1. General provisions
This personal data processing policy has been prepared in accordance with Federal Law No. 152-FZ of 27 July 2006, “On Personal Data” (the “Personal Data Law”), and defines the procedures for processing personal data and the measures taken to protect personal data by Mikhail Aleksandrovich Grechka (the “Operator”).

1.1. The Operator considers respect for human and civil rights and freedoms when processing personal data, including protection of privacy and personal and family confidentiality, a primary objective and condition of its activities.

1.2. This personal data processing policy (the “Policy”) applies to all information the Operator may obtain about visitors to https://colab.art.

2. Definitions used in this Policy
2.1. Automated processing of personal data: processing personal data using computing equipment.

2.2. Blocking personal data: temporarily suspending processing, except where processing is necessary to clarify the data.

2.3. Website: the collection of graphic and informational materials, software and databases available online at https://colab.art.

2.4. Personal data information system: personal data contained in databases and the information technology and technical equipment used to process it.

2.5. Depersonalisation: actions that make it impossible to attribute personal data to a particular User or other data subject without additional information.

2.6. Processing personal data: any action or set of actions performed with or without automation, including collection, recording, systematisation, accumulation, storage, clarification (updating or amendment), retrieval, use, transfer (distribution, provision or access), depersonalisation, blocking, deletion and destruction.

2.7. Operator: a public authority, municipal authority, legal entity or individual that independently or jointly organises or carries out processing and determines its purposes, the data to be processed and the operations performed.

2.8. Personal data: any information relating directly or indirectly to an identified or identifiable User of https://colab.art.

2.9. Personal data authorised for distribution: personal data to which the data subject has granted access to an unlimited number of persons by giving consent to processing for distribution in accordance with the Personal Data Law.

2.10. User: any visitor to https://colab.art.

2.11. Provision of personal data: actions intended to disclose personal data to a specified person or group of persons.

2.12. Distribution of personal data: actions intended to disclose data to an unlimited number of persons or familiarise an unlimited number of persons with it, including publication in the media, placement on information and telecommunications networks, or access provided by other means.

2.13. Cross-border transfer: transfer of personal data to a foreign state, foreign public authority, foreign individual or foreign legal entity.

2.14. Destruction of personal data: actions that make it impossible to restore personal data in an information system and/or destroy its physical media.

3. The Operator’s principal rights and obligations
3.1. The Operator may:
— obtain accurate information and/or documents containing personal data from the data subject;
— continue processing without consent where the grounds set out in the Personal Data Law apply, including following withdrawal of consent or a request to stop processing;
— independently determine the measures necessary and sufficient to comply with the Personal Data Law and regulations adopted under it, unless federal law provides otherwise.

3.2. The Operator must:
— provide information concerning processing at the data subject’s request;
— organise processing in accordance with Russian law;
— respond to enquiries and requests from data subjects and their legal representatives in accordance with the Personal Data Law;
— provide the information requested by the authorised personal data protection authority within ten days of receiving its request; this period may be extended by up to five working days if a reasoned notice is sent explaining the extension;
— publish this Policy or otherwise provide unrestricted access to it;
— take legal, organisational and technical measures to protect personal data from unlawful or accidental access, destruction, amendment, blocking, copying, provision, distribution and other unlawful actions;
— stop transfer (distribution, provision or access), stop processing and destroy personal data in the cases and manner prescribed by the Personal Data Law;
— fulfil other obligations prescribed by the Personal Data Law.

4. Data subjects’ principal rights and obligations
4.1. Data subjects may:
— obtain information about processing, except in cases provided for by federal law; information must be provided in an accessible form and must not include another data subject’s personal data unless lawful grounds exist for disclosure; the Personal Data Law establishes the information provided and how to obtain it;
— require clarification, blocking or destruction of incomplete, outdated, inaccurate, unlawfully obtained data or data unnecessary for the stated purpose, and take legal measures to protect their rights;
— require prior consent for processing intended to promote goods, works or services;
— withdraw consent and request termination of processing;
— appeal unlawful actions or omissions to the authorised personal data protection authority or a court;
— exercise other rights provided by Russian law.

4.2. Data subjects must provide accurate information about themselves and notify the Operator of updates or changes.

4.3. Persons who provide inaccurate information about themselves, or another person’s information without that person’s consent, bear responsibility under Russian law.

