Privacy Policy

Policy of the Limited Liability Company
LLC “Arkus‑Holding” regarding the processing of personal data

General provisions
This personal data processing policy is drawn up in accordance with the requirements of Federal Law No. 152‑FZ dated 27.07.2006 “On Personal Data” (hereinafter — the Personal Data Law) and defines the procedure for processing personal data and measures to ensure the security of personal data. It was developed in compliance with the requirements of clause 2, part 1, article 18.1 of Federal Law No. 152‑FZ dated 27.07.2006 “On Personal Data” (hereinafter — the Personal Data Law) in order to ensure the protection of human and civil rights and freedoms during the processing of their personal data, including the right to privacy, personal and family secrets.
1.1. This policy applies to all personal data processed by the Limited Liability Company “Arkus‑Holding”.

1.2. This Operator’s policy regarding the processing of personal data (hereinafter — the Policy) applies to all information that the Operator may obtain about visitors to the website . The Operator does not control and is not responsible for third‑party websites to which the User may navigate via links available on the website.

1.3. In compliance with the requirements of part 2, article 18.1 of the Personal Data Law, this Policy is published in free access in the information and telecommunications network Internet on the Operator’s website.

Key terms used in the Policy
2.1. Automated processing of personal data — processing of personal data using computer equipment.

2.2. Blocking of personal data — temporary suspension of personal data processing (except where processing is necessary to clarify the personal data).

2.3. Website — a set of graphic and informational materials, as well as computer programs and databases ensuring their availability on the Internet via the network address .

2.4. Personal data information system — a set of personal data contained in databases and the information technologies and technical means ensuring their processing.

2.5. Depersonalisation of personal data — actions as a result of which it becomes impossible to identify the owner of the personal data without additional information — i.e., to determine to which specific User or other personal data subject the personal data belong.

2.6. Processing of personal data — any action (operation) or set of actions (operations) performed with personal data, with or without the use of automation tools, including collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalisation, blocking, deletion, and destruction of personal data.

2.7. Operator — a state body, municipal body, legal entity or individual who, alone or jointly with others, organises and/or carries out the processing of personal data and determines the purposes of personal data processing, the scope of personal data to be processed, and the actions (operations) to be performed with the personal data.

2.8. Personal data — any information directly or indirectly relating to a specific or identifiable User of the website.

2.9. Personal data authorised by the personal data subject for distribution — personal data to which an unlimited number of persons have been granted access by the personal data subject through giving consent to the processing of personal data authorised for distribution in the manner prescribed by the Personal Data Law (hereinafter — personal data authorised for distribution).

2.10. User — any visitor to the website.

2.11. Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific group of persons.

2.12. Distribution of personal data — any actions aimed at disclosing personal data to an indefinite group of persons (transfer of personal data) or at making personal data available to an unlimited number of persons, including publication of personal data in the media, placement in information and telecommunications networks, or providing access to personal data in any other way.

2.13. Cross‑border transfer of personal data — transfer of personal data to the territory of a foreign state to a foreign government authority, foreign individual, or foreign legal entity.

2.14. Destruction of personal data — any actions resulting in the irreversible destruction of personal data with no possibility of further recovery of the data content in the personal data information system and/or the destruction of physical media containing personal data.

2.15. Cookies — data automatically transmitted to LLC “Arkus‑Holding” during the use of the Website via the software installed on the User’s device, including the IP address, geographical location, browser information and type of operating system of the User’s device, technical characteristics of the hardware and software used by the User, and the date and time of access to the Website. By accepting the terms of the Policy, you agree to the use of cookies.

