Privacy
Policy

01. General Provisions

This personal data processing policy has been drawn up in accordance with Federal Law No. 152-FZ of 27 July 2006, “On Personal Data” (the “Personal Data Law”). It establishes the procedure for processing personal data and the measures taken by Individual Entrepreneur Irina Vladimirovna Ivashova (the “Operator”) to ensure the security of personal data.

1.1. The Operator considers respect for human and civil rights and freedoms in the processing of personal data, including protection of the right to privacy and personal and family secrets, to be a primary objective and a condition of its activities.

1.2. This policy of the Operator concerning the processing of personal data (the “Policy”) applies to all information that the Operator may obtain about visitors to the website https://grandthai.ru/..

02. Definitions Used in This Policy

2.1. Automated processing of personal data: processing personal data using computing equipment.

2.2. Blocking of personal data: temporarily suspending the processing of personal data, except where processing is necessary to clarify the data.

2.3. Website: the collection of graphic and informational materials, computer programs and databases that make these materials available on the internet at https://grandthai.ru/..

2.4. Personal data information system: the combination of personal data contained in databases and the information technologies and technical means used to process that data.

2.5. Depersonalisation of personal data: actions that make it impossible, without additional information, to attribute personal data to a particular User or other personal data subject.

2.6. Processing of personal data: any action or set of actions performed on personal data, with or without automated means, including collection, recording, systematisation, accumulation, storage, clarification (updating or alteration), retrieval, use, transfer (dissemination, provision or access), depersonalisation, blocking, removal and destruction.

2.7. Operator: a state authority, municipal authority, legal entity or natural person that, independently or jointly with others, organises and/or carries out the processing of personal data and determines the purposes of processing, the personal data to be processed and the actions or operations to be performed on that data.

2.8. Personal data: any information relating directly or indirectly to an identified or identifiable User of the website https://grandthai.ru/..

2.9. Personal data authorised by the data subject for dissemination: personal data to which the data subject has granted access to an unlimited number of persons by giving consent to the processing of personal data authorised for dissemination in the manner prescribed by the Personal Data Law (“personal data authorised for dissemination”).

2.10. User: any visitor to the website https://grandthai.ru/..

2.11. Provision of personal data: actions intended to disclose personal data to a particular person or a particular group of persons.

2.12. Dissemination of personal data: any actions intended to disclose personal data to an indefinite group of persons (transfer of personal data) or to make personal data known to an unlimited number of persons, including publication in the mass media, placement on information and telecommunications networks, or provision of access by any other means.

2.13. Cross-border transfer of personal data: transfer of personal data to the territory of a foreign state, to an authority of that state, or to a foreign natural person or legal entity.

2.14. Destruction of personal data: any actions resulting in the irreversible destruction of personal data, so that the content of the data cannot subsequently be restored within the personal data information system, and/or the destruction of physical media containing personal data.

03. Principal Rights and Obligations of the Operator

3.1. The Operator is entitled to:

• Receive accurate information and/or documents containing personal data from the data subject.
• Continue processing personal data without the data subject's consent after consent has been withdrawn, where grounds specified in the Personal Data Law exist.
• Independently determine the composition and list of measures necessary and sufficient to fulfil the obligations established by the Personal Data Law and regulations adopted under it, unless otherwise provided by that law or other federal laws.

3.2. The Operator must:

• Provide the data subject, upon request, with information concerning the processing of their personal data.
• Organise the processing of personal data in accordance with applicable legislation of the Russian Federation.
• Respond to enquiries and requests from data subjects and their lawful representatives in accordance with the Personal Data Law.
• Provide the authorised authority for the protection of data subjects' rights with the information it requests within 30 days of receiving the request.
• Publish this Policy, or otherwise provide unrestricted access to it.
• Take legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful actions.
• Cease the transfer (dissemination, provision or access) and processing of personal data, and destroy personal data, in the manner and circumstances prescribed by the Personal Data Law.
• Fulfil other obligations established by the Personal Data Law.

04. Principal Rights and Obligations of Personal Data Subjects

4.1. Personal data subjects are entitled to:

• Obtain information concerning the processing of their personal data, except in circumstances provided for by federal law. The Operator must provide this information in an accessible form. It must not contain personal data relating to other data subjects unless there are lawful grounds for disclosing that data. The information to be provided and the procedure for obtaining it are established by the Personal Data Law.
• Require the Operator to clarify, block or destroy their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated processing purpose, and take measures provided for by law to protect their rights.
• Require prior consent for the processing of personal data for the purpose of promoting goods, works and services on the market.
• Withdraw consent to the processing of personal data.
• Challenge unlawful actions or omissions of the Operator in the processing of personal data before the authorised authority for the protection of data subjects' rights or in court.
• Exercise other rights established by legislation of the Russian Federation.

4.2. Personal data subjects must:

• Provide the Operator with accurate information about themselves.
• Inform the Operator when their personal data needs to be clarified, updated or altered.

4.3. Persons who provide the Operator with inaccurate information about themselves, or with information about another data subject without that subject's consent, are liable in accordance with legislation of the Russian Federation.

