Policy of personal data confidentiality

1.1. This Policy defines the procedure of personal data processing and measures of ensuring security of personal data published on the website at: www.ony.ru (hereinafter - the Website), which the operator, as well as visitors and users of the Website (within the limits allowed by the policy and complex of services of the Website) may receive about a user in course of using the Website, its services, programs and products in order to protect human and civil rights and freedoms when processing their personal data, including privacy rights protection. The Policy has been developed in accordance with the legislation of the Russian Federation in the field of personal data.

1.2. This Policy applies solely to the Website. The Operator does not control and is not responsible for third-party sites, which a User can reach through the links available on the Site.

1.3. The Operator's processing of personal data of other categories of personal data subjects is regulated by other local acts of the Operator.

1.4. This Policy comes into force from the moment of its approval, namely from 14 june 2022 and is valid for unlimited term, until it is replaced by a new Policy.

2.1. The following terms are used in this Policy:

2.1.1 Information system of personal data means a set of personal data and information technologies and technical means providing its processing, contained in databases.

2.1.2 Processing of personal data - any action (operation) or set of actions (operations) performed with or without the use of automation means with personal data, including collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.

2.1.3. Depersonalization of personal data - actions, as a result of which it is impossible to determine without the use of additional information what personal data belongs to a particular user or other subject of personal data.

2.1.4. Personal data operator (operator) - Studio "ONY", Limited Liability Company (OGRN 1057747678890), including authorized employees of the Website management, acting on behalf of Studio "ONY" LLC, who organize and/or conduct personal data processing, as well as determine personal data processing purposes, composition of personal data subject to processing, actions (operations) performed with personal data;

2.1.5 Personal data - any information relating to a directly or indirectly identified or identifiable individual (personal data subject);

2.1.6. Website User (also User) - any person visiting the Website and using the information, materials and services of the Website.

2.1.7. Cookies - is a small piece of data, sent by a web-server and stored on the User's computer, which a web-client or a web-browser sends to a web-server in HTTP-request every time it tries to open a page of a corresponding site.

2.1.8. IP-address - the unique network address of the node in a computer network, through which the User gets access to the Site.

2.1.9 Website is an interactive service owned by the Owner, available at the unique address in the Internet www.ony.ru/.

2.1.10 “Owner” - Studio "ONY", Limited Liability Company (Moscow 123060, Marshala Rybalko str, 2, bld. 6, floor 11, place I, room 28, office 5), as well as its subsidiary and affiliated companies.

3.1. The legal basis for processing of personal data by the Operator/Owner are:

• The Civil Code of the Russian Federation.
• Federal Law of 27.07.2006. Federal Law No. 152-FZ "On Personal Data" (hereinafter referred to as FZ-152, the Law).
• Federal Law of the Russian Federation dated 27.07.2006 No. 149-FZ "On Information, Information Technologies and the Protection of Information";
• Decree of the Government of the Russian Federation of November 1, 2012 № 1119 "On approving the requirements for protecting personal data when processing personal data in personal data information systems";
• Decree of the Government of the Russian Federation dated 15.09.2008 № 687 "On approval of the regulations on the specifics of the processing of personal data carried out without the use of automation";
• Order of FSTEC of Russia No. 21 dated 18.02.2013 "On approval of the composition and content of organizational and technical measures to ensure the security of personal data during their processing in personal data information systems";
• Other applicable laws and regulations;
• Local legal acts of ONY Studio LLC.
• User's consent to processing of personal data

3.2. Users of the Site give their consent to processing of their personal data in the following cases:

• when authorizing through social networks;
• when filling out feedback forms on the Webite;
• when subscribing to the newsletter;
• when sending feedback;
• when registering and identifying on the Website
• when using the Website in any way.

