Personal Data Processing Policy
This is a translation. The legally binding text is the policy in Russian: Политика в отношении обработки персональных данных.
1. General provisions
This personal data processing policy has been drawn up in accordance with Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” (the “Personal Data Law”) and sets out how personal data are processed and what measures to secure personal data are taken by Nezavisimaya Assotsiatsiya Gipnologov, the Independent Association of Hypnotherapists (the “Operator”).
1.1. The Operator's most important goal and condition of its work is to respect human and civil rights and freedoms when processing personal data, including the right to privacy and to personal and family confidentiality.
1.2. This policy of the Operator on personal data processing (the “Policy”) applies to all information that the Operator may receive about visitors to the websites https://независимая-ассоциация-гипнологов.рф and https://iahypnotherapists.org.
2. Main terms used in the Policy
2.1. Automated processing of personal data: processing of personal data by computer.
2.2. Blocking of personal data: temporary stopping of personal data processing (except where processing is needed to correct personal data).
2.3. Website: the set of graphic and information materials, computer programs and databases that make them available on the internet at https://независимая-ассоциация-гипнологов.рф and https://iahypnotherapists.org.
2.4. Personal data information system: the personal data contained in databases and the information technologies and technical means that process them.
2.5. Depersonalisation of personal data: actions after which it is impossible, without additional information, to tell which User or other personal data subject the personal data belong to.
2.6. Processing of personal data: any action or set of actions performed with personal data, with or without automation, including collection, recording, organisation, accumulation, storage, correction (updating, changing), retrieval, use, transfer (distribution, provision, access), depersonalisation, blocking, deletion and destruction of personal data.
2.7. Operator: a state or municipal body, legal entity or individual that, alone or together with others, organises and/or carries out the processing of personal data and determines the purposes of processing, the personal data to be processed and the actions performed with them.
2.8. Personal data: any information relating directly or indirectly to an identified or identifiable User of the Website.
2.9. Personal data permitted by the subject for distribution: personal data that the subject has made accessible to an unlimited number of persons by giving consent to their processing in the manner set by the Personal Data Law (“personal data permitted for distribution”).
2.10. User: any visitor to the Website.
2.11. Provision of personal data: actions aimed at disclosing personal data to a certain person or a certain group of persons.
2.12. Distribution of personal data: any actions aimed at disclosing personal data to an indefinite group of persons or at making personal data available to an unlimited number of persons, including publication in the media, placement in information and telecommunication networks or giving access to personal data in any other way.
2.13. Cross-border transfer of personal data: transfer of personal data to the territory of a foreign state, to a foreign authority, a foreign individual or a foreign legal entity.
2.14. Destruction of personal data: any actions after which personal data are destroyed irreversibly, so that their content in the personal data information system cannot be restored, and/or the physical media of personal data are destroyed.
3. Main rights and duties of the Operator
3.1. The Operator has the right to:
- receive from the personal data subject reliable information and/or documents containing personal data;
- if the subject withdraws consent to processing or asks for processing to stop, continue processing without the subject's consent where the Personal Data Law allows it;
- decide on the measures necessary and sufficient to fulfil the duties under the Personal Data Law and the regulations adopted under it, unless the Personal Data Law or other federal laws provide otherwise.
3.2. The Operator must:
- give the personal data subject, at their request, information about the processing of their personal data;
- organise the processing of personal data in the manner set by the law of the Russian Federation;
- answer requests and enquiries from personal data subjects and their legal representatives as the Personal Data Law requires;
- provide the authority for the protection of the rights of personal data subjects, at its request, with the necessary information within 10 days of receiving the request;
- publish this Policy or otherwise give unlimited access to it;
- take legal, organisational and technical measures to protect personal data from unlawful or accidental access, destruction, change, blocking, copying, provision, distribution and other unlawful actions;
- stop transferring (distributing, providing, giving access to) personal data, stop processing and destroy personal data in the manner and cases set by the Personal Data Law;
- perform other duties set by the Personal Data Law.
4. Main rights and duties of personal data subjects
4.1. Personal data subjects have the right to:
- receive information about the processing of their personal data, except in cases set by federal laws. The Operator provides the information in an accessible form, without personal data of other subjects unless there are legal grounds to disclose them. The list of information and the way to receive it are set by the Personal Data Law;
- require the Operator to correct, block or destroy their personal data if the data are incomplete, out of date, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing, and take the measures provided by law to protect their rights;
- make their prior consent a condition for processing personal data to promote goods, work and services;
- withdraw consent to the processing of personal data and require processing to stop;
- appeal against unlawful actions or inaction of the Operator in processing their personal data to the authority for the protection of the rights of personal data subjects or in court;
- exercise other rights provided by the law of the Russian Federation.
4.2. Personal data subjects must:
- give the Operator reliable information about themselves;
- inform the Operator of corrections (updates, changes) to their personal data.
