Personal Data Processing Policy

1. General provisions

This Personal Data Processing Policy (the “Policy”) sets out the procedure for processing personal data and the measures taken by the Operator to ensure the security of personal data.

The Policy is drafted in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” and the regulations adopted thereunder in the Russian Federation.

This Policy applies to information the Operator receives about users of the RENLI website (the “Site”), including its subdomains, and about the Operator’s customers.

2. Definitions

• “Operator” means the sole proprietor who, alone or jointly with others, organises and/or carries out the processing of personal data and determines the purposes of processing, the categories of personal data to be processed and the actions performed on personal data.
• “Personal data” means any information relating directly or indirectly to an identified or identifiable user of the Site.
• “Processing” means any action (operation) or set of actions performed on personal data, with or without automation tools, including collection, recording, systematisation, accumulation, storage, rectification, extraction, use, transfer (dissemination, provision, access), anonymisation, blocking, deletion and destruction.
• “Consent to the processing of personal data” means the data subject’s freely given, specific and informed indication of will. Consent is given separately from any other document and may not be expressed by silence, inaction or a pre-ticked box.

3. Operator details

The personal data Operator is:

• Name: Individual Entrepreneur Akulinin Nikolay Vladimirovich (Индивидуальный предприниматель Акулинин Николай Владимирович).
• Primary State Registration Number (OGRNIP): 322774600709243.
• Taxpayer Identification Number (INN): 772603180960.
• Registration number in the register of personal data operators (Roskomnadzor): 77-26-554007.
• Contact e-mail: nexusbots.studio@gmail.com.

4. Purposes of processing

The Operator processes personal data solely for the following purposes:

• concluding, performing and terminating civil-law contracts: placing an order, delivering goods, returns and exchanges, warranty service and payments;
• handling requests submitted through the subscription form, by e-mail, in messengers and social networks, and preparing replies;
• sending information and advertising messages about new arrivals, collections, promotions and events — only with the data subject’s separate consent;
• collecting and analysing anonymised statistics on Site visits in order to improve the Site;
• performing the duties imposed on the Operator by the legislation of the Russian Federation.

The Operator does not process special categories of personal data (racial or ethnic origin, political opinions, religious beliefs, health, intimate life) or biometric personal data.

5. Legal grounds for processing

• the data subject’s consent (Art. 6(1)(1) of Federal Law No. 152-FZ) — for data submitted through the Site forms and for advertising and information messages;
• performance of a contract to which the data subject is a party (Art. 6(1)(5) of Federal Law No. 152-FZ) — for placing and performing an order;
• the Operator’s legitimate interests that do not violate the rights and freedoms of the data subject (Art. 6(1)(7) of Federal Law No. 152-FZ) — for Site security and fraud prevention;
• performance of duties imposed on the Operator by the legislation of the Russian Federation.

6. Categories of data subjects and personal data processed

Data subjects are visitors of the Site, persons who placed an order and persons who contacted the Operator. The Operator processes the following categories of personal data, only to the extent necessary for the purposes set out in section 4:

• data provided by the data subject: name, e-mail address, telephone number, delivery address, order comment;
• order data: order contents, amount, payment and delivery status, history of requests and returns;
• data processed automatically: IP address, cookies, session identifiers, browser and device information, date and time of access, requested page address;
• details required for preparing documents upon return of goods.

The Operator does not process payment card data: card details are entered on the payment provider’s side and are not transferred to the Operator.

7. Principles of processing

• processing is carried out on a lawful and fair basis;
• processing is limited to specific, pre-defined and lawful purposes; processing incompatible with the purposes of collection is not permitted;
• databases containing personal data processed for incompatible purposes may not be combined;
• the content and scope of the processed data correspond to the stated purposes; excessive data is not processed;
• accuracy, sufficiency and, where necessary, currency of personal data are ensured;
• personal data is stored in a form that allows the data subject to be identified no longer than required by the purposes of processing.

8. Retention and destruction

Upon achievement of the purposes of processing, or upon withdrawal of consent, personal data is destroyed or anonymised within 30 days, unless otherwise provided by the legislation of the Russian Federation. Destruction is carried out by irreversible deletion of records and/or destruction of tangible media and is recorded in a statement.

9. Transfer to third parties

Personal data may be transferred to third parties where required by the legislation of the Russian Federation; for the performance of an order (delivery service, payment service, telecom operator); or with the data subject’s separate consent. Transfer is limited to the scope necessary for the relevant task and is based on a contract containing personal data protection requirements (Art. 6(3) of Federal Law No. 152-FZ).

The data subject may withdraw consent at any time by sending a notice to nexusbots.studio@gmail.com marked “Withdrawal of consent to the processing of personal data”.

10. Cookies and analytics

Analytics and marketing cookies, counters and scripts are not loaded or set before consent is obtained. Strictly necessary cookies are always set, as the Site cannot function without them; they are not used to track users and are not shared with third parties for advertising purposes.

Users may change or withdraw their consent at any time on the “Cookie settings” page or by managing cookies in their browser. Disabling strictly necessary cookies may impair some Site features.

11. Third-party services and external links

The Site may contain links to external resources. Following such a link takes the user away from the Site; processing on the external resource is governed by that service’s own policy. The Operator is not responsible for third-party privacy policies or actions.

Personal data is not transferred automatically to these services: the user follows the link on their own initiative. If the user contacts the Operator through a messenger, the enquiry is processed under this Policy, while the messenger processes data under its own policy.

12. Cross-border transfer

Processing of personal data, including primary collection, recording, systematisation, accumulation and storage, is carried out using databases located in the territory of the Russian Federation (Art. 18(5) of Federal Law No. 152-FZ). The Operator does not carry out cross-border transfer of personal data.

13. Security measures

• appointment of a person responsible for organising personal data processing;
• issuing local regulations on personal data processing and protection and familiarising employees and contractors with them;
• encryption of the communication channel (HTTPS);
• role-based access control to personal data and records of persons granted access;
• logging of operations performed on personal data;
• backup and recovery control;
• detection of and response to unauthorised access incidents;
• internal control over compliance of processing with legal requirements.

In the event of unlawful transfer (leak) of personal data, the Operator notifies the competent authority within 24 hours of discovering the incident and, following the internal investigation, within 72 hours (Art. 21(3.1) of Federal Law No. 152-FZ).

14. Data subject rights

• to obtain information about the processing of their personal data, including confirmation of processing, purposes and legal grounds, the list of data processed, recipients and retention periods;
• to demand rectification, blocking or destruction of data that is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose;
• to withdraw consent to the processing of personal data at any time;
• to receive their personal data in a structured, machine-readable format;
• to exercise other rights provided by the legislation of the Russian Federation.

Requests are sent to nexusbots.studio@gmail.com and are reviewed within 10 business days. The data subject may also lodge a complaint with Roskomnadzor (https://rkn.gov.ru) or with a court.

15. Final provisions

The Operator may amend this Policy. A new revision takes effect upon publication on the Site. The current revision is always available at /ru/privacy and /en/privacy. The Policy remains in force until replaced by a new revision.