Privacy Policy

This Policy for Processing Financial Data (hereinafter referred to as the Policy) defines the objectives, establishes the procedure and conditions for processing financial data, measures aimed at protecting financial data, and also contains information on the rights of individuals to whom the relevant personal data pertains in ООО «КупиСлона» the city of Novosirsk, street Дуси Ковальчук 244 room 1 ИНН 5402090099 (hereinafter referred to as the Company).

The Company processes digital data in accordance with the requirements of Federal Law of the Russian Federation dated 27.07.2006 No. 152-FZ «On Digital Data» and other regulatory legal acts of the Russian Federation governing legal relations in the field of processing digital data.
The Policy applies to all personal data of financial entities, based on paragraphs 4.1.1., 4.1.2. Policies, such changes as the use of automation tools and without the use of tools.

The policy applies to all actions, the transition of digital data processing to information resources, access to them is carried out through the domain name «*.», «*.https://kupislona-online.ru/» or the use of national applications of the company (hereinafter referred to as the Site). . , as well as to all actions, a break in the processing of medical data by the Company in the Services.

In the event that the civil data of the subject objects to the processing of digital data by the Company in accordance with the Policy, the civil data of the subject objects to the use of the Site and / or Service and / or send a corresponding request to the company. In this case, the ability to connect to the Site and / or Service, including for logging into your personal account, are not provided.

The processing of legal data by subjects of legal data is carried out under an agreement of the subjects of legal data when processing their historical data, as well as without receiving documents in cases stipulated by the obligations of the Russian Federation.

This Policy shall enter into force upon its approval by the Director General of the Organization and shall be valid indefinitely until it is replaced by a new Policy.

The Company has developed a unilateral change to the terms of the Policy.

Given that the text of the Policy is freely available on the Internet, the subject is obliged to independently monitor changes made to the Policy. In the event of a priority conflict, use the publicly available version of the Policy.

This Policy applies to personal data obtained both before and after the date of application of this Policy.

Internal control over compliance with policy requirements, the person responsible for organizing the processing of medical data in the company.

The following terms are used in the Policy:
Automated data processing using computing technology.
Blocking is a temporary continuation of the processing of digital data (except in cases where processing is necessary to clarify digital data).

Digital data security is the state of security of digital data, characteristic data, the use of information networks, data, technologies, technical means and technologies, ensuring confidentiality, reliability and availability of digital data when processing them into information, data protection.

Biometric personal data — data characterizing the external and biological characteristics of a person, on the basis of which his identity can be established.

Law — Federal Law of the Russian Federation of July 27, 2006 No. 152-FZ «On Digital Data».
Registered user (Buyer) — a capable official person who has a Site user ID (registered on the Site) and uses the Site in accordance with the Rules for using the Wildberry trading platform, posted at https://global.wildberry.ru/services/terms, as well as a capable individual who has been registered and/or authorized in the service in accordance with the user document of the Service.

Depersonalization — an action as a result of which it becomes impossible to determine without using additional information.

Processing of digital data is any action (operation) or set of actions (operations) performed with or without the use of automation tools with personal data, including through mixed processing, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, use of medical data. Company

The Company processes personal data in order to ensure the functionality of the Site and/or Service, including the following options:

Registration and use of personal accounts on the Site and/or Service, including.

Providing the ability to reduce information about yourself, including saving data on payment methods for placing orders for payment in a simplified manner without entering data;

Placing orders (including payment and delivery of orders), including tracking the payment of the order; writing reviews of goods and/or services; return of goods or money (during the warranty period);

provide opportunities for concluding third-stage contracts for proactive entities in the healthcare sector; customs clearance and delivery of goods in the case of ordering goods from abroad;

Filling in requests on issues, continuing the work of the Site and/or Service, through a form-form in the interface of the Site and/or Service or by working with an electronic assistant on the Site and/or Service;

Provided levels of opportunities (purchase) of tickets for air and ground transport in the Service in accordance with the user document of the Service;

Provided the opportunity to conduct training courses published by third-party organizations in the Service in accordance with the user document of the Service;

Providing the Service with the opportunity to conduct audio and video calls in accordance with the user document of the Service.

