Privacy Policy for the Klinin LLC website

General provisions

This Privacy Policy (hereinafter the “Policy”) has been approved by Klinin Limited Liability Company (OGRN 1057811902180, TIN (INN) 7813326820, address: office 13-N, lit. A, 14 Reshetnikova St, St Petersburg, 196105) (hereinafter the “Operator” or the “Site Administration”) in accordance with Federal Law No. 152-FZ “On Personal Data” of 27.07.2006 in order to establish the procedure for processing and protecting the personal data of Site Visitors.
The Policy governs the relations between the Site Administration and its Visitors with regard to the processing of personal data, sets out the Operator’s obligations to keep confidential and protect the personal data provided by Visitors to the site owned by the Operator, and sets out the Visitor’s right to the confidentiality of their personal data.
This Policy has been developed to provide Visitors with information on the procedure for processing personal data that may be obtained through the Site.
Use of the Site by the Visitor constitutes acceptance of the terms of this Policy. If the Visitor does not agree with the terms of this Policy, they must stop using the Site immediately.
This Policy applies to the site located at the domain address: https://klinin.com/, and to its subdomains (hereinafter the “Site”). The Site Administration does not control and is not responsible for third-party sites that the Visitor may access via links available on the Site.

For the purposes of this Policy, personal data include:

Data provided by the Visitor independently when using the Site
Data automatically collected by Web analytics services while the Site is being used, including IP address, cookie information, information about the browser used by the Visitor, access time and the address of the requested page.

Terms

The following terms are used in this Privacy Policy:

“Site Administration https://klinin.com/ (hereinafter the Administration)” – the Company and its employees authorised to manage the Site who organise and/or carry out the processing of personal data via the Site and determine the purposes of personal data processing, the personal data to be processed and the actions (operations) performed with personal data on the Site.
“Personal data” – any information relating directly or indirectly to an identified or identifiable individual (personal data subject).
“Personal data processing” – any action (operation) or set of actions (operations) performed with personal data, with or without the use of automation tools, including collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), blocking, deletion and destruction of personal data.
“Confidentiality of personal data” – a requirement, binding on the Operator or any other person who has gained access to personal data, not to allow their dissemination without the consent of the personal data subject or another lawful basis.
“Site” – a set of interlinked web pages hosted on the Internet at the unique address (URL): https://klinin.com/, and on its subdomains.
“Subdomains” – pages or sets of pages located on third-level and higher domains belonging to the Site, as well as other temporary pages at the end of which the Administration’s contact details are given.
“Site Visitor (hereinafter the Visitor)” – a person with full legal capacity, whether a resident or non-resident of the Russian Federation, who has access to the Site via the Internet and uses the information, materials and services of the Site.
“Cookie” – a piece of text data sent by the Site’s web server and stored on the Visitor’s computer. On each subsequent visit to the Site, the Visitor’s browser reads the information from the cookie and transmits it to the Site’s web server.
“IP address” – a unique network address that identifies a device on the Internet or a local network.
“Web analytics” – a system for measuring, collecting, analysing, presenting and interpreting information about website visitors in order to improve and optimise websites.
“Checkbox” – a graphical user interface element that allows the Visitor to control a parameter with two states – ☑ on and ☐ off – and that is used on the Site to confirm the Visitor’s consent to the processing of their personal data.

Purposes of processing the Visitor’s personal data

For the purpose of sending a feedback form via the Site, the following personal data of Site Visitors may be processed:

Telephone number
E-mail address
Surname, first name, patronymic
Organisation name

The legal basis for processing personal data is the Consent of the data subject.
Personal data are processed by means of collection, recording, systematisation, accumulation, storage, clarification (updating, modification), retrieval, use, transfer, blocking, deletion and destruction of personal data.
Personal data are processed for 5 years from the date the order is placed or until the Visitor withdraws their consent to processing.
The said personal data may also be processed in order to provide the Site Visitor with personalised services and to improve their quality.

