PRIVACY POLICY OF K2-9B GROUP LIMITED LIABILITY COMPANY
on personal data processing
1 Key terms used in the Policy
1.1 Automated processing of personal data means processing personal data using computer equipment.
1.2 Blocking of personal data means the temporary suspension of personal data processing, except where processing is required to clarify personal data.
1.3 Website means the collection of graphic and information materials, computer programs and databases that make them available on the Internet at https://k2-9b.com.
1.4 Depersonalisation of personal data means actions that make it impossible, without additional information, to determine that personal data belongs to a particular User or other personal data subject.
1.5 Processing of personal data means any action or set of actions performed with or without automation tools on personal data, including collection, recording, organisation, accumulation, storage, clarification (updating or amendment), retrieval, use, transfer (distribution, provision or access), depersonalisation, blocking, deletion and destruction.
1.6 Operator means a public authority, municipal authority, legal entity or individual that independently or jointly with others organises and/or carries out personal data processing and determines its purposes, the personal data to be processed and the actions performed on it.
1.7 Personal data means any information relating directly or indirectly to an identified or identifiable Website User (personal data subject).
1.8 Personal data authorised by the subject for distribution means personal data to which the subject has granted access to an unlimited number of persons by consenting to the processing of personal data authorised for distribution in accordance with the Personal Data Law.
1.9 User means any visitor to the Website.
1.10 Provision of personal data means actions aimed at disclosing personal data to a particular person or group of persons.
1.11 Distribution of personal data means any actions aimed at disclosing personal data to an indefinite number of persons or making it available to an unlimited number of persons, including publication in the media, placement in information and telecommunications networks or providing access by any other means.
1.12 Destruction of personal data means actions that irreversibly destroy personal data so that its content cannot be restored in a personal data information system and/or that destroy the physical media containing it.
1.13 IP address means the unique network address of a node in a computer network using the Internet Protocol.
2 General provisions
2.1 This Policy of K2-9B GROUP Limited Liability Company (the Company or Operator) on personal data processing has been developed under Clause 2, Part 1, Article 18.1 of Federal Law No. 152-FZ On Personal Data dated 27 July 2006 and other laws of the Russian Federation.
2.2 This Policy determines the procedure for processing users’ personal data and the measures used to protect personal data on the website owned, administered or used by K2-9B GROUP LLC, OGRN 1203600033691, registered address: Office 509, 10 Druzhinnikov Street, Voronezh, Voronezh Region, 394026, Russia: https://k2-9b.com.
2.3 This Policy applies to all personal data received by the Company and its employees from Website users, customers and their representatives (collectively or individually, Users or a User).
2.4 Principal rights and obligations of the Operator
2.4.1 The Operator has the right:
- to obtain reliable information and/or documents containing personal data from the personal data subject;
- if the subject withdraws consent or requests that processing cease, to continue processing without consent where grounds specified by the Personal Data Law exist;
- to determine independently the composition and list of measures necessary and sufficient to fulfil the obligations established by the Personal Data Law and regulations adopted under it, unless otherwise provided by law.
2.4.2 The Operator must:
- provide the personal data subject, at their request, with information concerning the processing of their personal data;
- organise personal data processing in accordance with the legislation of the Russian Federation;
- respond to requests from personal data subjects and their legal representatives in accordance with the Personal Data Law;
- provide the authorised personal data protection authority, at its request, with the necessary information within ten days after receiving the request;
- publish or otherwise provide unrestricted access to this Personal Data Processing Policy;
- take legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, amendment, blocking, copying, provision, distribution and other unlawful actions;
- cease transferring and processing personal data and destroy it in the procedure and cases established by the Personal Data Law;
- perform other duties established by the Personal Data Law.
2.5 Principal rights and obligations of Users
2.5.1 Personal data subjects have the right:
- to obtain explanations concerning the processing of their personal data by contacting the Operator or emailing info@k2-9b.com;
- to require the Operator to clarify or block personal data that is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated processing purpose, and to take legal measures to protect their rights;
- to require prior consent for personal data processing carried out to collect data for personalised Services;
- to withdraw consent and request that personal data processing cease;
- to challenge unlawful actions or omissions by the Operator before the authorised personal data protection authority or a court;
- to exercise other rights provided by Russian law.
2.5.2 Personal data subjects must:
- provide the Operator with accurate data about themselves;
- inform the Operator when their personal data is clarified, updated or changed.
3 Principles of personal data processing
3.1 The Operator processes personal data in accordance with the following principles:
- lawfulness and fairness;
- limiting processing to specific, predetermined and lawful purposes;
- preventing processing incompatible with the purposes for which personal data was collected;
- preventing the consolidation of databases containing personal data processed for incompatible purposes;
- processing only personal data that meets the purposes of processing;
- ensuring that the content and volume of personal data are consistent with the stated processing purposes;
- preventing the processing of personal data excessive in relation to the stated purposes;
- ensuring the accuracy, sufficiency and relevance of personal data;
- deleting personal data once processing purposes have been achieved or are no longer relevant, or where the Operator cannot remedy violations, unless otherwise provided by federal law.
4 Purposes of collecting personal data
4.1 Providing personalised Services to the User.
5 Legal grounds for personal data processing
5.1 Personal data is processed with the consent of the personal data subject.
5.2 Resolution of the Government of the Russian Federation No. 687 dated 15 September 2008, approving the regulations on non-automated personal data processing.
5.3 Federal Law No. 152-FZ On Personal Data dated 27 July 2006.
6 Scope and categories of personal data processed and categories of personal data subjects
6.1 The Website processes personal data belonging to the following category:
- Website Users.
6.2 The following data is collected, stored, transferred and processed:
- first name;
- last name;
- organisation name;
- contact details.
