of personal data has given consent to the Operator for the transfer of data to a third party to fulfill obligations under a civil law contract.
• 10.3. In case of the detection of inaccuracies in personal data, the User may update them independently by sending a notice to the Operator's email marketing@mycustoms.ru with a note containing the phrase "Update to personal data".
• 10.4. The term of processing of personal data shall depend on the achievement of the purposes for which the personal data were collected, unless a different term is specified in the contract or applicable law.
• The User may withdraw their consent to personal data processing at any time by sending a notice to the Operator's email marketing@mycustoms.ru with a note "Withdrawal of consent to personal data processing".
• 10.5. All information that is collected by third-party services, including payment systems, communication methods and other service providers, is stored and processed by these persons (operators) in accordance with their User Agreement and Privacy Policy. The subject of personal data and/or the User shall familiarize themselves with these documents in a timely manner. The Operator shall not be responsible for the actions of third parties, including the service providers mentioned in this clause.
• 10.6. The prohibitions established by the subject of personal data for transferring (other than granting access), as well as processing (other than gaining access) personal data authorized for distribution shall not apply in cases of personal data processing in state, social and other public interests, as defined by the legislation of the Russian Federation.
• 10.7. When processing personal data, the Operator shall ensure the privacy of personal data.
• 10.8. The Operator fulfills the storage of personal data in a form that makes it possible to identify the subject of personal data, no longer than is required by the purposes of the personal data processing unless the term of storage of personal data is not established by any federal law or contract to which the subject of personal data is a party, beneficiary or guarantor.
• 10.9. The condition for termination of personal data processing may be the achievement of the purposes of personal data processing, the expiration of the consent of the subject of personal data or withdrawal of consent by the subject of personal data, as well as the detection of improper personal data processing.

11. List of Actions Performed by the Operator with the Received Personal Data

• 11.1. The Operator carries out the collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), anonymization, blocking, removal, and destruction of personal data.
• 11.2. The Operator carries out automated personal data processing with or without the receipt and/or transmission of the received information via information and telecommunications networks.

12. Cross-Border Transfer of Personal Data

• 12.1. Before starting the cross-border transfer of personal data, the Operator shall ensure that the foreign country to whose territory the transfer of personal data is to be carried out provides for the reliable protection of the rights of subjects of personal data.
• 12.2. The cross-border transfer of personal data in foreign countries that do not meet the above requirements may be carried out only under the written consent of the subject of personal data on the cross-border transfer of their personal data and/or performance of the contract to which the subject of personal data is a party.

13. Confidentiality of Personal Data

The Operator and other persons who have access to personal data may not disclose to third parties and distribute personal data without the consent of the subject of personal data, unless otherwise provided for by federal law.

14. Final Provisions

• 14.1. The User may receive any clarifications on questions of interest relating to the processing of their personal data by contacting the Operator via email at marketing@mycustoms.ru.
• 14.2. This document shall reflect any changes to the Operator's policy for personal data processing. The Policy is valid indefinitely until it is replaced by a new version.
• 14.3. The current version of the Policy is publicly available on the internet at mycustoms.ru/en/privacy.