Privacy Policy Regarding the Personal Data of Visitors to the Website of LTD "OMB"
1. General Provisions
1.1. This Policy regarding the processing of personal data (hereinafter the "Policy") has been prepared in accordance with Clause 2, Part 1, Article 18.1 of the Federal Law of the Russian Federation "On Personal Data" No. 152-FZ dated 27 July 2006 (hereinafter the "Law") and sets out the position of the legal entity Limited Trade Development "OMB" (PSRN: 1037739359305, TIN: 7730039620, registered address: 125124, Moscow, Pravdy St., 26) and/or its affiliated persons (hereinafter the "Company") in the area of the processing and protection of personal data (hereinafter the "Data"), and the observance of the rights and freedoms of every individual and, in particular, the right to inviolability of private life and to personal and family confidentiality.
2. Scope of Application
2.1. This Policy shall apply to Data obtained both prior to and following the entry into force of this Policy.
2.2. Recognising the importance and value of Data, and being mindful of the observance of the constitutional rights of citizens of the Russian Federation and citizens of other States, the Company ensures the reliable protection of Data.
3. Definitions
3.1. "Data" means any information relating, directly or indirectly, to a determined or determinable natural person (citizen), namely, such information shall include, in particular: surname, first name, patronymic, e-mail address, telephone number, location, IP address, and so forth.
3.2. "Processing of Data" means any action (operation) or set of actions (operations) performed with respect to Data, whether or not by automated means. Such actions (operations) shall include: collection, recording, systematisation, accumulation, storage, refinement (updating, alteration), retrieval, use, transfer (dissemination, provision, access), depersonalisation, blocking, deletion, and destruction of Data.
3.3. "Security of Data" means the protection of Data against unlawful and/or unauthorised access thereto, destruction, alteration, blocking, copying, provision, dissemination of Data, as well as against other unlawful actions with respect to Data.
4. Legal Grounds and Purposes of the Processing of Data
4.1. The processing and the ensuring of the security of Data within the Company are carried out in accordance with the requirements of the Constitution of the Russian Federation, the Law, the Labour Code of the Russian Federation, subordinate regulatory acts, other federal laws of the Russian Federation determining the cases and particularities of the processing of Data, and the governing and methodological documents of the FSTEC of Russia and the FSB of Russia.
4.2. The data subjects whose Data are processed by the Company are: clients – consumers, including visitors to the website https://en.omb.ru/, as well as related pages within the domain name omb.ru belonging to the Company, including for the purpose of placing an order for goods, works, or services on the Website with subsequent delivery to the client.
4.3. The Company processes the Data of data subjects for the following purposes: performance of the functions, powers, and obligations imposed upon the Company by the legislation of the Russian Federation in accordance with federal laws, including but not limited to: the Civil Code of the Russian Federation, the Tax Code of the Russian Federation, the Labour Code of the Russian Federation, the Family Code of the Russian Federation, Federal Law No. 27-FZ dated 01.04.1996 "On Individual (Personalised) Records in the Mandatory Pension Insurance System," Federal Law No. 152-FZ dated 27.07.2006 "On Personal Data," Federal Law No. 53-FZ dated 28.03.1998 "On Military Duty and Military Service," Federal Law No. 31-FZ dated 26.02.1997 "On Mobilisation Preparation and Mobilisation in the Russian Federation," Federal Law No. 14-FZ dated 08.02.1998 "On Limited Liability Companies," Federal Law No. 2300-1 dated 07.02.1992 "On the Protection of Consumer Rights," Federal Law No. 129-FZ dated 21.11.1996 "On Accounting," Federal Law No. 326-FZ dated 29.11.2010 "On Mandatory Medical Insurance in the Russian Federation"; and of clients – consumers, for the purposes of:
4.3.1. providing information on goods/services, ongoing promotions, and special offers;
4.3.2. analysing the quality of the service provided by the Company and improving the quality of service to the Company's clients;
4.3.3. informing about the status of an order;
4.3.4. performance of a contract, including a contract of sale and purchase, including one concluded by means of distance selling on the Website, and a contract for the provision of services for consideration; the provision of services, as well as the accounting of services rendered to consumers for the purposes of mutual settlements;
4.3.5. delivery of ordered goods to the client who placed the order on the Website, and the return of goods;
4.3.6. creation of an account, authorisation, and recovery of a user's lost access to an account on the website;
4.3.7. analysis of the operation of the website and its individual pages;
4.3.8. assessment of website traffic;
4.3.9. fulfilment of obligations to users and the provision of information.
