Policy on processing and protection of personal data
Version dated 31.01.2022.



This document defines the policy of LLC "STP-PACK" in the field of processing and protection of personal data (hereinafter - the Policy).
Policy is valid in relation to all personal data, which "STP-PACK" LLC can receive from the subject of personal data.



1. terms and definitions
Agreement means a license agreement on granting the right to use the Service to "STP-PACK" LLC.
Service - the Operator's website located at: kudos-media.ru.
Operator - "STP-PACK" Ltd.
Personal data - any information related directly or indirectly to certain or defined User.
User - physical person using the Service.
Consent - consent to the processing of Personal Data of the User placed at kudos-media.ru.
Processing of Personal Data (Processing) - any action (operation) or a set of actions (operations) with Personal Data, performed with or without the use of automation tools. Processing includes, but is not limited to: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), anonymization, blocking, deletion, destruction.
2. general provisions
2.1 The Policy is a local document of the Operator, which determines the procedure for processing and protection of the Users' Personal Data.
2.2. The Operator has developed the Policy in line with the Constitution of the Russian Federation, Federal Law of 27.07.2006 #152-FZ "On Personal Data", other laws and regulations which define the order of processing of personal data and requirements to ensure their security.
2.3 The purpose of this Policy is:
2.3.1. ensure protection of human and civil rights and freedoms in the processing of their Personal Data, including protection of the rights to privacy, personal and family secrets;
2.3.2. strict and strict compliance with requirements of legislation of the Russian Federation in the area of personal data
2.3.3. exclude unauthorized actions of any third parties in relation to the Processing;
2.3.4. preventing possible threats to the security of Users.
2.4. The Operator shall independently organise and/or carry out the processing of Personal Data, determine their composition and purposes of Processing, actions (operations) performed with Personal Data.
2.5. The Operator has published the Policy at kudos-media.ru. The Operator makes the Policy available to anyone who applies in person.
2.6. The Operator has the right to change the Policy. The new version of the Policy comes into force from the moment of its publication.



3. Purposes of the Processing of Personal Data
3.1. The Operator processes Personal Data for the purpose of concluding and executing the Agreement, including
- Registration and identification of the User in the Service.
- Providing an access to the Personal Account - for the purposes of using the Service.
- Communication with Users - in order to provide the necessary information related to the activities of the Service or the Operator. Including, but not limited to, sending notifications, requests and information about the work with the Service, the availability of new functionality, notifications with updates to the Service, recommendations on functionality settings. The Operator is entitled to use the email address specified by the User for communication.
- Processing of incoming enquiries and requests from the User - for the purpose of consulting on the questions of work of the Service.
- Receiving feedback from the User - in order to improve the quality of the Service, the convenience of its use, the development of new services.
- Conducting statistical and other studies based on anonymised data in order to obtain information about satisfaction with the Service and its functions. This information is used for the analysis to improve the quality of the Service and research of any categories.
- Analyzing the User's actions on the Service and the functioning of the Service.
- Conducting advertising and newsletters.
-Protecting the confidentiality of Personal Data, the operability and security of the Service, confirming the actions of the User, preventing fraud, cyber-attacks and other abuses, and investigating such cases.


4. Principles of Personal Data Processing
4.1 The Operator shall process Personal Data on the following principles
- The lawful and fair basis of the Processing;
- Processing in accordance with specific, predetermined and legitimate purposes;
- Avoid combining databases containing Personal Data whose Processing is incompatible with each other;
- compliance of the content and scope of Personal Data with the stated purposes of the Processing;
- the accuracy, adequacy, relevance and reliability of the Personal Data;
- the lawfulness of the technical measures aimed at the Processing;
- the reasonableness and expediency of the Processing;
- the storage of Personal Data no longer than required for the purposes of the Processing, unless the storage period is prescribed by law, an agreement to which the User is a party;
- Destruction or depersonalisation of Personal Data upon attainment of the purposes of the Processing or when it is no longer necessary to attain those purposes, unless otherwise provided by the Act.



