Policy on the Processing of Personal Data

1. General Provisions

1.1. This Policy on the Processing of Personal Data (hereinafter, the “Policy”) sets out the procedure and conditions for the processing of personal data by ZHATVA Limited Liability Company (INN 6900017801, OGRN 1256900001016, address: 47 Burashevskoye Shosse, Tver, Tver Region, 170016; hereinafter, the “Operator”) and the measures taken to ensure its security.

1.2. The Policy has been developed in accordance with Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” (hereinafter, the “Law”) and is published in open access at https://zhatvarussia.ru/policy pursuant to Article 18.1(2) of the Law.

1.3. The Policy applies to all personal data that the Operator receives from Users of the website https://zhatvarussia.ru (hereinafter, the “Website”), including when placing Orders, using the Personal Account, participating in the loyalty programme, purchasing gift certificates, submitting requests, and when exchanging messages by email, SMS and messaging apps.

1.4. The Operator is entered in the register of operators processing personal data under registration number 69-25-021279.

1.5. By using the Website and providing their personal data to the Operator, the User confirms that they have read the Policy.

2. Terms

Personal data: any information relating directly or indirectly to an identified or identifiable individual (the personal data subject).

User: an individual using the Website: a visitor, a Buyer, the holder of a Personal Account, a person who has submitted a request, and also the recipient of an Order or gift certificate whose details were provided by the Buyer.

Processing of personal data: any action performed with personal data, with or without the use of automated means: collection, recording, systematisation, accumulation, storage, clarification, retrieval, use, transfer (provision, access), depersonalisation, blocking, deletion, destruction.

Processor: a person who processes personal data on behalf of the Operator under a contract (Article 6(3) of the Law).

Personal Account: a section of the Website to which the User gains access using a telephone number and a one-time code sent by SMS.

Order, Buyer, Seller: as defined in the Public Offer (https://zhatvarussia.ru/oferta).

3. Personal Data Processed

3.1. The Operator processes only the personal data necessary for the purposes listed in Section 4. The Operator does not collect or process special categories of personal data (concerning health, racial or ethnic origin, political or religious views) or biometric personal data. Information about the User’s state of health provided by the User in the text of an enquiry is used solely to respond to that enquiry and is not stored in the User’s account.

3.2. Data provided by the User:

when placing an Order: surname, first name, telephone number, email address, delivery address or selected pick-up point, contents and cost of the Order, selected payment and delivery methods, and any promo code, points and certificate applied;

when using the Personal Account: telephone number, name, email address, delivery address, Order history, points balance and tier in the loyalty programme, saved cart and favourites;

when paying for an Order: information about the selected payment system and the last four digits of the bank card number, if the User has chosen to save the card. Full bank card details are not transferred to the Operator: they are processed by the Robokassa payment service on its side;

when purchasing a gift certificate: the Buyer’s telephone number and email address, the recipient’s name and telephone number, the sender’s name, the greeting message, and the face value and design of the certificate;

when submitting a request for a consultation or a call-back: name, telephone number, email address, selected contact method, text of the enquiry, answers to the questions for selecting a supplement set.

3.3. Data obtained automatically when using the Website: IP address, information about the device, operating system and browser, date and time of access, addresses of the pages requested, technical cookie data (Section 9).

3.4. The User is responsible for the accuracy and currency of the data provided. The Operator is not obliged to verify the accuracy of the data provided by the User and proceeds on the basis that it is accurate.

3.5. By providing the details of another person (the recipient of an Order or gift certificate), the User warrants that they have obtained that person’s consent to the transfer of their data to the Operator and its processing for the purpose of performing the agreement, and is liable to that person for the consequences of providing the data without their consent.

4. Purposes, Legal Grounds and Periods of Processing

4.1. Conclusion and performance of the retail sale and purchase agreement: placing, payment, picking, delivery and handover of the Order, sending service messages about its progress, handling claims and returns. Data: clause 3.2 (Order, payment). Legal ground: Article 6(1)(5) of the Law — processing is necessary for the performance of an agreement to which the User is a party; consent is not required. Period: 5 years from the performance of the agreement — the retention period for contracts with customers and primary accounting documents established by Order of Rosarkhiv No. 236 of 20.12.2019 and Article 23 of the Tax Code of the Russian Federation.

