Personal data processing policy of Mayer J. Co. LLC

1.
1.1. Personal data – any information relating directly or indirectly to a specific or identifiable individual (subject of personal data).
1.2. The subject of personal data in this policy (“User”) is an individual/individual entrepreneur/representative of a legal entity who uses both the Site for its functional purpose and who attends/has the intention to attend events organized by the Operator/with the assistance of the Operator, including, but not limited to, exhibitions, congress and exhibition events, business programs, forums, other events related to exhibitions, etc.
1.2. Operator – Mayer Jay Co. LLC (OGRN 1267700119752, INN 9705255090, Legal address 115114, City of Moscow, internal territory of the Municipal District of Zamoskvorechye, Letnikovskaya St., building 10, building 4, room 1/1), independently or jointly with other persons organizing and (or) carrying out the processing of personal data, as well as determining the purposes of their processing, the composition to be processed, actions (operations) performed with personal data.
The operator can develop separate local regulations in relation to different categories of personal data subjects.
1.3. Website – a website located on the Internet at the following addresses: websites https://www.igrushka-market.ru/ and https://christmasbox.ru/.
1.4. Processing of personal data is any action (operation) or set of actions (operations) performed using automation tools or without the use of such means with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.
1.5. Providing personal data – actions aimed at disclosing personal data to a certain person or a certain circle of persons.
1.6. Blocking of personal data – temporary cessation of processing of personal data (except for cases when processing is necessary to clarify personal data).
1.7. Destruction of personal data – actions as a result of which it becomes impossible to restore the content of personal data in the personal data information system and (or) as a result of which the material media of personal data are destroyed.
2.
2.1. The Operator’s personal data processing policy defines the principles and conditions for the processing of personal data, measures to protect them, as well as the Operator’s responsibilities when processing them.
This Policy is part of the General Policy of Myer J. Co. LLC regarding the processing of personal data.
The Policy applies to the personal data of Users for the purpose of providing services by the Operator, as well as carrying out other interactions with them.
2.2. The purpose of the Policy is to protect Users’ personal data from unauthorized access and disclosure. Personal data is confidential, protected information.
2.3 The policy regarding the processing of personal data (hereinafter referred to as the “Policy”) has been developed and applied by the Operator in accordance with Federal Law dated July 27, 2006 N 152-FZ “On Personal Data” (as amended and supplemented), Federal Law dated March 13, 2006 N 38-FZ “On Advertising” (as amended and supplemented), and other regulations in the field of personal data protection data valid on the territory of the Russian Federation.
2.5. This Policy does not apply to relationships:
- arising during the processing of personal data of the Operator’s employees/contractors, since such relations are regulated by a separate local act, which is part of the Operator’s policy regarding the processing of personal data;
- relationships to which Federal Law No. 152-FZ of July 27, 2006 “On Personal Data” does not apply (clause 2, Article 1).
2.6. The policy comes into force from the date of its approval by order of the General Director of the Operator and is valid until it is canceled or amended in accordance with current legislation.
2.7. In pursuance of the requirements of Part 2 of Art. 18.1 of the Law on Personal Data The Policy is published in the public domain on the Internet information and telecommunications network on the Operator’s websites.
3.
3.1. The processing of personal data is carried out on the basis of the following principles:
• processing is carried out on a lawful and fair basis;
• processing is limited to the achievement of specific, pre-defined and legitimate purposes. Processing incompatible with the purposes of their collection is not permitted;
• it is not allowed to combine databases containing personal data, the processing of which is carried out for purposes that are incompatible with each other;
• only personal data that meets the purposes of their processing are subject to processing;
• the content and volume of personal data processed must correspond to the stated purposes of processing. The personal data processed should not be redundant in relation to the stated purposes of their processing;
• when processing personal data, their accuracy, sufficiency, and, where necessary, relevance in relation to the purposes of processing must be ensured;
• storage of personal data is carried out in a form that makes it possible to identify the subject of personal data, no longer than required by the purposes of processing, unless the storage period is established by federal law, an agreement to which the subject of personal data is a party, beneficiary or guarantor;
• processed personal data is subject to destruction or depersonalization upon achievement of the processing goals or in the event of loss of the need to achieve these goals, unless otherwise provided by federal law.
4.
4.1. The processing of personal data is limited to the achievement of specific, pre-defined and legitimate purposes. Processing of personal data that is incompatible with the purposes of collecting personal data is not permitted. Depending on the specific purposes of processing personal data, such processing may include, in particular, performing all or some of the following actions (operations) with personal data: collection (receipt), recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.