4.3. Persons who have given the Operator false information about themselves, or information about another personal data subject without that person's consent, are liable under the law of the Russian Federation.
5. Principles of personal data processing
5.1. Personal data are processed lawfully and fairly.
5.2. Processing of personal data is limited to specific, predefined and lawful purposes. Processing incompatible with the purposes of collection is not allowed.
5.3. Databases containing personal data processed for incompatible purposes may not be combined.
5.4. Only personal data that meet the purposes of processing are processed.
5.5. The content and amount of personal data processed match the stated purposes. Processing more personal data than the stated purposes require is not allowed.
5.6. When personal data are processed, their accuracy, sufficiency and, where necessary, relevance to the purposes of processing are ensured. The Operator takes, or makes sure others take, the necessary measures to delete or correct incomplete or inaccurate data.
5.7. Personal data are stored in a form that allows the subject to be identified for no longer than the purposes of processing require, unless the storage period is set by federal law or by a contract to which the subject is a party, beneficiary or guarantor. Processed personal data are destroyed or depersonalised once the purposes of processing are achieved or are no longer needed, unless federal law provides otherwise.
6. Purposes of personal data processing
Purpose of processing: concluding, performing and terminating civil law contracts.
Personal data: surname, first name, patronymic; e-mail address; phone numbers; length of work experience.
Legal grounds: the charter (founding) documents of the Operator.
Types of processing: collection, recording, organisation, accumulation, storage, destruction and depersonalisation of personal data.
7. Conditions of personal data processing
7.1. Personal data are processed with the consent of the personal data subject to the processing of their personal data.
7.2. Processing of personal data is necessary to achieve the purposes set by an international treaty of the Russian Federation or by law, and to perform the functions, powers and duties imposed on the operator by the law of the Russian Federation.
7.3. Processing of personal data is necessary for the administration of justice and the execution of a court decision or a decision of another body or official that must be executed under the law of the Russian Federation on enforcement proceedings.
7.4. Processing of personal data is necessary to perform a contract to which the personal data subject is a party, beneficiary or guarantor, or to conclude a contract on the initiative of the subject or a contract under which the subject will be a beneficiary or guarantor.
7.5. Processing of personal data is necessary to exercise the rights and legitimate interests of the operator or third parties or to achieve socially significant purposes, provided that the rights and freedoms of the personal data subject are not violated.
7.6. Personal data are processed to which the subject has given access to an unlimited number of persons, or at the subject's request (“publicly available personal data”).
7.7. Personal data are processed that must be published or disclosed under federal law.
8. Collection, storage, transfer and other processing of personal data
The security of personal data processed by the Operator is ensured by legal, organisational and technical measures needed to fully meet the requirements of the law on personal data protection.
8.1. The Operator keeps personal data safe and takes all possible measures to prevent access to them by unauthorised persons.
8.2. The User's personal data will never, under any circumstances, be transferred to third parties, except as required by law or where the personal data subject has consented to the Operator transferring the data to a third party to perform obligations under a civil law contract.
8.3. If inaccuracies are found in personal data, the User can update them by sending a notice to the Operator's e-mail address oskin.ff@gmail.com marked “Updating personal data”.
8.4. The period of personal data processing is set by the achievement of the purposes for which the data were collected, unless another period is provided by contract or by law.
The User may withdraw consent to the processing of personal data at any time by sending a notice to the Operator's e-mail address oskin.ff@gmail.com marked “Withdrawal of consent to personal data processing”.
8.5. All information collected by third-party services, including payment systems, means of communication and other service providers, is stored and processed by those persons (Operators) in accordance with their User Agreement and Privacy Policy. The Operator is not responsible for the actions of third parties, including the service providers named in this clause.
8.6. Bans set by the personal data subject on the transfer (except for giving access) and on the processing or conditions of processing (except for obtaining access) of personal data permitted for distribution do not apply where personal data are processed in state, public and other public interests defined by the law of the Russian Federation.
8.7. When processing personal data, the Operator ensures their confidentiality.
8.8. The Operator stores personal data in a form that allows the subject to be identified for no longer than the purposes of processing require, unless the storage period is set by federal law or by a contract to which the subject is a party, beneficiary or guarantor.
8.9. Processing of personal data may stop when the purposes of processing are achieved, when the subject's consent expires, when the subject withdraws consent or asks for processing to stop, or when unlawful processing is found.
9. Actions performed by the Operator with the personal data received
9.1. The Operator collects, records, organises, accumulates, stores, corrects (updates, changes), retrieves, uses, transfers (distributes, provides, gives access to), depersonalises, blocks, deletes and destroys personal data.
9.2. The Operator processes personal data automatically, with or without receiving and/or transmitting the information over information and telecommunication networks.
10. Cross-border transfer of personal data
10.1. Before starting cross-border transfer of personal data, the Operator must notify the authority for the protection of the rights of personal data subjects of its intention to carry out such transfer (this notice is sent separately from the notice of intention to process personal data).