Privacy Policy

What is this document about?

This personal data processing policy (hereinafter – the Policy and Personal Data respectively) was developed in accordance with the Federal Law "On Personal Data" (hereinafter also the Law) and establishes the principles of processing personal data, defined in "Boyarsky", and is an approved local act of Boyarsky

Where does the Policy apply?

The Policy applies directly in the business activities of Boyarsky, on websites on the Internet owned and/or administered by the company Boyarsky, as well as in other cases when Boyarsky is required to process the Personal Data of third parties.

What terms are used in the Policy?

The Policy uses terms established by the Federal Law "On Personal Data", as well as other generally used terms that may be applicable to the Policy.

What are the general principles of Personal Data processing?

• Processing of Personal Data is limited to achieving specific, pre-defined, and lawful purposes. We do not allow processing of personal data if it is incompatible with the purposes of collecting such Personal Data.
• We do not allow combining databases containing Personal Data if they are processed for purposes that are incompatible with each other.
• We process only those Personal Data that correspond to the purposes of their processing.
• The content and volume of processed Personal Data correspond to the stated purposes. The processed personal data is not excessive in relation to the stated purposes of processing.
• When processing Personal Data, accuracy, sufficiency, and, where necessary, relevance of Personal Data to the purposes of processing are ensured. We take necessary measures to delete or clarify incomplete or inaccurate Personal Data.
• We store Personal Data in a form that allows identification of the Personal Data subject no longer than required by the purposes of processing, unless a longer storage period is established by federal law, contract, or where the subject is a party, beneficiary, or guarantor.
• We destroy or anonymize Personal Data upon achieving the purposes of processing or if there is no longer a need to achieve these purposes, unless otherwise provided by the Law.

What are the grounds for processing Personal Data?

We process Personal Data exclusively in the following cases:

• With the consent of the personal data subject;
• As well as in cases when processing is necessary for:
  • achieving goals provided by an international treaty of the Russian Federation or the law, for the exercise and fulfillment of functions, powers, and duties imposed on Boyarsky by Russian legislation;
  • performance of a contract to which the Personal Data subject is a party (beneficiary or guarantor), and for concluding a contract at the initiative of the Personal Data subject or a contract where the subject will be the beneficiary or guarantor;
  • exercise of rights and legitimate interests of Boyarsky or third parties, provided that the rights and freedoms of the Personal Data subject are not violated.

What is the list and purpose of processing Personal Data?

The specific list of Personal Data, purposes, and conditions of their processing are established in the consent to Personal Data processing, and must not contradict this Policy and the Law. Each consent to Personal Data processing placed on behalf of Boyarsky is an integral part of this Policy.

How is Personal Data processed?

When processing Personal Data, we may perform the following actions, separately or in combination, with or without automation: collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), anonymization, blocking, deletion, and destruction.

Boyarsky does not process Personal Data exclusively by automated means, nor does it process special categories of Personal Data or biometric Personal Data.

Sometimes we may obtain consent for cross-border transfer of Personal Data. Such transfer is made only to countries that provide adequate protection of the rights of Personal Data subjects and/or to organizations specified in the respective consent.

What are the storage periods and destruction requirements for Personal Data?

The storage periods of Personal Data depend on the type of processed data and are specified in the respective consent to processing.

Processed Personal Data shall be destroyed in any of the following cases:

• upon achieving the purposes of processing or if there is no longer a need for their achievement;
• upon receipt of an appropriate request from the Personal Data subject in accordance with the Law;
• upon receipt of a lawful request from an authorized authority;
• upon expiration of the established storage periods.

What measures are taken during processing and to protect Personal Data?

• We appoint employees responsible for organizing Personal Data processing;
• We define, publish, and update the Policy on Personal Data processing and, if necessary, issue and implement local acts to ensure secure processing or eliminate negative consequences of such processing;
• If necessary, we apply legal, organizational, and technical measures to ensure Personal Data security, as well as other measures aimed at ensuring Personal Data processing in accordance with the Law and the Policy.

What rights does the Personal Data subject have?

Boyarsky guarantees compliance with the rights of Personal Data subjects defined by the Law and this Policy. The Personal Data subject may obtain complete information about the processing and protection of their Personal Data by sending an official request to Boyarsky in accordance with the Law.