Privacy policy

Politics

Personal data processing

of guests of LLC “UYUTNY DOM”

1. GENERAL PROVISIONS

1.1. This Personal Data Processing Policy (hereinafter referred to as the Policy) has been developed pursuant to Federal Law No. 152-F3 of 27.07.2006 "On Personal Data" in order to ensure the protection of human and civil rights and freedoms when processing personal data, including the protection of the rights to privacy, personal and family secrets, in particular in accordance with the Constitution of the Russian Federation, Federal Law No. 149-Fz of 27.07.2006 "On Information, Information Technologies and Information Protection", as well as other regulatory legal acts of the Russian Federation and regulatory documents of the Organization in the field of personal data processing.

1.2. This policy applies to all information that may be obtained from guests of LLC “UYUTNY DOM”, including information posted by the user on the website on the Internet at https://karelia-resort.ru (hereinafter referred to as the “Site”), as well as information that the organization may obtain about the user while using the Site, its services, programs, and products.

1.3. COZY HOUSE LLC, OGRN 1241000005399, TIN 1000018747, location address: 186730, Republic of Karelia, Lahdenpokhsky district, village of Raukhala, block 2202, building 2790 (hereinafter referred to as the "Organization"), as the operator processing personal data in accordance with this Policy, ensures the protection of rights and freedoms subjects during the processing of their personal data and takes measures to ensure the fulfillment of obligations stipulated by the Federal Law of 27.07.2006 . No. 152-F3 "On Personal Data" and the regulatory legal acts adopted in accordance with it.

1.4. In the case of using the Site, the Organization does not control and is not responsible for third-party sites to which the user can click on links.,

available on the website.

1.5. The Policy is valid indefinitely after approval and until it is replaced by a new version.

2. BASIC CONCEPTS

2.1. The following concepts are used in the policy:

- guest/user — an individual, a consumer of the services provided by the Organization, a subject of personal data;

- services provided by the Organization — the Organization’s activities in accordance with the Charter and the assigned OKVED codes;

- personal data — any information that is directly or indirectly related to a specific or identifiable individual (a subject of personal data), including;

- personal information that the user provides about themselves when registering (creating an account) or while using the Website;

- data that is automatically transmitted to the Website’s services during their use via software installed on the user’s device, including

IP address, cookie data, information about the user’s browser (or other program used to access the services), technical specifications of the software used by the user, date and time of access to the services, addresses of requested pages, and other similar information.

- the subject of personal data is an individual who is directly or indirectly identified, or is defined using personal data;

- operator - a legal entity that independently or jointly with other persons organizes and/or performs the processing of personal data, as well as determines the purposes of personal data processing, the composition of personal data to be processed, actions (operations) performed with personal data;

- personal data processing - any action (operation) or set of actions

(operations) performed with or without automation tools

such means with personal data, including collection, recording, systematization, accumulation, storage, clarification (update, modification), extraction, use, transfer (dissemination, provision, access), depersonalization, blocking, deletion, destruction of personal data;

- automated processing of personal data - processing of personal data using computer technology;

- dissemination of personal data - actions aimed at disclosing personal data to an indefinite circle of persons;

- provision of personal data - actions aimed at disclosing personal data to a specific circle of persons;

- blocking of personal data - temporary termination of the processing of personal data (except in cases where the processing is necessary to clarify personal data).

data);

- destruction of personal data - actions as a result of which it becomes impossible to restore the content of personal data in the information system

personal data and (or) as a result of which the material media is destroyed

personal data;

- depersonalization of personal data - actions as a result of which it becomes impossible to determine the identity of personal data to a specific personal data subject without using additional information;

- personal data information system - a set of databases contained in

personal data and information technologies and technical means providing their processing;

- cross-border transfer of personal data - transfer of personal data to the territory of a foreign state to an authority of a foreign state, a foreign individual or a foreign legal entity;

- confidentiality of personal data is a mandatory requirement for the operator or other person who has access to personal data to prevent their dissemination without the consent of the personal data subject or other legitimate grounds.

2.2. Other concepts used in the Policy are applied in accordance with their meanings as defined in Federal Law No. 152‑FZ dated July 27, 2006, “On Personal Data” and other regulatory legal acts of the Russian Federation.

