1. General provisions

This is an unofficial English translation provided for convenience only. In case of any discrepancy, the Russian version shall prevail.

This privacy policy (hereinafter, the “Policy”) has been approved by individual entrepreneur LEONID MIKHAILOVICH SHEVARENKOV (INN 524900756570, OGRNIP 314524908700038, address: 37 Pchelkina St., Chemal, Altai Republic), in accordance with Federal Law No. 152-FZ “On Personal Data” of 27.07.2006 (hereinafter, the Personal Data Law), and sets out the procedure for processing personal data and the measures taken by Individual Entrepreneur L. M. Shevarenkov (hereinafter, the Operator) to ensure the security of personal data.

1.1. The Operator’s most important goal and condition for carrying out its activities is respect for the rights and freedoms of individuals and citizens when processing their personal data, including the protection of the rights to privacy and personal and family secrets.

1.2. This Policy applies to all information that the Operator may obtain about visitors to the website https://chemalskoe-podvorie.ru/.

2. Key terms used in the Policy

2.1. Automated processing of personal data — processing of personal data using computer technology.

2.2. Blocking of personal data — temporary suspension of personal data processing (except where processing is necessary to clarify the personal data).

2.3. Website — a set of graphic and information materials, as well as computer programs and databases that make them available on the internet at https://chemalskoe-podvorie.ru/.

2.4. Personal data information system — a set of personal data contained in databases, together with the information technologies and technical means that process it.

2.5. Anonymisation of personal data — actions that make it impossible, without additional information, to determine whether personal data belongs to a specific User or other personal data subject.

2.6. Processing of personal data — any action (operation) or set of actions (operations), with or without automation tools, performed with personal data, including collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), anonymisation, blocking, deletion and destruction of personal data.

2.7. Operator — a state body, municipal body, legal entity or individual that, alone or jointly with others, organises and/or carries out the processing of personal data and determines the purposes of processing, the composition of the personal data to be processed and the actions (operations) performed with personal data. The personal data operator is individual entrepreneur LEONID MIKHAILOVICH SHEVARENKOV (INN 524900756570, OGRNIP 314524908700038, address: 37 Pchelkina St., Chemal, Altai Republic).
2.8. Personal data — any information relating directly or indirectly to an identified or identifiable User of the website https://chemalskoe-podvorie.ru/.

2.9. Personal data authorised by the data subject for dissemination — personal data to which the data subject has granted access to an unlimited number of persons by consenting to the processing of personal data authorised for dissemination in accordance with the Personal Data Law (hereinafter, personal data authorised for dissemination).

2.10. User — any visitor to the website https://chemalskoe-podvorie.ru/.

2.11. Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific group of persons.

2.12. Dissemination of personal data — any actions aimed at disclosing personal data to an indefinite group of persons (transfer of personal data) or at making personal data available to an unlimited number of persons, including publication in the mass media, posting on information and telecommunication networks, or providing access to personal data in any other way.

2.13. Cross-border transfer of personal data — transfer of personal data to the territory of a foreign state, to a foreign state authority, or to a foreign individual or legal entity.

2.14. Destruction of personal data — any actions that irreversibly destroy personal data, making it impossible to restore the content of the personal data in the personal data information system, and/or destroy the physical media containing personal data.

3. Main rights and obligations of the Operator

3.1. The Operator has the right to:

• receive reliable information and/or documents containing personal data from the personal data subject;
• continue processing personal data without the data subject’s consent, if the data subject withdraws their consent, where there are grounds for doing so under the Personal Data Law;
• independently determine the composition and list of measures necessary and sufficient to fulfil the obligations under the Personal Data Law and the regulations adopted in accordance with it, unless otherwise provided by the Personal Data Law or other federal laws.

3.2. The Operator is obliged to:

• provide the personal data subject, at their request, with information about the processing of their personal data;
• organise the processing of personal data in the manner established by the current legislation of the Russian Federation;
• respond to requests and enquiries from personal data subjects and their legal representatives in accordance with the Personal Data Law;
• publish or otherwise ensure unrestricted access for Users to this Policy on the processing of personal data;
• take legal, organisational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision or dissemination, as well as from other unlawful actions with respect to personal data;
• stop transferring (providing, granting access to) personal data, stop processing it and destroy it in the manner and cases provided for by the Personal Data Law;
• perform other obligations provided for by the Personal Data Law.

4. Main rights and obligations of personal data subjects

4.1. Personal data subjects have the right to:

• receive information about the processing of their personal data, except in cases provided for by federal laws. The Operator provides such information to the data subject in an accessible form, and it must not contain personal data relating to other data subjects, unless there are legal grounds for disclosing such data. The list of information and the procedure for obtaining it are established by the Personal Data Law;
• demand that the operator clarify, block or destroy their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing, and take legal measures to protect their rights;
• require prior consent as a condition for processing personal data for the purpose of promoting goods, works and services on the market;
• withdraw their consent to the processing of personal data;
• exercise other rights provided for by the legislation of the Russian Federation.

