This Personal Data Processing Policy has been prepared in accordance with the requirements of Federal Law No. 152-FZ dated July 27, 2006 “On Personal Data” (hereinafter referred to as the “Personal Data Law”) and defines the procedure for processing personal data and measures taken to ensure the security of personal data by Individual Entrepreneur Sergey Yuryevich Galler (hereinafter referred to as the “Operator”).
1.1. The Operator considers the observance of human and civil rights and freedoms in the processing of personal data, including the protection of the right to privacy and personal and family secrecy, as its highest priority and essential condition for carrying out its activities.
1.2. This Policy of the Operator regarding the processing of personal data (hereinafter referred to as the “Policy”) applies to all information that the Operator may obtain about visitors to the website https://dubaigaller.com.
2. Basic Terms Used in the Policy
2.1. Automated processing of personal data – processing of personal data using computer equipment.
2.2. Blocking of personal data – temporary suspension of personal data processing (except where processing is necessary to clarify personal data).
2.3. Website – a set of graphic and informational materials, as well as software and databases, ensuring their availability on the Internet at https://dubaigaller.com.
2.4. Personal data information system – a set of personal data contained in databases and information technologies and technical means ensuring their processing.
2.5. Depersonalization of personal data – actions resulting in the impossibility of determining, without additional information, the ownership of personal data to a specific User or other personal data subject.
2.6. Processing of personal data – any action (operation) or set of actions (operations) performed with or without the use of automation tools on personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, and destruction of personal data.
2.7. Operator – a state authority, municipal authority, legal entity, or individual that independently or jointly with others organizes and/or carries out the processing of personal data and determines the purposes of personal data processing, the composition of personal data to be processed, and the actions (operations) performed with personal data.
2.8. Personal data – any information relating directly or indirectly to a specific or identifiable User of the website https://dubaigaller.com.
2.9. Personal data authorized by the subject for dissemination – personal data to which an unlimited number of persons have been granted access by the personal data subject by giving consent to the processing of personal data authorized for dissemination in accordance with the Personal Data Law (hereinafter referred to as “personal data authorized for dissemination”).
2.10. User – any visitor to the website https://dubaigaller.com.
2.11. Provision of personal data – actions aimed at disclosing personal data to a specific person or a specific group of persons.
2.12. Dissemination of personal data – any actions aimed at disclosing personal data to an indefinite group of persons (transfer of personal data) or making personal data accessible to an unlimited number of persons, including publication in the media, placement in information and telecommunication networks, or provision of access in any other way.
2.13. Cross-border transfer of personal data – transfer of personal data to the territory of a foreign state to a foreign authority, foreign individual, or foreign legal entity.
2.14. Destruction of personal data – any actions resulting in the irreversible destruction of personal data with no possibility of restoring their content in the personal data information system and/or destruction of physical media containing personal data.
3. Basic Rights and Obligations of the Operator
3.1. The Operator has the right to:
– receive reliable information and/or documents containing personal data from the personal data subject;
– continue processing personal data without the consent of the personal data subject in cases where consent has been withdrawn, provided there are legal grounds specified in the Personal Data Law;
– independently determine the composition and list of measures necessary and sufficient to ensure compliance with obligations established by the Personal Data Law and related regulations, unless otherwise provided by law.
3.2. The Operator is obliged to:
– provide the personal data subject, upon request, with information regarding the processing of their personal data;
– organize personal data processing in accordance with the current legislation of the Russian Federation;
– respond to inquiries and requests from personal data subjects and their legal representatives in accordance with the Personal Data Law;
– provide the authorized body for the protection of personal data subjects’ rights with necessary information within 30 days from the date of receipt of such request;
– publish or otherwise ensure unrestricted access to this Policy;
– take legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination, and other unlawful actions;
– cease transfer (dissemination, provision, access), cease processing, and destroy personal data in cases stipulated by law;
– fulfill other obligations предусмотренные законодательством о персональных данных.
4. Basic Rights and Obligations of Personal Data Subjects
4.1. Personal data subjects have the right to:
– receive information regarding the processing of their personal data, except where restricted by federal law;
– require the Operator to clarify, block, or destroy their personal data if such data are incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing;
– require prior consent for processing of personal data for marketing purposes;
– withdraw consent to the processing of personal data;
– appeal unlawful actions or omissions of the Operator to the authorized body or in court;
– exercise other rights предусмотренные законодательством РФ.