The Company may also process personal data for the purposes specified in the agreement on the processing of digital data in the data collection form or in the interface of the Site and/or Service after such agreement, for example, receiving marketing messages or to contact the User and/or Registered User. on their initiative.

The processing of personal data is carried out by the Company on the following legal grounds:

processing of personal data is carried out with consent subject personal data for processing his personal data, which the subject provides at interaction with the siteincluding putting a mark on consent in the form of data collection and / or n the interface upon receipt of such consent; 

the processing of personal data is necessary to achieve the purposes, provided for by the international treaty of the Russian Federation or by law, for the implementation and performance of the functions, powers and duties imposed on the operator by the legislation of the Russian Federation;

the processing of personal data is necessary for the performance of an agreement to which the subject of personal data is a party, beneficiary or guarantor, as well as for the conclusion of an agreement on the initiative of the subject of personal data or an agreement under which the subject of personal data will be a beneficiary or guarantor;

the processing of personal data is necessary for the exercise of the rights and legitimate interests of the operator or third parties, provided that the rights and freedoms of the subject of personal data are not violated.

The Company processes personal data of the following personal data subjects:

Physical persons  – Users, in accordance with thepurpose  processing specified in paragraphs 2.1.1, 2.1.4, 2.2.

Individuals – Registered Users, in accordance with the processing purposes specified in paragraphs 2.1, 2.2.

The Company processes the following categories of personal data of personal data subjects:

Within the framework achievements goals, specified in paragraph 2.1.1 of the Policy – ​​telephone number.

Within the framework achievements goals, specified in clause 2.1.2 of the Policy — Site user ID; telephone number; pseudonym (nickname); email address; gender; order delivery address; payment methods.

Within the framework achievements goals, specified in clause 2.1.3 of the Policy – ​​Registered User ID; telephone number; pseudonym (nickname); email address; gender; order delivery addresses; order composition; payment method details; fiscal receipt; information about purchased goods; in case of customs clearance and delivery of goods from abroad also: full name, date of birth, identity document details, TIN.

Within the framework achievements goals, specified in clause 2.1.5 of the Policy – ​​full name; date of birth; citizenship; gender; details of identity documents; telephone number; details of payment methods; loyalty card number (optional); email address; Registered User ID.

Within the framework achievements goals, specified in paragraph 2.1.6 of the Policy – ​​full name; telephone number; email address; information about completing courses at educational institutions (regional branch and/or association/union), Registered User ID.

Within the framework achievements goals, specified in paragraph 2.1.7 of the Policy – ​​pseudonym (nickname); photo and/or video images (optional, without the purpose of identification); telephone number.

Within the framework achievements goals, specified in paragraph 2.2 of the Policy – ​​data specified in the data collection form and/or in the text of the consent to the processing of personal data.

The Company processes and ensures the security of personal data for the implementation of the functions, powers and duties imposed on the Company by the legislation of the Russian Federation, including, but not limited to, in accordance with the Constitution of the Russian Federation, federal laws, in particular the Law, by-laws, other federal laws of the Russian Federation determining the cases and features of processing the said personal data, as well as the Civil Code of the Russian Federation, Law of the Russian Federation No. 2300-1 of February 7, 1992 «On the Protection of Consumer Rights», as well as the charter and local acts of the Company.

Society carries out the processing of personal data using automation tools, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access, distribution), depersonalization, blocking, deletion, destruction of personal data within the timeframes necessary to achieve the purposes of processing personal data.

