POLICY

Revision date: 28.07.2026

POLICY

on the Processing and Confidentiality of Personal Data

1.   GENERAL PROVISIONS
1.1.   This Policy on the Processing and Confidentiality of Personal Data (hereinafter referred to as the “Policy”) applies to all personal information that the Operator may receive about the User while using the Operator's Website https://form-bronze.com/, including all its subdomains and its content (hereinafter referred to as the “Website”).
1.2.   The processing of Personal Data during the User's use of the Website is carried out by:
Limited Liability Company “Forma i bronza”
Abbreviated name: LLC “FB”
TIN:   7805788161
PSRN:   1227800002000
Legal address:   198188, Russian Federation, Saint Petersburg, Vozrozhdeniya St., building 42, letter A, premises 15-n, office 16
Postal address:   198188, Russian Federation, Saint Petersburg, Vozrozhdeniya St., building 42, letter A, premises 15-n, office 16
E-mail:   info@form-bronze.com
Telephone:   +7(911)932-11-53
1.3.   This Policy has been prepared in accordance with the requirements of Federal Law No. 152-FZ dated 27.07.2006 “On Personal Data”, Federal Law No. 149-FZ dated 27.07.2006 “On Information, Information Technologies and the Protection of Information”, and other requirements of the legislation of the Russian Federation in the field of processing and protection of personal data, and defines the general principles, purposes and procedure for processing the Personal Data of Users, as well as measures to ensure the security of Personal Data processing when the following relations with the User arise:
-   when using the Website's functions;
-   when the Operator exercises the rights and fulfills the obligations established by agreements/contracts;
-   when it is necessary to communicate with the personal data subject, as well as when processing applications, requests and messages sent by the Operator and the personal data subject to each other;
-   when maintaining statistics and analyzing the operation of the Website;
-   in other cases where the User provides Personal Data to the Operator through the functionality of the Website.
1.4.   All matters related to the processing of Personal Data that are not regulated by this Policy shall be resolved in accordance with the current legislation of the Russian Federation in the field of Personal Data.
1.5.   If the User does not agree with the terms of the Policy, the User shall discontinue use of the Website and/or shall not use its functionality for the relevant purposes of Personal Data processing.
1.6.   The Operator does not verify the accuracy of the Personal Data provided by the User. The User is responsible for the accuracy of the data provided. The Operator assumes that Personal Data is provided by the User voluntarily, in good faith, freely and in the User's own interest for the purpose of obtaining access to the information and materials of the Website, and also that the User:
1.6.1.   Knowingly uses the Website in their own name and accurately provides information about themselves to the extent and in cases where this is provided for by the functionality of the Website.
1.6.2.   Knowingly determines and controls the settings of the software used by them in accordance with their preferences regarding the protection of information stored on the browser side, information about their own hardware and software and Internet connection.
1.6.3.   Has read and has the opportunity at any time to review the terms of the Policy by following the hyperlink posted on the Website.
1.6.4.   By providing the data of third parties necessary for using the functionality of the Website, the User confirms that they have obtained the consent of such persons to the processing of their Personal Data or have the authority to express consent on behalf of such persons, which constitutes a representation as to the relevant circumstances.
1.7.   The User may obtain any explanations regarding matters of interest related to the processing of their Personal Data by sending a request to the Operator at the following e-mail address: info@form-bronze.com.
1.8.   The Operator does not process the Personal Data of minors (persons under 18 years of age) without the consent of their legal representative. Legal representatives of minors are responsible for the actions of minors. All Website Users under 18 years of age are required to obtain permission from their legal representatives before providing any personal information about themselves. If the Operator becomes aware that Personal Data of a minor has been received without the consent of the legal representatives, such information shall be deleted as soon as possible.