4.2. Maintaining the Personal Account and participation in the “Harvest” loyalty programme: recording Orders, earning and redeeming points, determining the tier, storing the cart and address. Data: clause 3.2 (Personal Account). Ground: Article 6(1)(5) of the Law — agreement (Loyalty Programme Rules, https://zhatvarussia.ru/loyalty). Period: for the entire lifetime of the Personal Account and 5 years after its deletion at the User’s request — as regards information about Orders, the retention period for which is established by law.

4.3. Issuing and delivering a gift certificate and applying it when paying for an Order. Data: clause 3.2 (certificate). Ground: Article 6(1)(5) of the Law — agreement with the Buyer; with regard to the recipient, an agreement under which the recipient is the beneficiary. Period: until the certificate has been fully used and thereafter 5 years together with the sales documents.

4.4. Sending service messages: the login code for the Personal Account, notifications of payment, dispatch, arrival, cancellation of the Order and refunds, the till receipt. Ground: Article 6(1)(5) of the Law — agreement; Federal Law No. 54-FZ of 22.05.2003. Such messages are not advertising and cannot be opted out of without withdrawing from the agreement. Period: together with the Order data.

4.5. Handling requests and enquiries: answering a question about the products, an Order or cooperation via the channel chosen by the User. Data: clause 3.2 (request). Ground: the User’s consent (Article 6(1)(1) of the Law), expressed by ticking a box in a form on the Website. Period: for the duration of the consent — until it is withdrawn by the User, but no more than 5 years from the date of the enquiry.

4.6. Promotion of the Operator’s goods: sending advertising and information messages about new products, promotions, discounts and personal offers by email, SMS and messaging apps. Data: name, telephone number, email address, Order history, tier in the loyalty programme. Ground: the User’s separate prior consent (Article 15(1) of the Law, Article 18(1) of Federal Law No. 38-FZ of 13.03.2006 “On Advertising”), expressed by ticking a box in the Order form or in the Personal Account; the box is not ticked by default. Period: until consent is withdrawn. The Operator keeps the date and method by which consent was obtained as proof.

4.7. Ensuring the operation and security of the Website: protection against fraud, automated Orders and guessing of login codes, analysis of technical failures. Data: clause 3.3. Ground: Article 6(1)(7) of the Law — the Operator’s legitimate interests. Period: no more than 6 months.

4.8. Fulfilment of obligations imposed on the Operator by law: accounting and tax records, use of cash register equipment, responses to requests from authorised state bodies. Ground: Article 6(1)(2) of the Law. Period: as established by the relevant law.

4.9. The Operator does not make decisions giving rise to legal consequences for the User on the basis of solely automated processing of their personal data.

5. Transfer of Personal Data to Third Parties

5.1. The Operator does not sell personal data and does not transfer it to third parties for purposes not specified in Section 4. Personal data is transferred only to the persons specified in this section and only to the extent necessary for the relevant purpose.

5.2. Independent operators — persons processing personal data for their own purposes on the basis of the law or an agreement with the User:

delivery services — CDEK, Yandex Delivery and other carriers chosen by the Buyer when placing the Order: surname, first name, telephone number, delivery address or pick-up point, weight and dimensions of the shipment;

the Robokassa payment service: Order amount and number, contents of the till receipt, email address for sending the receipt; bank card details are entered by the User on the payment service’s side;

authorised state bodies — at their request in cases established by law.

5.3. Processors — persons acting on behalf of the Operator under a contract that obliges them to maintain confidentiality and comply with the requirements of Article 19 of the Law:

the SigmaSMS SMS gateway — delivery of login codes, certificate links and service SMS messages: telephone number, message text;

an email service — delivery of emails about Orders, certificates and requests: email address, name, contents of the email;

the DaData address suggestion service — the delivery address entered by the User, to generate suggestions;

the Telegram messenger — notifying an employee of the Operator about a new request: name, telephone number, contact method, text of the enquiry;

the hosting provider Beget — hosting of the Website and the database.

5.4. The list of recipients of personal data is updated when the set of services used by the Operator changes, stating the date of the new version of the Policy.