The processing of personal data of the Personal Data Subjects is carried out on the basis of the user documents of the Site and / or Service, unless otherwise specified during their collection, and unless otherwise provided by the legislation of the Russian Federation, and is necessary for the performance of an agreement (user documents of the Site and / or Service), to which the personal data subject is a party, beneficiary or guarantor, as well as for the conclusion of an agreement on the initiative of the personal data subject or an agreement under which the personal data subject will be a beneficiary or guarantor in accordance with paragraph 5 of Part 1 of Article 6 of the Law during the period of use of the Site and / or Service as a Registered User, as well as during the limitation period, i.e. within three (3) years after the deletion of the personal account on the Site and / or in the Service on the basis of paragraph 7 of Part 1 of Article 6 of the Law. After the deletion of the personal account of the Registered User, other data processing not related to storage for the purposes of paragraph 7 of Part 1 of Article 6 of the Law, is not carried out by the Company, and upon expiration of the limitation period, provided that there are no claims of the subject and other grounds for processing personal data, such personal data are destroyed.

Society does not process special categories of personal data and biometric personal data except in cases where the processing of personal data is due to current business objectives, with the mandatory consent of the subject of personal data to the processing of personal data, or is necessary in accordance with the requirements of the legislation of the Russian Federation.

Society has the right to entrust the processing of personal data to third parties — processors — on the basis of agreements concluded with these persons and in the presence of the corresponding legal basis. If the Company entrusts the processing of personal data to another person, the Company shall be responsible to the subject of personal data for the actions of the said person. The person processing personal data on behalf of the Company shall be responsible to the Company for the security of personal data and compliance with the requirements of the Law before the Society.

Persons processing personal data on the basis of an agreement concluded with the Company (operator’s instructions), under the terms of the agreements concluded with them, undertake to comply with the principles, rules for processing and protecting personal data stipulated by current legislation.

Society has the right to entrust the processing of personal data, or transfer the personal data specified in paragraphs 4.2.1. — 4.2.8. of the Policy, to third parties only if there are proper grounds for processing, and also provided that the data will be transferred in the minimum amount necessary to achieve the specified purposes, and third parties will take measures aimed at complying with the requirements for ensuring the security of personal data to achieve the purposes specified in paragraph 2.1.3, in particular for payment, delivery and return of goods or funds, providing the opportunity to conclude agreements with third parties on the initiative of the personal data subject, customs clearance and delivery of goods in the case of ordering goods from abroad; in paragraph 2.1.5, in particular for booking (purchasing) air and ground transport tickets in the Service in accordance with the user documents of the Service; in paragraph 2.1.6, in particular when taking training courses published by third-party organizations in the Service in accordance with the user documents of the Service.

In accordance with paragraph 5.7. of the Policy, the assignment of processing and transfer of personal data are carried out on the basis of agreements concluded by the Company with the following third parties: legal entities providing services to the Company, including ensuring the security, delivery and customs clearance of goods; sellers of goods and services, if this is necessary for the Registered User to receive an order; legal entities providing educational and other services to Registered Users; third parties with whom the subject of personal data enters into agreements. The assignment of processing and transfer of personal data are carried out in cases stipulated by agreements under which the subject of personal data is a party, beneficiary or guarantor, in particular, in accordance with the Rules for using the “КупиСлона” trading platform, located at https://global.wildberries.ru/services/terms, as well as other user documents of the Services available in the interface of the Services.

Society obliges persons authorized to process personal data not to disclose to third parties or distribute personal data without proper legal grounds, unless otherwise provided by federal law.

The procedure for the destruction of personal data on media containing personal data, including external/removable electronic media, paper media and in personal data information systems, is determined by the Company in its internal documents and local regulations.

Society does not check (has no way to check) the relevance and accuracy of the information provided by the personal data subjects, obtained through the Site and/or Service. The Company assumes that the personal data subjects provide reliable and sufficient personal data and keep it up to date.

Society does not control compliance with the terms of confidentiality and processing of personal data of personal data subjects by owners or users of other sites to which the personal data subject may follow links available on the Site and/or Service, and is not responsible for the actions or inactions of the owners or users of such sites in the area of ​​processing personal data and maintaining confidentiality.

Representatives of authorized government bodies (including supervisory, regulatory, law enforcement, inquiry and investigation bodies) receive access to personal data processed by the Company in the volume and manner established by the legislation of the Russian Federation.