2. TERMS AND DEFINITIONS
In this Policy, unless its text expressly provides otherwise, the following terms shall have the meanings specified below:
“Automated processing of personal data” means the processing of Personal Data using computer technology, including through specialized services.
“Blocking of personal data” means the temporary suspension of the processing of Personal Data (except where processing is necessary to clarify Personal Data).
“Application” means a request submitted on the Website using the Operator's form by the User regarding the need to establish contact with them (callback, e-mail message, messenger message) in order for the User to obtain information about the Operator, the Operator's services or for other purposes provided for by the functionality of the Website when clicking buttons labeled “Submit an Application”, “Send Data”, “Send a Message”, “Check Availability”, “Request a Callback”, or any other buttons with similar meanings. An Application includes the User providing their Personal Data to the Operator.
“Depersonalization of personal data” means actions as a result of which it is impossible to determine, without using additional information, the attribution of Personal Data to a specific User or another Personal Data subject.
“Processing of personal data” means any action (operation) or set of actions (operations) performed with or without the use of automation tools on Personal Data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion and destruction of Personal Data.
“Confidentiality of personal data” means a requirement mandatory for compliance by the Operator or another person who has gained access to Personal Data not to allow its dissemination without the User's consent or another lawful basis.
“Dissemination of personal data” means any actions aimed at disclosing Personal Data to an indefinite number of persons (transfer of Personal Data) or making Personal Data available to an unlimited number of persons, including publication of Personal Data in mass media, placement in information and telecommunications networks, or providing access to Personal Data in any other manner.
“Personal Data” means any information relating directly or indirectly to an identified or identifiable individual (Personal Data subject (User)).
“Provision of personal data” means actions aimed at disclosing Personal Data to a specific person or a specific group of persons.
“User” means the Personal Data subject — a person who is interested in the goods and/or services of the Operator presented on the Website, or a person who visits the Website, uses it and the functionality implemented on it.
The Users are: Website Visitor, Potential Client (as well as a potential counterparty), Registered User (as the owner of an account in the Personal Account on the Website), Mailing Recipient.
“Destruction of personal data” means any actions as a result of which Personal Data is irreversibly destroyed, making further restoration of the content of the Personal Data impossible within the Personal Data information system, and/or the physical media containing Personal Data are destroyed.
“Cookies” means a small set of data sent by a web server and stored on the User's device (computer, smartphone, tablet and other similar devices capable of accessing websites on the Internet) without modification or any processing, which the web client sends back to the web server as part of an HTTP request each time the website on the Internet is accessed. For the purposes of the Policy, Cookies also include metric data.
“Personal Account” means a set of protected Website pages created as a result of the User's registration on the Website. Access to the Personal Account is provided using the User's credentials (login and password) after registration on the Website.

3.   SUBJECT OF THE POLICY
3.1.   This Policy establishes the Operator's obligations regarding non-disclosure and ensuring the confidentiality protection regime for the Personal Data of the User and third parties provided by the User when accessing the Website, using the Website, creating and using the Personal Account, submitting an Application on the Website and in other cases provided for by the functionality of the Website.
3.2.   Personal Data permitted for processing under this Privacy Policy is provided by the User in the cases specified in clause 3.1 of the Policy. When using the Website without providing Personal Data by the User, the Website processes only the User's cookies.
3.3.   Characteristics of Personal Data processing:
PURPOSE No. 1

Category of Personal Data subject: Website Visitor

Purposes of Personal Data processing: providing the ability to use the Website and its functionality, improving the operation and content of the Website

Legal grounds for Personal Data processing:
- Consent of the Personal Data subject provided through conclusive actions: continuing to use the Website despite the pop-up notification (banner) about the collection of Cookies.

Categories and list of Personal Data processed.
Personal Data (other):
1) Yandex.Metrika metric data: cookies and localStorage properties — collection of information about Website Visitors, behavior on the Website and traffic sources. The list of cookies and their purposes are determined in accordance with the Internet page concerning temporary files installed by Yandex Metrika: https://yandex.ru/support/metrica/ru/general/cookie-usage.html. The Operator may process a smaller list of data;
2) _session_id — stores the unique identifier of the user's session, allowing the server to identify and track the user's actions within the Website. Storage period — session.
The User may disable the collection of cookies on the Website through the web browser settings. Disabling them may result in incorrect operation of the Website, or make certain sections or functions unavailable.

Methods of Personal Data processing:
Automated, with transmission through the internal network of the legal entity, with transmission via the Internet.

List of actions performed with Personal Data:
collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), depersonalization, blocking, deletion, destruction.

