Personal Data Processing Policy
This document is a translation of the Russian original provided for convenience. The processing of personal data is governed by the legislation of the Russian Federation. In the event of any discrepancy, the Russian version shall prevail.
1. General provisions
1.1. This personal data processing policy (the "Policy") has been drawn up in accordance with Federal Law of the Russian Federation No. 152-FZ "On Personal Data" of 27 July 2006 (the "Personal Data Law") and defines the procedure for processing personal data and the personal data security measures taken by the operator: Individual Entrepreneur Olga Nikolaevna Karakurkchi (OGRNIP 317784700024308, INN 784290076694) (the "Operator").
1.2. The Operator considers respect for the rights and freedoms of every individual in the processing of their personal data, including the protection of the rights to privacy and personal and family confidentiality, to be a key goal and condition of its activities.
1.3. The Policy applies to all information the Operator may obtain about visitors of the website https://jewelleryschool.com (the "Website"), including its language versions.
2. Key terms
2.1. The Policy uses the terms defined by the Personal Data Law: personal data, personal data processing, automated processing, blocking, provision, dissemination, cross-border transfer, depersonalisation, destruction of personal data, personal data information system.
2.2. User means any visitor of the Website. Personal data means any information relating directly or indirectly to an identified or identifiable User.
3. Rights and obligations of the Operator
3.1. The Operator has the right to: receive accurate information and documents containing personal data from the data subject; continue processing personal data without the data subject’s consent where grounds specified in the Personal Data Law exist; independently determine the measures necessary and sufficient to fulfil its obligations under the Personal Data Law.
3.2. The Operator is obliged to: provide the data subject, at their request, with information concerning the processing of their personal data; organise the processing of personal data in accordance with the applicable legislation of the Russian Federation; respond to enquiries and requests of data subjects and their legal representatives; provide the authorised personal data protection authority (Roskomnadzor), at its request, with the necessary information within 10 business days; keep this Policy publicly accessible; take legal, organisational and technical measures to protect personal data; cease processing and destroy personal data in the cases and manner provided for by the Personal Data Law.
3.3. If an unlawful or accidental transfer (provision, dissemination, access) of personal data resulting in a violation of data subjects’ rights is established, the Operator shall notify Roskomnadzor of the incident within 24 hours, and of the results of the internal investigation within 72 hours of discovery.
4. Rights and obligations of data subjects
4.1. Data subjects have the right to: receive information concerning the processing of their personal data; demand that their personal data be corrected, blocked or destroyed if the data are incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose of processing; withdraw consent to the processing of personal data and demand that processing cease; appeal against the Operator’s actions or omissions to Roskomnadzor or in court.
4.2. The User’s consent to the processing of personal data that are not necessary for the conclusion and performance of a contract may not be made a condition of concluding the contract or providing services.
4.3. Data subjects must provide the Operator with accurate information about themselves and notify the Operator of any changes. Persons who provide inaccurate information about themselves, or information about another data subject without the latter’s consent, bear liability under the legislation of the Russian Federation.
5. Principles of personal data processing
5.1. Processing is carried out on a lawful and fair basis and is limited to the achievement of specific, predetermined and legitimate purposes. Processing incompatible with the purposes of collection is not permitted, nor is processing of data excessive in relation to the stated purposes. Accuracy, sufficiency and, where necessary, relevance of personal data are ensured. Personal data are stored no longer than required by the purposes of processing, after which they are destroyed or depersonalised.
6. Purposes of processing
6.1. Registration and identification of the User on the Website and enabling full use of the Website.
6.2. Establishing and maintaining communication between the User and the Operator, consulting on services, receiving and handling enrolment and equipment purchase requests.
6.3. Concluding contracts and performing the Operator’s obligations under them, including informing the User of class and event schedules and changes (by telephone, e-mail, WhatsApp and Telegram messengers, and the VK social network) and sending documents and learning materials.
6.4. Sending the User advertising and informational mailings about the Operator’s products and services - solely subject to the User’s separate consent to receive such mailings. Refusal of advertising mailings does not affect the use of the Website or the provision of services.
6.5. Improving the quality of service and upgrading the Website, including processing the User’s requests and applications, and recording telephone conversations to improve service quality and preserve evidence in the event of disputes.
6.6. Statistical and other research based on depersonalised information.
7. Legal grounds and conditions of processing
7.1. Processing is carried out: with the data subject’s consent; where necessary for the performance of a contract to which the data subject is a party or beneficiary, or to conclude a contract at the data subject’s initiative; to exercise the rights and legitimate interests of the Operator, provided the data subject’s rights and freedoms are not violated; and in other cases provided for by the Personal Data Law.
8. Personal data processed
8.1. When submitting a request or registering on the Website: surname, first name, patronymic; telephone number; e-mail address.
8.2. When maintaining communication regarding services: surname, first name, patronymic; telephone number; e-mail address; social network and messenger account details.
8.3. When handling contract withdrawal and refund requests: surname, first name, patronymic; telephone number; e-mail address; bank details for the refund.
8.4. To improve service quality and for statistical research: cookies and technical interaction data.
8.5. The Operator does not process special categories of personal data or biometric personal data. Bank card details used for online payments are processed by the payment provider; the Operator has no access to full card details.
9. Collection, storage, transfer and other processing
9.1. The Operator ensures the security of personal data and takes all possible measures to prevent access to personal data by unauthorised persons.
9.2. The User’s personal data are not transferred to third parties, except: in cases provided for by the legislation of the Russian Federation; where processing is carried out on the Operator’s behalf by persons ensuring the operation of the Website and the Operator’s services (hosting, customer relationship management systems, communication and mailing services, payment providers) under contracts containing confidentiality and personal data protection requirements; and where the data subject has consented to the transfer of data to a third party.
9.3. Databases containing personal data of citizens of the Russian Federation are located in the territory of the Russian Federation at the time of collection.
9.4. If inaccuracies in personal data are identified, the User may update them by sending the Operator a notice to top@jewelleryschool.com marked "Personal data update".
9.5. The User may withdraw consent to the processing of personal data at any time by sending the Operator a notice to top@jewelleryschool.com marked "Withdrawal of consent to personal data processing". The Operator shall cease processing and destroy the personal data within 30 days of receipt of the withdrawal, except where processing may be continued in accordance with the law.
9.6. Information collected by third-party services, including payment systems, communication providers and other service providers, is stored and processed by those parties in accordance with their user agreements and privacy policies.
10. Cross-border transfer
10.1. Before commencing any cross-border transfer of personal data, the Operator notifies the authorised personal data protection authority of its intention and obtains the information required by law from the foreign parties to whom the transfer is planned.
11. Confidentiality
11.1. The Operator and other persons with access to personal data must not disclose personal data to third parties or disseminate them without the data subject’s consent, unless otherwise provided by federal law.
12. Final provisions
12.1. The User may obtain clarification on any matters concerning the processing of their personal data by contacting the Operator at top@jewelleryschool.com.
12.2. Any changes to the Operator’s personal data processing policy will be reflected in this document. The Policy remains in force indefinitely until replaced by a new version. The current version is available at https://jewelleryschool.com/privacy-policy/.
13. Operator details
Individual Entrepreneur Olga Nikolaevna Karakurkchi
OGRNIP 317784700024308, INN 784290076694
Registered address: 125504, Moscow, Dmitrovskoye shosse, 75/77, apt. 124, Russia
Business address: 190020, St. Petersburg, Bumazhnaya st., 17, lit. A, Russia
E-mail: top@jewelleryschool.com