Society takes the necessary legal, organizational and technical measures to protect personal data from unauthorized or accidental access to them, destruction, modification, blocking, copying, provision, distribution of personal data, as well as from other illegal actions with respect to personal data in accordance with the requirements of the legislation of the Russian Federation and internal documents. Ensuring the security of personal data and the fulfillment by the Company of its obligations, in accordance with the Law, is achieved, including:

Determination of threats to the security of personal data when processing them in personal data information systems.

The use of organizational and technical measures to ensure the security of personal data when processing them in personal data information systems, necessary to meet the requirements for the protection of personal data, the implementation of which ensures the levels of protection of personal data established by the Government of the Russian Federation.

Rating of the effectiveness of measures taken to ensure the security of personal data before putting into operation the personal data information system.

By appointing a person responsible for organizing the processing of personal data.

The publication by the Company of documents defining the Company’s policy regarding the processing of personal data, local acts on the processing of personal data, defining for each purpose of processing personal data the categories and list of personal data to be processed, the categories of subjects whose personal data are processed, the methods and terms of their processing and storage, the procedure for the destruction of personal data upon achieving the purposes of their processing or upon the occurrence of other legal grounds, as well as local acts establishing procedures aimed at preventing and identifying violations of the legislation of the Russian Federation, eliminating the consequences of such violations. Such documents and local acts may not contain provisions limiting the rights of subjects of personal data, or imposing on the Company powers and obligations not provided for by the legislation of the Russian Federation.

Implementation of internal control and (or) audit of compliance of personal data processing with the Law and regulatory legal acts adopted in accordance with it, requirements for the protection of personal data, the Company’s policy regarding the processing of personal data, and the Company’s internal documents.

Familiarization of the Company’s employees directly involved in the processing of personal data with the provisions of the legislation of the Russian Federation on personal data, including requirements for the protection of personal data, documents defining the Company’s policy regarding the processing of personal data, local acts on issues of processing personal data, and (or) training of the said employees.

An assessment of the damage in accordance with the requirements established by the authorized body for the protection of the rights of personal data subjects, which may be caused to personal data subjects in the event of a violation of this Federal Law, the ratio of the said damage and the measures taken by the operator aimed at ensuring the fulfillment of the obligations stipulated by this Federal Law.

Detection of facts of unauthorized access to personal data and the adoption of measures, including measures to detect, prevent and eliminate the consequences of computer attacks on personal data information systems and to respond to computer incidents in them.

Monitoring the measures taken to ensure the security of personal data and the level of protection of personal data information systems.

Society shall cease processing personal data and destroy them in the following cases:

liquidation of the Company;

reorganization of the Company, resulting in the termination of its activities;

termination of the legal grounds for processing personal data and/or achievement of the purposes of processing personal data;

revocation of consent of the personal data subject to the processing of personal data.

The storage of personal data is carried out by the society in a form that allows the identification of the subject of personal data for no longer than required by the purposes of processing personal data and in accordance with the provisions of the Law.

When collecting personal data, the society ensures the recording, systematization, accumulation, storage, clarification (updating, modification), and extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except in cases stipulated by the Law.

Cross-border transfer of personal data is carried out to achieve the purpose specified in paragraph 2.1.3, in particular to provide the opportunity to conclude agreements with third parties and in the case of customs clearance and delivery of goods from abroad. Such transfer is carried out by the Company subject to notification of the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) in accordance with Article 22 of the Law and in the presence of a legal basis for processing personal data.

The procedure for the destruction of personal data on media containing personal data, including external/removable electronic media, paper media and in personal data information systems, is developed in accordance with the Order of the Federal Service for Supervision of Communications, Information Technology and Mass Media dated October 28, 2022 No. 179 «On approval of the Requirements for confirmation of the destruction of personal data» and is enshrined in the Rules for the destruction and depersonalization of personal data of the Company.

A registered user has the ability to independently delete their personal account with all the data provided using the functionality of the Site and/or Service.