Regarding the transfer of Personal Data:
Personal Data may be transferred to persons engaged by the Operator to achieve the purpose of Personal Data processing formulated by the Operator. Such persons include, among others, providers of cloud/server infrastructure, developers and technical support, suppliers (providers) of software (services).
The Operator has the right to entrust the processing of Personal Data for the purpose of achieving the relevant purpose.
Personal Data is transferred to:
─ Yandex LLC (Address: 16 Lev Tolstoy St., Moscow, 119021; TIN: 7736207543; PSRN: 1027700229193; Privacy Policy: https://yandex.ru/legal/confidential/ru/); Cookie Policy: https://yandex.ru/legal/cookies_policy/ru/ — Yandex.Metrika metric data. Personal Data processing for the purpose is carried out under instruction;
─ Individual Entrepreneur M.S. Kostrov (PSRNIP 325784700343440, TIN 440401160907, 76 Bolshoy Prospekt V.O., letter B, apartment 70, Saint Petersburg) — access to Cookie files for configuring, maintaining and building the Operator's IT infrastructure. Personal Data processing for the purpose is carried out under instruction.

Period of Personal Data processing and storage:
─ Consent to the processing of Personal Data is provided until its withdrawal;
─ Processing shall cease and Personal Data shall be destroyed after 30 (thirty) days from the date of withdrawal of consent to the processing of Personal Data or the date on which the purpose of Personal Data processing is achieved, whichever occurs earlier.

PURPOSE No. 2

Category of Personal Data subject: Potential Client

Purposes of Personal Data processing: collecting feedback or other forms of communication from the Potential Client through an Application in order to establish contact with the Potential Client (call, e-mail message, messenger message) for the purpose of discussing the possibility and terms of concluding a civil-law agreement concerning the Operator's goods and/or services, the parties to which will be the Potential Client and the Operator.

Legal grounds for Personal Data processing (other):
- Consent of the Personal Data subject provided by checking the checkbox containing the consent form for the processing of Personal Data, which is a mandatory condition for submitting an Application;
- Conclusion and performance of a civil-law agreement to which the Potential Client may become a party.

Categories and list of Personal Data processed.
Personal Data:
─ When completing an Application (feedback form) — the information specified therein: first name, last name, telephone number, e-mail address, preferred messenger for communication (if selected as the preferred method of communication), message text (if specified in the Application form).

Methods of Personal Data processing:
Mixed, with transmission through the internal network of the legal entity, with transmission via the Internet.

Regarding the transfer of Personal Data:
Personal Data may be transferred to persons engaged by the Operator to achieve the purpose of Personal Data processing formulated by the Operator. Such persons include, among others, providers of cloud/server infrastructure, developers and technical support, suppliers (providers) of software (services).
The Operator has the right to entrust the processing of Personal Data for the purpose of achieving the relevant purpose.
Personal Data is transferred to:
-   Joint Stock Company “amoCRM” (PSRN: 5157746087681, TIN: 7709477879, legal address: 38 Lyusinovskaya St., Moscow, intra-city municipal formation of Zamoskvorechye, 115093) — Personal Data contained in the Application is transferred to the “amoCRM” service. The company's Personal Data Processing Policy: https://www.amocrm.ru/confidence/;
-   Limited Liability Company “VK” (PSRN: 1027739850962, TIN: 7743001840, legal address: 39, building 79, Leningradsky Prospekt, Moscow, 125167) — Personal Data may be sent to the Operator's e-mail. Mail Mail service Privacy Policy: https://help.mail.ru/legal/terms/mail/privacy/;
-   Individual Entrepreneur M.S. Kostrov (PSRNIP 325784700343440, TIN 440401160907, 76 Bolshoy Prospekt V.O., letter B, apartment 70, Saint Petersburg) — access to Personal Data for configuring, maintaining and building the Operator's IT infrastructure. Personal Data processing for the purpose is carried out under instruction.

Period of Personal Data processing and storage:
- Consent to the processing of Personal Data is provided until its withdrawal;
- Processing shall cease and Personal Data shall be destroyed after 30 (thirty) days from the date of occurrence of one of the following events (whichever occurs earlier): (1) termination of communication; (2) submission of the Application (if communication has not commenced); (3) withdrawal of consent to the processing of Personal Data. If a civil-law agreement between the Operator and the Personal Data subject has been concluded or is in force within the 30-day period, processing shall cease and Personal Data shall be destroyed after 30 (thirty) days from the date of termination of the obligations of the parties under the civil-law agreement.

PURPOSE No. 3

Category of Personal Data subject: Registered User

Purposes of Personal Data processing: Registration of the Personal Data subject on the Website and provision of the ability to use the functionality of the Website available through the Personal Account (creation and maintenance of the Personal Account, creation and storage of order history, placing orders), as well as discussion of the possibility and terms of concluding a civil-law agreement concerning the Operator's goods and/or services, the parties to which are the Registered User and the Operator.