4.2. The operator processes personal data for the purpose of carrying out activities defined by the Charter, including, but not limited to, concluding civil contracts, organizing and holding exhibitions, congress and exhibition events, business programs, other events accompanying exhibitions, ensuring the safety of persons participating in and visiting events, advertising and promoting exhibitions and events, providing information about ongoing events/exhibitions, registration at exhibitions/events, collecting feedback on the results exhibitions/events, press accreditation, registration at exhibitions and events, provision of badges/passes, sending advertising and information materials, providing feedback, monitoring and improving the quality of services and functioning of the Site, collecting impersonal information about the actions of Users on the Site in order to improve the quality of the Site and the content of the Site, and other purposes not inconsistent with the law.
4.3. List of personal data to the processing of which the User consents: last name, first name, patronymic; contact phone number, email address/corporate mail, position, place of work/name of company/individual entrepreneur, details of the legal entity, city.
5.
5.1. The processed personal data can be obtained both directly from the User and from other third parties who are contractors of the Operator.
5.2. The operator uses the following methods of processing personal data: automated processing (using automation tools) and non-automated processing (without using automation tools), as well as mixed, including through the following actions - collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.
5.3. Processing is carried out in compliance with the requirements of the legislation of the Russian Federation and the Policy, as well as the provisions of the Operator’s local acts regulating the processing and protection of personal data.
5.4. Automated processing of personal data must be carried out in the Operator’s personal data information systems.
5.5. Automated processing of personal data is carried out using computer technology, both installed locally and integrated into personal data information systems.
5.6. Access to personal data information systems is provided to authorized employees only for the performance of their job functions and job responsibilities.
5.7. During automated processing, personal data is contained on computer storage media of personal data. Recording of personal data on computer media is carried out using computer technology (copying personal data to any removable or non-removable computer media, entering personal data into a database, etc.).
5.8. The processing of personal data in order to promote work and services by making direct contacts with potential consumers via communication means is carried out by the Operator only with the prior consent of the subject of personal data. The operator is obliged to immediately stop, at the request of the personal data subject, the processing of his personal data for the above purposes.
5.12. The User’s use of the Site, registration on the Site, registration at exhibitions/events organized by the Operator, sending an application using the Site or transferring it to an Operator’s employee at an exhibition/event/via the Internet, transfer by the User of a business card to an Operator’s employee, concluding a civil contract means agreement with this Policy and the terms of processing of the User’s personal data. By giving consent, the User confirms that he is acting of his own free will and in his own interest, and that the specified personal data is reliable.
5.13. Sufficient proof that the Operator has received the User’s consent to process personal data is the User’s action by clicking on the button “Submit”, “Register”, “Sign up”, “Leave a request”, “Accredit”, “Agree” and/or marking “✓” in the corresponding blocks on the websites https://www.igrushka-market.ru/ and https://christmasbox.ru/ or marking “✓” in the column when registering directly on exhibition/event, as well as sending a letter containing personal data to the Operator’s employee by email, submitting an application or signing a civil contract. The fact that the User has transferred a business card to an employee of the Operator does not require additional confirmation and means the User’s unconditional consent to the Policy and consent to the processing of personal data by the Operator. No other evidence is required for additional confirmation by the User of his free will.
Consent to the processing of personal data is valid until the User’s request to terminate their processing is received.
5.14. Sufficient proof that the Operator has received the User’s consent to receive advertising and information materials is the User’s action by clicking on the button “Submit”, “Register”, “Sign up”, “Leave a request”, “Accredit”, “Agree” and/or putting a mark “✓” in the appropriate box on the websites https://www.igrushka-market.ru/ and https://christmasbox.ru/ or putting a mark “✓” in the box when registration directly at the exhibition/event, as well as sending a letter to the Operator’s employee by email, submitting an application, signing a civil contract, handing over a business card to the Operator’s employee. The actions specified in this paragraph do not require additional confirmation and mean the User’s unconditional consent to receive from the Operator and third parties engaged by the Operator, via telecommunication networks (via the mobile phone number and email address specified by the User, information messages, including information of a commercial advertising nature (advertising).
6.
6.1. The operator has the right:
• check the accuracy of the personal data provided and request the User for documents confirming the accuracy of the personal data provided by him;
• use the received personal data in cases provided for by law and local regulations of the Operator;
• transfer personal data to third parties in cases provided for by the legislation of the Russian Federation, as well as transfer to third parties/entrust the processing of personal data to third parties on the basis of an agreement concluded with these persons. When executing an order, a third party has the right to use its information systems located on the territory of the Russian Federation for processing.
