1. GENERAL PROVISIONS

1.1. This Policy is implemented by AI-Surfer (hereinafter referred to as the “Operator”) in relation to the processing and protection of personal data of individuals (subjects of personal data) on the basis of Article 24 of the Constitution of the Russian Federation and Federal Law No. 152 — FZ “On Personal Data”.

1.2. The Policy applies to all personal data that may be obtained by the Operator in the course of its activities, including personal data of the Operator’s clients. Processing of personal data in the Operator is carried out in accordance with the following regulatory legal acts::

• Federal Law No. 152-FZ of July 27, 2006 “On Personal Data “(hereinafter referred to as the Federal Law “On Personal Data”);
• Decree of the Government of the Russian Federation No. 687 of September 15, 2008 “On Approval of the Regulation on the Specifics of processing Personal Data performed without the use of automation Tools”;
• other regulatory legal acts of the Russian Federation and regulatory documents of executive bodies of state power.

1.3. The purpose of the Policy is to provide the persons providing their personal data with the necessary information to assess what personal data is processed by the Operator and for what purposes, what methods of ensuring their security are implemented, as well as to establish the main principles and approaches to processing and ensuring the security of personal data in the Operator.

1.4. The Policy protects the rights and freedoms of subjects when processing their personal data using automation tools or without using such tools, and also establishes the responsibility of persons who have access to personal data for non-compliance with the requirements governing the processing and protection of personal data.

1.5. Users using the Operator’s services and services, services and services posted on the Operator’s website ai-surfer.ru (hereinafter referred to as the Website), by informing the Operator of their personal data, including through the intermediary of third parties, they acknowledge their consent to the processing of personal data in accordance with this Policy. In case of disagreement with this Policy in general, as well as in case of disagreement with any clause of this Policy, the User must refrain from using the Services.

1.6. The Operator receives and starts processing the Subject’s personal data from the moment of receiving his consent. Consent to the processing of personal data may be given by the Subject of personal data in a form that allows confirming the fact of obtaining consent, unless otherwise established by federal law:

• in writing and/or
• by performing specific actions by the Personal Data Subject (checking the appropriate personal data entry form) when using the services on the Operator’s website, using feedback forms and accepting offers containing provisions on the processing of personal data in accordance with current legislation. If the Personal Data Subject does not consent to the processing of his / her personal data, such processing is not carried out.

1.7. Consent to the processing of personal data may be revoked by the personal data subject. If the personal data subject withdraws consent to the processing of personal data, the operator has the right to continue processing personal data without the consent of the personal data subject, if there are grounds specified by the current legislation.

1.8. This Policy may be changed by the Operator. The Operator has the right to make changes to this Policy at any time at its sole discretion, provided that the User is notified of this in advance. When making changes in the current version, the date of the last update is indicated. The new version of the Policy takes effect from the moment it is posted on the web server, unless otherwise provided by the new version of the Policy.

1.9. This Policy applies only to User information obtained during the use of the Operator’s Services. The Operator does not control and is not responsible for the processing of User information by third-party websites to which the User can click on links available on the Operator’s official web server.

1.10. CONCEPTS USED IN THIS POLICY:

• personal data – any information relating directly or indirectly to a specific or identifiable natural person (subject of personal data)
• personal data operator (operator) – a state body, municipal body, legal entity or individual that independently or jointly with other persons organizes and / or performs the processing of personal data, as well as determines the purposes of personal data processing, the composition of personal data to be processed, actions (operations) performed with personal data;
• processing of personal data – any action (operation) or a set of actions (operations) with personal data performed with or without the use of automation tools. Processing of personal data includes, but is not limited to: collection; recording; systematization; accumulation; storage; clarification (updating, modification); extraction; use; transfer (distribution, provision, access); depersonalization; blocking; deletion; destruction.
• automated processing of personal data – processing of personal data using computer technology;
• dissemination of personal data – actions aimed at disclosing personal data to an indefinite group of persons;
• provision of personal data – actions aimed at disclosing personal data to a certain person or a certain group of persons;
• destruction of personal data – actions that make it impossible to restore the content of personal data in the personal data information system and (or) as a result of which the material carriers of personal data are destroyed;
• personal data information system– a set of personal data contained in databases and information technologies and technical means that ensure their processing;
• a personal data subject is a natural person who is directly or indirectly identified or determined on the basis of Personal Data relating to him / her.

