Personal Data Processing Policy

1. General provisions

This personal data processing policy has been prepared in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (the “Personal Data Law”). It defines how personal data is processed and the measures taken to protect it by EcoColor Trading Company LLC (the “Operator”).

1.2. This policy of the Operator regarding personal data processing (the “Policy”) applies to all information the Operator may receive about visitors to https://ecocolor.com.

2. Key terms used in this Policy

2.1. Automated processing of personal data — processing personal data using computer technology.

2.2. Blocking of personal data — temporary suspension of processing, except where processing is necessary to correct the personal data.

2.3. Website — a collection of graphic and informational materials, computer programs and databases that make the website available at https://ecocolor.com.

2.4. Personal data information system — personal data contained in databases and the information technologies and technical means used to process it.

2.5. Anonymisation of personal data — actions that make it impossible, without additional information, to identify which User or other data subject the personal data belongs to.

2.6. Processing of personal data — any action or set of actions performed on personal data, with or without automation, including collection, recording, organisation, accumulation, storage, clarification (updating or modification), retrieval, use, transfer (disclosure, provision or access), anonymisation, blocking, deletion and destruction.

2.7. Operator — a government or municipal authority, legal entity or individual that, alone or jointly with others, organises and/or carries out personal data processing and determines its purposes, the data to be processed and the operations performed on it.

2.8. Personal data — any information relating directly or indirectly to an identified or identifiable User of https://ecocolor.com.

2.9. Personal data authorised by the data subject for dissemination — personal data made accessible to an unlimited number of people by the data subject’s consent to its processing for dissemination, in accordance with the procedure established by the Personal Data Law (hereinafter, “personal data authorised for dissemination”).

2.10. User — any visitor to the website https://ecocolor.com.

2.11. Provision of personal data — actions intended to disclose personal data to a specific person or a specific group of people.

2.12. Dissemination of personal data — any actions intended to disclose personal data to an unspecified group or make it available to an unlimited number of people, including publication in the media, placement on information and telecommunications networks, or access by any other means.

2.13. Cross-border transfer of personal data — transfer of personal data to a foreign state, its public authority, a foreign individual or a foreign legal entity.

2.14. Destruction of personal data — actions that irreversibly destroy personal data so that it cannot be restored in the personal data information system and/or destroy its physical storage media.

3. Main rights and obligations of the Operator

— receive accurate information and/or documents containing personal data from the data subject;

— if the data subject withdraws consent to processing or requests that processing cease, continue processing without consent where grounds specified in the Personal Data Law apply;

3.1. The Operator has the right to:

— determine independently the measures necessary and sufficient to meet the obligations under the Personal Data Law and related regulations, unless that Law or other federal laws provide otherwise.

— provide the data subject, upon request, with information about the processing of their personal data;

— organise personal data processing in accordance with applicable legislation of the Russian Federation;

3.2. The Operator is required to:

— respond to requests from data subjects and their legal representatives as required by the Personal Data Law;

— provide the authorised personal data protection authority with the requested information within 10 days of receiving its request;

— publish this Policy or otherwise ensure unrestricted access to it;

— take legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision or dissemination, as well as other unlawful actions;

— stop the transfer (dissemination, provision or access), processing and destroy personal data in the cases and manner prescribed by the Personal Data Law;

— perform other obligations established by the Personal Data Law.

4. Main rights and obligations of data subjects

— receive information about the processing of their personal data, except where federal laws provide otherwise. The Operator provides this information in an accessible form, without personal data relating to other data subjects unless disclosure is legally permitted. The Personal Data Law sets out the information available and the procedure for obtaining it;

— require the Operator to correct, block or destroy personal data that is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purpose, and take other measures provided by law to protect their rights;

4.1. Data subjects have the right to:

— require prior consent for personal data processing for the promotion of goods, works or services on the market;

— withdraw consent to personal data processing and request that processing cease;

— appeal unlawful actions or inaction by the Operator to the authorised personal data protection authority or a court;

— exercise other rights provided by the laws of the Russian Federation.

— provide the Operator with accurate information about themselves;

— notify the Operator of corrections, updates or changes to their personal data.

4.2. Data subjects are required to:

4.3. Persons who provide inaccurate information about themselves or information about another data subject without that person’s consent are liable under the laws of the Russian Federation.

5.1. Personal data is processed lawfully and fairly.

5.2. Processing is limited to specific, predetermined and lawful purposes. Personal data may not be processed in ways incompatible with the purposes for which it was collected.

