Privacy policy
This is a courtesy translation. The policy is governed by the law of the Russian Federation and the Russian version is the binding text. Where the two differ, the Russian version prevails.
1. General provisions
This personal data processing policy is drawn up in accordance with the requirements of Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (the Personal Data Law) and sets out the procedure for processing personal data and the measures taken to secure personal data by Alexander Vasilyevich Skurikhin, sole proprietor (the Operator).
1.1. The Operator holds as its most important objective and as a condition of carrying out its activity the observance of human and civil rights and freedoms in the processing of personal data, including protection of the rights to privacy of personal and family life.
1.2. This policy of the Operator on the processing of personal data (the Policy) applies to all information the Operator may obtain about visitors to the website ebitda.solutions.
2. Key terms used in the Policy
2.1. Automated processing of personal data: processing of personal data by means of computing equipment.
2.2. Blocking of personal data: temporary suspension of the processing of personal data, except where processing is necessary to correct the personal data.
2.3. Website: a body of graphic and information materials, together with computer programs and databases, made available on the internet at the network address ebitda.solutions.
2.4. Personal data information system: a body of personal data contained in databases, together with the information technologies and technical means that process it.
2.5. Anonymisation of personal data: actions after which it is impossible, without additional information, to determine that personal data belongs to a particular User or other data subject.
2.6. Processing of personal data: any action or set of actions performed with or without the use of automation tools with personal data, including collection, recording, systematisation, accumulation, storage, correction (updating, modification), extraction, use, transfer (distribution, provision, access), anonymisation, blocking, deletion and destruction of personal data.
2.7. Operator: a state body, municipal body, legal entity or natural person that, alone or jointly with others, organises and/or carries out the processing of personal data and determines the purposes of processing, the composition of the personal data to be processed, and the actions performed with the personal data.
2.8. Personal data: any information relating directly or indirectly to a determined or determinable User of the website ebitda.solutions.
2.9. Personal data authorised by the data subject for distribution: personal data to which access by an unlimited number of persons has been granted by the data subject through consent to the processing of personal data authorised for distribution in the manner set out in the Personal Data Law.
2.10. User: any visitor to the website ebitda.solutions.
2.11. Provision of personal data: actions aimed at disclosing personal data to a specified person or a specified group of persons.
2.12. Distribution of personal data: any actions aimed at disclosing personal data to an indefinite group of persons, or at making personal data known to an unlimited number of persons, including publication in mass media, posting on information and telecommunication networks, or granting access to personal data by any other means.
2.13. Cross-border transfer of personal data: transfer of personal data to the territory of a foreign state, to a foreign state authority, a foreign natural person or a foreign legal entity.
2.14. Destruction of personal data: any actions as a result of which personal data is irreversibly destroyed with no possibility of further restoration of its content in the personal data information system, and/or the material carriers of the personal data are destroyed.
3. Principal rights and obligations of the Operator
3.1. The Operator has the right to:
- receive from the data subject accurate information and/or documents containing personal data
- where the data subject withdraws consent to the processing of personal data, or sends a demand that processing cease, continue processing the personal data without the data subject’s consent where the grounds set out in the Personal Data Law are present
- determine independently the composition and list of measures necessary and sufficient to ensure the fulfilment of the obligations set out in the Personal Data Law and the regulations adopted under it, unless the Personal Data Law or other federal laws provide otherwise
3.2. The Operator is obliged to:
- provide the data subject, at their request, with information concerning the processing of their personal data
- organise the processing of personal data in the manner established by applicable Russian law
- respond to enquiries and requests from data subjects and their legal representatives in accordance with the requirements of the Personal Data Law
- report to the authorised body for the protection of data subjects’ rights, at that body’s request, the information required, within 10 days of receiving such a request
- publish or otherwise provide unrestricted access to this Policy on the processing of personal data
- take legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, modification, blocking, copying, provision and distribution, and against other unlawful actions in respect of personal data
- cease the transfer (distribution, provision, access) of personal data, cease processing and destroy personal data in the manner and in the cases set out in the Personal Data Law
- fulfil the other obligations set out in the Personal Data Law
4. Principal rights and obligations of data subjects
4.1. Data subjects have the right to:
- receive information concerning the processing of their personal data, except in the cases set out in federal laws. The information is provided to the data subject by the Operator in an accessible form and must not contain personal data relating to other data subjects, except where there are lawful grounds to disclose such data. The list of information and the procedure for obtaining it are set out in the Personal Data Law
- require the operator to correct their personal data, or to block or destroy it, where the personal data is incomplete, out of date, inaccurate, unlawfully obtained or not necessary for the stated purpose of processing, and to take the measures provided by law to protect their rights
- make prior consent a condition of the processing of personal data for the purpose of promoting goods, works and services on the market
- withdraw consent to the processing of personal data, and send a demand that processing cease
- appeal to the authorised body for the protection of data subjects’ rights, or to a court, against unlawful acts or omissions of the Operator in processing their personal data
- exercise the other rights provided by Russian law
4.2. Data subjects are obliged to:
- provide the Operator with accurate data about themselves
- notify the Operator of any correction (update, change) to their personal data
4.3. Persons who have provided the Operator with inaccurate information about themselves, or information about another data subject without that subject’s consent, bear liability in accordance with Russian law.
5. Principles of personal data processing
5.1. Personal data is processed on a lawful and fair basis.
5.2. The processing of personal data is limited to the achievement of specific, predetermined and lawful purposes. Processing of personal data that is incompatible with the purposes of collection is not permitted.
5.3. Databases containing personal data processed for purposes incompatible with one another may not be combined.
5.4. Only personal data that meets the purposes of its processing is processed.
5.5. The content and volume of the personal data processed correspond to the stated purposes of processing. Personal data processed in excess of the stated purposes is not permitted.