5. Principles and Conditions of the Processing of Data.
5.1. In processing Data, the Company adheres to the following principles: the processing of Data is carried out on a lawful and fair basis; Data are not disclosed to third parties and are not disseminated without the consent of the data subject, save for cases requiring the disclosure of Data at the request of authorised State bodies or in the course of legal proceedings; the determination of specific lawful purposes prior to the commencement of the processing (including the collection) of Data; only such Data are collected as are necessary and sufficient for the declared purpose of processing; the consolidation of databases containing Data, the processing of which is carried out for purposes incompatible with one another, is not permitted; the processing of Data is limited to the achievement of specific, predetermined, and lawful purposes; the Data processed are subject to destruction or depersonalisation upon achievement of the purposes of processing or in the event of loss of the need to achieve those purposes, unless otherwise provided by federal law.
5.2. The Company may include the Data of data subjects in publicly accessible sources of Data, in which case the Company obtains the written consent of the data subject to the processing of his/her Data, or by means of the expression of consent through a website form (a checkbox), by clicking which the personal data subject expresses his/her consent.
5.3. The Company does not process Data concerning racial or ethnic origin, political views, religious, philosophical, or other beliefs, intimate life, or membership in public associations, including trade unions.
5.4. Biometric Data (information characterising the physiological and biological features of a person, on the basis of which his/her identity may be established and which are used by the operator to establish the identity of the data subject) are not processed within the Company.
5.5. The Company does not carry out cross-border transfer of Data.
5.6. In the cases established by the legislation of the Russian Federation, the Company shall be entitled to transfer Data to third parties (the Federal Tax Service, the State Pension Fund, and other State bodies) in the cases provided for by the legislation of the Russian Federation.
5.7. In cases not established by Clause 5.6, the Company shall be entitled to entrust the processing of the Data of data subjects to third parties with the consent of the data subject, on the basis of a contract concluded with such persons, including upon agreement with the user agreement and the personal data processing policy posted on the website. Consent to the processing of data by third parties is provided by data subjects separately.
5.8. Persons carrying out the processing of Data on the basis of a contract concluded with the Company (an operator's instruction) undertake to observe the principles and rules of the processing and protection of Data provided for by the Law. For each third party, the contract shall define the list of actions (operations) with respect to Data to be performed by the third party carrying out the processing of Data, the purposes of processing, shall establish the obligation of such person to observe confidentiality and to ensure the security of Data in their processing, and shall set out the requirements for the protection of the Data being processed in accordance with the Law.
5.9. For the purposes of complying with the requirements of the applicable legislation of the Russian Federation and with its contractual obligations, the processing of Data within the Company is carried out both with and without the use of automated means. The set of processing operations includes the collection, recording, systematisation, accumulation, storage, refinement (updating, alteration), retrieval, use, transfer (provision, access), depersonalisation, blocking, deletion, and destruction of Data.
5.10. The Company prohibits the adoption, on the basis of exclusively automated processing of Data, of decisions giving rise to legal consequences with respect to the data subject or otherwise affecting his/her rights and legitimate interests, save for the cases provided for by the legislation of the Russian Federation.
6. Rights and Obligations of Data Subjects, and of the Company, with Respect to the Processing of Data
6.1. A data subject whose Data are processed by the Company shall have the right:
6.1.1. to obtain from the Company:
- confirmation of the fact of the processing of Data and information on the presence of Data relating to the relevant data subject; information on the legal grounds for and purposes of the processing of Data; information on the methods of processing Data applied by the Company; information on the name and location of the Company; information on the persons (other than employees of the Company) who have access to the Data or to whom the Data may be disclosed on the basis of a contract with the Company or on the basis of federal law;
- the list of Data being processed that relate to the data subject, and information on the source from which they were obtained, unless a different procedure for the provision of such Data is provided for by federal law;
- information on the periods for the processing of Data, including the periods of their storage; information on the procedure for the data subject's exercise of the rights provided for by the Law;
- the name (or surname, first name, patronymic) and address of the person carrying out the processing of Data on behalf of the Company;
- other information provided for by the Law or by other regulatory legal acts of the Russian Federation.
