Personal Data Processing Policy for Website Visitors
Version dated May 31, 2026
- GENERAL PROVISIONS
1.1. This Personal Data Processing Policy (hereinafter referred to as the “Policy”) has been developed pursuant to the requirements of Clause 2, Part 1, Article 18.1 of Federal Law No. 152-FZ dated July 27, 2006 “On Personal Data” (hereinafter referred to as the “Personal Data Law”) for the purpose of ensuring the protection of human and civil rights and freedoms during the processing of personal data.
1.2. The Policy governs the processes of personal data processing by the operator – Individual Entrepreneur Anastasia Viktorovna Tarasova (Taxpayer Identification Number (INN) 732897965709, hereinafter referred to as the “Operator”) in the course of operation of the website located on the Internet at
http://anastasia-fashiondoll.su (hereinafter referred to as the “Website”).
1.3. For the purposes of this Policy, personal data means any information relating directly or indirectly to an identified or identifiable individual who is a visitor (user) of the Website (hereinafter referred to as the “Personal Data Subject” or the “Subject”).
2. PRINCIPLES OF PERSONAL DATA PROCESSING
2.1. Personal data shall be processed by the Operator in accordance with the requirements of the legislation of the Russian Federation based on the following principles:
2.1.1. legality and fairness;
2.1.2. restriction of personal data processing to the achievement of specific, predetermined, and lawful purposes;
2.1.3. inadmissibility of personal data processing incompatible with the purposes of personal data collection;
2.1.4. inadmissibility of combining databases containing personal data where such data is processed for purposes incompatible with one another;
2.1.5. processing only those personal data that correspond to the purposes of their processing;
2.1.6. ensuring that the content and scope of personal data processed correspond to the declared purposes of processing;
2.1.7. prevention of excessive personal data processing in relation to the declared purposes of processing;
2.1.8. ensuring the accuracy, sufficiency, and relevance of personal data in relation to the purposes of personal data processing;
2.1.9. destruction of personal data upon achievement of the purposes of processing or in the event that the need to achieve such purposes ceases to exist, where it is impossible for the Operator to remedy violations committed in relation to personal data, unless otherwise provided by law.
3. MAIN RIGHTS AND OBLIGATIONS OF THE OPERATOR
3.1. The Operator shall have the right to:
3.1.1. independently determine the composition and list of measures necessary and sufficient to ensure compliance with the obligations established by the Personal Data Law, unless otherwise provided by legislation;
3.1.2. entrust the processing of personal data to another person with the consent of the Personal Data Subject, unless otherwise provided by federal law, on the basis of an agreement concluded with such person. A person processing personal data on behalf of the Operator shall be obliged to comply with the principles and rules of personal data processing established by the Personal Data Law;
3.1.3. transfer the Subject’s personal data to third parties with the Subject’s consent or in other cases expressly provided for by law;
3.1.4. continue processing personal data without the consent of the Personal Data Subject in the event that the Subject withdraws consent, provided there are grounds specified in the Personal Data Law.
3.2. The Operator shall be obliged to:
3.2.1. provide the Subject, upon request, with information regarding the processing of personal data;
3.2.2. use personal data exclusively for the purposes specified in this Policy;
3.2.3. maintain the confidentiality of personal data and not disclose or disseminate personal data to third parties without the Subject’s consent;
3.2.4. take legal, organizational, and technical measures to ensure the confidentiality and security of Subjects’ personal data in accordance with legal requirements and generally accepted business practices applicable to the protection of such information;
3.2.5. block personal data relating to the relevant Subject from the moment of receipt of a request or inquiry from the Subject, the Subject’s legal representative, or the authorized authority for the protection of personal data subjects’ rights for the period of verification in the event inaccurate personal data or unlawful actions are identified;
3.2.6. clarify personal data upon confirmation of the fact that such personal data is inaccurate;
3.2.7. terminate personal data processing or ensure its termination (where processing is carried out by another person acting on behalf of the Operator), and destroy personal data or ensure its destruction (where processing is carried out by another person acting on behalf of the Operator) within a period not exceeding thirty days from the date the purpose of personal data processing is achieved;
3.2.8. provide the authorized authority for the protection of personal data subjects’ rights with the necessary information upon request of such authority within 10 days from the date of receipt of the request;
3.2.9. respond to inquiries and requests from personal data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
3.2.10. in the event of establishing the fact of an unlawful accidental transfer (provision, dissemination, access) of personal data resulting in a violation of the rights of Subjects, notify the authorized authority of the incident within 24 hours from the moment such incident is identified and take other measures required by law within the prescribed time limits in connection with the identified incident;
3.2.11. perform other obligations stipulated by the Personal Data Law.