3. PURPOSE OF PERSONAL DATA PROCESSING

3.1. Personal data processing is limited to achieving specific, predetermined and lawful purposes. Processing of personal data incompatible with the purposes of personal data processing is not permitted.

3.2. The user’s personal data is processed for the following purposes:

3.2.1. Guest identification when booking and purchasing services directly from the Organization.

3.2.2. Guest identification for the purposes of using other services provided by the Organization.

3.2.3. Identification of a user registered on the Website for the purpose of using the services provided by the Website.

3.2.4. Establishing feedback with the user and/or guest, including:

sending notifications, requests related to the use of the Website, the provision of services, and processing requests and applications from the user.

3.2.5. Confirming the accuracy and completeness of the personal data provided by the user and/or guest.

3.2.6. Creating an account for a personal profile if the user has agreed to create an account.

3.2.7. Notifying the user about the cancellation or replacement of ongoing events, as well as changes to local regulations established for users.

3.2.8. Providing the user with effective customer and technical support in case of problems related to the use of the Website and the provision of hotel services.

3.2.9. Conducting advertising activities, including informing guests about the Organization’s offers, events, promotions, and services, in order to study opinions (surveys) and improve the quality of services provided by the Organization. If a person does not wish to receive advertising messages, they have the right to unsubscribe from advertising via email by following the link provided in the advertising message or by blocking the subscriber from whom the advertising message was received.

4. LEGAL BASIS FOR PROCESSING PERSONAL DATA

4.1. The legal basis for processing personal data is a set of regulatory legal acts, in accordance with which and pursuant to which the Organization processes personal data, including:
the Constitution of the Russian Federation;
the Civil Code of the Russian Federation;
the Tax Code of the Russian Federation.
Federal Law No. 149-FZ dated July 27, 2006, “On Information, Information Technologies, and the Protection of Information”;

Federal Law No. 27-FZ dated April 1, 1996, “On Individual (Personalized) Accounting in the Mandatory Pension Insurance System”;
Federal Law No. 114‑FZ dated August 15, 1996, “On the Procedure for Leaving the Russian Federation and Entering the Russian Federation”;
Law of the Russian Federation No. 5242‑1 dated June 25, 1993, “On the Right of Citizens of the Russian Federation to Freedom of Movement, Choice of Place of Stay and Residence within the Russian Federation.”
Resolution of the Government of the Russian Federation dated January 15, 2007, No. 9 “On the Procedure for Conducting Migration Registration of Foreign Citizens and Stateless Persons in the Russian Federation”
Other regulatory legal acts of the Russian Federation and regulatory documents of the authorized bodies of state power.
4.2. The legal basis for the processing of personal data is also the consent of the subjects to the processing of their personal data.

5. PERSONAL DATA BEING PROCESSED

5.1. The content and scope of the personal data processed must comply with

the stated purposes of processing provided for in section 3 of this Policy. The personal data being processed should not be redundant in relation to the stated purposes of their processing.

5.2. Depending on the purposes provided for in Section 3 of this Policy, the Organization may process the following personal data::

- users of the Organization's services (guests): Last name, first name, patronymic, date of birth, passport details, registration address, place of residence, contact phone number, email address, banking details, and other personal data provided by users of the Organization’s services, which are necessary to provide the services, including for the user to use the Website, its services, programs, and products;

5.3. The Organization does not process special categories of personal data related to race, nationality, political views, religious or philosophical beliefs, or private life.

6. PROCESSING OF PERSONAL DATA

6.1. Personal data is processed with the consent of the personal data subjects.

personal data, unless otherwise provided by the legislation of the Russian Federation.

6.2. The processing of personal data may be carried out using computer technology (automated processing) or with direct

with human participation without the use of computer technology (non-automated processing).

6.3. Only those employees of the Organization whose job responsibilities include processing personal data are allowed to process personal data. The specified employees have the right to receive only those personal data that are necessary for them to perform their job duties.

6.4. Personal data processing is carried out by:

- obtaining information containing personal data in oral and written form directly from the subjects of personal data;

- providing the subjects of personal data with the originals of the necessary documents;

- obtaining copies of documents containing personal data, certified in accordance with the established procedure, or copying the original documents.