05. User Data the Operator May Process

5.1. Surname, first name and patronymic.

5.2. Telephone numbers.

5.3. Email address.

5.4. The website also collects and processes depersonalised visitor data, including cookies, using internet statistics services such as Yandex Metrica, Google Analytics and others.

5.5. The above data is collectively referred to in this Policy as “Personal Data”.

5.6. The Operator does not process special categories of personal data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, or intimate life.

5.7. Processing personal data authorised for dissemination that falls within the special categories specified in Part 1 of Article 10 of the Personal Data Law is permitted if the prohibitions and conditions set out in Article 10.1 of that law are observed.

5.8. The User's consent to the processing of personal data authorised for dissemination is given separately from other consents to the processing of their personal data. The conditions established, in particular, by Article 10.1 of the Personal Data Law must be observed. Requirements concerning the content of this consent are established by the authorised authority for the protection of data subjects' rights.

5.9. The User provides consent to the processing of personal data authorised for dissemination directly to the Operator.

5.9.1. Within no more than three working days of receiving that consent, the Operator must publish information about the processing conditions, including any prohibitions and conditions applicable to the processing, by an unlimited number of persons, of personal data authorised for dissemination.

5.9.2. The transfer (dissemination, provision or access) of personal data authorised by the data subject for dissemination must cease at any time upon the data subject's request. The request must include the subject's surname, first name, patronymic where applicable, contact information (telephone number, email address or postal address), and a list of the personal data whose processing must cease.

The personal data specified in that request may be processed only by the Operator to whom the request is addressed.

5.9.3. Consent to the processing of personal data authorised for dissemination ceases to have effect when the Operator receives the request specified in clause 5.8.2 of this Policy.

06. Principles of Personal Data Processing

6.1. Personal data is processed lawfully and fairly.

6.2. Processing is limited to achieving specific, predetermined and lawful purposes. Processing incompatible with the purposes for which personal data was collected is prohibited.

6.3. Databases containing personal data processed for mutually incompatible purposes must not be combined.

6.4. Only personal data relevant to the processing purposes may be processed.

6.5. The content and volume of personal data processed must correspond to the stated purposes. Personal data must not be excessive in relation to those purposes.

6.6. The accuracy, sufficiency and, where necessary, currency of personal data must be ensured in relation to the processing purposes. The Operator takes, and/or ensures that others take, the necessary measures to remove or clarify incomplete or inaccurate data.

6.7. Personal data is stored in a form that permits identification of the data subject for no longer than the processing purposes require, unless a storage period is established by federal law or by a contract to which the subject is a party, beneficiary or guarantor.

Personal data being processed is destroyed or depersonalised when the processing purposes have been achieved or are no longer necessary, unless otherwise provided by federal law.

07. Purposes of Personal Data Processing

7.1. The purposes of processing the User's personal data are:

• Informing the User by email.
• Concluding, performing and terminating civil-law contracts.
• Giving the User access to services, information and/or materials on the website https://grandthai.ru/..

7.2. The Operator is also entitled to send the User notifications about new products and services, special offers and various events. The User may opt out of these informational messages at any time by emailing biz.ivashov@yandex.ru with the subject “Refusal of Notifications About New Products and Services and Special Offers”.

7.3. Depersonalised User data collected through internet statistics services is used to gather information about User activity on the website and to improve the quality of the website and its content.

08. Legal Grounds for Personal Data Processing

8. Legal Grounds for Personal Data Processing

8.1. The legal grounds on which the Operator processes personal data are:

• List the regulatory legal acts governing relations associated with your activities; for example, if your activities relate to information technology, particularly website creation, you may specify Federal Law No. 149-FZ of 27 July 2006, “On Information, Information Technologies and Information Protection”, here.
• The Operator's constitutional documents.
• Contracts concluded between the Operator and the data subject.
• Federal laws and other regulations concerning the protection of personal data.
• Users' consents to the processing of their personal data and of personal data authorised for dissemination.

8.2. The Operator processes the User's personal data only when the User independently enters and/or submits it through special forms on https://grandthai.ru/ or sends it to the Operator by email. By completing those forms and/or sending their personal data to the Operator, the User expresses agreement with this Policy.

8.3. The Operator processes depersonalised User data where the User's browser settings permit it, with cookies and JavaScript enabled.

8.4. The data subject independently decides whether to provide their personal data and gives consent freely, voluntarily and in their own interest.

09. Conditions for Personal Data Processing

9.1. Personal data is processed with the data subject's consent to such processing.

9.2. Processing is necessary to achieve purposes provided for by an international treaty of the Russian Federation or by law, and to exercise functions, powers and duties assigned to the Operator by legislation of the Russian Federation.

9.3. Processing is necessary for the administration of justice or the enforcement of a judicial act or an act of another authority or official subject to enforcement under legislation of the Russian Federation on enforcement proceedings.

9.4. Processing is necessary to perform a contract to which the data subject is a party, beneficiary or guarantor, or to conclude a contract at the data subject's initiative or under which the subject will be a beneficiary or guarantor.