5. List of Personal Data processed
5.1 General Personal Data, including: first name, surname, patronymic, telephone number, e-mail address.
5.2 Other data concerning the use of the Service, including
5.2.1. technical means (devices) data: IP address, type of operating system, browser type, geographical location, Internet service provider.
5.2.2. information about the User's behaviour in the Service (including the date, time and number of visits, information about the pages visited, transition from other resources, requests sent).
5.2.3. information automatically obtained when the User accesses the Service, including by using cookies. Cookies are fragments of text that are automatically saved in the User's Internet browser. This enables the Service to access and retrieve the information stored on the User's computer, if necessary. You have the right to change the settings of your Internet browser and refuse to store cookies.
5.2.4. general personal data: name, e-mail address, telephone number.
5.3. The personal data uploaded by the User is processed "as is".
5.4 The Operator does not verify:
- the User's legal capacity;
- The reliability of the Personal Data provided by the User.
5.5. the User guarantees
- the Personal Data provided is true, up-to-date and does not violate the laws of the Russian Federation;
- obtaining the consent of a third party for the transfer of Personal Data to the Operator, the subsequent Processing if the Personal Data relates to a third party.



6. Processing of Personal Data
6.1 The subjects of the Personal Data are the Users, who have indicated their details in the forms for registration in the Service, feedback, etc.
6.2 The operator collects the Personal Data in the following ways:
6.2.1. the User provides the data by filling in the forms of the Service, by means of communication, including telephone, e-mail, etc;
6.2.2. automatic collection of data about the User with the help of technologies and services: web protocols, cookies, web-tags, which are started only when the User enters their data.
6.3 The Operator shall store Personal Data:
6.3.1. exclusively on duly protected electronic media, including electronic media;
6.3.2. in the Service with the use of automated processing, except when non-automated Processing is necessary in connection with the fulfilment of the requirements of the legislation of the Russian Federation.
6.3.3. using databases located in the Russian Federation.
6.3.4. storage periods for Personal Data are determined by the terms of the Consent: the data begins to be stored at the time of giving the Consent.
6.4. The Operator shall not distribute or provide Personal Data to third parties without the written consent of the User, except in the following cases
6.4.1. execution of the terms of the Agreement;
6.4.2. in order to prevent, suppress illegal actions of the User and protect the lawful interests of the Operator and third parties, as well as in cases prescribed by the laws of the Russian Federation;
6.4.3. upon a motivated request from the judicial authorities, state security authorities, prosecutor's office, police, investigative authorities, and other authorities and organisations in the cases stipulated by laws and regulations which are binding on the Operator.
6.5 The Operator shall warn the receiving persons that the transmitted data may only be used for the purposes for which it is communicated.
6.6. The Operator shall update the Personal Data if it is confirmed to be inaccurate.
6.7. The Operator shall destroy Personal Data in the following cases
- existence of a threat to the security of the Service;
- expiration of the storage period of the Personal Data;
- breach of the Contract;
- The termination or cancellation of the Agreement;
- at the User's request.

6.8. The Operator deletes all information received from the User when they withdraw their Consent. The right to use the Service is terminated.
6.9. The Operator has the right to temporarily discontinue the processing of Personal Data, i.e. to block the Processing (unless the Processing is necessary to clarify the Personal Data).



7. Rights of the User
7.1 The User has the right to make a request to the Operator, in the manner prescribed in this Policy, for information about the Processing, including
7.1.1. confirmation of the fact of the Processing;
7.1.2. the legal basis for the Processing;
7.1.3. the purposes and methods of Processing used by the Operator;
7.1.4. which Personal Data is processed and the source of its obtaining;
7.1.5. the time limits for Processing, including the time limits for storage of Personal Data;
7.1.6. procedure for exercise of rights under the legislation of the Russian Federation;
7.1.7. information on cross-border transfer of data already made or expected to be made
7.1.8. information on the persons to whom Personal Data may be disclosed on the basis of the agreement with the Operator or in accordance with the laws of the Russian Federation;
7.1.9. the name or surname, first name, patronymic and address of the person who carries out the Processing on behalf of the Operator, if the Processing is or will be assigned to such person;
7.1.10. Other information as provided by the legislation of the Russian Federation.