Conditions for processing personal data provided by the Visitor:

All personal data of the Visitor are processed in accordance with the legislation of the Russian Federation on personal data.
Personal data are processed both with and without the use of automation tools.
The Site Administration may process other categories of Visitors’ personal data when Visitors send messages using the telephone numbers and e-mail addresses given on the Site. Such personal data are provided by the Visitor voluntarily and at their own discretion.
The Administration takes the necessary organisational and technical measures to protect the Visitor’s personal data against unlawful or accidental access, destruction or modification, as well as blocking, copying, dissemination or other unlawful actions of third parties.
The Administration, together with the Visitor, takes all necessary measures to prevent losses or other negative consequences caused by the loss or disclosure of the Visitor’s personal data.
The Administration grants access to the Visitor’s personal data only to its employees who are authorised to work with personal data and have signed a Personal Data Non-Disclosure Undertaking.
The Administration may use the information provided by the Visitor, including personal data, to ensure compliance with the current legislation of the Russian Federation (including to prevent and/or stop illegal and/or unlawful actions of Visitors). Personal data provided by the Visitor may be disclosed only in accordance with the current legislation of the Russian Federation at the request of a court or law enforcement authorities, and in other cases provided for by the legislation of the Russian Federation. In such cases, personal data are transferred to organisations, authorities and persons to which the transfer of the Visitor’s personal data is mandatory under the legislation of the Russian Federation.
The Administration does not verify the accuracy of the information provided by the Visitor and assumes that the Visitor, acting in good faith, provides accurate and sufficient information and takes care to update previously provided information in a timely manner when necessary.
Personal data, as well as other information that does not constitute personal data, may be collected by the Site Administration using third-party Internet resources, in particular via messenger applications.

Use of cookies and web analytics services by the Site

The Site uses the following categories of cookies:

Strictly necessary cookies, required for the basic functions of the Site
Functional cookies, used to improve the Visitor’s interaction with the Site, for example to save the selected language
Advertising cookies, used to provide the Visitor with targeted advertising
Analytics cookies, used to collect statistical and analytical data on Visitors’ visits to the Site
Personalisation cookies, used to create personalisation tags for automatically filling in data collection forms on the Site

To process data about the Visitor, the Site may also use the Yandex.Metrica web analytics service.

In accordance with the Terms of Use of the Yandex.Metrica web analytics service, the Site Administration may obtain the following information about the Visitor using cookies:

Standard reports:

Traffic
Conversions
Sources

Visitors:

Geography
Age
Gender
Traffic by time of day
Time spent on the site

Content:

Popular
Entry pages
Exit pages

Technology:

Browsers
Screen resolution
Operating systems
Devices (mobile devices, desktop PCs)

Monitoring:

Site load
Traffic by minute
Page load speed

In accordance with the Terms of Use of the Yandex.Metrica web analytics service, the Visitor understands and agrees that the counter installed on the Site collects anonymous data (not linked to Visitors’ personal data) on visits to the Site and data on the end Visitor’s device, and automatically transmits them to Yandex LLC to obtain aggregated statistical information available for further use through the service by both the Administration and Yandex LLC for its own purposes.
Yandex LLC treats all data collected and stored by the web analytics service as the Visitor’s confidential information and, in the cases provided for by applicable law, as the Visitor’s trade secret, and undertakes to keep the data confidential and not to transfer such data to third parties (except for persons belonging to the same group as Yandex LLC), unless the Visitor permits such transfer or independently grants third parties access to the data.
The functionality of the web analytics service and the terms on which the Yandex.Metrica service processes and protects the Visitor’s personal data may be changed without the consent of the Site Administration; the Visitor may therefore familiarise themselves with how the Yandex.Metrica service works on the page at: https://yandex.ru/support/metrica/general/how-it-works.html.
The legal basis for the use of the cookies specified in this Policy is the Visitor’s consent.
The Visitor may disable cookies in the browser they use.
The Visitor understands that disabling cookies, as well as refusing to consent to their use, may make it impossible to display certain materials on the Site and to use some of its functions.

Visitor’s consent to the processing of personal data

A link to this Privacy Policy is provided in all personal data collection forms on the Site.
The Visitor confirms their consent to the processing of personal data by ticking the corresponding Checkbox present in all data collection forms on the Site.
The Visitor confirms their consent to the processing of cookies by clicking the button in the pop-up notification about the use of cookies and web analytics services.

Visitor’s requests and applications

The Visitor has the right to receive information concerning the processing of their personal data, including:

Confirmation of the fact that the Operator processes personal data
The legal grounds and purposes of personal data processing
The purposes and methods of personal data processing used by the Operator
The name and location of the Operator, and information about persons (other than the Operator’s employees) who have access to personal data or to whom personal data may be disclosed under a contract with the Operator or under federal law
The list of personal data being processed relating to the respective data subject and the source from which they were obtained, unless a different procedure for providing such data is established by federal law
The periods of personal data processing, including retention periods
The procedure for the data subject to exercise the rights provided for by the legislation of the Russian Federation
Information on any completed or planned cross-border data transfer
The name, or surname, first name, patronymic and address, of the person processing personal data on behalf of the Operator, if the processing has been or will be entrusted to such person