Legal grounds for Personal Data processing:
- Consent of the Personal Data subject provided by checking the checkbox containing the consent form for the processing of Personal Data, which is a mandatory condition for registration on the Website for the purpose of creating a Personal Account;
- Conclusion and performance of a civil-law agreement to which the Registered User may become a party.

Categories and list of Personal Data processed.
Personal Data (other):
- First name, last name, telephone number, e-mail address, order history, and other Personal Data provided for by the Personal Account and left by the Personal Data subject.

Methods of Personal Data processing:
Mixed, with transmission through the internal network of the legal entity, with transmission via the Internet.

Regarding the transfer of Personal Data:
Personal Data may be transferred to persons engaged by the Operator to achieve the purpose of Personal Data processing formulated by the Operator. Such persons include, among others, providers of cloud/server infrastructure, developers and technical support, suppliers (providers) of software (services).
The Operator has the right to entrust the processing of Personal Data for the purpose of achieving the relevant purpose.
Personal Data is transferred to:
-   Joint Stock Company “amoCRM” (PSRN: 5157746087681, TIN: 7709477879, legal address: 38 Lyusinovskaya St., Moscow, intra-city municipal formation of Zamoskvorechye, 115093) — Personal Data contained in the Personal Account may be transferred to the “amoCRM” service. The company's Personal Data Processing Policy: https://www.amocrm.ru/confidence/;
-   Limited Liability Company “VK” (PSRN: 1027739850962, TIN: 7743001840, legal address: 39, building 79, Leningradsky Prospekt, Moscow, 125167) — Personal Data may be sent to the Operator's e-mail. Mail Mail service Privacy Policy: https://help.mail.ru/legal/terms/mail/privacy/;
-   Individual Entrepreneur M.S. Kostrov (PSRNIP 325784700343440, TIN 440401160907, 76 Bolshoy Prospekt V.O., letter B, apartment 70, Saint Petersburg) — access to Personal Data for configuring, maintaining and building the Operator's IT infrastructure. Personal Data processing for the purpose is carried out under instruction.

PURPOSE No. 4

Category of Personal Data subject: Mailing Recipient

Purposes of Personal Data processing: sending messages (mailings) of an advertising and/or informational nature to the Personal Data subject at their e-mail address.

Categories and list of Personal Data processed.
Personal Data (other):
- First name, e-mail address.
Methods of Personal Data processing:
Automated, with transmission through the internal network of the legal entity, with transmission via the Internet.

Regarding the transfer of Personal Data:
Personal Data may be transferred to persons engaged by the Operator to achieve the purpose of Personal Data processing formulated by the Operator (contractors, service providers, suppliers, providers of cloud/server infrastructure, message mailing services).
The Operator has the right to entrust the processing of Personal Data for the purpose of achieving the relevant purpose.
Personal Data is transferred to:
-   Joint Stock Company “amoCRM” (PSRN: 5157746087681, TIN: 7709477879, legal address: 38 Lyusinovskaya St., Moscow, intra-city municipal formation of Zamoskvorechye, 115093) — Personal Data contained in the mailing subscription is transferred to the “amoCRM” service and may be processed in “amoCRM”. The company's Personal Data Processing Policy: https://www.amocrm.ru/confidence/;
-   Limited Liability Company “VK” (PSRN: 1027739850962, TIN: 7743001840, legal address: 39, building 79, Leningradsky Prospekt, Moscow, 125167) — Personal Data may be sent to the Operator's e-mail. Mail Mail service Privacy Policy: https://help.mail.ru/legal/terms/mail/privacy/;
─   Individual Entrepreneur M.S. Kostrov (PSRNIP 325784700343440, TIN 440401160907, 76 Bolshoy Prospekt V.O., letter B, apartment 70, Saint Petersburg) — access to Personal Data for configuring, maintaining and building the Operator's IT infrastructure. Personal Data processing for the purpose is carried out under instruction.

Period of Personal Data processing and storage:
- Consent to the processing of Personal Data is provided until its withdrawal.
- After 30 (thirty) days from the date of refusal or unsubscribing from the mailing/withdrawal of consent to the processing of Personal Data, or in the event that the Operator ceases the mailing, whichever event occurs earlier, processing shall cease and Personal Data shall be destroyed.

3.4. The Operator may process Personal Data on other grounds to achieve purposes in accordance with the legislation of the Russian Federation, in particular, for the purpose of protecting the rights and legitimate interests of the Operator based on the exercise of the Operator's rights and legitimate interests in implementing judicial, administrative and other means (mechanisms) for protecting rights and legitimate interests.