- obtaining personal data when sending requests to government bodies, state extra‑budgetary funds, other government bodies, local self‑government bodies, commercial and non‑commercial organizations, and individuals in cases and in accordance with the procedure established by the legislation of the Russian Federation;

- obtaining personal data from publicly accessible sources;

- recording (registering) personal data in journals, books, registers, and other accounting forms;

- entering personal data into the Organization’s information systems;

- obtaining personal data by having the data subject submit it on the Organization’s website.

- the use of other means and methods of recording personal data received in

within the framework of the activities carried out by the Organization.

6.5. The transfer of personal data to third parties is allowed with written consent.

subjects of personal data, with the exception of cases established by the legislation of the Russian Federation.

When transferring personal data to third parties in accordance with the contracts concluded by the Organization, it ensures mandatory compliance with the requirements of the legislation of the Russian Federation and the Organization's regulations in the field of personal data.

6.6. Personal data is stored by the Organization in a form that allows the identification of the data subject for no longer than is required by the purposes of its processing. Once the processing purposes have been achieved or if the need to achieve them has ceased, the personal data must be destroyed.

The retention periods for personal data in the Organization are determined in accordance with the legislation of the Russian Federation and the Organization’s regulatory acts.

6.7. The hosting and database containing personal data are located on the territory of Russia.

7. BASIC RIGHTS AND OBLIGATIONS OF PERSONAL DATA SUBJECTS

7.1. Users whose personal data is processed by the Organization have the right:

to view their personal data free of charge, except in cases provided for by Federal Law No. 152‑FZ dated 27.07.2006 “On Personal Data”;
to receive information regarding the processing of their personal data, including information containing:
- confirmation of the fact of personal data processing by the Organization;

- legal grounds and purposes of personal data processing;

- the purposes and methods of personal data processing used by the Organization;

- the name and location of the Organization, information about persons (with the exception of employees of the Organization) who have access to personal data or to whom personal data may be disclosed on the basis of an agreement with the Organization or on

based on the federal law;

- the personal data being processed, related to the relevant personal data subject, and the source of their receipt, unless another procedure for submitting such data is provided for by federal law;

- the timeframes for processing personal data, including the duration of their storage;

- the procedure for the subject of personal data to exercise the rights provided for in Federal Law No. 152‑FZ dated July 27, 2006, “On Personal Data”;

- information about the absence of cross‑border data transfer;

- the name or surname, first name, patronymic, and address of the person who processes personal data on behalf of the Organization, if the processing has been or will be entrusted to such a person;

- other information provided for by the legislation of the Russian Federation.

to require the Organization to clarify their personal data, block or delete it if the personal data is incomplete, outdated, inaccurate, obtained illegally, or not necessary for the stated purpose of processing, as well as to take the measures provided for by law to protect their rights;

to appeal the Organization’s actions or inaction to the authorized body for the protection of the rights of personal data subjects or in court;
to withdraw consent to the processing of their personal data;
to exercise other rights provided for by the legislation of the Russian Federation.
7.2. Users whose personal data is processed by the Organization are required to:

- provide reliable information about themselves and submit documents containing personal data, the composition of which is established by the legislation of the Russian Federation and the Organization’s local regulatory documents, to the extent necessary for the purpose of processing;

- inform the Organization about any updates (updating, changes) to their personal data.

8. BASIC RIGHTS AND OBLIGATIONS OF THE OPERATOR

8.1. The organization, depending on the processing purposes specified in section 3 of this

Policy, has the right to:

receive documents containing personal data;
require the subject of personal data to promptly update the provided personal data;
To independently determine the composition and list of measures necessary and sufficient to ensure compliance with the obligations stipulated by Federal Law No. 152‑FZ dated July 27, 2006, “On Personal Data,” and the regulatory legal acts adopted in accordance with it, unless otherwise provided for by Federal Law No. 152‑FZ dated July 27, 2006, “On Personal Data,” or other federal laws.
To entrust the processing of personal data to another person with the consent of the data subject, unless otherwise provided for by federal law, on the basis of an agreement concluded with that person. The person processing personal data on behalf of the Organization is obliged to comply with the principles and rules for processing personal data provided for in Federal Law No. 152‑FZ dated July 27, 2006, “On Personal Data”;
in the event that the subject of personal data withdraws their consent to the processing of personal data, the Organization has the right to continue processing personal data without the consent of the subject of personal data, provided that there are grounds specified in Federal Law No. 152‑FZ dated July 27, 2006, “On Personal Data”.
8.2. When processing personal data, the Organization is obliged to:

to take the necessary measures to fulfill the operator’s obligations provided for by the legislation of the Russian Federation in the field of processing and protection of personal data;

to explain to the subject of personal data the legal consequences of refusing to provide personal data if this is mandatory in accordance with the legislation of the Russian Federation;
to block unlawfully processed personal data;
to stop the processing of personal data in accordance with the legislation of the Russian Federation;
to notify the subject of personal data about the elimination of any violations or the destruction of their personal data.
To provide, at the request of the subject of personal data or their representative, information concerning the processing of their personal data, in accordance with the procedure established by the legislation of the Russian Federation and the Organization’s regulatory acts.

9. CONSENT TO DATA PROCESSING

9.1. Personal data processing is carried out after obtaining the consent of the data subject, unless otherwise provided for by applicable law.

9.2. The user’s consent to this Policy and the terms of processing their personal data specified in it may be expressed in the form of the data subject performing conclusive actions, for example:

9.2.1. accepting the terms of the contract for the services provided by the Organization;

9.2.2. continuing to use the Organization’s website and interact with its user interfaces after the user has been notified about the processing of personal data;

9.2.3. granting the necessary permissions to the mobile app when requested at the time of installation or use;

9.2.4. checking marks and filling in the relevant fields in forms and blanks;

9.2.5. other actions performed by the subject that can be used to infer their will.

9.3. If the user disagrees with the terms of this Policy, they must refrain from using the Website and its services and/or consuming the services.

9.4. In certain cases provided for by the legislation of the Russian Federation, consent must be in writing, including the information specified in Federal Law No. 152‑FZ dated July 27, 2006, “On Personal Data”;

9.5. In the event that the subject refuses to provide the necessary and sufficient amount of their

If you receive personal data, the Organization will not be able to take the necessary actions to achieve the processing objectives. For example, in this case, it may not be

user registration has been completed, contract services may not be provided, etc.

9.6. By agreeing to the provisions of this Policy, the personal data subject gives

Consent to the processing of personal data, including collection, recording, systematization, accumulation, storage, clarification (update, modification), extraction, use, transfer (dissemination, provision, access), including cross‑border data transfer in accordance with the current legislation of the Russian Federation, anonymization, blocking, deletion, destruction of personal data, with or without the use of automated means, for the purposes specified in Section 3 of the Policy.

9.7. The consent to the processing of personal data provided in accordance with this Policy is valid until the consent is revoked.

9.8. The consent to the processing of personal data provided in accordance with this Policy may be revoked by the data subject at any time. In such a case, the Organization is obliged to stop the processing of personal data or ensure the cessation of such processing (if the processing of personal data is carried out by another person acting on behalf of the Organization and, if the retention of personal data is no longer required for the purposes of the processing of personal data, to destroy the personal data or ensure their destruction

within the period established by the legislation of the Russian Federation.

9.9. The subject of personal data may notify the Organization of the withdrawal of the consent provided for the processing of personal data in one of the following ways:

By sending the relevant statement by mail to the Organization’s address, as specified in the Unified State Register of Legal Entities.
By sending the relevant statement via the feedback form on the website.

10. REQUIREMENTS FOR THE PROTECTION OF PERSONAL DATA IMPLEMENTED BY THE ORGANIZATION

10.1. The security of personal data when it is processed by the Organization is ensured in accordance with the legislation of the Russian Federation and the requirements of the authorized state authority responsible for protecting the rights of personal data subjects, the federal executive authority authorized in the field of ensuring security, and the federal executive authority authorized in the field of countering technical intelligence and technical protection of information.

10.2. The Organization takes the necessary organizational and technical measures to protect personal data from accidental or unauthorized access,

destruction, modification, blocking of access and other unauthorized actions.