The Visitor has the right to withdraw consent to the processing of their personal data or to demand their destruction.
If the Visitor withdraws consent to the processing of their personal data, the Operator shall stop processing them or ensure that such processing is stopped, and destroy the personal data or ensure their destruction (if the personal data are processed by another person acting on behalf of the Operator) within a period not exceeding thirty days from the date of receipt of such withdrawal.
If the Visitor applies to the Operator with a demand to stop processing personal data, the Operator shall, within a period not exceeding ten working days from the date of receipt of such demand, stop processing them or ensure that such processing is stopped (if it is being carried out) by the person processing the personal data. This period may be extended by no more than five working days if the Operator sends the Visitor a reasoned notice stating the reasons for extending the period for providing the requested information.

Security measures

To protect personal data, the Operator uses the following information security measures:

Appointment of employees responsible for organising personal data processing (including in information systems)
Approval of a list of persons whose access to personal data processed in the information system is required for the performance of their official (employment) duties
Internal monitoring of the compliance of personal data processing with the current legislation of the Russian Federation
Assessment of the harm that may be caused to personal data subjects in the event of a breach of the legislation of the Russian Federation
Familiarisation of employees directly involved in personal data processing with the provisions of the legislation of the Russian Federation on personal data;
Identification of threats to the security of personal data during their processing in personal data information systems
Application of organisational and technical measures to ensure the security of personal data during their processing in personal data information systems, as required to meet personal data protection requirements, the fulfilment of which ensures the levels of personal data protection established by the legislation of the Russian Federation
Assessment of the effectiveness of the measures taken to ensure the security of personal data before a personal data information system is put into operation
Detection of unauthorised access to personal data and taking appropriate action
Recovery of personal data modified or destroyed as a result of unauthorised access to them
Establishment of rules for access to personal data processed in the personal data information system, and ensuring the registration and recording of all actions performed with personal data in the personal data information system
Monitoring of the measures taken to ensure the security of personal data and the level of protection of personal data information systems
Registration of machine-readable personal data media
Ensuring the safekeeping of personal data media
Organisation of a security regime for the premises housing the personal data information system that prevents uncontrolled entry into or presence in those premises by persons without the right of access to them
Placement of personal data processing equipment within a protected area
Use of information security tools that have undergone conformity assessment against the requirements of the legislation of the Russian Federation on information security, where the use of such tools is necessary to neutralise current threats

Information on the implemented personal data protection requirements

When processing personal data, the Operator is guided by Federal Law No. 152-FZ “On Personal Data” of 27.07.2006, as well as by other current legislation on personal data protection.
The protection of personal data processed by the Operator is ensured by implementing the legal, organisational and technical measures necessary and sufficient to meet the requirements of personal data legislation; in particular, the Operator has (i) appointed a person responsible for organising personal data processing; (ii) approved local regulations governing personal data processing, including this Policy; (iii) familiarised the Operator’s employees directly involved in personal data processing with the provisions of the legislation of the Russian Federation on personal data, including personal data protection requirements, the documents defining the Operator’s policy on personal data processing and the local regulations on personal data processing; (iv) established rules for access to personal data (personal data are accessible only to strictly designated employees of the Operator); (v) established rules for storing personal data (data (databases) are stored on password-protected electronic media, and paper records in lockable cabinets); (vi) keeps a register of machine-readable personal data media; (vii) uses certified information security tools; (viii) monitors the personal data protection measures applied and their compliance with the requirements of current legislation on personal data processing, this Policy and the Operator’s local regulations on personal data processing.

The Visitor has the right to:

Freely decide whether to provide their personal data necessary to use the functions offered to them via the Site, and give consent to their processing.
Update and supplement previously provided personal data if they change.
The Visitor has the right to obtain from the Administration information concerning the processing of their personal data by sending a request in accordance with the requirements of Article 14 of Federal Law No. 152-FZ “On Personal Data” of 27.07.2006. The Visitor may require the Administration to clarify, block or destroy their personal data if the personal data are incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing, and may take measures provided for by law to protect their rights.
Withdraw consent to the processing of personal data at any time by sending a written notice to: Klinin LLC, office 13-N, Letter A, 14 Reshetnikova St, intra-city territory of the Moskovskaya Zastava municipal district, St Petersburg, 196105, Russia, marked “withdrawal of consent to the processing of personal data”; withdrawal of consent to the processing of personal data entails the deletion of records containing personal data from Klinin LLC’s personal data processing systems, which may make it impossible to use the Operator’s Internet services

The Site Administration has the right to:

Amend this Privacy Policy without the Visitor’s consent, with subsequent publication of the new version of the Policy on the Site.
Request the Visitor to update previously provided personal data.
If the Visitor withdraws consent to the processing of personal data, the Site Administration may continue processing personal data without the consent of the personal data subject where there are grounds specified in paragraphs 2–11 of part 1 of Article 6, part 2 of Article 10 and part 2 of Article 11 of Federal Law No. 152-FZ “On Personal Data” of 27.07.2006.

