Policy on the processing of personal data
1. General provisions
This policy on the processing of personal data has been drawn up in accordance with the requirements of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (hereinafter, the Personal Data Law) and sets out the procedure for the processing of personal data and the measures to ensure the security of personal data taken by CODA COMPANY LIMITED (hereinafter, the Operator).
1.1. The Operator regards respect for the rights and freedoms of the individual and the citizen in the processing of their personal data, including protection of the rights to privacy and to personal and family confidentiality, as the paramount objective of its activities and as a condition of carrying them out.
1.2. This policy of the Operator with regard to the processing of personal data (hereinafter, the Policy) applies to all information that the Operator may obtain about visitors to the website https://dandaraphuket.com/.
2. Key terms used in the Policy
2.1. Automated processing of personal data means the processing of personal data by means of computer equipment.
2.2. Blocking of personal data means the temporary cessation of the processing of personal data (except where the processing is necessary in order to rectify the personal data).
2.3. Website means the body of graphic and informational materials, together with the computer programs and databases that make them accessible on the internet at the network address https://dandaraphuket.com/.
2.4. Personal data information system means the body of personal data contained in databases together with the information technologies and technical means that ensure their processing.
2.5. Anonymisation of personal data means actions as a result of which it is impossible, without the use of additional information, to establish that the personal data belong to a particular User or other data subject.
2.6. Processing of personal data means any action (operation) or set of actions (operations) performed on personal data with or without the use of automated means, including the collection, recording, systematisation, accumulation, storage, rectification (updating, amendment), extraction, use, transfer (dissemination, provision, access), anonymisation, blocking, deletion and erasure of personal data.
2.7. Operator means a state body, a municipal body, or a legal or natural person that, alone or jointly with others, organises and/or carries out the processing of personal data and also determines the purposes of the processing of personal data, the categories of personal data to be processed, and the actions (operations) performed on the personal data.
2.8. Personal data means any information relating directly or indirectly to an identified or identifiable User of the website https://dandaraphuket.com/.
2.9. Personal data authorised by the data subject for dissemination means personal data to which access by an unlimited range of persons has been granted by the data subject by giving consent to the processing of personal data authorised by the data subject for dissemination in the manner provided for by the Personal Data Law (hereinafter, personal data authorised for dissemination).
2.10. User means any visitor to the website https://dandaraphuket.com/.
2.11. Provision of personal data means actions directed at disclosing personal data to a particular person or a particular range of persons.
2.12. Dissemination of personal data means any actions directed at disclosing personal data to an indeterminate range of persons (transfer of personal data) or at making personal data known to an unlimited range of persons, including publishing personal data in the mass media, placing them in information and telecommunications networks, or granting access to personal data by any other means.
2.13. Cross-border transfer of personal data means the transfer of personal data to the territory of a foreign state, to a public authority of a foreign state, or to a foreign natural person or a foreign legal person.
2.14. Erasure of personal data means any actions as a result of which personal data are irretrievably erased, with no possibility of subsequently recovering the content of the personal data in the personal data information system, and/or as a result of which the physical media containing the personal data are destroyed.
3. Principal rights and obligations of the Operator
3.1. The Operator shall have the right:
— to obtain from the data subject accurate information and/or documents containing personal data;
— where the data subject withdraws consent to the processing of personal data, and likewise where a request for the cessation of the processing of personal data is sent, to continue processing the personal data without the data subject’s consent where the grounds specified in the Personal Data Law are present;
— to determine independently the composition and the list of measures that are necessary and sufficient to ensure the fulfilment of the obligations provided for by the Personal Data Law and by the regulatory legal acts adopted in accordance with it, unless otherwise provided for by the Personal Data Law or by other federal laws.
3.2. The Operator shall be obliged:
— to provide the data subject, at their request, with information concerning the processing of their personal data;
— to organise the processing of personal data in the manner established by the applicable legislation of the Russian Federation;
— to respond to applications and requests from data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
— to report to the authorised body for the protection of the rights of data subjects, at that body’s request, the information required, within 10 days of the date of receipt of such request;
— to publish or otherwise provide unrestricted access to this Policy on the processing of personal data;
— to take legal, organisational and technical measures to protect personal data against unlawful or accidental access to them, and against the erasure, alteration, blocking, copying, provision or dissemination of personal data, as well as against other unlawful actions in respect of personal data;
— to cease the transfer (dissemination, provision, access) of personal data, to cease the processing and to erase the personal data in the manner and in the cases provided for by the Personal Data Law;
— to perform such other obligations as are provided for by the Personal Data Law.