5. Principles of processing
5.1. Processing is lawful and fair.

5.2. Processing is limited to specific, predetermined and lawful purposes. Processing incompatible with the purposes for which data was collected is prohibited.

5.3. Databases containing data processed for incompatible purposes must not be combined.

5.4. Only data relevant to the processing purposes may be processed.

5.5. The content and amount of data must correspond to those purposes. Excessive processing is prohibited.

5.6. Data must be accurate, sufficient and, where necessary, up to date. The Operator takes or ensures necessary measures to delete or clarify incomplete or inaccurate data.

5.7. Data is kept in a form identifying the subject for no longer than necessary, unless a retention period is established by federal law or a contract to which the subject is a party, beneficiary or guarantor. Data is destroyed or depersonalised when its purposes are achieved or no longer necessary, unless federal law provides otherwise.

6. Purposes of processing

7. Conditions of processing
7.1. Processing is carried out with the data subject’s consent.

7.2. Processing may be necessary to achieve the purposes prescribed by an international treaty or Russian law, or to perform functions, powers and duties imposed on the Operator by law.

7.3. Processing may be necessary for the administration of justice or enforcement of a judicial act, or an act of another body or official enforceable under Russian enforcement legislation.

7.4. Processing may be necessary to perform a contract to which the subject is a party, beneficiary or guarantor, or to enter into a contract at the subject’s initiative or one under which the subject will be a beneficiary or guarantor.

7.5. Processing may be necessary to exercise the rights and legitimate interests of the Operator or third parties, or to achieve socially significant objectives, provided the subject’s rights and freedoms are not infringed.

7.6. Processing may concern data made accessible to an unlimited number of persons by the subject or at their request (publicly available personal data).

7.7. Processing may concern data subject to publication or mandatory disclosure under federal law.

8. Collection, storage, transfer and other processing procedures
The security of personal data processed by the Operator is ensured through legal, organisational and technical measures necessary to comply fully with applicable personal data protection legislation.

8.1. The Operator safeguards data and takes all possible measures to prevent unauthorised access.

8.2. User data is never transferred to third parties except where required by applicable law or where the subject consents to transfer for performance of civil-law contractual obligations.

8.3. Users may correct inaccurate data by emailing art.collab.agency@gmail.com with the subject line “Personal data update.”

8.4. The processing period is determined by achievement of the purposes for which data was collected, unless a contract or applicable law provides otherwise. Users may withdraw consent at any time by emailing art.collab.agency@gmail.com with the subject line “Withdrawal of consent to personal data processing.”

8.5. Information collected by third-party services, including payment systems, communications services and other providers, is stored and processed by those parties under their user agreements and privacy policies. Data subjects should consult those documents. The Operator is not responsible for third parties’ actions, including those of the providers listed here.

8.6. Restrictions imposed by a data subject on transfer (except granting access), processing, or processing conditions (except obtaining access) for data authorised for distribution do not apply where processing is in state, public or other public interests defined by Russian law.

8.7. The Operator maintains confidentiality during processing.

8.8. Data is stored in a form identifying the subject for no longer than necessary unless a retention period is prescribed by federal law or a contract to which the subject is a party, beneficiary or guarantor.

8.9. Processing may stop when its purposes are achieved, consent expires or is withdrawn, the subject requests termination, or unlawful processing is identified.

9. Operations performed on personal data
9.1. The Operator collects, records, systematises, accumulates, stores, clarifies (updates or amends), retrieves, uses, transfers (distributes, provides or grants access to), depersonalises, blocks, deletes and destroys personal data.

9.2. The Operator performs automated processing with or without receipt and/or transmission of information over information and telecommunications networks.

10. Cross-border transfer
10.1. Before starting cross-border transfers, the Operator must notify the authorised personal data protection authority of its intention to do so. This notice is separate from the notice of intention to process personal data.

10.2. Before submitting that notice, the Operator must obtain the relevant information from the foreign public authorities, individuals and legal entities to whom data is to be transferred.

11. Confidentiality
The Operator and other persons with access to personal data must not disclose it to third parties or distribute it without the data subject’s consent, unless federal law provides otherwise.

12. Final provisions
12.1. Users may request clarification about processing by emailing art.collab.agency@gmail.com.

12.2. Changes to the Operator’s processing policy will be reflected in this document. The Policy remains in force indefinitely until replaced by a new version.

12.3. The current Policy is freely available at https://colab.art/en/privacy.