4.   PRINCIPLES OF PERSONAL DATA PROCESSING
4.1.   When processing Personal Data, the Operator adheres to the following principles:
-   Lawfulness.
-   Limitation of Personal Data processing to the achievement of specific, predetermined and lawful purposes.
-   Prevention of processing of Personal Data incompatible with the purposes of collecting Personal Data.
-   Prevention of combining databases containing Personal Data whose processing is carried out for purposes incompatible with each other.
-   Other principles provided for by the legislation of the Russian Federation on Personal Data.

5.   CONDITIONS FOR PROCESSING PERSONAL DATA
5.1.   The Operator processes Personal Data for the period necessary to fulfill the purposes for which the data was collected, by any lawful means, using automation tools or without using such tools, through the Internet.
5.2.   All Personal Data is provided (collected) directly from the User. The User independently decides whether to provide their Personal Data and gives consent to its processing by the Operator freely, of their own will and in their own interest. In accordance with the Policy, other legal grounds for processing Personal Data besides consent may be used to achieve certain purposes.
5.3.   Consent to the processing of Personal Data is provided by the User by: (1) checking a checkbox — a functional window intended to express the User's will; (2) other methods provided for by the Website, provided that they comply with the current legislation of the Russian Federation. Separate written consent from the User is not required to achieve the purposes of Personal Data processing.
5.4.   When providing the Operator with Personal Data of third parties, the User represents and warrants that: (1) they obtained the Personal Data by lawful means; (2) they have lawful grounds for processing Personal Data (including the consent of the Personal Data subjects to transfer the Personal Data to the Operator for the purpose of storage); (3) they comply with the principles and rules for processing Personal Data established by the legislation of the Russian Federation. The User undertakes to provide the Operator with confirmation of the existence of legal grounds for processing Personal Data and the fact of proper notification of the Personal Data subject about its transfer within 5 (five) calendar days from the date of receipt of the relevant request from the Operator.
5.5.   If claims and demands are made against the User by third parties, including Personal Data subjects and authorized bodies, in connection with the transfer of Personal Data to the Operator, the User shall independently, at their own expense and by their own efforts, settle such claims, protect the Operator from possible losses and participation in the consideration of claims, demands and possible court proceedings. If the Operator needs to participate in the settlement of the above claims and/or demands, the Operator has the right to demand reimbursement from the User for losses and expenses incurred in connection with such participation, including, but not limited to, expenses for a representative, negotiations and other expenses.
5.6.   If claims are brought against the Operator by third parties, including Personal Data subjects and authorized bodies, in connection with violations of the procedure for processing Personal Data caused by the User's fault, including, but not limited to, the User's lack of authority to transfer Personal Data of third parties to the Operator, which result in a legally effective court decision requiring the Operator to pay money, the Operator has the right to demand that the User reimburse the Operator for expenses incurred in the course of resolving the legal dispute and in enforcement of the court decision, as well as all court costs and losses incurred by the Operator in full.