2. THE CONCEPT AND COMPOSITION OF PERSONAL DATA

2.1. For the purposes of this Policy, personal data means any information related directly or indirectly to a specific individual (personal data subject).

2.2. Depending on the subject of personal data, the Operator may process personal data of the following categories of subjects in order to carry out its activities and fulfill its obligations:

• Customer Data — information required by the Operator to fulfill its obligations under the contractual relationship with the Customer and to comply with the requirements of the legislation of the Russian Federation. This also includes data provided by potential clients, representatives of clients authorized to represent clients; managers and chief accountants of legal entities that are clients of the Operator, persons who have concluded civil contracts with the Operator for the provision of Operator services; employees of the Operator’s partners and other legal entities that have contractual relations with the Operator, with which the Operator’s employees interacta within the scope of its activities;
• personal data of the Client provided during registration on the Website, as well as when using the services, communication forms posted on the website;
• personal data of other individuals who have expressed consent to the processing of their personal data by the Operator, or individuals whose personal data processing is necessary for the Operator to achieve the goals stipulated by an international treaty of the Russian Federation or a law, to exercise and fulfill the powers and obligations assigned by the legislation of the Russian Federation;
• personal data of individuals that they have made publicly available, and their processing does not violate their rights and meets the requirements established by the Legislation on Personal data.

2.3. The Operator hereby informs the Subjects of personal data that within the framework of the personal data provided on the Website by the Operator, subject to the consent of the Subject of Personal Data to the processing of personal data, expressed by putting the appropriate check mark under the personal data collection form or clicking on the appropriate button, the following personal data may be processed: first name, last name, phone number; e-mail address (E-mail).

3. GROUNDS AND PURPOSES OF PERSONAL DATA PROCESSING

3.1. The Operator processes personal data for carrying out its activities, including providing services to Customers. The Operator has the right to:

• perform the functions assigned to the Operator by the legislation of the Russian Federation in accordance with the Federal Law “On Personal Data” and other laws and regulations of the Russian Federation, as well as the Charter and regulations of the Operator;
• The Operator collects and stores the Client’s personal data necessary for the provision of services, execution of agreements and contracts, and fulfillment of obligations to the Client.

3.2. The Operator processes personal data only if at least one of the following conditions is met::

• processing of personal data is carried out with the consent of the personal data subject to the processing of his personal data;
• the processing of personal data is necessary for achieving the goals stipulated by law, for performing and fulfilling the functions, powers and duties assigned to the operator by the legislation of the Russian Federation;
• the processing of personal data is necessary for the performance of a contract to which the personal data subject is a party or beneficiary or guarantor, as well as for the conclusion of a contract on the initiative of the personal data subject or a contract under which the personal data subject will be a beneficiary or guarantor;
• processing of personal data is necessary to exercise the rights and legitimate interests of the Company or third parties, or to achieve socially significant goals, provided that the rights and freedoms of the personal data subject are not violated;
• processing of personal data is carried out, access to which is granted to an unlimited number of persons by the subject of personal data or at his request;
• processing of personal data subject to publication or mandatory disclosure in accordance with federal law is carried out.

3.3. The Operator and other persons who have obtained access to personal data are obliged not to disclose or distribute personal data to third parties without the consent of the personal data subject, unless otherwise provided by federal law.

3.4. The Operator may process personal data of personal data subjects for the following purposes::

• to identify the subject of personal data;
• for communication with the personal data subject, if necessary, including sending offers, notifications, information and requests, both related and not related to the provision of services, as well as processing applications, requests and requests from the Client;
• improving the quality of services provided by the Operator.

3.5. Processing special categories Personal data related to race, nationality, political views, religious or philosophical beliefs, or intimate life are not processed by the Operator.

4. TERMS OF PERSONAL DATA PROCESSING

4.1. The terms of personal data processing are determined based on the purposes of processing in the Operator’s information systems, in accordance with the term of validity of the contract or agreement with the personal data subject.

4.2. The condition for termination of personal data processing may be the achievement of the purposes of personal data processing in accordance with the terms of the contract concluded between the Operator and the personal data subject, the expiration of the consent period or revocation of the consent of the personal data subject to the processing of his personal data, as well as the identification of illegal processing of personal data.