10.3. The protection measures implemented by the Organization in the processing of personal data include:

adoption of local regulatory acts and other documents in the field of processing and protection of personal data;
appointment of officials responsible for ensuring the security of personal data in the Organization’s departments and information systems;
appointment of a person responsible for the organization of personal data processing and protection in the Organization;
creating the necessary conditions for working with physical media and information systems in which personal data is processed;
organization of accounting of material carriers of personal data and information systems in which personal data is processed;
storage of material carriers of personal data in compliance with the conditions ensuring the safety of personal data, excluding unauthorized access to them;
separation of personal data processed without the use of automation tools from other information;
Establishing a ban on the transmission of personal data via open communication channels, computer networks, and the Internet without applying the measures for ensuring the security of personal data established by the Organization;

carrying out internal control over compliance with the legislation of the Russian Federation and the Organization’s local regulatory acts in the processing of personal data.

11. UPDATING, CORRECTING, DELETING AND DESTROYING PERSONAL DATA; RESPONSES TO SUBJECTS’ REQUESTS FOR ACCESS TO PERSONAL DATA

11.1 The Organization shall provide confirmation of the fact that personal data is being processed, the legal grounds and purposes for processing personal data, as well as other information specified in Part 7 of Article 14 of Federal Law No. 152‑FZ dated July 27, 2006, “On Personal Data”, to the subject of personal data or their representative upon their request or upon receiving such a request. The information provided does not include personal data related to other subjects of personal data, except in cases where there are legitimate grounds for the disclosure of such personal data.

The request must contain:

the number of the main document certifying the identity of the personal data subject or his representative, information on the date of issue of the specified document and the issuing authority,
information confirming the participation of the personal data subject in relations with the Organization (contract number, date of conclusion of the contract, conditional verbal designation and (or) other information), or information otherwise confirming the fact of personal data processing by the Organization;
The signature of the subject of personal data or their representative.
If the subject’s appeal (request) does not contain all the necessary information in accordance with the requirements of Federal Law No. 152‑FZ dated 27.07.2006 “On Personal Data”, or if the subject does not have the right to access the requested information, a reasoned refusal is sent to them. The right of the subject of personal data to access their personal data may be restricted in accordance with Part 8 of Article 14 of the Federal Law No. 152‑FZ dated July 27, 2006, “On Personal Data,” including if the subject of personal data’s access to their personal data violates the rights and legitimate interests of third parties.

11.2. If inaccurate personal data is identified in the course of an inquiry from the data subject or their representative, or at their request, or at the request of Roskomnadzor, the Organization shall block the personal data relating to this data subject from the moment of such inquiry or receipt of the specified request for the period of the verification, provided that blocking the personal data does not violate the rights and legitimate interests of the data subject or third parties.

If the inaccuracy of personal data is confirmed, the Organization, based on the information provided by the subject of personal data or their representative, or by Roskomnadzor, or on the basis of other necessary documents, clarifies the personal data within seven business days from the date such information is submitted and lifts the blocking of the personal data.

11.3. If unlawful processing of personal data is detected upon an appeal (request) from the subject of personal data or their representative, or from Roskomnadzor, the Organization blocks the unlawfully processed personal data relating to that subject of personal data from the moment such an appeal or request is received.

11.4. When the purposes of processing personal data are achieved, as well as in the event that the subject of personal data revokes consent to its processing, the personal data shall be destroyed unless:

otherwise provided for in a contract, a party to which, the beneficiary or guarantor thereof is the subject of personal data;
the operator is not entitled to carry out processing without the consent of the subject of personal data on the grounds provided for in Federal Law No. 152‑FZ dated 27.07.2006 “On Personal Data” or in other federal laws.

unless otherwise provided for by another agreement between the Organization and the subject of personal data.

12. LIABILITY FOR VIOLATION OF THE RULES GOVERNING THE PROCESSING OF PERSONAL DATA

12.1. Liability for violation of the requirements of the legislation of the Russian Federation and regulatory acts by the Organization in the field of processing and protection of personal data is determined in accordance with the legislation of the Russian Federation.

12.2. Persons found guilty of violating the rules governing the collection, processing, and protection of *personal data are subject to disciplinary, administrative, civil, or criminal liability in accordance with federal laws.

13. FINAL PROVISIONS

13.1. This Policy comes into force from the moment of its approval by the authorized body.

the face of the Organization.

13.2. The Organization has the right to make changes to this Personal Data Processing and Protection Policy without the user's consent.