6.1.2. to require of the Company:
- the refinement of his/her Data, the blocking or destruction thereof in the event that the Data are incomplete, outdated, inaccurate, unlawfully obtained, or are not necessary for the declared purpose of processing; to withdraw his/her consent to the processing of Data at any time; to require the cessation of unlawful actions of the Company with respect to his/her Data;
- to appeal against the actions or inaction of the Company to the Federal Service for Supervision of Communications, Information Technology, and Mass Media (Roskomnadzor) or by judicial procedure, in the event that the data subject considers that the Company is processing his/her Data in violation of the requirements of the Law or is otherwise infringing his/her rights and freedoms;
- to the protection of his/her rights and legitimate interests, including the compensation of losses and/or compensation for moral harm by judicial procedure.
6.2. In the course of the processing of Data, the Company shall be obliged:
- to provide to the data subject, at his/her request, information concerning the processing of his/her personal data, or to provide a refusal on lawful grounds, within thirty days from the date of receipt of the request of the data subject or his/her representative;
- to explain to the data subject the legal consequences of a refusal to provide Data, where the provision of Data is mandatory in accordance with federal law;
- prior to the commencement of the processing of Data (where the Data have been obtained other than from the data subject), to provide to the data subject the following information, save for the cases provided for by Part 4 of Article 18 of the Law:
1) the name, or the surname, first name, patronymic, and address of the Company or its representative;
2) the purpose of the processing of Data and its legal basis;
3) the prospective users of the Data;
4) the rights of data subjects established by the Law;
5) the source from which the Data were obtained.
- to take, or to ensure the taking of, the necessary legal, organisational, and technical measures for the protection of Data against unlawful or accidental access thereto, destruction, alteration, blocking, copying, provision, dissemination of Data, as well as against other unlawful actions with respect to Data; to publish on the Internet and to ensure unrestricted access by means of the Internet to the document defining its policy regarding the processing of Data, and to the information on the implemented requirements for the protection of Data;
- to provide to data subjects and/or their representatives, free of charge, the opportunity to familiarise themselves with the Data upon submission of the relevant request, within 30 days from the date of receipt of such request;
- to block the unlawfully processed Data relating to the data subject, or to ensure the blocking thereof (where the processing of Data is carried out by another person acting on behalf of the Company), from the moment of application or receipt of the request, for the period of verification, in the case of the detection of unlawful processing of Data upon application by the data subject or his/her representative, or at the request of the data subject or his/her representative or of the authorised body for the protection of the rights of personal data subjects;
- to refine the Data, or to ensure the refinement thereof (where the processing of Data is carried out by another person acting on behalf of the Company), within 7 working days from the date of submission of the information, and to lift the blocking of the Data, in the event of confirmation of the fact of the inaccuracy of the Data on the basis of information submitted by the data subject or his/her representative;
- to cease the unlawful processing of Data, or to ensure the cessation of the unlawful processing of Data by a person acting on behalf of the Company, in the event of the detection of unlawful processing of Data carried out by the Company or by a person acting on the basis of a contract with the Company, within a period not exceeding 3 working days from the date of such detection;
- to cease the processing of Data, or to ensure the cessation thereof (where the processing of Data is carried out by another person acting under a contract with the Company), and to destroy the Data, or to ensure the destruction thereof (where the processing of Data is carried out by another person acting under a contract with the Company), upon achievement of the purpose of the processing of Data, unless otherwise provided by the contract to which the data subject is a party, beneficiary, or guarantor, in the event of the achievement of the purpose of the processing of Data; to cease the processing of Data, or to ensure the cessation thereof, and to destroy the Data, or to ensure the destruction thereof, in the event of the withdrawal by the data subject of consent to the processing of Data, where the Company is not entitled to process Data without the consent of the data subject; to maintain a register of records of applications by personal data subjects, in which the requests of data subjects for the obtaining of Data, as well as the facts of the provision of Data pursuant to such requests, shall be recorded.
7. Requirements for the Protection of Data
7.1. In processing Data, the Company takes the necessary legal, organisational, and technical measures for the protection of Data against unlawful and/or unauthorised access thereto, destruction, alteration, blocking, copying, provision, dissemination of Data, as well as against other unlawful actions with respect to Data.
7.2. Such measures, in accordance with the Law, shall include, in particular:
- the appointment of a person responsible for the organisation of the processing of Data, and of a person responsible for ensuring the security of Data;
- the development and approval of local acts on matters of the processing and protection of Data; the application of legal, organisational, and technical measures to ensure the security of Data:
- the identification of threats to the security of Data in their processing within personal data information systems;
- the application of organisational and technical measures to ensure the security of Data in their processing within personal data information systems, necessary for the fulfilment of the requirements for the protection of Data, the fulfilment of which ensures the levels of security of Data established by the Government of the Russian Federation;
- the use of information protection means that have undergone the conformity assessment procedure in the established manner;
- the assessment of the effectiveness of the measures taken to ensure the security of Data prior to the commissioning of a personal data information system;
- the keeping of records of machine-readable media of Data, where the storage of Data is carried out on machine-readable media;
- the detection of facts of unauthorised access to Data and the taking of measures to prevent such incidents in the future;
- the restoration of Data modified or destroyed as a result of unauthorised access thereto;
- the establishment of rules of access to Data processed within a personal data information system, as well as the ensuring of the registration and recording of all actions performed with respect to Data within a personal data information system; control over the measures taken to ensure the security of Data and over the level of security of personal data information systems;
- the assessment of the harm that may be caused to data subjects in the event of a violation of the requirements of the Law, and the correlation of the said harm with the measures taken by the Company aimed at ensuring the performance of the obligations provided for by the Law;
- the observance of conditions excluding unauthorised access to tangible media of Data and ensuring the preservation of Data; the familiarisation of the employees of the Company who directly carry out the processing of Data with the provisions of the legislation of the Russian Federation on Data, including with the requirements for the protection of Data and the local acts on matters of the processing and protection of Data, and the training of the employees of the Company.
8. Periods of Processing (Storage) of Data
8.1. The periods of processing (storage) of Data shall be determined on the basis of the purposes of the processing of Data, in accordance with the term of the contract with the data subject, the requirements of federal laws, the requirements of the operators of Data on whose behalf the Company carries out the processing of Data, the basic rules for the operation of the archives of organisations, and the limitation periods.
8.2. Data the period of processing (storage) of which has expired shall be destroyed, unless otherwise provided by federal law. The storage of Data after the cessation of their processing is permitted only following their depersonalisation.
9. Procedure for Obtaining Clarifications on Matters of the Processing of Data
9.1. Persons whose Data are processed by the Company may obtain clarifications on matters of the processing of their Data by applying in person to the Company or by sending the relevant written request to the address of the location of the Company: 125124, Moscow, Pravdy St., 26.
9.2. In the event of sending an official request to the Company, the text of the request must indicate: the surname, first name, and patronymic of the data subject or his/her representative; the number of the principal identity document of the data subject or his/her representative, information on the date of issue of the said document and the body that issued it; information confirming the existence of a relationship between the data subject and the Company; feedback information for the purpose of the Company's sending a reply to the request; and the signature of the data subject (or his/her representative). Where the request is sent in electronic form, it must be drawn up in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.
10. Particularities of the Processing and Protection of Data Collected by the Company by Means of the Internet
10.1. The Company processes Data received from users of the Website at the resource: https://en.omb.ru/ (hereinafter the "Website"), as well as Data received via the Company's telephone: +7-(495)-925-81-50, the Company's e-mail address: site@omb.ru, and via the Company's feedback form located on the website, including at the link: https://omb.ru/faq/pokupka-oborudovaniya-i-raskhodnykh-materialov/.