6.   METHODS AND PERIODS OF PROCESSING PERSONAL DATA, THEIR PROTECTION
6.1.   Users' Personal Data is stored in Personal Data information systems and databases to which only the Operator has access, except where, in accordance with the Policy and the provisions of the current legislation of the Russian Federation, there are grounds for transferring Personal Data or entrusting its processing, which permits access to Personal Data by processors/other operators.
6.2.   The User may withdraw their consent to the processing of Personal Data at any time by sending a notification to the Operator by e-mail to the Operator's e-mail address: info@form-bronze.com with the subject “Withdrawal of consent to the processing of personal data”. The User is notified that withdrawal of consent to the processing of Personal Data may result in the inability to use the full functionality of the Website if the Operator has no other grounds for processing Personal Data for the relevant purposes.
6.3.   Users' Personal Data is stored within the territory of the Russian Federation. If the User is located in a territory where their consent is required for the transfer of Personal Data to the Russian Federation, by using the Website the User gives their explicit and unambiguous consent to such transfer or storage and/or processing of information in the Russian Federation.
6.4.   Processing of Users' Personal Data without their consent is carried out in the following cases:
-   Personal Data is publicly available.
-   At the request of authorized state bodies in cases provided for by federal law.
-   Personal Data processing is carried out on the basis of a federal law establishing its purpose, conditions for obtaining Personal Data and the range of subjects whose Personal Data is subject to processing, as well as defining the powers of the Operator.
-   Personal Data processing is carried out for the purpose of concluding and performing a contract to which the Personal Data subject — the User — is a party.
-   In other cases provided for by the legislation of the Russian Federation.
6.5.   The Operator takes all necessary measures to protect Personal Data from unauthorized, accidental or unlawful destruction, loss, alteration, improper use, disclosure or access, as well as other unlawful forms of processing, including the development of the Operator's internal regulations concerning the processing of Personal Data; persons directly carrying out the processing of Personal Data have been familiarized with the provisions of the legislation of the Russian Federation on Personal Data, including requirements for the protection of Personal Data, documents defining the policy regarding the processing of Personal Data, and internal regulations concerning the processing of Personal Data; a person responsible for the processing of Personal Data has been appointed, who organizes the processing of Personal Data; a document defining the policy regarding the processing of Personal Data and information about the implemented requirements for the protection of Personal Data has been posted; internal control over compliance with the requirements for the protection of Personal Data is carried out; internal control and/or an audit of compliance of Personal Data processing with Federal Law No. 152-FZ dated 27.07.2006 “On Personal Data” and regulatory legal acts adopted in accordance with it, requirements for the protection of Personal Data, and internal regulations of the Operator is carried out; the possibility of uncontrolled entry or presence of unauthorized persons in premises where work with Personal Data is carried out has been excluded; the preservation of Personal Data media and information security measures has been ensured; software and technical means are used to ensure the security of Personal Data. Necessary conditions for working with Personal Data have been provided. A procedure for data destruction has been organized; a password has been set on the computer to access Personal Data, and antivirus protection has also been installed.
6.6.   When processing Personal Data both without the use of automation tools and through automated processing, adequate security of the place where the processing takes place is ensured.

7.   RIGHTS AND OBLIGATIONS OF THE PARTIES IN THE PROCESSING OF PERSONAL DATA
7.1.   The User shall:
7.1.1.   Provide the Operator only with accurate Personal Data and promptly notify the Operator of any changes to their Personal Data. At the same time, the Operator does not verify the accuracy of Personal Data and does not monitor the legal capacity of Users, and assumes that the User provides accurate and sufficient personal information. The User bears the risk of providing inaccurate Personal Data independently.
7.2.   The User has the right to:
7.2.1.   Freely decide whether to provide their Personal Data necessary for using the Website and give consent to its processing, as well as withdraw their consent.
7.2.2.   Update, supplement or conceal the information provided about their Personal Data.
7.2.3.   Receive from the Operator information concerning the processing of their Personal Data, unless such right is restricted in accordance with federal laws.
7.2.4.   Demand that the Operator clarify their Personal Data, block or destroy it if the Personal Data is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose of processing, as well as take measures provided by law to protect their rights. To do this, the User must notify the Operator at the following e-mail address: info@form-bronze.com. The request must contain information confirming the User's participation in contractual/other relations with the Operator and the User's signature.
The Operator shall consider the User's request concerning their Personal Data within 30 (thirty) calendar days from the date of such request.
7.2.5.   Demand that unlawful actions by the Operator concerning their Personal Data be eliminated.
7.2.6.   Appeal the Operator's actions concerning their Personal Data to the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) or through judicial proceedings if the citizen believes that the Operator processes their Personal Data in violation of the requirements of Federal Law No. 152-FZ “On Personal Data”.
7.2.7.   Perform other actions in accordance with the current legislation of the Russian Federation.
7.3.   The Operator shall:
7.3.1.   Provide the User free of charge with the opportunity to review the Personal Data relating to them and make the necessary changes to it upon the User providing information confirming that the Personal Data is incomplete, outdated, inaccurate or unlawfully obtained. The Operator shall notify the User of the changes made and measures taken and take reasonable measures to notify third parties to whom the Personal Data of this User was transferred.
7.3.2.   Process Personal Data exclusively for the purposes specified in Section 3 of this Policy.
7.3.3.   Ensure that Personal Data is kept confidential, not disclose it without the User's prior written permission, and not sell, exchange, publish or otherwise disclose the User's transferred Personal Data.
7.3.4.   Take precautions to protect the confidentiality of the User's Personal Data in accordance with the procedure normally used to protect information of this type in existing business practices.
7.3.5.   Take measures to detect unauthorized access to Personal Data and immediately communicate this information to the User and authorized state authorities in accordance with the legislation of the Russian Federation.
7.3.6.   Block the Personal Data relating to the relevant User from the moment of receipt of an application or request from the User, their legal representative or an authorized body for the protection of the rights of Personal Data subjects, for the period of verification, if inaccurate Personal Data or unlawful actions are identified.