8. Obligations of the Operator
8.1. The Operator shall:
8.1.1. at the User's request, provide information about the Processing or a reasonable refusal;
8.1.2. take measures that are necessary and sufficient to ensure the fulfilment of the obligations under the legislation of the Russian Federation.
8.1.3. at the request of the User, clarify the Personal Data being processed, block or delete if it is incomplete, outdated, inaccurate, illegally obtained or unnecessary for the stated purpose of the Processing;
8.1.4. ensure the lawfulness of the Processing. If it is impossible to ensure the lawfulness of the Processing, the Operator shall destroy or ensure the destruction of the Personal Data within a period not exceeding 10 (ten) working days from the date of identification of the unlawful Processing;
8.1.5. terminate the Processing and destroy the Personal Data (if their preservation is no longer required for the purposes of the Processing) within a period not exceeding 30 (thirty) days from the date of the User's withdrawal of Consent, except where the Processing may be continued in accordance with the legislation of the Russian Federation.



9. Measures to ensure the protection of Personal Data
9.1 The Operator shall ensure the implementation of legal, organisational and technical measures necessary and sufficient to ensure the protection of Personal Data.
9.2 Legal measures include:
9.2.1. drawing up of local documents by the Operator, implementing the requirements of the Russian laws, including - the Policy, and posting it on the Service;
9.2.2. refraining from any methods of Processing that do not comply with the purposes predetermined by the Operator.
9.3 Organisational measures include:
9.3.1. designating a person responsible for organising the Processing;
9.3.2. limiting the composition of the Operator's employees who have access to Personal Data and organising a permissive system of access to it;
9.3.3. briefing and familiarizing the Operator's employees engaged in the Processing with the provisions of the Russian Federation Personal Data legislation, including requirements for personal data protection, with the Operator's local acts regulating the procedure of work and protection of personal data;
9.3.4. periodically assessing the risks related to the Processing process;
9.3.5. carrying out periodic audits in order to exercise internal control over the Processing's compliance with Russian Federation legislation.
9.4. technical measures:
9.4.1. preventing, including through internal investigations, unauthorised access to systems where Personal Data is stored;
9.4.2. backup and recovery of Personal Data, operability of hardware and software, information security features in Personal Data information systems
9.4.3. other necessary security measures.



10. Limitation of the Policy
10.1 The Policy applies only to the Service.
10.2 The Operator shall not be liable for the actions of third parties who have obtained access to the User's Personal Data through its fault.



11. communication of the Subject of personal data
11.1 The User or their representative has the right to submit their appeals/requests to the Operator, including regarding the Processing, to withdraw their consent to the Processing:
11.1.1. in writing to the address: 123 Rybnaya Street, Rostov-on-Don
11.1.2. in the form of an electronic document to the following email address: info@stp-pack.ru.
11.2 The request must contain the following information:
11.2.1. information about the User's identification document;
11.2.2. information about the User's membership with the Operator (phone number, e-mail address registered through the Site);
11.2.3. the details of the User's representative and his or her power of attorney (in case of a request by the representative); 11.2.4.
11.2.4. the User's (representative's) signature.
11.3 The Operator shall consider and respond to the incoming request within 30 (thirty) calendar days from the moment of its receipt.
11.4 All the correspondence received by the Operator (requests in written or electronic form) belongs to the information that is restricted and is not disclosed without the User's written consent.



Details

Name: STP-PACK Ltd.
INN: 6141059449
KPP: 614101001
Расчётный: №40702810301500146667
Name of the bank: POINT OF PJSC BANK "FC OPKRYTIE" BIK: 044525999
BIK: 044525999
City: Moscow
Corr. account: 30101810845250000999