4. Principal rights and obligations of data subjects
4.1. Data subjects shall have the right:
— to obtain information concerning the processing of their personal data, except in the cases provided for by federal laws. Such information shall be provided to the data subject by the Operator in an accessible form and shall not contain personal data relating to other data subjects, save where there are lawful grounds for disclosing such personal data. The list of the information and the procedure for obtaining it are established by the Personal Data Law;
— to require the Operator to rectify, block or erase their personal data where the personal data are incomplete, out of date, inaccurate, unlawfully obtained or not necessary for the stated purpose of the processing, and also to take the measures provided for by law to protect their rights;
— to require prior consent as a condition of the processing of personal data for the purposes of promoting goods, works and services on the market;
— to withdraw consent to the processing of personal data, and likewise to send a request for the cessation of the processing of personal data;
— to appeal to the authorised body for the protection of the rights of data subjects, or to the courts, against unlawful acts or omissions of the Operator in the processing of their personal data;
— to exercise such other rights as are provided for by the legislation of the Russian Federation.
4.2. Data subjects shall be obliged:
— to provide the Operator with accurate data about themselves;
— to inform the Operator of any rectification (updating, amendment) of their personal data.
4.3. Persons who have provided the Operator with inaccurate information about themselves, or with information about another data subject without that person’s consent, shall bear liability in accordance with the legislation of the Russian Federation.
5. Principles of the processing of personal data
5.1. Personal data shall be processed on a lawful and fair basis.
5.2. The processing of personal data shall be limited to the achievement of specific, predetermined and lawful purposes. Processing of personal data that is incompatible with the purposes of the collection of the personal data is not permitted.
5.3. It is not permitted to combine databases containing personal data that are processed for purposes incompatible with one another.
5.4. Only personal data that meet the purposes of their processing shall be subject to processing.
5.5. The content and the volume of the personal data processed correspond to the stated purposes of the processing. The personal data processed shall not be excessive in relation to the stated purposes of their processing.
5.6. In the processing of personal data, the accuracy of the personal data, their sufficiency and, where necessary, their currency in relation to the purposes of the processing of the personal data shall be ensured. The Operator shall take, and/or ensure the taking of, the measures necessary to delete or rectify incomplete or inaccurate data.
5.7. Personal data shall be stored in a form that permits the data subject to be identified for no longer than the purposes of the processing of the personal data require, unless the storage period for the personal data is established by federal law or by a contract to which the data subject is a party, beneficiary or guarantor. The personal data processed shall be erased or anonymised once the purposes of the processing have been achieved, or where the need to achieve those purposes has ceased, unless otherwise provided for by federal law.
6. Purposes of the processing of personal data
| Purpose of processing | informing the User by means of email messages |
| Personal data | • surname, first name, patronymic • telephone numbers |
| Legal grounds | • contracts concluded between the operator and the data subject |
| Types of processing of personal data | • Sending informational messages to an email address |
7. Conditions for the processing of personal data
7.1. Personal data shall be processed with the consent of the data subject to the processing of their personal data.
7.2. The processing of personal data is necessary in order to achieve the purposes provided for by an international treaty of the Russian Federation or by law, and in order to perform the functions, powers and obligations conferred on the operator by the legislation of the Russian Federation.
7.3. The processing of personal data is necessary for the administration of justice and for the enforcement of a judicial act or of an act of another body or official that is subject to enforcement in accordance with the legislation of the Russian Federation on enforcement proceedings.
7.4. The processing of personal data is necessary for the performance of a contract to which the data subject is a party, beneficiary or guarantor, and also for the conclusion of a contract at the initiative of the data subject or of a contract under which the data subject is to be a beneficiary or guarantor.