10.2. Collection of Data. There are two principal means by which the Company obtains Data via the Internet:
10.2.1. Provision of Data (independent input of data by the user): surname, first name, patronymic, date of birth, city of residence, place of work, position, e-mail address, telephone number;
10.2.2. By data subjects by means of receipt via the Company's telephone: +7 (495) 925-81-50, the Company's e-mail address: site@omb.ru, and via the Company's feedback form located on the website, including at the link: https://omb.ru/faq/pokupka-oborudovaniya-i-raskhodnykh-materialov/.
10.3. Automatically Collected Information. The Company may collect and process information that does not constitute personal data:
- the determination of location, the IP address, information on the interests of users on the Website based on the search queries entered by Website users concerning goods sold and offered for sale by the Company, for the purpose of providing up-to-date information to the Company's clients when using the Website, as well as of summarising and analysing information as to which sections of the Website and which goods are in the greatest demand among the Company's clients;
- the processing and storage of the search queries of Website users for the purpose of summarising and creating client statistics on the use of the sections of the Website. The Company automatically obtains certain types of information acquired in the course of users' interaction with the Website, e-mail correspondence, and the like. This concerns technologies and services such as web protocols, cookies, web beacons, as well as the applications and tools of the said third party. At the same time, web beacons, cookies, and other monitoring technologies do not enable the automatic obtaining of Data. Only if a Website user, at his/her own discretion, provides his/her Data — for example, when completing a feedback form or when sending an e-mail message — are the processes of automatic collection of detailed information thereby initiated, for the convenience of using the websites and/or for the improvement of interaction with users.
10.4. The Company shall be entitled to use the Data provided in accordance with the declared purposes of their collection, subject to the consent of the data subject, where such consent is required in accordance with the requirements of the legislation of the Russian Federation in the area of Data. The Data obtained, in summarised and depersonalised form, may be used for a better understanding of the needs of the purchasers of the goods and services sold by the Company and for the improvement of the quality of service.
10.5. The Company may entrust the processing of Data to third parties exclusively with the consent of the data subject. Data may also be transferred to third parties in the following cases:
a) by way of a response to the lawful requests of authorised State bodies, in accordance with laws, court decisions, etc.;
b) Data may not be transferred to third parties for marketing, commercial, or other similar purposes, save in cases where the prior consent of the data subject has been obtained.
10.6. The Website contains links to other web resources where information that may be useful and of interest to Website users may be located. The effect of this Policy shall not, however, extend to such other websites. Users who follow links to other websites are advised to familiarise themselves with the data-processing policies posted on such websites.
10.7. A Website user may at any time withdraw his/her consent to the processing of Data by sending a written notification to the address of the Company: 125124, Moscow, Pravdy St., 26. Upon receipt of such notification, the processing of the user's Data shall be ceased, and his/her Data shall be deleted, except in cases where processing may be continued in accordance with applicable law.
10.8. The processing of personal data is carried out within the territory of the Russian Federation, at the address of the location of the operator.
Final Provisions
This Policy constitutes a local regulatory act of the Company.
This Policy is publicly accessible. The public accessibility of this Policy is ensured by its publication on the Company's Website. This Policy may be revised in any of the following cases:
- upon a change in the legislation of the Russian Federation in the area of the processing and protection of personal data; in cases of the receipt of orders from the competent State bodies to remedy non-conformities affecting the scope of the Policy;
- by decision of the management of the Company; upon a change in the purposes and periods of the processing of Data; upon a change in the organisational structure or in the structure of the information and/or telecommunications systems (or the introduction of new ones);
- upon the application of new technologies for the processing and protection of Data (including transfer and storage);
- upon the emergence of a need to alter the process of the processing of Data connected with the activities of the Company. In the event of failure to comply with the provisions of this Policy, the Company and its employees shall bear liability in accordance with the applicable legislation of the Russian Federation. Control over the fulfilment of the requirements of this Policy is exercised by the persons responsible for the organisation of the processing of the Company's Data, as well as for the security of personal data.