3.3. If a User does not agree with the terms of this Policy, the use of the Site must be immediately terminated.

3.4. Personal information about Users of the Website is processed for the following purposes:

• sending to the User advertising messages, newsletters about the products, services of the Operator/Owner and its partners, about special offers, promotions, drawings, contests, surveys to a User's e-mail address through mailing, SMS messages, push notifications;
• establishing feedback with the User of the Website, including sending notices, inquiries and their processing, as well as processing requests and applications from the User for the purpose of further conclusion and execution of the agreement;
• receipt and publication of feedback;
• personnel recruitment;
• maintaining statistics and analysis of the Website's work.
• conclusion of contracts and performance of the Operator/Owner's obligations to the User under them.
• posting on the Website, in official social networking groups and other Operator/Owner communities on the Internet, other advertising and information sources for the purposes not related to the User's identity:
• to improve the quality of the User's service and upgrade the Website by processing requests and applications from the User, as well as for the purpose of recording phone conversations with the Operator/Owner, to improve the quality of service, to preserve evidence in case of disputes between the Operator/Owner and the User.

The User can always refuse to receive information messages by sending a letter to the Operator to the address mail@ony.ru with the note "Refuse of notifications about new products and services and special offers".

3.5. The list of personal data of Users processed on the Site using automation tools:

• last name, first name, middle name;
• telephone number;
• e-mail address;
• other information which the User chooses to provide.

3.6. To maintain statistics and analysis of the Website, the Operator processes with the use of the metric services Google Analytics and Yandex Metrika such data as:

• IP address;
• browser information;
• data from cookies;
• access time;
• referrer (address of previous page).

3.7. The anonymized data of the Users, collected with the help of Internet statistics services, serves for collecting information about the User's actions on the Website, improving the quality of the Website and its content.

3.8. The Operator processes the anonymised data about the User if it is allowed in the settings of the User's browser (cookie saving and JavaScript technology usage are enabled).

3.9. If the User refuses to process cookies, they must stop using the Website or disable the use of cookies in their browser settings, thus some functions of the Website may become unavailable.

3.10. The processing of biometric personal data and special categories of personal data related to race, ethnicity, political views, religious or philosophical beliefs, health, intimate life is not carried out on the Website.

3.11. The operator doesn't check the reliability of the information provided by the User and assumes that the User provides reliable and sufficient information, controls its relevance.

3.12. The operator performs the following actions with personal data: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (distribution, provision, access), blocking, removal, destruction.

3.13. Personal data shall be stored in a form that allows to identify the subject of personal data no longer than required by the purposes of personal data processing.

3.14. The condition for termination of personal data processing may be the achievement of the objectives of personal data processing, the expiration of the period of personal data processing, withdrawal of the Website user's consent to the processing of their personal data, as well as the detection of unlawful processing of personal data.

3.15. The term of storage of personal data of the Website Users is 5 years from the date of the last dispatch of data.

3.16. The period of processing of personal data is unlimited. The User may withdraw their consent to the processing of personal data at any time by sending a notice via e-mail to the Operator's e-mail address mail@ony.ru with the note "Withdrawal of consent to the processing of personal data".

3.17. The User consents to receive sms, as well as other types of newsletters and notifications of informational nature (oral and written) from the Operator/Owner using any means of communication, including, but not limited to the following: email, phone, mailings. This consent is valid from the date of User registration on the Website. This consent may be withdrawn by the User at any time by sending a notice by email to mail@ony.ru. Taking into account that this consent is necessary for the proper functioning of the Website, the User has the right to limit the access to the Website in case of withdrawal of the consent under this paragraph. The User gives their consent to receive text messages as well as other types of newsletters and notifications of advertising nature (oral and written) from the Operator/Owner using any means of communication, including, but not limited to the following: email, phone, mailings. The present consent is valid from the date of registration of the User on the Website/date of providing personal data. In this regard, the Operator/Owner assumes that when providing personal data on the Website the User:

• is a legally capable person. In case of incapacitated person using the Site the consent to processing of personal data is given by legal representative of the User, who read and accepted the terms of processing of personal data, specified in the present Policy.
• delivers accurate information about themselves or the represented incapacitated person in the amounts necessary to use the Site. The user independently maintains the provided personal data up to date.
• is aware that the information on the Website, posted by the User about themselves, may become available to other Users of the Website, can be copied and distributed by such Users in the cases stipulated by this Policy.