4. MAIN RIGHTS OF THE PERSONAL DATA SUBJECT
4.1. The Personal Data Subject shall have the right to:
4.1.1. obtain information concerning the processing of their personal data, unless access to such information is restricted by law. Such information shall be provided by the Operator to the Personal Data Subject in an accessible form. It shall not contain personal data relating to other Personal Data Subjects, except where lawful grounds exist for disclosure of such personal data. The list of information and the procedure for obtaining it are established by the Personal Data Law;
4.1.2. require the Operator to clarify, block, or destroy their personal data if such personal data is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated purpose of processing;
4.1.3. withdraw previously granted consent to the processing of personal data and submit a request to the Operator to terminate personal data processing;
4.1.4. take measures provided for by law to protect their rights;
4.1.5. appeal unlawful actions or omissions of the Operator in connection with the processing of personal data to Roskomnadzor or in court;
4.1.6. exercise other rights provided for by the Personal Data Law.
5. PURPOSES AND CONDITIONS OF PERSONAL DATA PROCESSING
5.1. Personal data processing shall be limited to the achievement of specific, predetermined, and lawful purposes. Processing of personal data incompatible with the purposes of personal data collection shall not be permitted. Only personal data that correspond to the purposes of processing shall be processed.
5.2. The content and scope of the personal data processed must correspond to the declared processing purposes specified in this section. The personal data processed must not be excessive in relation to the declared purposes of processing.
5.3. The Operator processes the Subject’s personal data for the following purposes:
5.3.1. Processing of a preliminary application submitted by the Personal Data Subject for the purchase of the Operator’s goods and services
5.3.1.1. List of personal data processed
surname, first name, patronymic
residential address
country of residence
city of residence
telephone number
email address
5.3.1.2. Categories of Subjects whose personal data is processed
Website visitors
5.3.1.3. Legal basis for personal data processing
Consent of the Personal Data Subject to the processing of personal data
5.3.1.4. List of processing activities
Collection, systematization, storage, retrieval, transfer (provision, access), blocking, destruction, recording, accumulation, clarification (updating, modification), use, deletion
5.3.1.5. Methods of processing
Mixed processing of personal data involving receipt and/or transmission of information via the Internet
5.3.1.6. Processing and storage periods
Until the purpose of personal data processing is achieved, or until the Subject withdraws consent to the processing of personal data / the Operator receives a request to terminate personal data processing, unless another period is provided for by an agreement or applicable law.
5.3.1.7. Procedure for storage and destruction upon achievement of processing purposes or other grounds
Personal data shall be stored on physical media in specially designated locations preventing unauthorized access, or on electronic media (software, services) using software-based access restriction measures.
Upon achievement of the purposes of personal data processing or occurrence of other grounds for termination of processing, physical media containing personal data shall be destroyed, and personal data shall be deleted from electronic media and systems without the possibility of recovery.
5.3.2. Preparation, conclusion, and performance of a civil law contract
5.3.2.1. List of personal data processed
surname, first name, patronymic
residential address
country of residence
city of residence
telephone number
email address
5.3.2.2. Categories of Subjects whose personal data is processed
clients
Website visitors intending to enter into a civil law contract with the Operator for the purchase of goods and services presented on the Website
5.3.2.3. Legal basis for personal data processing
Conclusion and performance of a contract to which the Personal Data Subject is a party, beneficiary, or guarantor, as well as conclusion of a contract at the initiative of the Subject (including through acceptance by the Subject of the Operator’s offer published on the Website for the purchase of goods/works/services).
5.3.2.4. List of processing activities
Collection, systematization, storage, retrieval, transfer (provision, access), blocking, destruction, recording, accumulation, clarification (updating, modification), use, deletion
5.3.2.5. Methods of processing
Mixed processing of personal data involving receipt and/or transmission of information via the Operator’s internal network and via the Internet
5.3.2.6. Processing and storage periods
For a period of 3 years from the date the Parties fulfill their obligations under the concluded contract (provided such contract has been concluded and taking into account the limitation period for claims arising from contractual performance), or until the purpose of personal data processing is achieved, or until the Subject withdraws consent to the processing of personal data / the Operator receives a request to terminate personal data processing, provided there are no other legal grounds for continuing the processing of the Subject’s personal data.
5.3.2.7. Procedure for storage and destruction upon achievement of processing purposes or other grounds
Personal data shall be stored on physical media in specially designated locations preventing unauthorized access, or on electronic media (software, services) using software-based access restriction measures.
Upon achievement of the purposes of personal data processing or occurrence of other grounds for termination of processing, physical media containing personal data shall be destroyed, and personal data shall be deleted from electronic media and systems without the possibility of recovery.