Deleting a personal account may be unavailable if the Registered User or the Company have not fulfilled their obligations in accordance with the Rules for using the “КупиСлона” trading platform, located at https://kupislona-online.ru/offer/ , as well as other user documents of the Services available in the interface of the Services, in particular if the Registered User has active deliveries, debts to the Company, as well as if the Company suspects a violation of the terms of user documents, including suspicions of fraudulent and other illegal actions on the Site and / or in the Service.

The Site and/or the Service may use the Cookies listed in paragraph 6.1. The User Documents of the Site and/or the Service may provide for the use of other Cookies.

To refuse the use of Cookies, the User and Registered User have the right to use the browser settings, where it is possible to disable the use of Cookies, as well as in the interface of the Site and / or Service, if applicable. Complete disabling of Cookies may lead to limitation of the functionality of the Site and / or Service. Detailed instructions on disabling Cookies are available at external links

Google Chrome 

Safari 

Яндекс Браузер 

Microsoft Edge

Mozilla Firefox

When collecting personal data, the Society is obliged to provide the subject of personal data, at his request, with the information provided for in Part 7 of Article 14 of the Law.

The subject of personal data has the right to demand that the Societies clarify his personal data, block or destroy them if the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing, and also to take measures provided by the Law to protect his rights. The loss of the phone number to which the personal account is registered, as well as its transfer to another person, is the responsibility of the Registered User. In this case, the Registered User must contact the Company via sales@wildberries.ru to delete his personal account. Restoring access to the personal account if the phone number is lost is impossible.

The personal data subject has the right to apply to the  Society with a request to stop the transfer (distribution, provision, access) of his personal data, previously authorized by the personal data subject, in terms of the specified actions for distribution, in case of non-compliance with the provisions of Article 10.1 of the Law, or to apply to the court with such a request. The Company is obliged to stop the transfer (distribution, provision, access) of personal data within three working days from the moment of receipt of the request of the personal data subject or within the period specified in the court decision that has entered into legal force, and if such period is not specified in the court decision, then within three working days from the moment the court decision enters into legal force.

The subject of personal data has the right to appeal the actions or inaction of the Company to the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) or in court if the subject of personal data believes that the Company processes his personal data in violation of the requirements of the Law or otherwise violates his rights and freedoms.

To exercise their rights and protect their legitimate interests, the personal data subject has the right to contact the Company. To send official requests to the Company, it is necessary to use the contact information specified in paragraphs 7.17, 7.18. of the Policy.

In the event that unlawful processing of personal data is detected upon an appeal by a personal data subject or his/her representative, or at the request of a personal data subject or his/her representative, or an authorized body for the protection of the rights of personal data subjects, the operator is obliged to block the unlawfully processed personal data related to this personal data subject, or ensure their blocking (if the processing of personal data is carried out by another person acting on the instructions of the operator) from the moment of such appeal or receipt of the specified request for the verification period.

In the event that inaccurate personal data is discovered upon an appeal by a personal data subject or his/her representative or at their request or at the request of an authorized body for the protection of the rights of personal data subjects, the operator is obliged to block the personal data related to this personal data subject or ensure their blocking (if the processing of personal data is carried out by another person acting on the instructions of the operator) from the moment of such appeal or receipt of the specified request for the verification period, if the blocking of personal data does not violate the rights and legitimate interests of the personal data subject or third parties.

In the event of confirmation of the fact of inaccuracy of personal data, the Company, on the basis of information provided by the subject of personal data or his representative or the authorized body for the protection of the rights of subjects of personal data, or other necessary documents, is obliged to clarify the personal data or ensure their clarification (if the processing of personal data is carried out by another person acting on behalf of the operator) within seven working days from the date of submission of such information and remove the blocking of personal data.

In the event that the purpose of processing personal data is achieved, the  Society is obliged to stop processing personal data or ensure its termination (if the processing of personal data is carried out by another person acting on behalf of the operator) and destroy the personal data or ensure their destruction (if the processing of personal data is carried out by another person acting on behalf of the Company) within a period not exceeding thirty days from the date of achieving the purpose of processing personal data, unless otherwise provided by an agreement to which the subject of personal data is a party, beneficiary or guarantor, another agreement between the Company and the subject of personal data, or if the Company does not have the right to process personal data without the consent of the subject of personal data on the grounds provided for by the Law or other federal laws.