4.1. Safety of personal data, processed by the Operator, is provided by implementation of legal, organizational, technical and software measures, necessary and sufficient for ensuring the requirements of the legislation of the Russian Federation.

4.2. Personal data of the User won't be transferred by the Operator to the third parties, except the cases, connected with fulfillment of the current legislation.

4.3. The operator takes the following measures to ensure the security of personal data:

• appointment of responsible persons for the organization of processing and ensuring the protection of personal data;
• limiting the composition of the Operator's employees, having access to personal data;
• determination of personal data security level during processing of personal data in personal data information systems;
• establishing rules for delimitation of access to personal data processed in personal data information systems, and ensuring registration and accounting of all actions performed with personal data;
• restriction of access to premises, where main technical facilities and systems of personal data information systems are located and where non-automated processing of personal data is carried out;
• organization of back-up and recovery of personal data information systems and personal data modified or destroyed as a result of unauthorized access thereto;
• setting the requirements to the complexity of passwords for access to information systems of personal data;
• implementation of anti-virus control, prevention of introduction of malicious programs (virus programs) and program bookmarks into the corporate network;
• organization of timely updating of software used in information systems of personal data and information security means;
• regular assessment of the effectiveness of measures taken to ensure security of personal data;
• detection of facts of unauthorized access to personal data and taking measures to identify causes and eliminate possible consequences;
• control over measures taken to ensure security of personal data and levels of protection of personal data information systems.

5.1. The Website User has the right to receive information regarding the processing of his personal data, including

• confirmation of the fact of processing of personal data by the Operator;
• legal bases and objectives of personal data processing;
• methods of personal data processing used by the operator;
• name and location of the Operator, information about persons (except for the Operator's employees) who have access to personal data or to whom personal data may be disclosed on the basis of a contract with the Operator or on the basis of federal law;
• processed personal data pertaining to the respective personal data subject, the source of its obtaining, unless other procedure of presentation of such data is provided by the federal law;
• the terms of processing of personal data, including the period of their storage;
• the procedure of exercising by the subject of personal data of their rights provided by the Federal Law "On Personal Data";
• information about performed or expected cross-border transfer of personal data;
• name or surname, first name, middle name and address of the person processing personal data by order of the Operator, if processing is or will be assigned to such person;
• other information as provided by the Federal Law "On Personal Data" or other federal laws.

5.2. The User is entitled to demand from the Operator to clarify their personal data, block or destroy them if the personal data is incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing, as well as to take statutory measures to protect his rights.

5.3. All questions regarding the processing of personal data should be reported to mail@ony.ru.

6.1. The User is fully responsible for compliance with the requirements of the current legislation of the Russian Federation, including, but not limited to, the laws on advertising, on the protection of copyright and related rights, the protection of trademarks and service marks, including full responsibility for the content and form of materials, in case of quoting or otherwise using the information obtained in connection with the use of the Website complex services.

7.1 The operator processes personal data on the basis of the following principles:

• legality and fair basis;
• limitation of processing of personal data by achieving specific, predetermined and legitimate objectives;
• inadmissibility of processing of personal data, incompatible with the purposes of personal data collection;
• inadmissibility of combining databases containing personal data, whose processing is incompatible with each other;
• processing only that personal data which corresponds to the purposes of its processing;
• compliance of the content and scope of processed personal data with the declared processing purposes;
• inadmissibility of processing of personal data redundant with the stated processing purposes;
• ensuring accuracy, sufficiency and relevance of personal data in relation to the purposes of personal data processing;
• destruction or depersonalization of personal data upon achievement of the purposes of processing or if it is no longer necessary to achieve these purposes, upon receipt from Users of a request for destruction of personal data, upon receipt from Users of a withdrawal of consent to the processing of personal data.