4.2. Personal data subjects are obliged to:

• provide the Operator with reliable information about themselves;
• notify the Operator of any clarification (updating, modification) of their personal data.

4.3. Persons who have provided the Operator with false information about themselves, or information about another personal data subject without the latter’s consent, are liable in accordance with the legislation of the Russian Federation.

5. The Operator may process the following personal data of the User

5.1. When visiting the Website:

1. IP address of the website user.
2. Cookies (unique browser identifier).
3. Information about the device used (smartphone, PC).
4. Browser and its version.
5. Operating system and its version.
6. Screen resolution.
7. Behaviour on the website: time of visit, page depth, link clicks, clicks, page scrolling, and the search phrases that brought the visitor to the website.
8. Geolocation: approximate geographic location (determined from the IP address).
9. Page URL.
10. Page referrer.
11. Page title.
12. Webvisor (Yandex Metrica session replay) data: mouse movements, keystrokes, data entered into forms.

5.2. When using the TravelLine: Booking Engine booking module on the Website:

1. Last name, first name, patronymic.
2. Phone number, e-mail address.
3. Bank account number.
4. Bank card number.
5. Date and time of arrival and departure.

5.3. When Website visitors use the TravelLine: Booking Engine booking module, the Operator transfers (provides, grants access to) the personal data specified above to the following legal entity acting on behalf of the Operator: TRAVEL LINE SYSTEMS LLC, INN 1215180595, OGRN 1141215003214, registered address: 112 Komsomolskaya St., Yoshkar-Ola, Mari El Republic, 424031, for the purposes of providing accommodation services (room bookings) at the Chemalskoe Podvorye guest house, automating business processes and centralised storage and management of the Operator’s data, as well as performing the following actions (operations) with such data: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion and destruction.

5.4. The website collects and processes anonymised data about visitors (including cookies) using web statistics services (Yandex Metrica and others). Cookies are processed in accordance with the Cookie Policy.

5.5. The data listed above is hereinafter referred to collectively as Personal Data.

5.6. The Operator does not process special categories of personal data referred to in Part 1 of Article 10 of the Personal Data Law relating to race, nationality, political views, religious or philosophical beliefs, health or intimate life.

5.7. The Operator does not carry out cross-border transfer of personal data (to the territory of a foreign state, to a foreign state authority, or to a foreign individual or legal entity).

6. Principles of personal data processing

6.1. Personal data is processed on a lawful and fair basis.

6.2. The processing of personal data is limited to achieving specific, predetermined and lawful purposes. Processing of personal data incompatible with the purposes of its collection is not permitted.

6.3. Combining databases containing personal data processed for mutually incompatible purposes is not permitted.

6.4. Only personal data that meets the purposes of its processing may be processed.

6.5. The content and volume of the personal data processed correspond to the stated purposes of processing. Processing of personal data that is excessive in relation to the stated purposes is not permitted.

6.6. When processing personal data, its accuracy, sufficiency and, where necessary, relevance to the purposes of processing are ensured. The Operator takes, or ensures that others take, the necessary measures to delete or clarify incomplete or inaccurate data.

6.7. Personal data is stored in a form that allows the data subject to be identified for no longer than required by the purposes of processing, unless the retention period is established by federal law or by a contract to which the data subject is a party, beneficiary or guarantor. Processed personal data is destroyed or anonymised once the purposes of processing have been achieved or are no longer necessary, unless otherwise provided by federal law.

7. Purposes of personal data processing

7.1. Purpose of processing the User’s personal data:
– providing accommodation services at the Chemalskoe Podvorye guest house;
– analysing traffic on the website https://chemalskoe-podvorie.ru/;
– giving the User access to the services, information and/or materials on the website https://chemalskoe-podvorie.ru/;
– sending the User information and marketing messages.

7.2. Anonymised User data collected through web statistics services is used to gather information about Users’ actions on the website and to improve the website and its content.

8. Legal grounds for processing personal data

8.1. The legal grounds for the Operator’s processing of personal data are:
– Federal Law No. 149-FZ “On Information, Information Technologies and Information Protection” of 27.07.2006;
– federal laws and other regulations in the field of personal data protection;
– Users’ consent to the processing of their personal data.

8.2. The Operator processes the User’s personal data only if the User fills in and/or submits it themselves through the special forms on the website https://chemalskoe-podvorie.ru/ or sends it to the Operator by e-mail. By filling in the relevant forms and/or sending their personal data to the Operator, the User agrees to this Policy.

8.3. The Operator processes anonymised data about the User if this is permitted by the User’s browser settings (cookies and JavaScript enabled).