9.5. Processing is necessary to exercise the rights and legitimate interests of the Operator or third parties, or to achieve objectives of public importance, provided that the data subject's rights and freedoms are not infringed.

9.6. The personal data being processed is data to which the data subject, or another person at their request, has granted access to an unlimited number of persons (“publicly available personal data”).

9.7. The personal data being processed is subject to publication or mandatory disclosure under federal law.

10. Collection, Storage, Transfer and Other Processing of Personal Data

The security of personal data processed by the Operator is ensured by implementing the legal, organisational and technical measures necessary to comply fully with applicable personal data protection legislation.

10.1. The Operator ensures the safekeeping of personal data and takes all possible measures to prevent unauthorised persons from gaining access to it.

10.2. The User's personal data will never, under any circumstances, be transferred to third parties except where required to comply with applicable legislation or where the data subject has consented to the Operator transferring the data to a third party to fulfil obligations under a civil-law contract.

10.3. If the User discovers inaccuracies in their personal data, they may update it by emailing a notification to biz.ivashov@yandex.ru with the subject “Updating Personal Data”.

10.4. The processing period is determined by the achievement of the purposes for which the data was collected, unless a different period is provided for by contract or applicable legislation.

The User may withdraw consent to the processing of personal data at any time by emailing the Operator at biz.ivashov@yandex.ru with the subject “Withdrawal of Consent to Personal Data Processing”.

10.5. All information collected by third-party services, including payment systems, communications services and other service providers, is stored and processed by those parties (Operators) in accordance with their user agreements and privacy policies. The data subject and/or User must familiarise themselves with those documents independently and in a timely manner.

The Operator is not responsible for the actions of third parties, including the service providers specified in this clause.

10.6. Prohibitions imposed by a data subject on the transfer, other than provision of access, and on the processing or conditions of processing, other than obtaining access, of personal data authorised for dissemination do not apply where personal data is processed in state, public or other public interests defined by legislation of the Russian Federation.

10.7. The Operator maintains confidentiality when processing personal data.

10.8. The Operator stores personal data in a form permitting identification of the data subject for no longer than the processing purposes require, unless a storage period is established by federal law or by a contract to which the subject is a party, beneficiary or guarantor.

10.9. Grounds for ending processing may include achievement of the processing purposes, expiry or withdrawal of the data subject's consent, or the discovery of unlawful processing.

11. Operations Performed by the Operator on Personal Data Received

11.1. The Operator collects, records, systematises, accumulates, stores, clarifies (updates or alters), retrieves, uses, transfers (disseminates, provides or grants access to), depersonalises, blocks, removes and destroys personal data.

11.2. The Operator carries out automated processing of personal data with or without receiving and/or transmitting information over information and telecommunications networks.

12. Confidentiality of Personal Data

The Operator and other persons who have obtained access to personal data must not disclose it to third parties or disseminate it without the data subject's consent, unless otherwise provided by federal law.

13. Final Provisions

4.1. The User may obtain clarification of any questions concerning the processing of their personal data by contacting the Operator at biz.ivashov@yandex.ru..

14.2. This document will reflect any changes to the Operator's personal data processing policy. The Policy remains in effect indefinitely until replaced by a new version.

14.3. The current version of the Policy is freely available online at https://grandthai.ru/policy/..

14. Our Use of Yandex Metrica

This website uses the Yandex Metrica web analytics service provided by YANDEX LLC, 16 L. Tolstogo Street, Moscow, 119021, Russia (“Yandex”). Yandex Metrica uses cookies: small text files placed on users' computers to analyse their activity.

The information collected through cookies cannot identify you, but it may help us improve our website. Information about your use of this website collected through cookies will be transferred to Yandex and stored on a Yandex server in the EU and the Russian Federation. Yandex will process this information to evaluate your use of the website, compile reports on website activity for us and provide other services.

Yandex processes this information in accordance with the terms of use of Yandex Metrica.

You may refuse the use of cookies by selecting the appropriate settings in your browser. You may also use the Yandex Metrica opt-out tool. This may, however, affect theoperation of certain website features. By using this website, you agree to Yandex processing data about you in the manner and for the purposes described above.

15. Our Use of Cookies on This Website

By using this website, you consent to the processing of cookies and user data, including location; operating system type and version; browser version; device type and screen resolution; the source from which you arrived at the website, including the referring website or advertisement; operating system and browser language; pages opened and buttons clicked; and IP address. This data is processed to operate the website, apply retargeting, and collect statistics and reviews. If you do not want your data to be processed, you must leave this website.

This website uses cookies. A cookie is a small, simple file, consisting of a string of letters and numbers, sent with website pages and saved by your browser on your computer's hard drive. On subsequent visits, information from this file may be sent back to our servers. Web servers can use cookies to identify and track users as they browse different pages of our website and to determine whether they have visited before.

The cookies that we store through this website do not contain data that can identify you personally.

Further information on enabling, disabling and deleting cookies can be found in your browser's instructions or help section.

Further information about cookies is available on Wikipedia and other websites.