4.2. Personal data subjects are obliged to:
– provide the Operator with accurate data about themselves;
– inform the Operator of any clarification (update, modification) of their personal data.
4.3. Persons who provide inaccurate information about themselves or about another personal data subject without consent shall bear liability in accordance with the legislation of the Russian Federation.
5. Personal Data Processed by the Operator
5.1. Full name.
5.2. Email address.
5.3. Phone numbers.
5.4. The website also collects and processes anonymized visitor data (including cookies) using internet statistics services (Yandex Metrica, Google Analytics, and others).
5.5. The above data are collectively referred to as Personal Data in this Policy.
5.6. The Operator does not process special categories of personal data relating to race, nationality, political views, religious or philosophical beliefs, or intimate life.
5.7–5.8.4. Processing of personal data authorized for dissemination shall be carried out strictly in accordance with Articles 10 and 10.1 of the Personal Data Law. Consent for such processing is obtained separately and may be withdrawn at any time by the personal data subject. Upon withdrawal, processing and dissemination must be terminated in accordance with statutory requirements.
6. Principles of Personal Data Processing
Personal data processing is carried out lawfully and fairly, limited to specific, predetermined, and legitimate purposes. Only data relevant to the purposes of processing are processed. The Operator ensures accuracy, sufficiency, and relevance of personal data and stores them no longer than required by the purposes of processing unless otherwise established by law or contract. Upon achievement of processing purposes, personal data are destroyed or anonymized unless otherwise required by law.
7. Purposes of Personal Data Processing
7.1. The purposes of processing the User’s personal data include:
– informing the User by sending emails;
– conclusion, performance, and termination of civil law contracts;
– providing the User with access to services, information, and/or materials available on the website https://dubaigaller.com.
7.2. The Operator may send notifications about new products, services, special offers, and events. The User may opt out by sending an email to alex.moody@yandex.ru marked “Unsubscribe from notifications about new products and services and special offers.”
7.3. Anonymized data collected via internet statistics services are used to analyze user actions on the website and improve its quality and content.
8. Legal Grounds for Personal Data Processing
Processing is carried out on the basis of contracts with the personal data subject, federal laws and regulations, and user consent. Personal data are processed only if voluntarily provided via website forms or email. By submitting personal data, the User consents to this Policy. Anonymized data are processed if permitted by browser settings (cookies and JavaScript enabled). Consent is given freely and voluntarily in the User’s own interest.
9. Conditions of Personal Data Processing
Processing is carried out with consent or in cases provided by law, including contract performance, legal obligations, administration of justice, protection of legitimate interests, public interests, and processing of publicly available data or data subject to mandatory disclosure under law.
10. Procedure for Collection, Storage, Transfer, and Other Processing
The Operator ensures the security of personal data through legal, organizational, and technical measures.
Personal data will not be transferred to third parties except as required by law or with the consent of the personal data subject for contract performance. Users may update their data by emailing alex.moody@yandex.ru marked “Personal Data Update.” Consent may be withdrawn at any time by emailing “Withdrawal of Consent to Personal Data Processing.”
Third-party service providers process data in accordance with their own agreements and policies. The Operator is not responsible for their actions.
Personal data are stored only as long as necessary to achieve processing purposes unless otherwise required by law. Processing is terminated upon achievement of purposes, expiration or withdrawal of consent, or detection of unlawful processing.
11. Actions Performed with Personal Data
The Operator performs collection, recording, systematization, accumulation, storage, updating, retrieval, use, transfer, anonymization, blocking, deletion, and destruction of personal data, including automated processing with or without transmission over information and telecommunication networks.
12. Cross-Border Transfer of Personal Data
Before cross-border transfer, the Operator ensures that the foreign state provides adequate protection of personal data subjects’ rights. Transfer to countries without adequate protection is permitted only with written consent of the personal data subject or for contract performance.
13. Confidentiality of Personal Data
The Operator and other persons with access to personal data must not disclose or disseminate personal data without the consent of the personal data subject unless otherwise provided by federal law.
14. Final Provisions
14.1. Users may request clarification regarding personal data processing by contacting alex.moody@yandex.ru.
14.2. Any changes to this Policy will be reflected in this document. The Policy remains in effect indefinitely until replaced by a new version.
14.3. The current version of the Policy is publicly available at: