- Home
- Рrivacy policy
Рrivacy policy
1. General provisions
1.1. This Personal Data Processing Policy (hereinafter referred to as the Policy) is drawn up in accordance with the requirements of Federal Law No. 152-FZ dated 27.07.2006 "On Personal Data" (hereinafter referred to as the Personal Data Law) and defines the procedure for processing personal data and measures to ensure the security of personal data taken by BFZ JSC (hereinafter referred to as the Operator).
1.2. this Policy applies to personal data of the following categories of persons:
- Buyers who have ordered goods or services on the Site;
- Visitors to the Site who provided their personal data (including when filling out feedback forms, registering, using the Site services or accepting Cookies).
All such persons are referred to herein as "Users."
2. Basic concepts used in the Policy
2.1. Automated processing of Personal Data - processing of Personal Data using computer equipment.
2.2. site - the website of the aobfz.ru through which BFZ JSC sells its goods/services.
2.3. Processing of Personal Data - any action (operation) or a set of actions (operations) performed using automation means or without using such means with Personal Data, including collection, recording, systematization, accumulation, storage (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of Personal Data.
2.4. Operator - a person who processes Personal Data, as well as determines the purpose of processing Personal Data, the composition of Personal Data to be processed, actions (operations) performed with Personal Data.
2.5. Personal Data - any information relating directly or indirectly to a certain or defined Personal Data Subject.
2.6. Personal Data Subject - an individual who is directly or indirectly identified or determined using Personal Data.
2.7. cross-border transfer of Personal Data - transfer of Personal Data to the territory of a foreign state to the authority of a foreign state, a foreign individual or a foreign legal entity.
3. Rights and obligations of the Operator
3.1. the operator has the right:
- receive reliable information and/or documents containing Personal Data from the Personal Data Subject;
- independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of obligations stipulated by the Law on Personal Data and regulatory legal acts adopted in accordance with it, unless otherwise provided by the Law on Personal Data or other regulatory legal acts;
- in case the Personal Data Subject revokes the consent to Personal Data processing or sends a request to terminate Personal Data processing, the Operator has the right to continue Personal Data processing without the consent of the Personal Data Subject if there are grounds specified in the Personal Data Law.
3.2. the operator shall:
- provide the Personal Data Subject, at his request, with information concerning the processing of his Personal Data;
- organize the processing of Personal Data in the manner prescribed by the current legislation of the Russian Federation;
- respond to requests and requests of Personal Data Subjects and their legal representatives in accordance with the requirements of the Law on Personal Data;
- inform the authorized body for the protection of the rights of Personal Data Subjects at the request of this body of the necessary information within ten (10) days from the date of receipt of such request;
- publish or otherwise provide unrestricted access to this Policy;
- take legal, organizational and technical measures to protect Personal Data from illegal or accidental access to them, destruction, modification, blocking, copying, provision, distribution of Personal Data, as well as from illegal actions in relation to Personal Data;
- stop the transfer (provision, access) of Personal Data, stop processing and destroy Personal Data in the manner and cases provided for by the Law on Personal Data;
- perform other duties stipulated by the Law on Personal Data.
4. rights and obligations of Personal Data Subjects
4.1. Subjects of Personal Data have the right:
- receive information concerning the processing of their Personal Data, except as provided by law. The Information shall be provided to the Personal Data Subject by the Operator in an accessible form and shall not contain Personal Data related to other Personal Data Subjects, except for cases when there are legitimate grounds for disclosure of such Personal Data;
- require the Operator to clarify its Personal Data, block them or destroy them if the Personal Data are incomplete, outdated, inaccurate or are not necessary for the stated purpose of processing, as well as to take measures stipulated by law to protect their rights;
- withdrawal of consent to the processing of Personal Data, as well as sending a request to terminate the processing of Personal Data;
- appeal to the authorized body for the protection of the rights of Personal Data Subjects or in court against illegal actions or inaction of the Operator when processing his Personal Data;
- to exercise other rights provided for by the legislation of the Russian Federation.
4.2. Subjects of Personal Data shall:
- provide the Operator with reliable data about itself;
- inform the Operator about clarification (update, change) of their Personal Data.
4.3. Persons who provided the Operator with inaccurate information about themselves or information about another Personal Data Subject without the consent of the latter shall be liable in accordance with the legislation of the Russian Federation.
5. Principles of Personal Data Processing
5.1. Processing of Personal Data is carried out on a legal and fair basis.
5.2. The processing of Personal Data is limited to the achievement of specific, predetermined and legitimate goals. Processing of Personal Data incompatible with the purposes of collecting Personal Data is not allowed.
5.3. It is not allowed to combine databases containing Personal Data, the processing of which is carried out for purposes incompatible with each other.
5.4. only Personal Data that meet the purposes of its processing shall be processed.
5.5. The content and volume of Personal Data processed correspond to the stated purposes of processing. Redundancy of processed Personal Data in relation to the stated purposes of their processing is not allowed.
5.6. When processing Personal Data, the accuracy of Personal Data, their sufficiency, and, if necessary, relevance in relation to the purposes of processing Personal Data are ensured. The Operator shall take the necessary measures and/or ensure that they are taken to remove or clarify incomplete or inaccurate data.
5.7. Personal Data shall be stored in a form that allows to determine the Personal Data Subject, shall be stored no longer than the purposes of their processing require, if the period of storage of Personal Data is not established by the legislation of the Russian Federation, the contract to which the Personal Data Subject is a party.
5.8. Destruction or ensuring the destruction of Personal Data (if the processing of Personal Data is carried out by another person acting on behalf of the Operator) is carried out upon achievement of the goals of their processing or in case of loss of the need to achieve these goals, unless otherwise provided by the legislation of the Russian Federation.
6. Purposes of Personal Data Processing
6.1. the Operator shall process Personal Data for the following purposes:
6.1.1 Provision of Operator's services to Users and (or) purchase of Operator's goods.
(a) execution, performance and delivery of the User's orders;
(b) creating a personal account of the User;
(c) provision of consulting and technical support, feedback with the User;
(d) sending notices related to the execution of orders, as well as notifications about changes in the terms of use, technical updates and other significant events;
(e) fulfillment of obligations stipulated by the current legislation of the Russian Federation (including in the field of accounting, tax accounting, consideration of appeals of authorized state bodies);
(f) protect the seller's legitimate rights and interests, including prevention and investigation of fraud, dispute resolution and User's default;
(g) publication of User's reviews of goods/services (if any);
(h) analysis and improvement of the Site operation, improvement of services and determination of Users "preferences;
(i) consideration of the User's requests received through the forms on the Site or otherwise, and interaction with it.
List of personal data:
- User identifiers;
- surname, first name, patronymic;
- telephone number;
- e-mail address;
- delivery addresses;
- data of orders and preferences, including composition and cost of orders, order status, payment and delivery method, order history, date and time of ordering, payment details, compositions and history of baskets, comparison of goods and favorites;
- technical and analytical data, including IP address, browser and device information, cookies, site actions (clicks, events), sources of site navigation (referrers, UTM tags), geolocation (country, city);
- sign of agreement with documents;
- communications: correspondence between the Operator and the User (support);
- customer (user) feedback (if any).
Legal basis: Clause 4 of Part 1 of Art. of the Law on Personal Data - execution of the contract concluded with the Personal Data Subject, the User's consent to the use of Cookies, the User's consent to the processing of Personal Data, the User's consent to the distribution of Personal Data.
6.1.2. Marketing and advertising communications (if carried out by the Operator).
List of Personal Data:
- User identifiers;
- surname, first name, patronymic;
- telephone number;
- e-mail address;
- sign of agreement with documents.
Legal basis: the User's consent to receive advertising messages (in accordance with Part 1 of Article 18 of the Federal Law "On Advertising").
7. Terms of Personal Data Processing
7.1. Depending on the specific purposes of processing Personal Data specified in Clause 6.1 of this Policy, such processing may include, in particular, performing all or some of the following actions (operations) with personal data: collection (receipt), recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (distribution, provision, access), blocking, deletion, destruction of Personal Data.
7.2. For the purposes of processing Personal Data specified in clause 6.1 of this Policy, the following methods of processing Personal Data are provided:
- Automated processing of Personal Data (using computer equipment);
- non-automated processing of Personal Data (without the use of computer equipment) with recording of Personal Data on tangible media.
When processing Personal Data in an automated manner, the Operator shall take the necessary measures to ensure the security of the Personal Data being processed.
7.3. The terms of processing and storage of Personal Data for each purpose of processing Personal Data specified in clause 6.1 of this Policy shall be established taking into account compliance with the requirements of, including conditions of Personal Data processing defined by the legislation of the Russian Federation, and/or subject to the provisions of the contract, the party, beneficiary or surety under which the Personal Data Subject acts, and/or the consent of the Personal Data Subject to the processing of his Personal Data, Personal Data shall be processed and stored for no longer than than the purposes of Personal Data processing require, unless otherwise established by the legislation of the Russian Federation.