7.2. The Operator carries out processing of personal data of Users (recording, systematization, accumulation, storage, clarification (update, change), extraction) with the use of databases on the territory of the Russian Federation.

7.3. Processing of personal data of Users is carried out by the Operator both with and without the use of automated means.

7.4. The Operator and other persons who obtained access to personal data are obliged not to disclose to third parties and not to distribute personal data without the consent of the subject of personal data, unless otherwise provided by federal law.

7.5. Personal data shall be stored during the period established by the legislation of the Russian Federation on education and archiving. The storage of personal data is carried out (depending on which event comes first)

• until their destruction by the Operator
• in the case of withdrawal of consent to process personal data from the User or a request for destruction of personal data;
• until the expiration of the consent.

7.6. The Operator has the right to transfer personal data in accordance with the requirements of the legislation of the Russian Federation or the consent of the subject of personal data processing to third parties, namely:

7.6.1 Partners, such as owners of sites and applications, advertising networks and other partners providing the Operator with services related to the placement and display of advertising on websites, programs, products or services owned or controlled by such partners;

7.6.2. Partners attracted by the Operator to provide services to the Users on the platform at www.ony.ru.

7.6.3. to Partners for providing the Users with specialized offers for conclusion of civil law contracts;

7.7. Transfer of personal data to third parties specified in paragraph 7.6 of the Policy is carried out under the following conditions:

• the third party carries out processing of personal data using databases in the Russian Federation.
• the third party ensures the confidentiality of personal data during their processing and use; undertakes not to disclose to other persons, as well as not to distribute personal data of Users without their consent.
• the third party ensures compliance with the following measures to ensure security of personal data during their processing: the use of information security measures; detection and recording of unauthorized access to personal data and taking measures to restore personal data; restriction of access to personal data; registration and accounting of actions with personal data; control and evaluation of the effectiveness of measures used to ensure security of personal data. It is prohibited for the third party to transfer and distribute personal data.

8.1. The User of personal data has the right to demand from the Operator the clarification of their personal data, their blocking or destruction, if the personal data is incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing, as well as to take statutory measures to protect their rights.

8.2. If the Personal Data User withdraws its consent to the processing of its personal data, the Operator shall discontinue the processing of personal data or ensure its cessation and, if the preservation of personal data is no longer required for the purposes of personal data processing, destroy personal data or ensure its destruction within a period not exceeding thirty days from the date of receipt of the said withdrawal.

8.3. If it is not possible to destroy personal data within the period specified in paragraphs 8.4, 8.5, 8.6 of this Policy, the Operator shall block such personal data or ensure the destruction of personal data within a period not exceeding six months, unless otherwise provided by federal laws.

8.4. Users' Requests:

8.4.1 Users shall be entitled to send their requests to the Operator, including requests regarding the use of their personal data under paragraph 8.1. of this Policy, in the form of an electronic document to the e-mail address: mail@ony.ru.

8.4.2 The Operator undertakes to review and respond to the user's request within 30 days from the receipt of the request.

8.5. All correspondence received by the Operator from Users (requests in the electronic form) belongs to the information of limited access and is not disclosed without the written consent of the User. Personal data and other information about the User, who sent an inquiry, can't be used without the User's special consent, except for answering the question of the received inquiry or in cases, which are directly stipulated by the legislation.

9.1. The Operator shall have the right to amend this Policy unilaterally in case of changes in the regulatory legal acts of the Russian Federation, as well as at its own discretion.

9.2. Control of compliance with the requirements of this Policy shall be carried out by the person responsible for organizing the processing of personal data.

9.3. Persons guilty of violating the rules governing the processing and protection of personal data shall bear material, disciplinary, administrative, civil or criminal liability in the manner prescribed by the laws of the Russian Federation.

Studio "ONY" Limited Liability Company

• OGRN: 1057747678890
• TIN: 7734529922
• KPP: 773401001
• Legal address: Moscow 123060, Marshala Rybalko str, 2, bld. 6, floor 11, place I, room 28, office 5
• Contacts: +7 (495) 120-78-88, mail@ony.ru