7 Procedure and conditions for personal data processing
7.1 The Operator may perform the following actions on personal data:
- collection;
- recording;
- organisation;
- accumulation;
- storage;
- clarification (updating or amendment);
- use;
- transfer (provision);
- blocking;
- destruction;
- deletion.
7.2 Personal data may be processed by automated and non-automated means.
7.3 The Operator may transfer personal data to investigative authorities and other authorised bodies on the grounds established by Russian law.
7.4 The Operator and other persons with access to personal data must not disclose it to third parties or distribute it without the subject’s consent, unless otherwise provided by federal law.
7.5 Personal data processing may be terminated when its purposes have been achieved, the subject’s consent expires or is withdrawn, the subject requests termination, or unlawful processing is identified.
7.6 Personal data is processed in a form that allows the subject to be identified only for as long as the processing purposes require, unless a different period is established by federal law or an agreement to which the subject is a party, beneficiary or guarantor.
7.7 When storing personal data, the Operator must use databases located in the Russian Federation where the collection of Russian citizens’ personal data is concerned.
7.8 Cross-border transfer of personal data is not carried out.
8 Personal data security
8.1 The Operator ensures personal data security through legal, organisational and technical measures necessary to comply fully with applicable personal data protection law.
8.2 To prevent unauthorised access, the Operator applies organisational and technical measures including:
- appointing persons responsible for organising processing and protecting personal data;
- limiting the number of employees authorised to process personal data;
- familiarising employees with federal personal data law and the Operator’s internal rules;
- organising the accounting, storage and handling of media containing personal data;
- identifying security threats and developing threat models;
- developing a personal data protection system based on the threat model;
- testing the readiness and effectiveness of information security tools;
- restricting user access to information resources and processing hardware and software;
- recording and logging the actions of personal data information system users;
- using antivirus software and recovery tools;
- where necessary, using firewalls, intrusion detection, vulnerability analysis and cryptographic information protection tools;
- controlling physical access to the Operator’s premises containing personal data processing equipment;
- organising non-automated processing so that storage locations and authorised persons can be identified for each category of personal data;
- storing physical media separately where the personal data is processed for different purposes;
- ensuring the security of physical media and preventing unauthorised access;
- informing persons carrying out non-automated processing about the fact, categories, rules and special requirements of such processing.
9 Storage, use, updating, correction, deletion and destruction of personal data; responses to data-subject access requests
9.1 If unlawful processing is identified following a request by a personal data subject, their representative or the authorised authority, the Operator must block the relevant unlawfully processed data, or ensure that it is blocked by a processor acting on the Operator’s behalf, for the duration of the review. If inaccurate data is identified, the Operator must similarly block it for the duration of the review, provided that blocking does not violate the rights and legitimate interests of the subject or third parties.
9.2 If personal data is confirmed to be inaccurate, the Operator must clarify it, or ensure that a processor acting on its behalf clarifies it, on the basis of information supplied by the subject, their representative, the authorised authority or other necessary documents, within seven business days after receiving that information, and must then remove the block.
9.3 If unlawful processing is identified, the Operator must stop it, or ensure that a processor acting on its behalf stops it, within three business days. If processing cannot be made lawful, the Operator must delete the personal data, or ensure that it is deleted, within ten business days and notify the subject or representative and, where applicable, the authorised authority that referred the request.
9.4 If the subject withdraws consent, the Operator must stop processing or ensure that processing stops and, where storage is no longer required, delete the personal data or ensure its deletion within thirty days, unless continued processing is permitted by an agreement or by federal law without consent.
9.5 At the subject’s request, the Operator must provide the subject or representative with information about the processing of that subject’s personal data in accordance with Article 20 of Federal Law No. 152-FZ.
9.6 Requests may be sent to the Company:
- by signed letter to Office 509, 10 Druzhinnikov Street, Voronezh, Voronezh Region, 394026, Russia;
- by email to info@k2-9b.com.
9.7 Within the periods and procedure established by Federal Law No. 152-FZ and the Company’s internal regulations, the Company reviews requests and makes the required amendments or stops processing, blocks or deletes personal data unless otherwise established by federal law.
9.8 Responses are sent in the form in which the corresponding request was received unless the request specifies otherwise.
9.9 The Company retains personal data collected to provide personalised Services for the period required to fulfil the processing purpose, but no longer than two years after the last interaction, except where an effective agreement, legal proceedings or a statutory requirement permits continued processing and the User is notified.
9.10 Users’ personal data is stored exclusively on electronic media and processed using automated systems, except where non-automated processing is required to comply with law.
9.11 When personal data processed without automation is clarified, it is updated or amended on the physical medium or, if the medium does not permit this, the amendment is recorded on the same medium or a new medium containing the clarified data is produced.
9.12 Destruction of part of the personal data, where permitted by the physical medium, may be performed in a way that prevents further processing of that data while allowing other data recorded on the same medium to continue to be processed.
10 Final provisions
10.1 Employees of the Operator who violate personal data processing and protection rules are liable in accordance with federal law and the Operator’s internal regulations.
10.2 The Company may amend the Policy. The User must review it each time the Website is used.
10.3 The Policy is a publicly available document. Its current version takes effect when it is made freely available at https://k2-9b.com/privacy.
Full legal name: K2-9B GROUP Limited Liability Company
Short name: K2-9B
Registered address: Office 509, 10 Druzhinnikov Street, Voronezh, Voronezh Region, 394026, Russia
Postal address: Office 509, 10 Druzhinnikov Street, Voronezh, Voronezh Region, 394026, Russia
INN 3662288650
OGRN 1203600033691
Telephone/fax: +7 (952) 106-09-12
Email: info@k2-9b.com
The Russian-language Policy is the controlling version. This complete English translation is provided for convenience.