8.4. The personal data subject decides independently whether to provide their personal data and gives consent freely, of their own will and in their own interest.

9. Conditions for processing personal data

9.1. Personal data is processed with the consent of the personal data subject to the processing of their personal data.

9.2. The processing of personal data is necessary to achieve the purposes provided for by an international treaty of the Russian Federation or by law, and to perform the functions, powers and duties imposed on the operator by the legislation of the Russian Federation.

9.3. The processing of personal data is necessary for the administration of justice and the enforcement of a court decision or an act of another body or official subject to enforcement under the legislation of the Russian Federation on enforcement proceedings.

9.4. The processing of personal data is necessary for the performance of a contract to which the data subject is a party, beneficiary or guarantor, and for concluding a contract at the data subject’s initiative or a contract under which the data subject will be a beneficiary or guarantor.

9.5. The processing of personal data is necessary to exercise the rights and legitimate interests of the operator or third parties or to achieve socially significant goals, provided that the rights and freedoms of the data subject are not violated.

9.6. Personal data is processed to which the data subject has granted access to an unlimited number of persons, or at their request (hereinafter, publicly available personal data).

9.7. Personal data subject to publication or mandatory disclosure in accordance with federal law is processed.

10. Procedure for collecting, storing, transferring and otherwise processing personal data

The security of personal data processed by the Operator is ensured by implementing the legal, organisational and technical measures required to fully comply with current personal data protection legislation.

10.1. The Operator ensures the safety of personal data and takes all possible measures to prevent access to personal data by unauthorised persons.

10.2. The User’s personal data will never, under any circumstances, be transferred to third parties, except where required by current legislation or where the data subject has consented to the Operator transferring the data to a third party to fulfil obligations under a civil law contract.

10.3. If inaccuracies are found in the personal data, the User can update it by sending a notice to the Operator’s e-mail address order@chemalskoe-podvorie.ru marked “Personal data update”.

10.4. The period of personal data processing is determined by the achievement of the purposes for which the personal data was collected, unless another period is provided for by contract or current legislation.
The User may withdraw their consent to the processing of personal data at any time by sending a notice to the Operator’s e-mail address order@chemalskoe-podvorie.ru marked “Withdrawal of consent to personal data processing”.

10.5. All information collected by third-party services, including payment systems, communication providers and other service providers, is stored and processed by those parties (Operators) in accordance with their User Agreements and Privacy Policies. The personal data subject and/or User must review those documents in a timely manner. The Operator is not responsible for the actions of third parties, including the service providers mentioned in this clause. By using the TravelLine: Booking Engine booking module on the website https://chemalskoe-podvorie.ru/, the User is informed of and agrees that the Operator transfers (provides, grants access to) the personal data specified above to the following legal entity acting on behalf of the Operator: TRAVEL LINE SYSTEMS LLC, INN 1215180595, OGRN 1141215003214, registered address: 112 Komsomolskaya St., Yoshkar-Ola, Mari El Republic, 424031, for the purposes of providing accommodation services (room bookings) at the Chemalskoe Podvorye guest house, automating business processes and centralised storage and management of the Operator’s data, as well as performing the following actions (operations) with such data: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), blocking, deletion and destruction

10.6. When processing personal data, the Operator ensures its confidentiality.

10.7. The Operator stores personal data in a form that allows the data subject to be identified for no longer than required by the purposes of processing, unless the retention period is established by federal law or by a contract to which the data subject is a party, beneficiary or guarantor.

10.9. Processing of personal data may be terminated when the purposes of processing have been achieved, when the data subject’s consent expires or is withdrawn, or when unlawful processing of personal data is detected.

11. Actions performed by the Operator with the personal data received

11.1. The Operator collects, records, systematises, accumulates, stores, clarifies (updates, modifies), retrieves, uses, transfers (provides, grants access to), anonymises, blocks, deletes and destroys personal data.

11.2. The Operator carries out automated processing of personal data, with or without receiving and/or transmitting the information over information and telecommunication networks.

12. Cross-border transfer of personal data

12.1. The Operator does not carry out cross-border transfer of personal data.

13. Confidentiality of personal data

The Operator and other persons who have obtained access to personal data must not disclose it to third parties or disseminate it without the consent of the personal data subject, unless otherwise provided by federal law.

14. Final provisions

14.1. The User can obtain any clarification on questions regarding the processing of their personal data by contacting the Operator by e-mail at order@chemalskoe-podvorie.ru.

14.2. By accessing the Website, the user agrees to the terms of this Policy every time they visit https://chemalskoe-podvorie.ru/ from any device. Any changes to the terms of the Policy will be published on the Website. Individual Entrepreneur L. M. Shevarenkov reserves the right to change the terms of the Policy in whole or in part. All changes and additions take effect from the moment they are published on the Website. Continued use of the Website confirms the User’s acceptance of all such changes.