2.16. The legal grounds for the Operator to process personal data are:

The Constitution of the Russian Federation;
The Civil Code of the Russian Federation;
The Labour Code of the Russian Federation;
The Tax Code of the Russian Federation;
Federal Law No. 14‑FZ dated 08.02.1998 “On Limited Liability Companies”;
Federal Law No. 402‑FZ dated 06.12.2011 “On Accounting”;
Federal Law No. 167‑FZ dated 15.12.2001 “On Compulsory Pension Insurance in the Russian Federation”;
Federal Law No. 149‑FZ dated 27.07.2006 “On Information, Information Technologies and Information Protection”;
Resolution of the Government of the Russian Federation No. 119 dated 01.11.2012 “On Approval of Requirements for the Protection of Personal Data during Their Processing in Personal Data Information Systems”;
Resolution of the Government of the Russian Federation No. 687 dated 15.09.2008 “On Approval of the Regulations on the Specifics of Personal Data Processing without the Use of Automation Tools”;
Order of FSTEC of Russia No. 21 dated 18.02.2013 “On Approval of the Composition and Content of Organisational and Technical Measures to Ensure the Security of Personal Data during Their Processing in Personal Data Information Systems”;
Other applicable regulatory legal acts;
The Charter of the Limited Liability Company “Arkus‑Holding”;
Local regulatory acts of the Operator regarding the processing and security of personal data;
Agreements concluded between the Operator and the personal data subject;
Consent of the personal data subject to the processing of personal data.

The Website Operator acts as the operator only for those personal data it receives from Website Users during the use of the Website with their consent, provided by the User through conclusive actions on the Website.
2.17. The Website Operator does not verify the accuracy of the personal data provided by the Website User on the Website. The Website Operator assumes that the Website User provides accurate and sufficient personal data and keeps this information up to date. The Website User bears full responsibility for the consequences of providing inaccurate or invalid personal data.

2.18. The Website User confirms that, by providing their personal data and giving consent to its processing and transfer, they act voluntarily, of their own free will and in their own interest, or in the interest of their minor child, and also confirms their legal capacity.

2.19. The personal data authorised for processing under the Policy are not special or biometric data; they are provided by the Website User by filling out special forms on the Website on an indefinite basis (until the Website User revokes their consent to the processing of personal data). Depending on the web form filled out by the User, the data include the following information:

Non‑special and non‑biometric personal data: surname, first name, patronymic; place of employment and position; email address; contact phone numbers; information about the email client; information about the browser used;
Information about clicks on links in emails; location information; information about IP addresses from which the User opens the email.

By filling out the relevant web forms and/or sending their personal data to the Website Operator, the Website User expresses their consent to the Privacy Policy.
2.20. The use of the Website’s services by the Website User constitutes their unconditional consent to the Privacy Policy and the terms for processing the Website User’s personal data.

2.21. If the Website User disagrees with the terms of the Policy, they must stop using the Website.

2.22. Methods for giving consent to the terms specified in this Policy:

2.22.1. The Website User gives consent to the processing of personal data when using the website in accordance with this Policy by checking the “I agree” box or an equivalent option during registration, or by clicking on the Website interface in other parts where it is indicated that data submission is carried out under the terms of this Policy.

2.22.2. Giving such consent by the Website User also means consent to:
receiving newsletters and promotional materials from the Website Operator or other persons acting on its behalf, to the email address and contact phone number (including via calls and SMS messages, push notifications) specified by the Website User during registration on the Website; receiving by the Website Operator of the Website User’s personal data from third parties in order to provide the Website User with functional service capabilities for receiving (including based on search results) product offers and information relevant to the Website User’s interests; recording of telephone conversations with the Website Operator to improve the quality of service and to preserve evidence in case of disputes between the Website Operator and the Website User.

2.22.3. Employees give consent to this Policy upon hiring by the Website Operator by reading it and signing the coordination sheet, as well as by signing a consent to the processing of personal data in the form provided by the Website Operator. Consent may be given using a simple electronic signature in accordance with the Operator’s local acts.

2.22.4. We do not process the personal data of minors (under 18 years of age in the Russian Federation or another age threshold in other jurisdictions) without the consent of their parents or legal representatives.