• independently establish the procedure for processing personal data, develop and approve local regulations governing the processing and protection of personal data;
• send to the User, to the addresses specified by him (email, telephone), in the form of SMS messages and/or emails, and/or messages in instant messengers, and/or push notifications, and/or social networks, and/or through telephone calls, advertising and information materials about exhibitions organized by the Operator, congress and exhibition events, business programs, forums, other events related to exhibitions, etc.
• exercise other rights provided for by the legislation of the Russian Federation.
6.2. The operator is obliged:
• process personal data of the subject of personal data for the purposes specified in the Policy;
• provide the User, upon his request, with information regarding the processing of his personal data or provide a refusal on legal grounds;
• at the User's request, clarify or delete the processed personal data if it is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated price of processing;
• notify the User about processing if personal data was not received from the User;
• explain to the User the consequences of failure to provide or provision of inaccurate personal data;
• destroy/ensure the destruction of the User’s personal data upon achieving the purpose of their processing within the time limits established by law;
• take measures to protect personal data from unauthorized access, modification, disclosure or destruction.
6.3. The user is obliged:
• provide the Operator or its employee with reliable and complete personal data necessary to achieve the goals specified in the Policy;
• within a period not exceeding 5 working days, notify the Operator about changes in your personal data, which may affect the implementation of the rights and obligations of the Operator and the User;
• comply with the requirements of the legislation of the Russian Federation, local regulations of the Operator in the field of personal data protection. Users who have provided the Operator with false information about themselves or information about another subject of personal data without the latter’s consent are liable in accordance with the legislation of the Russian Federation.
6.4. The user has the right:
• to receive complete information about their personal data processed by the Operator;
• access to their personal data, including the right to receive a copy of any record containing their personal data, except as required by law;
• to clarify your personal data, block it or destroy it in cases where the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing;
• the user can contact the Operator with a request for clarification, change, blocking, revocation, etc. your personal data by email marketing@mayer.ru
• to withdraw consent to the processing of personal data;
• to take measures provided by law to protect their rights;
• to exercise other rights provided for by the legislation of the Russian Federation.
• to receive advertising and information materials;
• to refuse to receive advertising and information materials.
6.5. The User gives consent to the Operator to process the User’s personal data by third parties acting on the basis of agreements with the Operator. The Operator undertakes to stop the transfer (distribution, provision, access) of personal data authorized by the User for distribution, if a corresponding request is received from the User. This requirement must include the last name, first name, patronymic (if any), contact information (telephone number, email address or postal address) of the User, as well as a list of personal data, the processing of which is subject to termination.
6.6. The User has the right at any time to withdraw his consent to the processing of personal data/receipt of advertising and information materials in whole or in part by sending a corresponding request to the Operator's email address marketing@mayer.ru, and by clicking on the appropriate link existing in the message/letter.
7.
7.1. The operator keeps records of personal data processed in personal data information systems and on tangible media (including paper).
7.2. Personal data is stored under conditions that ensure its security and protection from unauthorized access, modification, copying, distribution, blocking, destruction and other unlawful actions.
7.3. The Operator stores information about the User for 7 years from the date of receipt of such information. If the Operator receives an application from the User to revoke consent to the processing of personal data, the Operator stops processing it from the date specified in the application, but not earlier than the date following the date of actual receipt of the revocation.
7.4. Destruction of personal data is carried out in cases provided for by the Law on Personal Data and other regulatory legal acts of the Russian Federation.
8.
8.1. The Operator ensures the relevance and accuracy of the processed personal data of Users.
8.2. The User is obliged to promptly, within a period not exceeding 5 working days, notify the Operator about changes in personal data that may affect the implementation of the rights and obligations of the Operator
(for example, changing your last name, first name, patronymic, address, email, telephone, place of work, position, etc.).
8.3. Updating or changing the User’s personal data is carried out on the basis of a written application from the User and/or documents submitted by him confirming such changes.
8.4. The operator, having received an application to update or change personal data, is obliged to make such changes within 7 working days from the date of receipt of the application.
8.5. If inaccurate or incomplete personal data is identified, the Operator has the right to independently make the necessary clarifications or additions based on the documents available to him
8.6. In order to ensure the reliability of personal data, the Operator has the right to periodically verify personal data with the documents they have.
9.