5. CIRCLE OF PERSONS AUTHORIZED TO PROCESS PERSONAL DATA

5.1. In order to achieve the objectives of Article 3 of this Policy, only those employees of the Operator who are assigned such a duty in accordance with their official (labor) duties are allowed to process personal data. Access to other employees may be granted only in cases stipulated by law. The operator requires its employees to maintain confidentiality and ensure the security of personal data when processing them.

5.2. The Operator has the right to transfer personal data to third parties in the following cases::

• The personal data subject has explicitly expressed his consent to such actions;
• The transfer is provided for by Russian or other applicable legislation within the framework of the procedure established by law.

In this case, the acquirer assumes all obligations to comply with the terms of this Policy in relation to the data received by him.

5.3. At the reasoned request of the authorized body and in accordance with the current legislation, the subject’s personal data may be transferred without his consent:

• in connection with the administration of justice to the judicial authorities;
• to the police, the federal Security Service, the Prosecutor’s Office, and the investigative committee;
• to other bodies authorized by the current legislation and applicable legal norms and the Operator in cases established in regulatory legal acts that are binding on the operator.

6. PROCEDURE AND METHODS OF PERSONAL DATA PROCESSING

6.1. In the process of providing services and performing on-farm activities, the Operator uses automated and non-automated processing of personal data.

6.2. The Operator has the right to entrust the Processing of Personal Data to another person with the consent of the Personal Data Subject, unless otherwise provided for by the legislation of the Russian Federation, on the basis of a contract concluded with this person, the mandatory condition of which is that this person complies with the principles and rules for Processing Personal Data provided for by the Federal Law “On Personal Data”.

6.3. Personal data is not disclosed to third parties and is not distributed in any other way without the consent of the Personal Data Subject, unless otherwise provided by the legislation of the Russian Federation.

6.4. Representatives of state authorities (including those controlling, supervising, law enforcement and other bodies) are granted access to Personal Data processed in the Operator, to the extent and in accordance with the procedure established by the legislation of the Russian Federation.

6.5. Within the framework of personal data processing, the following rights are defined for the Personal Data Subject and the Operator.

6.5.1. The personal data subject has the right to::

• receive information concerning the processing of their personal data in accordance with the procedure, form and terms established by the Legislation on Personal Data;
• request clarification of their personal data, their Blocking or Destruction if the personal data is incomplete, outdated, unreliable, illegally obtained, is not necessary for the stated purpose of processing, or is used for purposes not previously stated when the Personal Data Subject consents to the processing of personal data;
• take legal measures to protect their rights;
• withdraw your consent to the processing of personal data.

6.5.2. The Operator has the right to:

• process personal data of the Personal Data Subject in accordance with the stated purpose;
• require the Personal Data Subject to provide reliable personal data necessary for the performance of the contract, provision of services, identification of the Personal Data Subject, as well as in other cases provided for by the Personal Data Legislation; restrict the Personal Data Subject’s access to his / her personal data if the processing of personal data is carried out in accordance with the anti-legalization legislationaccess of the Personal Data Subject to his / her personal data violates the rights and legitimate interests of third parties, as well as in other cases provided for by the legislation of the Russian Federation;
• process publicly available personal data of individuals;
• process personal data that is subject to publication or mandatory disclosure in accordance with the legislation of the Russian Federation;
• assign the processing of personal data to another person with the consent of the Personal Data Subject.

6.6. If the fact of inaccuracy of personal data or illegality of their processing is confirmed, the personal data is subject to updating by the operator, and the processing must be stopped.

6.7. If the purposes of personal data processing are achieved, as well as if the personal data subject withdraws consent to their processing, personal data is subject to destruction if:

• otherwise is not provided for in the contract to which the personal data subject is a party, beneficiary or guarantor;
• The Operator does not have the right to process personal data without the consent of the subject on the grounds provided for by the Federal Law “On Personal Data” or other federal laws;
• no other agreement between the Operator and the personal data subject provides otherwise.

6.8. The Operator is obliged to inform the personal data subject or his representative about the processing of personal data of such a subject carried out by him at the request of the latter.

6.9. The Operator also has other rights and bears other obligations established by the Federal Law “On Personal Data”.

7. All suggestions or questions regarding this Privacy Policy should be sent to the following email address: accountmedia@yandex.ru