Main rights and obligations of the Operator
3.1. The Operator has the right to:

Obtain reliable information and/or documents containing personal data from the personal data subject;
In the event that the personal data subject revokes consent to the processing of personal data or submits a request to terminate the processing of personal data, the Operator has the right to continue processing the personal data without the subject’s consent if grounds specified in the Personal Data Law exist;
Independently determine the composition and list of measures necessary and sufficient to fulfil the obligations provided for by the Personal Data Law and regulatory acts adopted in accordance with it, unless otherwise provided by the Personal Data Law or other federal laws.

3.2. The Operator is obliged to:

Provide the personal data subject, upon their request, with information concerning the processing of their personal data;
Organise the processing of personal data in accordance with the applicable legislation of the Russian Federation;
Respond to appeals and requests from personal data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
Provide the authorised body for the protection of personal data subjects, upon its request, with the necessary information within 10 days from the date of receipt of such a request;
Publish or otherwise ensure unrestricted access to this Policy regarding the processing of personal data;
Take legal, organisational and technical measures to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, provision, distribution of personal data, as well as from other unlawful actions regarding personal data;
Cease the transfer (distribution, provision, access) of personal data, stop processing and destroy personal data in the manner and cases provided for by the Personal Data Law;
Fulfil other obligations provided for by the Personal Data Law.

Main rights and obligations of personal data subjects
4.1. Personal data subjects have the right to:

Receive information concerning the processing of their personal data, except in cases provided for by federal laws. The information is provided to the personal data subject by the Operator in an accessible form and must not contain personal data relating to other personal data subjects, except where there are legal grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Personal Data Law;
Request the Operator to clarify their personal data, block it or destroy it if the personal data is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing, and to take measures to protect their rights as provided by law;
Withdraw consent to the processing of personal data and submit a request to terminate the processing of personal data;
If the Website Operator refuses to delete or correct the Users’ personal data, Users have the right to submit a written statement to the Website Operator expressing their disagreement with appropriate justification; withdraw their consent to the processing of personal data;
Challenge in court any unlawful actions or inaction by the Operator or a person authorised by them carried out during the processing and protection of the subject’s personal data;
Challenge unlawful actions or inaction by the Operator during the processing of their personal data with the authorised body for the protection of personal data subjects or in court;
Exercise other rights provided for by the legislation of the Russian Federation.

4.2. Personal data subjects are obliged to:

Provide the Operator with accurate data about themselves;
Inform the Operator about any clarification (update, change) of their personal data.

4.3. Persons who provide the Operator with inaccurate information about themselves or information about another personal data subject without their consent shall be liable in accordance with the legislation of the Russian Federation.

Principles of personal data processing
5.1. Personal data processing is carried out on a lawful and fair basis.

5.2. Personal data processing is limited to achieving specific, predefined and lawful purposes. Processing of personal data incompatible with the purposes for which the personal data was collected is not permitted.

5.3. Merging databases containing personal data that are processed for incompatible purposes is not permitted.

5.4. Only personal data relevant to the purposes of their processing shall be processed.

5.5. The Operator independently determines the composition and list of measures necessary and sufficient to ensure compliance with the requirements of the legislation of the Russian Federation. In particular, the Operator has taken the following measures:

Contracts concluded between the Operator and counterparties include an obligation of the parties to comply with the confidentiality requirements for personal data established by article 7 of Federal Law No. 52‑FZ, as well as information on the measures taken by the parties as provided for in part 2 of article 18.1 and part 1 of article 19 of the Federal Law “On Personal Data”. A person responsible for organising the processing of personal data has been appointed;
Officials responsible for ensuring compliance with local regulations on personal data processing within departments have been appointed;
Local acts on personal data processing have been developed and implemented, as well as local acts establishing procedures aimed at preventing and detecting violations of established personal data processing procedures and eliminating the consequences of such violations. Legal, organisational and technical measures are applied to ensure the security of personal data.