Personal Data Processing Policy

1. General provisions

1.1. This Policy sets out how Limited Liability Company Trading Company Konditer Profi (Konditer Profi Trading Company LLC, OGRN 1146679024030, INN 6679055258, address: 82-A Selkorovskaya St., Yekaterinburg, Sverdlovsk Oblast, 620103, Russia) — hereinafter the "Operator" — processes and protects the personal data of users of the website konditerprofi.ru and its English and Chinese versions (hereinafter the "Website").

1.2. The Policy has been drawn up in accordance with Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" and is published on the Website for unrestricted access (Part 2 of Article 18.1 of the Law).

1.3. The Policy applies to all personal data that the Operator receives through the Website: when an order is placed, when a user signs in to their account, subscribes to the newsletter, sends a wholesale request, a question about products, a job application or an internship request, and automatically when the Website is visited.

1.4. Personal data is processed on the basis of the data subject's consent (the "Consent to Personal Data Processing" on the Website), and also where processing is required to conclude and perform a sale contract to which the buyer is a party and to fulfil obligations imposed on the Operator by law (for example, tax law and the law on cash registers).

1.5. Terms are used in the meaning established by Law No. 152-FZ. A "User" is any person who visits the Website or provides personal data to the Operator through the Website.

2. What data we process and why

Placing and fulfilling an order. First and last name, phone number, email address, city, delivery address or selected pick-up point, order comment, order contents and amount, payment details (payment number and status, without bank card data). Purpose: to accept, pay for, pack and deliver the order, to notify about its status, to issue a cash receipt, to handle claims or returns.

Personal account and bonus programme. Email address, name, phone number (if provided by the user), order history, bonus points, favourite products and products for comparison. Purpose: signing in with a code sent by email, storing order history, accruing and spending bonus points. The account is created automatically for the email address specified in the order.

Newsletter about promotions and new products. Email address and website language. Purpose: sending advertising and informational emails. Only with separate consent to receive marketing emails.

Wholesale cooperation. Company name, INN, contact person, phone, email, city, client type, expected purchase volume, comment. Purpose: to respond to the request and prepare an offer.

Product questions, job applications and internship requests. Name, phone and/or email, message text, selected vacancy. Purpose: to respond to the request and to consider the candidate.

VKontakte notifications. VKontakte user ID — only if the user has clicked "Allow messages". Purpose: to notify about the order status.

Technical data. IP address, browser and device information, cookies, addresses of pages viewed, date and time of visit. Purpose: operation of the cart, sign-in and language choice, protection of forms against abuse and, with the user's consent, visit statistics (Section 6).

2.1. The Operator does not process special categories of personal data (health, beliefs, etc.) or biometric personal data. Please do not include such information in comments and messages.

2.2. Bank card details are entered on the secure page of the acquiring bank and are not transferred to the Operator.

2.3. The Website is not intended for collecting data of persons under 14. Orders on the Website are placed by adult buyers.

3. How we process data

3.1. Actions with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, changing), retrieval, use, transfer (provision, access), depersonalisation, blocking, deletion, destruction. Processing is carried out both with and without automation tools.

3.2. Personal data of citizens of the Russian Federation is recorded, systematised, accumulated, stored, clarified and retrieved using databases located in the Russian Federation (Part 5 of Article 18 of Law No. 152-FZ). The Website and its database run on the Operator's servers in Russia.

3.3. The Operator does not carry out cross-border transfer of personal data.

4. To whom we transfer data

4.1. The Operator transfers personal data only to the extent necessary for a specific purpose:

• to the delivery services chosen by the buyer (Ozon, CDEK, 5Post / Yandex Delivery, courier service) — name, phone, email, city, address or pick-up point, shipment details;
• to the acquiring bank through which the order is paid (Ozon Bank or YooKassa) — order number and amount, order contents for the cash receipt, the buyer's email or phone for sending the receipt;
• to the fiscal data operator — information that by law is included in the cash receipt;
• to VKontakte — only if the user has allowed messages from the community;
• to the email service through which the Website sends emails — email address and email text;
• to government authorities — in cases provided for by law.

4.2. Services that process data on behalf of the Operator are obliged to keep it confidential and protect it (Part 3 of Article 6 of Law No. 152-FZ).

4.3. The Operator does not sell personal data and does not transfer it for third-party advertising.

5. Retention periods

• order data and related correspondence — for the period established by accounting and tax law (at least 5 years after the end of the year in which the order was fulfilled);
• personal account data — until the account is deleted at the user's request; bonus points expire under the bonus programme rules;
• newsletter address — until unsubscription or withdrawal of consent;
• wholesale requests, product questions, job applications and internship requests — until the purpose of processing is achieved, but no longer than 3 years;
• technical data and log records — no longer than 1 year.

5.1. When the purpose of processing has been achieved, the period has expired or consent has been withdrawn (unless there is another legal basis), the Operator deletes or depersonalises the data within 30 days.

6. Cookies and statistics

6.1. Cookies are small files that the Website saves in the user's browser.

6.2. Necessary cookies always work: cart number, account sign-in, selected language, city, and remembering the choice in the cookie notice. Without them the Website cannot accept an order.

6.3. Statistics cookies (Yandex Metrica service, Yandex LLC) are enabled only if the user has clicked "Accept all" in the cookie notice. They help us understand which pages are used and make the Website more convenient. The choice can be changed at any time with the "Cookie settings" button at the bottom of the Website or by clearing cookies in the browser settings.

7. User rights

7.1. The user has the right to:

• receive information about the processing of their personal data;
• demand that the data be clarified, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose;
• withdraw consent to personal data processing and consent to marketing emails;
• appeal against the Operator's actions to Roskomnadzor or in court.

7.2. To exercise these rights, write to market@konditerprofi.ru or to the postal address PO Box 95, Yekaterinburg, 620103, Russia. Please state how to address you and the email address or phone number you used on the Website so that we can find your data.

7.3. The Operator responds to a request within 10 working days. This period may be extended by no more than 5 working days with a reason given.

7.4. You can also unsubscribe from the newsletter using the link in any newsletter email.

8. How we protect data

8.1. The Operator takes legal, organisational and technical protection measures: the connection to the Website is encrypted (HTTPS), access to the database and the control panel is available only to authorised employees with a personal password, backups are kept, and the Operator does not receive payment card data.

8.2. The Operator appoints a person responsible for organising the processing of personal data.

9. Changes to the Policy

9.1. The Operator may change the Policy. The new version takes effect from the moment it is published on the Website, unless otherwise stated in it. The version date is shown at the top of the page.

9.2. Questions about the Policy: market@konditerprofi.ru, phone +7 (34551) 5-16-10.