In the event that the subject of personal data revokes consent to the processing of his personal data, the Company is obliged to stop their processing or ensure the termination of such processing (if the processing of personal data is carried out by another person acting on behalf of the Company) and, if the storage of personal data is no longer required for the purposes of processing personal data, to destroy the personal data or ensure their destruction (if the processing of personal data is carried out by another person acting on behalf of the Company) within a period not exceeding thirty days from the date of receipt of the said revocation, unless otherwise provided by an agreement to which the subject of personal data is a party, beneficiary or guarantor, another agreement between the Company and the subject of personal data, or if the Company does not have the right to process personal data without the consent of the subject of personal data on the grounds provided for by the Law or other federal laws.

If a personal data subject applies to the Company with a request to stop processing personal data, the Company is obliged, within a period not exceeding ten working days from the date of receipt by the Company of the relevant request, to stop their processing or ensure the termination of such processing (if such processing is carried out by the person processing the personal data), except for the cases provided for in paragraphs 2 — 11 of Part 1 of Article 6, Part 2 of Article 10 and Part 2 of Article 11 of the Law. The specified period may be extended, but not more than by five working days if the operator sends a reasoned notice to the personal data subject indicating the reasons for extending the period for providing the requested information.

If it is not possible to destroy personal data within the period established by the Law, theSociety  shall block such personal data or ensure their blocking (if the processing of personal data is carried out by another person acting on behalf of the operator) and ensure the destruction of personal data within a period of no more than six months, unless another period is established by federal laws.

If personal data processed by the Обществом for the purposes of purchasing air and/or ground transport tickets are not received from the subject of personal data, such personal data shall be considered by the Company to be legally received by the Registered User of the Site and/or Service who transfers the personal data of the subject of personal data to the Company. Before starting to process such personal data, the Company is obliged to notify the subject of personal data and provide him/her with the following information:

Name and address of the Societies or its representative.

The purpose of processing personal data and its legal basis.

List of personal data.

Intended users of personal data.

The rights of the subject of personal data established by law.

Source of personal data.

The  Societyis exempted from the obligation to provide the subject of personal data with the information stipulated by the relevant clauses of this Policy in cases where:

The subject of personal data is notified about the processing of his personal data by the Society.

The processing of personal data permitted by the subject of personal data for distribution is carried out in compliance with the prohibitions and conditions provided for in Article 10.1 of the Law.

The  Society processes personal data for statistical or other research purposes, if this does not violate the rights and legitimate interests of the subject of personal data.

Provision of the personal data subject with information stipulated by the relevant clauses of this Policy violates the rights and legitimate interests of third parties.

When collecting personal data, the Company ensures the recording, systematization, accumulation, storage, clarification (updating, modification), and extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation, except in cases stipulated by the Law.

The Society  considers any requests and complaints from personal data subjects, investigates violations and takes all necessary measures for their immediate elimination and settlement of disputes out of court. The processing of personal data permitted by the personal data subject for distribution is carried out in compliance with the prohibitions and conditions stipulated by Article 10.1 of the Law.

A written request from a personal data subject for information regarding the processing of his/her personal data must contain the mandatory information specified in Part 3 of Article 14 of the Law, including the telephone number used to log in to the Site and/or Service. A written request may be sent to the following address: 630082 the city of Novosirsk, street Дуси Ковальчук 244 room 1

To obtain information about your personal data, to become familiar with it, to clarify it, block or stop its processing, or to revoke consent to its processing, requests can be sent to the e-mail address:  OOO_KupiSlona@mail.ruThe request can be sent by the subject of personal data in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.

Interaction on other issues related to the processing of personal data by the Company is also carried out using the following contact information: postal address (630082 the city of Novosirsk, street Дуси Ковальчук 244 room 1 )  and/or emailaddress(OOO_KupiSlona@mail.ru).