6. Measures to Ensure the Security of Personal Data

6.1. The Operator takes the legal, organisational and technical measures necessary to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful actions, including:

appointing a person responsible for organising the processing of personal data;

issuing internal regulations on the processing and protection of personal data and familiarising employees with them;

access control: access to personal data is granted only to employees who need it to perform their duties, through individual accounts;

transferring data between the User and the Website only over the secure HTTPS protocol;

logging in to the Personal Account with a one-time code of limited validity, with a limited number of entry attempts; the code itself is stored only as a hash;

excluding the processing of bank card details by the Operator: they are processed by a payment service certified to the PCI DSS standard;

recording and storing personal data in conditions that ensure its safety.

6.2. In the event of an unlawful or accidental transfer of personal data that has resulted in a violation of the rights of data subjects, the Operator notifies the authorised body within 24 hours, and of the results of the internal investigation within 72 hours (Article 21(3.1) of the Law).

7. Rights of the Personal Data Subject and Procedure for Handling Requests

7.1. The User has the right to:

receive the information about the processing of their personal data provided for by Article 14(7) of the Law;

demand that personal data be clarified, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing;

withdraw consent to the processing of personal data where the processing is based on consent (clauses 4.5, 4.6);

demand that the processing of personal data be stopped;

appeal against the actions or omissions of the Operator to the authorised body for the protection of the rights of personal data subjects (Roskomnadzor) or in court.

7.2. Requests are sent to the email address zhatva.russia@mail.ru or by post to the Operator’s address. A request must contain information allowing the User to be identified: the telephone number or email address specified in the Personal Account, Order or request. The Operator may leave a request sent from another address or without such information unfulfilled until the applicant’s identity is confirmed.

7.3. Time limits for handling requests:

providing information about processing — 10 business days from the date the request is received; this period may be extended by no more than 5 business days with a reasoned notice being sent;

clarification, blocking or destruction of incomplete, inaccurate or unlawfully obtained data — 7 business days from the date supporting information is provided;

withdrawal of consent — the processing is stopped and the data destroyed within 30 days of the date the withdrawal is received, unless the data is subject to further processing on another ground;

withdrawal of consent to advertising mailings — immediately; it is also possible to opt out via the link in an email, in the Personal Account or by replying “Стоп” (“Stop”) to an SMS.

7.4. Withdrawal of consent and a demand to stop processing do not apply to data processed on the basis of an agreement or the law (clauses 4.1–4.4, 4.8): such data continues to be processed for the established periods, after which it is destroyed or depersonalised.

8. Storage and Destruction of Personal Data

8.1. Personal data is stored in a form that allows the data subject to be identified for no longer than the purposes of processing require, for the periods specified in Section 4.

8.2. When the purposes of processing have been achieved, the retention period has expired or consent has been withdrawn (as regards data processed on the basis of consent), personal data is destroyed or depersonalised. Data processed in information systems is destroyed by deletion; the fact of destruction is recorded in a certificate or an extract from the system log (Roskomnadzor Order No. 179 of 28.10.2022).

8.3. The Website database is hosted by a hosting provider; only authorised employees of the Operator have access to it.

9. Cookies

9.1. The Website uses technical cookies and browser local storage necessary for its operation: storing the contents of the cart and favourites, maintaining the Personal Account session, and remembering that the cookie notice has been read. Without them the Website cannot perform its functions, so their use does not require separate consent.

9.2. No web analytics counters or advertising pixels are installed on the Website. If a web analytics service (Yandex Metrica) is connected, the Operator will request the User’s consent in the cookie notice before data collection begins and will supplement this section.

9.3. The User can disable cookies in the browser settings; in this case the cart and logging in to the Personal Account will be unavailable.

10. Final Provisions

10.1. The Operator may amend the Policy. A new version takes effect from the moment it is published on the Website, stating the date of the version. By continuing to use the Website after a new version is published, the User confirms that they have read it.

10.2. Questions relating to the processing of personal data are sent to the person responsible for organising the processing of personal data at zhatva.russia@mail.ru or by telephone on +7 929 099 40 44 (Mon–Fri, 9:00–18:00 Moscow time).

10.3. Operator’s details: ZHATVA LLC, INN 6900017801, OGRN 1256900001016, 47 Burashevskoye Shosse, Tver, Tver Region, 170016.