9.1. Processing of personal data is carried out:
• employees of the Operator;
• third parties processing personal data on behalf of the Operator, on the basis of an agreement concluded with these persons
9.2. When transferring personal data to third parties, the following conditions must be met:
• transfer (provision of access) is carried out on the basis of an agreement, the condition of which is to ensure confidentiality and security during their processing;
• transfer (provision of access) is carried out in accordance with the current legislation of the Russian Federation;
9.3. The contract must define a list of personal data, a list of actions (operations) with personal data that will be performed by the person processing personal data, the purpose of their processing, must establish the obligation of such a person to maintain the confidentiality of personal data, the requirements provided for in Part 5 of Article 18 and Article 18.1 of Law No. 152-FZ, the obligation, at the request of the Operator, during the validity period of the order, including before the processing of personal data, to provide documents and other information confirming the adoption of measures and compliance with the requirements for the execution of the Operator’s instructions, the obligation to ensure the security of personal data during their processing, and the requirements for the protection of processed personal data in accordance with Article 19 of Law No. 152-FZ must be specified, including the requirement to notify the Operator about the cases provided for in Part 3.1 of Article 21 of Law No. 152-FZ.
10.
10.1. When considering requests and/or requests from Users, the Operator is guided by the legislation of the Russian Federation.
10.2. Requests (appeals) are accepted by the Operator in the following forms:
• Written:
• Electronic:
• In person:
10.3. Providing information and/or taking other measures in connection with the receipt of requests and/or requests is carried out to the extent and within the time limits provided for by the legislation of the Russian Federation.
10.4. The operator, having received an appeal and/or request and is convinced of its legality, provides the information specified in the request in the form in which the corresponding appeal or request was sent, unless otherwise specified in the appeal or request, and/or takes other measures depending on the specifics (features) of the appeal and/or request. The information provided by the Operator cannot contain personal data belonging to other Users, unless there are legal grounds for disclosing such personal data.
10.5. The Operator has the right to refuse to satisfy the requirements specified in the appeal and/or request by sending it a reasoned refusal, if the Operator, in accordance with the legislation of the Russian Federation, has legal grounds to refuse to fulfill/satisfy the received requirements.
10.6. The User's requests (requests) are registered in the register/log of requests (requests).
10.7. The period for providing information or taking measures in connection with the receipt of requests and/or requests may be extended to 6 months if the Operator does not have the technical ability to destroy personal data in a shorter period of time.
11.
11.1. When processing personal data, the Operator takes the necessary legal, organizational and technical measures to protect them from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution, as well as from other unlawful actions in relation to them.
11.2. Ensuring the security of personal data is achieved, in particular:
• appointment of a person responsible for organizing the processing of personal data;
• publication of documents defining the Operator’s policy regarding the processing of personal data;
• application of organizational and technical measures to ensure the security of personal data during their processing, necessary to meet the requirements for the protection of personal data of Users,
the implementation of which is ensured by the levels of personal data security established by the Government of the Russian Federation;
• detecting facts of unauthorized access to personal data and taking measures, including measures to detect, prevent and eliminate the consequences of computer attacks on personal data information systems and to respond to computer incidents in them;
• establishing rules for access to personal data, as well as ensuring registration and accounting of all actions performed with personal data in personal data information systems;
• implementation of internal control of compliance of the processing of personal data with the requirements of laws and regulations;
• the Operator's employees directly involved in processing are familiar with the provisions of the legislation of the Russian Federation, including protection requirements, documents defining the Operator's policy regarding processing, local regulations of the Operator on processing issues, and training of employees has been conducted.
11.3. The Operator does not use, store or otherwise process biometric personal data.
11.4. The protection of personal data during non-automated processing is carried out in accordance with the requirements of regulatory legal acts of the Russian Federation and local regulations of the Operator for working with tangible media.
12.
12.1. Information related to personal data that has become known to the Operator is confidential information and is protected by law.
12.2. In the course of its activities, the operator ensures the confidentiality of the processed personal data.
12.3. The Operator's employees and other persons must be notified of the need to maintain the confidentiality of personal data.
12.4. If the User has made his personal data or part of it available to an unlimited number of persons, the Operator has the right not to process such personal data and is not responsible for it
13.
13.1. The Operator and/or the Operator’s employees who are guilty of violating the requirements of the legislation of the Russian Federation in the field of personal data, as well as the provisions of the Policy, bear responsibility under the legislation of the Russian Federation.
13.2. The Operator’s employee is responsible for ensuring the confidentiality of the User’s personal data that has become known to him in connection with the performance of his official duties.
14.
14.1. The Operator has the right to make changes and additions to the Policy. All changes and additions are made on the basis of the order (instruction) of the General Director of the Operator and come into force from the moment of their approval, unless a different period is specified in the order (instruction).
14.2. All issues not regulated by the Policy are resolved in accordance with the legislation of the Russian Federation.