8.   TRANSFER OF PERSONAL DATA
8.1.   Cases of Personal Data transfer are set out in Section 3 of the Policy. Transfer of Personal Data in other circumstances is possible only on the grounds provided for by the current legislation of the Russian Federation.
8.2.   When transferring Personal Data, the Operator shall comply with the following requirements:
8.2.1.   Allow access to Users' Personal Data only to specially authorized persons, provided that such persons have the right to receive only those Personal Data of Users that are necessary to perform specific functions.
8.2.2.   Transfer the User's Personal Data in accordance with this Policy and the requirements of the legislation of the Russian Federation in the field of protection and processing of Personal Data.
8.2.3.   Provide the User with access to their Personal Data upon receipt of the relevant request from the User.
8.2.4.   Transfer the User's Personal Data to the User's representatives in the manner established by the current legislation of the Russian Federation and limit this information to only those Personal Data of the User that are necessary for the representatives to perform their functions.

9.   TERMINATION OF PROCESSING AND DESTRUCTION OF PERSONAL DATA
9.1.   If inaccurate Personal Data is identified upon the User's request, the Operator shall block the Personal Data relating to this User from the moment of such request for the period of verification, provided that blocking the Personal Data does not violate the rights and legitimate interests of the User or third parties.
9.2.   If the inaccuracy of Personal Data is confirmed, the Operator, based on the information provided by the User, shall clarify the Personal Data within 7 (seven) working days from the date such information is provided and remove the blocking of the Personal Data.
9.3.   If unlawful processing of Personal Data carried out by the Operator is identified, the Operator shall accordingly terminate the unlawful processing of Personal Data within a period not exceeding 3 (three) working days from the date of such identification.
9.4.   If it is impossible to ensure the lawfulness of Personal Data processing, the Operator shall destroy such Personal Data within a period not exceeding 10 (ten) working days from the date of identification of the unlawful processing of Personal Data. The Operator shall notify the User of the elimination of the violations or destruction of the Personal Data.
9.5.   If the User withdraws consent to the processing of Personal Data, the Operator shall terminate its processing and, if retention of the Personal Data is no longer required for the purposes of processing, destroy the Personal Data within a period not exceeding 30 (thirty) days from the date of receipt of such withdrawal from the User.
The Operator has the right to continue using the User's Personal Data following consideration of the withdrawal of consent to its processing, provided that such information is depersonalized.
The User shall be notified of the results of consideration of the withdrawal of consent at the e-mail address specified when submitting the Application.

10.   PROCEDURES FOR IDENTIFYING AND PREVENTING VIOLATIONS OF THE LEGISLATION OF THE RUSSIAN FEDERATION IN THE FIELD OF PERSONAL DATA
10.1.   Procedures aimed at identifying and preventing violations of the legislation of the Russian Federation in the field of Personal Data include:
10.1.1.   application of legal, organizational and technical measures to ensure the security of Personal Data;
10.1.2.   internal control of compliance of Personal Data processing with the legislation of the Russian Federation on Personal Data processing and the terms of this Policy;
10.1.3.   appointment of a person responsible for organizing the processing of Personal Data;
10.1.4.   issuance of an order authorizing persons who have access to the Personal Data of the Operator's Personal Data subjects to process Personal Data;
10.1.5.   keeping records of persons who have access to the Personal Data of the Operator's Personal Data subjects for the purpose of processing Personal Data;
10.1.6.   granting access to the Personal Data of the Operator's Personal Data subjects only after the persons referred to above have signed an undertaking to ensure the confidentiality of Personal Data;
10.1.7.   obtaining consent to the processing of Personal Data from Personal Data subjects of the Operator who provide the Operator with their Personal Data;
10.1.8.   issuance of an internal local act defining the procedure for processing Personal Data, granting access to Personal Data, and ensuring the Personal Data protection system;
10.1.9.   familiarization of persons who have access to the Personal Data of the Operator's Personal Data subjects and process such Personal Data with the legislation of the Russian Federation in the field of Personal Data, including requirements for the protection of Personal Data and this Policy;
10.1.10.   prevention of access to Personal Data received by the Operator by persons who have not been duly authorized to process Personal Data;
10.1.11.   approval of storage locations for Personal Data provided to the Operator;
10.1.12.   limitation of Personal Data processing to the achievement of specific, predetermined and lawful purposes;
10.1.13.   processing of Personal Data in accordance
with the principles and conditions for Personal Data processing established by the legislation of the Russian Federation in the field of Personal Data;
10.1.14.   ensuring the inadmissibility of processing Personal Data incompatible with the purposes of collecting Personal Data;
10.1.15.   ensuring that the content and volume of processed Personal Data correspond to the stated purposes of processing. The Personal Data processed must not be excessive in relation to the stated purposes of their processing;
10.1.16.   ensuring the accuracy, sufficiency and, where necessary, relevance of Personal Data in relation to the purposes of Personal Data processing;
10.1.17.   informing the Federal Service for Supervision of Communications, Information Technology and Mass Media about each identified case of Personal Data leakage within 24 hours from the moment it is identified, specifying the details of the incident; causes of the data leakage; expected harm; measures taken by the Operator to eliminate the consequences of the leakage;
10.1.18.   providing information to the state system for detecting, preventing and eliminating the consequences of computer attacks in the event of an identified incident involving a Personal Data leak on the Internet.