7.4. Destruction of Personal Data processed within the purposes specified in Clause 6.1 of this Policy shall be performed in the following cases:
- achievement of the purpose (s) of Personal Data processing or in case of loss of the need to achieve the purpose (s) of Personal Data processing, unless otherwise established by the Law on Personal Data and/or other applicable regulatory legal acts of the Russian Federation;
- revealing the fact of illegal processing of Personal Data;
- withdrawal by the Personal Data Subject of consent to the processing of Personal Data, unless otherwise provided by the Law on Personal Data;
- submission by the Personal Data Subject of a request to terminate the processing of Personal Data, unless otherwise established by the Law on Personal Data.
7.5. Destruction is carried out by carrying out actions as a result of which it becomes impossible to restore the content of Personal Data in information systems and/or as a result of which material media of Personal Data are destroyed.
7.6. The Operator may receive Personal Data from a third party and/or transfer (provision, access) Personal Data to a third party, as well as commission the processing of Personal Data to a third party, with the consent of the Personal Data Subject to the processing of Personal Data, including those provided to a third party or if there are other grounds provided for by the legislation of the Russian Federation.
Receipt of Personal Data by the Operator from a third party and/or transfer (provision, access) of Personal Data to a third party, as well as an order to process Personal Data to a third party shall be carried out on the basis of an appropriate agreement with a third party, including the conditions for processing Personal Data, requirements for ensuring confidentiality and security of Personal Data during their processing and other requirements in accordance with the legislation of the Russian Federation.
7.7. Cross-border transfer of Personal Data may be carried out by the Operator taking into account the conditions and restrictions established by the Law on Personal Data. Prior to the start of the Cross-Border Transfer of Personal Data, the Operator shall assess the measures taken by the third party to whom the Cross-Border Transfer of Personal Data is planned to ensure the confidentiality and security of Personal Data. The Operator shall notify the supervisory authority of the planned Cross-Border Transfer of Personal Data in the manner prescribed by the legislation of the Russian Federation.
7.8. The Operator has the right to post Personal Data on the Website with the consent of the Personal Data Subject. When giving consent, the Personal Data Subject shall have the right to establish conditions and prohibitions on the distribution of Personal Data. The relevant conditions and prohibitions on the distribution of Personal Data are published by the Operator on the Website.
8. Measures to ensure confidentiality and security of Personal Data
8.1. the Operator shall ensure confidentiality of Personal Data when processing Personal Data.
8.2. The security of Personal Data processed by the Operator shall be ensured through the implementation of legal, organizational and technical measures necessary to fully comply with the requirements of the current legislation in the field of Personal Data protection. In particular, the following measures are being taken:
- Personal Data Processing Policy has been developed;
- legal, organizational and technical measures to ensure the security of Personal Data are applied in accordance with Article 19 of the Federal Law "On Personal Data";
- internal control of Personal Data processing is performed;
- assessment of harm that may be caused to Personal Data Subjects;
- employees processing Personal Data are familiarized with the provisions of the legislation of the Russian Federation on Personal Data and internal regulatory documents (if the Operator has employees);
- employees are trained in the rules for working with Personal Data (if the Operator has employees).
- threats to the security of Personal Data are identified when they are processed in information systems;
- accounting of machine-readable media of Personal Data is ensured;
- control over the measures taken to ensure the security of Personal Data and the level of protection of Personal Data information systems;
- restricted access of unauthorized persons to premises intended for Personal Data processing.
9. Procedure for Consideration of Personal Data Subjects "Requests on Personal Data Processing
9.1. The User may contact the Operator regarding the processing of his Personal Data in the following cases:
- To obtain information concerning the processing of his (the Subject's) Personal Data:
- To clarify their Personal Data, their blocking or destruction, if they are incomplete, outdated, inaccurate, illegally obtained or are not necessary for the stated purpose of processing;
- To file a complaint about illegal processing of Personal Data by the Operator (Subject);
- To withdraw your consent to the processing of Personal Data.
9.2. The response to the request shall be sent to the Personal Data Subject or his representative within a period not exceeding ten (10) days from the date of the request with the possibility of extension up to five (5) business days.
9.3. In case of refusal to provide information or to carry out the action reflected in the request, a reasoned response is sent to the Personal Data Subject, containing a reference to the provision of Part 8 of Art. 14 of the Law on Personal Data or other legal norm that is the basis for such refusal, within a period not exceeding 10 (Ten) days from the date of the Personal Data Subject's or his representative's request.
10. Final provisions
10.1 The User may receive any clarifications on issues of interest related to the processing of his Personal Data by contacting the Operator via e-mail aobfz@bk.ru
10.2 The Operator shall have the right to amend this Policy. When making changes in the current edition, the date of the last update is indicated. The new version of the Policy comes into force from the moment of its placement, unless otherwise provided by the new version of the Policy. The current version of the Policy is freely available on the Internet on the Seller's Website.