5.6. In processing personal data, the accuracy, sufficiency and, where necessary, currency of the personal data in relation to the purposes of processing is ensured. The Operator takes, or ensures that others take, the measures necessary to delete or correct incomplete or inaccurate data.
5.7. Personal data is stored in a form permitting identification of the data subject no longer than the purposes of processing require, unless a storage period is established by federal law or by a contract to which the data subject is a party, beneficiary or guarantor. Processed personal data is destroyed or anonymised once the purposes of processing are achieved, or where the need to achieve them is lost, unless federal law provides otherwise.
6. Purposes of personal data processing
- Purpose of processing
- booking the User onto a consultation and contacting them about that booking
- Personal data
- first name
email address - Legal grounds
- Federal Law No. 149-FZ of 27 July 2006 “On Information, Information Technologies and the Protection of Information”
- Types of personal data processing
- collection, storage and transfer of personal data
7. Conditions of personal data processing
7.1. Personal data is processed with the consent of the data subject to the processing of their personal data.
7.2. Processing of personal data is necessary to achieve the purposes provided by an international treaty of the Russian Federation or by law, and to carry out the functions, powers and duties placed on the operator by Russian law.
7.3. Processing of personal data is necessary for the administration of justice and the execution of a judicial act or an act of another body or official subject to enforcement under Russian enforcement proceedings law.
7.4. Processing of personal data is necessary for the performance of a contract to which the data subject is a party, beneficiary or guarantor, and for the conclusion of a contract on the data subject’s initiative or a contract under which the data subject will be a beneficiary or guarantor.
7.5. Processing of personal data is necessary to exercise the rights and legitimate interests of the operator or third parties, or to achieve socially significant purposes, provided that the rights and freedoms of the data subject are not infringed.
7.6. Processing is carried out of personal data to which access by an unlimited number of persons has been granted by the data subject or at their request (publicly available personal data).
7.7. Processing is carried out of personal data subject to publication or mandatory disclosure in accordance with federal law.
8. Procedure for collection, storage, transfer and other processing of personal data
The security of the personal data processed by the Operator is ensured through legal, organisational and technical measures necessary to comply in full with applicable data protection law.
8.1. The Operator ensures the safekeeping of personal data and takes every possible measure to prevent unauthorised persons from accessing it.
8.2. The User’s personal data will never, under any circumstances, be transferred to third parties, except where required by applicable law, or where the data subject has given the Operator consent to transfer the data to a third party for the performance of obligations under a civil law contract.
8.3. If inaccuracies in personal data are identified, the User may correct them independently by sending the Operator a notice to the Operator’s email address sasha@ebitda.solutions marked “Correction of personal data”.
8.4. The period of personal data processing is determined by the achievement of the purposes for which the personal data was collected, unless a different period is provided by contract or applicable law.
The User may withdraw consent to the processing of personal data at any time by sending the Operator a notice by email to the Operator’s address sasha@ebitda.solutions marked “Withdrawal of consent to the processing of personal data”.
8.5. All information collected by third-party services, including payment systems, communication tools and other service providers, is stored and processed by those persons (Operators) in accordance with their terms of use and privacy policies. The Operator bears no responsibility for the actions of third parties, including the service providers referred to in this clause.
8.6. Prohibitions established by the data subject on transfer (other than granting access), and on processing or conditions of processing (other than obtaining access) of personal data authorised for distribution, do not apply where personal data is processed in state, public and other public interests defined by Russian law.
8.7. In processing personal data, the Operator ensures the confidentiality of personal data.
8.8. The Operator stores personal data in a form permitting identification of the data subject no longer than the purposes of processing require, unless a storage period is established by federal law or by a contract to which the data subject is a party, beneficiary or guarantor.
8.9. Processing of personal data may cease upon achievement of the purposes of processing, expiry of the data subject’s consent, withdrawal of consent by the data subject, a demand that processing cease, or the identification of unlawful processing of personal data.
8.10. Booking onto a consultation is carried out through the Google Calendar service (Google LLC). The data the User enters into the booking form is processed by Google LLC in accordance with its privacy policy. The Operator receives this data in order to hold the consultation and does not pass it on to any other third parties.
9. List of actions performed by the Operator with the personal data obtained
9.1. The Operator carries out the collection, recording, systematisation, accumulation, storage, correction (updating, modification), extraction, use, transfer (distribution, provision, access), anonymisation, blocking, deletion and destruction of personal data.
9.2. The Operator carries out automated processing of personal data, with or without the receipt and/or transfer of the resulting information over information and telecommunication networks.
10. Cross-border transfer of personal data
10.1. Before beginning any activity involving the cross-border transfer of personal data, the Operator is obliged to notify the authorised body for the protection of data subjects’ rights of its intention to carry out cross-border transfer of personal data. Such notice is sent separately from the notice of intention to process personal data.
10.2. Before filing the above notice, the Operator is obliged to obtain the relevant information from the foreign state authorities, foreign natural persons and foreign legal entities to which the cross-border transfer of personal data is planned.
10.3. The Operator’s use of the Google Calendar service entails the transfer of the User’s personal data to the territory of a foreign state.
11. Confidentiality of personal data
The Operator and other persons who have obtained access to personal data are obliged not to disclose it to third parties and not to distribute personal data without the consent of the data subject, unless federal law provides otherwise.
12. Final provisions
12.1. The User may obtain any clarification on questions concerning the processing of their personal data by contacting the Operator by email at sasha@ebitda.solutions.
12.2. Any changes to the Operator’s personal data processing policy will be reflected in this document. The Policy is valid indefinitely until replaced by a new version.
12.3. The current version of the Policy is freely available on the internet at ebitda.solutions/policy.