Personal data processing policy

1. TERMS AND DEFINITIONS

1.1. Website — the internet page at https://atelier-spb.com.

1.2. User — a legally capable individual who uses the Website; a visitor of the Website.

1.3. Operator — Individual entrepreneur Aleksandra Mikhailovna Koverzneva, INN 780228653744, OGRNIP 325784700140380.

1.4. Personal data — information relating to a directly or indirectly identifiable individual, processed by the Operator solely as technical and metric data collected through web analytics services (IP address, cookies, browser and device details, time and actions on the Website).

2. GENERAL PROVISIONS

2.1. The policy applies to any information the Operator may receive from the User while the Website is in use, and sets the basic rules of that use. Its purpose is to protect information about Users, including their Personal data, from unauthorised access and disclosure. The policy covers the methods the Operator applies when processing data: collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), depersonalisation, blocking, deletion and destruction of personal data, both by automated means and without them.

2.2. Using the Website means the User has been informed about the processing of personal data under this policy. A User who does not agree with the policy or with the conditions of processing must stop using the Website.

2.3. The Operator may amend the policy when necessary: to protect data, to keep the information current, and to respond to legal and technical changes. Amendments are made unilaterally at any time, without prior notice, by publishing the current version on the Website. The User undertakes to follow changes and read the conditions. If within 7 (seven) days of publication the User has not informed the Operator that the new version is unacceptable, the User is deemed to agree with it. Earlier versions can be requested from the Operator. The current version is published at https://atelier-spb.com.

2.4. This policy applies to the Website only. The Operator does not control and is not responsible for third-party websites the User may reach through links available on the Website.

2.5. The legal grounds for processing personal data are the legal acts under which the Operator carries out the processing. For Users of this Website these are:

— federal laws and regulations adopted on their basis that govern relations connected with the Operator's activity;

— international treaties of the Russian Federation;

— the consent of Users to the processing of personal data.

3. THIRD-PARTY SERVICES

3.1. The Operator may use analytics software to understand how the Website performs. Such software can record how often the User visits the Website and what happens on its pages. The User is informed of these tools from the moment the Website is used.

3.2. The Website may contain third-party tracking tools and other resources of service providers acting on the Operator's instructions. The policy does not extend to third-party tracking tools, because the Operator has neither access to nor control over those third parties. The services the Operator may use include, without limitation:

— Yandex Metrica. A web analytics tool that gives the Operator reports, session recordings that contain no data identifying the User, and traffic sources. Details: https://yandex.ru/legal/metrica_termsofuse/.

— YClients. The booking service the booking buttons on the Website lead to. Data entered during booking is processed on the side of that service and under its own rules.

— Yandex Maps. Shows the location of the salon and builds a route to it.

4. PURPOSES AND PROCEDURE OF PROCESSING

4.1. By visiting the Website the User agrees that:

— the User provides the Operator with personal data obtained through the tools listed in clause 3.2. Personal data is processed in accordance with Federal Law No. 152-FZ of 27 July 2006 on personal data;

— the Operator may process the User's personal data, including collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (provision, access), depersonalisation, blocking, deletion and destruction;

— by providing personal data to the Operator the User consents to its processing;

— personal data is transferred electronically over open communication channels of the internet;

— personal data may be transferred to third parties for the purposes stated in this policy;

— no cross-border transfer of data takes place during processing;

— consent is valid until the Operator's purposes are achieved or until the User withdraws it, whichever comes first. Consent is withdrawn by contacting the Operator using the details in section 7.

The User confirms that they are aware of the requirements of Russian law governing the processing of personal data, as well as of the related rights and obligations.

4.2. The Operator may use Personal data for the following purposes:

— analysis of website traffic;

— keeping the Website working correctly;

— improving the experience of visitors;

— finding technical faults and vulnerabilities;

— compiling depersonalised statistics of use.

4.3. The Website uses cookies for technical and analytical purposes only, including through the third-party services listed in clause 3.2. Cookies are not used to identify Users. The User may limit cookies in browser settings. The User is aware that disabling the cookies this Website relies on may affect the way the Website works and may limit it partly or fully.

4.4. The Operator does not collect or process special categories of personal data concerning racial or ethnic origin, political views, religious or philosophical beliefs, health or intimate life.

4.5. The Operator processes Personal data only for as long as it is needed for the purposes it was collected for, unless the Operator has a legitimate interest or an obligation to keep it longer, or the data is required to establish, exercise or defend legal claims. In all other cases, once the purposes are achieved, the Operator stops processing and destroys or depersonalises the data within 10 (ten) business days of achieving the purpose or receiving a withdrawal of consent, unless this policy or applicable law provides otherwise. Confidentiality no longer applies to depersonalised data and in other cases provided by applicable law.

4.6. The Operator may also process other data that the User chooses to provide when contacting the Operator by phone or when booking a service.

5. RIGHTS OF THE USER

5.1. The User has the right to receive information about the processing of their personal data; to demand its clarification, blocking or destruction; to restrict processing; and to appeal against the Operator's actions.

5.2. The User may withdraw the consent on which the Operator relies at any time under clause 4.1. Withdrawal does not affect the lawfulness of processing carried out before it. On receiving a withdrawal notice the Operator stops processing within 10 (ten) business days. The notice is sent using the contact details in section 7.

6. PROTECTION MEASURES

6.1. The Operator takes technical, organisational and legal measures to protect personal data from unauthorised or accidental access, destruction, modification, blocking, copying, distribution and other unlawful actions.

6.2. The Operator has put in place commercially reasonable technical, physical, managerial and organisational measures designed to protect any information from accidental loss and from unauthorised access, use, alteration or disclosure. The Operator cannot, however, guarantee absolutely that unauthorised third parties will never be able to use, disclose or alter personal information for improper purposes.

6.3. If the Operator learns that Personal data has been compromised through a security breach, the Operator will promptly notify the people whose data is affected.

6.4. Personal data is stored in a form that allows the data subject to be identified no longer than the purposes of processing require, unless a storage period is set by federal law or by a contract to which the data subject is a party.

6.5. Personal data of Users is processed and stored on the territory of the Russian Federation.

6.6. The Operator takes no actions aimed at identifying Users of the Website.

7. OPERATOR DETAILS

7.1. Individual entrepreneur Aleksandra Mikhailovna Koverzneva, INN 780228653744, OGRNIP 325784700140380.

7.2. Address: 72A Vyborgskoye Shosse, apt. 10, St Petersburg, 194356, Russia.

7.3. If the User has requests, questions or concerns about this policy, including the exercise of rights or obligations relating to personal data, the User may contact the Operator by phone at +7 937 949-94-94.

8. LANGUAGE OF THE DOCUMENT

8.1. This text is a translation prepared for the convenience of English-speaking guests.

8.2. The binding version is the Russian one, published at https://atelier-spb.com/privacy. In case of any discrepancy between the two texts, the Russian version prevails.