11.   LIABILITY
11.1.   The Operator guilty of violating the requirements of the legislation of the Russian Federation on Personal Data, as well as the provisions of this Policy, shall bear the liability provided for by the legislation of the Russian Federation.
11.2.   The Operator shall not be liable for possible misuse of Personal Data or any damage caused to the User resulting from:
-   technical failures in software and technical equipment and networks beyond the Operator's control;
-   intentional or unintentional use of the Website for purposes other than its intended purpose by third parties through no fault of the Operator;
-   failure to ensure the confidentiality of access passwords or intentional transfer of access passwords or other information from the Website by the User themselves when receiving the Operator's services (using the Website) to other persons who do not have access to such information;
-   unlawful actions of third parties to access the Website's data, including Personal Data, through no fault of the Operator.
11.3.   The Operator shall not be liable for the processing of Personal Data of third parties that the User has provided as their own. The risk of liability in this case shall be borne by the User who provided inaccurate data.

12.   DISPUTE RESOLUTION
12.1.   In the event of questions and claims from the User, prior to applying to court, it is mandatory to submit a claim (a written proposal or an electronic proposal sent to the e-mail address: info@form-bronze.com for voluntary settlement of the dispute) to the Operator. When submitting the claim by e-mail, the subject line of the message must contain “Claim”, and the attached document must mandatorily contain the number and series of the primary identity document of the User, information about the date of issue of the specified document and the authority that issued it, information confirming the User's participation in contractual/other relations with the Operator, and the User's signature.
12.2.   The recipient of the claim shall notify the sender of the claim of the results of its consideration within 30 (thirty) calendar days from the date of receipt of the claim, using the same method by which the claim was submitted (electronically).
12.3.   Disputes between the parties that cannot be settled through the claims procedure shall be resolved in court in accordance with the procedure provided for by the current legislation of the Russian Federation.
12.4.   This Policy and the relations between the User and the Operator shall be governed by the legislation of the Russian Federation in force at the time the claim arises.

13.   MISCELLANEOUS
13.1.   The Operator has the right to amend this Privacy Policy without the consent of the Users.
13.2.   The new Privacy Policy shall enter into force from the moment it is posted on the Website, unless otherwise provided by the new version of the Policy.
13.3.   Suggestions and comments regarding amendments to the Policy should be sent to the Operator at the following e-mail address: info@form-bronze.com.
13.4.   When processing Personal Data, the Operator does not specifically verify whether a special Personal Data processing regime established by the legislation of countries to whose jurisdiction individual Users belong applies — the Operator's activities are directed toward the territory of the Russian Federation. If the User is a resident of a state with a special Personal Data protection regime, for example, in the European Economic Area (EEA), and accesses the Website from European countries, the Operator takes all reasonable measures to ensure compliance with such requirements of the Personal Data protection legislation established by the relevant state. For this purpose, the User must notify the Operator of the existence of a special regime for the protection of their Personal Data by contacting the Operator via a personal message at the e-mail address info@form-bronze.com. The Operator reserves the right to take other actions that will not contradict the legislation of the Russian Federation.

Personal Data Processing Policy

Cookie settings