5. Principles of personal data processing

5.3. Databases containing personal data processed for incompatible purposes may not be combined.

5.4. Only personal data relevant to the purposes of its processing may be processed.

5.5. The content and scope of processed personal data must correspond to the stated purposes. Processing must not be excessive in relation to those purposes.

5.6. Personal data must be accurate, sufficient and, where necessary, up to date for the purposes of processing. The Operator takes or ensures that measures are taken to delete or correct incomplete or inaccurate data.

5.7. Personal data is stored in a form that identifies the data subject only for as long as required by the purposes of processing, unless a retention period is established by federal law or a contract to which the data subject is a party, beneficiary or guarantor. Personal data is destroyed or anonymised when the purposes have been achieved or are no longer relevant, unless federal law provides otherwise.

7.1. Personal data is processed with the data subject’s consent.

7.2. Processing is necessary to achieve purposes established by an international treaty of the Russian Federation or by law, or to perform functions, powers and duties assigned to the Operator by the laws of the Russian Federation.

6. Purposes of personal data processing

7. Conditions for processing personal data

7.3. Processing is necessary for the administration of justice or enforcement of a court judgment or an act of another authority or official under Russian enforcement proceedings law.

7.4. Processing is necessary to perform a contract to which the data subject is a party, beneficiary or guarantor, or to enter into a contract at the data subject’s initiative or under which they will be a beneficiary or guarantor.

7.5. Processing is necessary to exercise the rights and legitimate interests of the Operator or third parties, or to achieve socially significant purposes, provided that the rights and freedoms of the data subject are not violated.

7.6. The data subject has made the personal data accessible to an unlimited number of people, either directly or at their request (publicly available personal data).

7.7. Processing concerns personal data that must be published or disclosed under federal law.

8. How personal data is collected, stored, transferred and otherwise processed

The Operator protects personal data by implementing legal, organisational and technical measures required to meet all applicable personal data protection requirements.

8.1. The Operator safeguards personal data and takes all possible measures to prevent access by unauthorised persons.

8.2. A User’s personal data will never be transferred to third parties, except where required by applicable law or where the data subject has authorised the Operator to transfer it to a third party to perform obligations under a civil law contract.

8.3. If a User finds inaccuracies in their personal data, they may update it by notifying the Operator at ecocolor@ecocolor.com with the subject line “Personal Data Update”.

8.4. Personal data is processed until the purposes for which it was collected have been achieved, unless a different period is established by a contract or applicable law.

The User may withdraw consent to personal data processing at any time by emailing the Operator at ecocolor@ecocolor.com with the subject line “Withdrawal of Consent to Personal Data Processing”.

8.5. Information collected by third-party services, including payment systems, communication services and other providers, is stored and processed by those providers (operators) in accordance with their user agreements and privacy policies. The data subject should consult those documents. The Operator is not responsible for the actions of third parties, including the service providers named in this clause.

8.6. Restrictions imposed by a data subject on the transfer (except for granting access to) or processing of personal data authorised for dissemination do not apply when the data is processed in state, public or other public interests established by Russian law.

8.8. The Operator stores personal data in a form that identifies the data subject only for as long as required by the purposes of processing, unless a retention period is established by federal law or a contract to which the data subject is a party, beneficiary or guarantor.

8.9. Processing may cease when its purposes have been achieved, the data subject’s consent expires or is withdrawn, the data subject requests that processing cease, or unlawful processing is identified.

8.7. The Operator ensures the confidentiality of personal data during processing.

9. Operations performed on the personal data received

9.1. The Operator collects, records, organises, accumulates, stores, updates, modifies, retrieves, uses, transfers (disseminates, provides or grants access to), anonymises, blocks, deletes and destroys personal data.

9.2. The Operator processes personal data by automated means, with or without receiving and/or transmitting the information over information and telecommunications networks.

10.1. Before beginning a cross-border transfer of personal data, the Operator must notify the authorised personal data protection authority of its intention to carry out such transfers. This notification is submitted separately from the notification of an intention to process personal data.

10.2. Before submitting that notification, the Operator must obtain relevant information from the public authorities, individuals and legal entities in the foreign state to which the personal data is to be transferred.

10. Cross-border transfer of personal data

The Operator and any other persons who have access to personal data must not disclose it to third parties or disseminate it without the data subject’s consent, unless federal law provides otherwise.

12.1. Users may ask the Operator for clarification about personal data processing by emailing ecocolor@ecocolor.com.

11. Confidentiality of personal data

12.2. Any changes to the Operator’s personal data processing policy will be reflected in this document. The Policy remains in force indefinitely until replaced by a new version.

12. Final provisions

12.3. The current version of this Policy is publicly available at https://ecocolor.com/privacy.

Food ingredients

and technology solutions