The Visitor shall:

Read the terms of the current version of this Policy before providing their personal data to the Administration.
Take precautions regarding the confidentiality of their personal data.
Update and supplement the personal data provided to the Administration if they change.

The Site Administration shall:

Use the information received solely for the purposes specified in this Privacy Policy.
Keep confidential information secret, not disclose it without the Visitor’s prior written permission, and not sell, exchange, publish or otherwise disclose the Visitor’s personal data provided.
Take precautions to protect the confidentiality of the Visitor’s personal data in accordance with the requirements established by the legislation of the Russian Federation on personal data.
Block the personal data relating to the respective Visitor from the moment of the application or request of the Visitor, their legal representative or the authorised body for the protection of the rights of personal data subjects for the duration of the verification, if inaccurate personal data or unlawful actions are detected.

Procedure for the destruction of personal data

Confirmation of the destruction of personal data in the cases provided for by Federal Law No. 152-FZ “On Personal Data” of 27.07.2006 is carried out in accordance with the requirements established by the authorised body for the protection of the rights of personal data subjects.
If the Operator processes personal data without the use of automation tools, the document confirming the destruction of the personal data of personal data subjects is a Personal Data Destruction Report.
If the Operator processes personal data using automation tools, the documents confirming the destruction of the personal data of personal data subjects are a personal data destruction report meeting the requirements set out in clauses 3 and 4 of Order No. 179 of the Federal Service for Supervision of Communications, Information Technology and Mass Media of 28 October 2022 “On Approval of the Requirements for Confirming the Destruction of Personal Data”, and an extract from the event log of the personal data information system (hereinafter the log extract).

Personal data are subject to destruction in the following cases:

when the purpose of personal data processing has been achieved or there is no longer a need to achieve it, unless otherwise provided by the Federal Law “On Personal Data”
when the regulatory legal acts establishing the legal grounds for personal data processing are amended or repealed
when unlawful processing of personal data is detected
when the personal data subject withdraws consent, unless otherwise provided by the Federal Law “On Personal Data”

Employees responsible for document management and archiving systematically monitor and identify documents containing personal data whose retention periods have expired.
The destruction of documents containing personal data whose retention periods have expired is considered by a commission whose members are approved by order of the General Director.
Following the commission’s meeting, minutes are drawn up together with a report on the selection of documents for destruction and an inventory of the files to be destroyed. The report on the selection of documents for destruction is signed by the chairman and members of the commission.
Upon expiry of the processing period, personal data on electronic media are destroyed by physically damaging the media in a way that prevents the personal data from being read or recovered, or by deleting them from the electronic media using methods and tools that guarantee the removal of residual information.

Liability of the parties

The Administration, if it fails to fulfil its obligations, shall be liable for losses incurred by the Visitor as a result of the unlawful use of personal data in accordance with the legislation of the Russian Federation, except in the cases provided for by this Policy.

In the event of loss or disclosure of personal data, the Site Administration shall not be liable if such data:

Became public knowledge prior to their loss or disclosure
Were obtained from a third party before being received by the Administration
Were disclosed with the Visitor’s consent

The Administration may refuse the Visitor further processing of the personal data provided by the Visitor if it deems the information provided to be unacceptable or incomplete.
The Visitor agrees that the information provided to them as part of the Site may be intellectual property, the rights to which are protected and belong to the Company or other persons.
The Administration shall not be liable for any direct or indirect losses arising from the inability to use the Site or individual services, or from unauthorised access to the Visitor’s communications.

Applicable law

This Privacy Policy and the relations between the Visitor and the Administration are governed by the current legislation of the Russian Federation.

Changes to the Privacy Policy.

A new version of the Policy takes effect from the moment it is published on the Site, unless otherwise provided by the new version of the Policy. All disputes and disagreements relating to the Site shall be resolved by the competent court in accordance with the general rules of jurisdiction.
All suggestions or questions regarding this Privacy Policy, as well as any applications and requests referred to in this Privacy Policy, should be sent to: office 13-N, lit. A, 14 Reshetnikova St, St Petersburg, 196105, or by e-mail to: hello@klinin.com.
The current Privacy Policy is available at: https://klinin.com/politika-konfidentsialnosti.php