7.5. The processing of personal data is necessary for the exercise of the rights and legitimate interests of the operator or of third parties, or for the achievement of purposes of public significance, provided that the rights and freedoms of the data subject are not thereby infringed.
7.6. Processing is carried out of personal data to which access by an unlimited range of persons has been granted by the data subject or at their request (hereinafter, publicly available personal data).
7.7. Processing is carried out of personal data that are subject to publication or to mandatory disclosure in accordance with federal law.
8. Procedure for the collection, storage, transfer and other types of processing of personal data
The security of the personal data processed by the Operator is ensured through the implementation of the legal, organisational and technical measures necessary for full compliance with the requirements of the applicable legislation on the protection of personal data.
8.1. The Operator shall ensure the safekeeping of personal data and shall take all possible measures to prevent access to personal data by unauthorised persons.
8.2. The User’s personal data shall never, under any circumstances, be transferred to third parties, except in cases connected with compliance with the applicable legislation, or where the data subject has given the Operator consent to transfer the data to a third party for the performance of obligations under a civil-law contract.
8.3. Should any inaccuracies in the personal data be identified, the User may update them independently by sending the Operator a notification to the Operator’s email address dandaraphuket@gmail.com marked “Updating of personal data”.
8.4. The period of processing of personal data is determined by the achievement of the purposes for which the personal data were collected, unless a different period is provided for by contract or by the applicable legislation.
The User may at any time withdraw their consent to the processing of personal data by sending the Operator a notification by email to the Operator’s email address dandaraphuket@gmail.com marked “Withdrawal of consent to the processing of personal data”.
8.5. All information collected by third-party services, including payment systems, means of communication and other service providers, is stored and processed by those persons (Operators) in accordance with their User Agreement and Privacy Policy. The data subject and/or with the said documents. The Operator shall not be liable for the actions of third parties, including the service providers referred to in this clause.
8.6. Prohibitions imposed by the data subject on the transfer (other than the granting of access) of personal data authorised for dissemination, and on the processing of such data or the conditions of such processing (other than obtaining access), shall not apply in cases of processing of personal data in state, public and other public interests defined by the legislation of the Russian Federation.
8.7. In processing personal data, the Operator shall ensure the confidentiality of the personal data.
8.8. The Operator shall store personal data in a form that permits the data subject to be identified for no longer than the purposes of the processing of the personal data require, unless the storage period for the personal data is established by federal law or by a contract to which the data subject is a party, beneficiary or guarantor.
8.9. Grounds for the cessation of the processing of personal data may include the achievement of the purposes of the processing of the personal data, the expiry of the term of the data subject’s consent, the withdrawal of consent by the data subject or a request for the cessation of the processing of personal data, and the identification of unlawful processing of personal data.
9. List of actions performed by the Operator on the personal data received
9.1. The Operator carries out the collection, recording, systematisation, accumulation, storage, rectification (updating, amendment), extraction, use, transfer (dissemination, provision, access), anonymisation, blocking, deletion and erasure of personal data.
9.2. The Operator carries out automated processing of personal data with or without the receipt and/or transfer of the information obtained over information and telecommunications networks.
10. Cross-border transfer of personal data
10.1. Before commencing any activity involving the cross-border transfer of personal data, the Operator shall be obliged to notify the authorised body for the protection of the rights of data subjects of its intention to carry out cross-border transfer of personal data (such notification shall be sent separately from the notification of the intention to process personal data).
10.2. Before submitting the notification referred to above, the Operator shall be obliged to obtain the relevant information from the public authorities of the foreign state, the foreign natural persons or the foreign legal persons to whom the cross-border transfer of personal data is planned.
11. Confidentiality of personal data
The Operator and other persons who have obtained access to personal data shall be obliged not to disclose personal data to third parties and not to disseminate them without the consent of the data subject, unless otherwise provided for by federal law.
12. Final provisions
12.1. The User may obtain any clarification on questions of interest concerning the processing of their personal data by contacting the Operator by email at dandaraphuket@gmail.com.
12.2. Any changes to the Operator’s policy on the processing of personal data will be reflected in this document. The Policy shall remain in force indefinitely until it is replaced by a new version.
12.3. The current version of the Policy is freely available on the Internet at https://dandaraphuket.com/policy.