5.3.3. Collection of statistical information regarding the Subject’s actions on the Website using web analytics services (metric programs)
5.3.3.1. List of personal data processed
cookie files (information collected through metric programs)
5.3.3.2. Categories of Subjects whose personal data is processed
Website visitors
5.3.3.3. Legal basis for personal data processing
Consent of the Personal Data Subject to the processing of personal data
5.3.3.4. List of processing activities
Collection, systematization, storage, retrieval, transfer (provision, access), blocking, destruction, recording, accumulation, clarification (updating, modification), use, deletion
5.3.3.5. Methods of processing
Automated processing of personal data involving receipt and/or transmission of information via the Operator’s internal network and via the Internet
5.3.3.6. Processing and storage periods
Until the purpose of personal data processing is achieved, or until the Subject withdraws consent to the processing of personal data / the Operator receives a request to terminate personal data processing, unless another period is provided for by an agreement or applicable law.
5.3.3.7. Procedure for storage and destruction upon achievement of processing purposes or other grounds
Personal data shall be stored in information systems (services) using software-based access restriction measures.
Upon achievement of the purposes of personal data processing or occurrence of other grounds for termination of processing, physical media containing personal data shall be destroyed, and personal data shall be deleted from electronic media (systems) without the possibility of recovery.
5.3.4. Ensuring compliance with tax legislation
5.3.4.1. List of personal data processed
Personal data:
surname, first name, patronymic
email address
5.3.4.2. Categories of Subjects whose personal data is processed
clients
Website visitors
5.3.4.3. Legal basis for personal data processing
Necessity to fulfill the functions, powers, and obligations imposed on the Operator by the legislation of the Russian Federation (issuance by the Operator of fiscal receipts to Website visitors who have purchased goods or services from the Operator).
5.3.4.4. List of processing activities
Collection, systematization, storage, retrieval, transfer (provision, access), blocking, destruction, recording, accumulation, clarification (updating, modification), use, deletion
5.3.4.5. Methods of processing
Mixed processing of personal data involving receipt and/or transmission of information via the Operator’s internal network and via the Internet
5.3.4.6. Processing and storage periods
Until the purpose of personal data processing is achieved, or until the Subject withdraws consent to the processing of personal data / the Operator receives a request to terminate personal data processing, unless another period is provided for by an agreement or applicable law.
5.3.4.7. Procedure for storage and destruction upon achievement of processing purposes or other grounds
Personal data shall be stored on physical media in specially designated locations preventing unauthorized access, or on electronic media (software, services) using software-based access restriction measures.
Upon achievement of the purposes of personal data processing or occurrence of other grounds for termination of processing, physical media containing personal data shall be destroyed, and personal data shall be deleted from electronic media and systems without the possibility of recovery.
6. LEGAL BASIS FOR PERSONAL DATA PROCESSING
6.1. The general legal basis for the Operator’s processing of personal data is the aggregate of regulatory legal acts pursuant to which the Operator carries out personal data processing, including:
6.1.1. the Constitution of the Russian Federation;
6.1.2. the Civil Code of the Russian Federation;
6.1.3. the Tax Code of the Russian Federation;
6.1.4. Federal Law No. 149-FZ dated July 27, 2006 “On Information, Information Technologies and Information Protection”;
6.1.5. other regulatory legal acts governing relations connected with the Operator’s activities, as well as regulatory documents of authorized state authorities of the Russian Federation.
6.2. Specific legal grounds for personal data processing include:
6.2.1. consent of the Personal Data Subject to the processing of personal data, where obtaining such consent is required under applicable law;
6.2.2. conclusion and performance of a contract to which the Personal Data Subject is a party, beneficiary, or guarantor, as well as conclusion of a contract at the Subject’s initiative (including through acceptance by the Subject of the Operator’s offer published on the Website for the purchase of goods/works/services);
6.2.3. necessity to fulfill the functions, powers, and obligations imposed on the Operator by the legislation of the Russian Federation.
6.3. The Operator is entitled to process the Subject’s personal data without obtaining consent where legal grounds provided for by the Personal Data Law exist.
6.4. The specific permissible legal grounds applicable to each purpose of processing the Subject’s personal data are specified in this Policy.
6.5. Obtaining consent for the processing of personal data is implemented through the functionality of the Website. By completing data collection forms on the Website and/or submitting personal data to the Operator, the Website user places a special mark (web mark) in the checkbox of the data collection form. Adjacent to the checkbox is a text indicating that the Subject grants consent to the Operator for personal data processing and confirms familiarity with this Policy. The text contains an active hyperlink through which the Subject may review the full text of the Policy. Checking the designated checkbox (performing conclusive actions) shall be deemed the Subject’s consent to the processing of their personal data by the Operator.
6.6. The Operator may send advertising and informational messages to the Personal Data Subject via email only upon obtaining prior consent to receive advertising in accordance with Part 1 of Article 18 of Federal Law No. 38-FZ dated March 13, 2006 “On Advertising”. Consent to receive advertising messages from the Operator via email may be provided in written form or electronically by checking the corresponding box on the Website. The Personal Data Subject may refuse to receive advertising messages by following the relevant unsubscribe link contained in emails received from the Operator or by sending a notice of refusal to receive advertising messages to the Operator.