> Privacy Policy

PRIVACY POLICY

(personal data processing policy)

Personal Data Operator:
Individual Entrepreneur Kateryna Valerievna Kamyshova
Taxpayer Identification Number (INN): 771594439274
Primary State Registration Number of Individual Entrepreneur (OGRNIP): 326774600180481
Address: Moscow, Leskova St., building 9, apartment 148
Email: hanziway@yandex.ru
Website: https://hanziway.com

This Policy defines how the personal data of users of Hanziway.com are processed and protected.

1. GENERAL PROVISIONS

This Privacy Policy (personal data processing policy) (hereinafter referred to as the “Policy”) of Individual Entrepreneur K.V. Kamyshova (hereinafter referred to as the “Operator”) has been prepared in accordance with Federal Law No. 152-FZ of July 27, 2006 “On Personal Data” and other applicable laws and regulations of the Russian Federation.

This Policy is the main internal document governing the Operator’s processing of personal data.

This Policy defines the purposes, procedures, conditions, scope, and methods of personal data processing by the Operator, the rights and obligations of the Operator, and information about the measures used to protect personal data.

This Policy applies to all personal data processed by the Operator using automated means, without automated means, or by mixed processing methods.

2. TERMS AND DEFINITIONS

“Personal Data” (“PD”) means any information relating directly or indirectly to an identified or identifiable individual (a personal data subject).

“PDIS” means a personal data information system.

“Processing of PD” means any action or set of actions performed with personal data, with or without automated means, including collection, recording, systematization, accumulation, storage, clarification (updating or modification), extraction, use, transfer (distribution, provision or access), depersonalization, blocking, deletion, and destruction of personal data.

“Website” means the website located at https://hanziway.com.

“User” means a visitor to the Website or a user of the Service.

“Personal Account” means the protected Website pages created after User registration and accessible after the User enters the relevant authentication credentials.

“Payment Record” means a record created in the Service when a one-time payment or automatic renewal is initiated and containing information required to create and account for the payment, receive its status, provide paid access, manage a subscription, and resolve disputed situations.

“Payment Partner” or “External Payment Service” means a third party used to accept, process, confirm, or refund User payments and to manage automatic renewal.

LAVALANE LTD, registration number HE 387079, registered at 3 Kallipoleos Street, Office 102, 1055 Nicosia, Cyprus, is a recipient of the limited information required to create and manage payments and subscriptions in US dollars.

“Provision of PD” means actions aimed at disclosing personal data to a specific person or a specific group of persons.

“Cross-border Transfer of Personal Data” means the transfer of personal data to the territory of a foreign country to a foreign government authority, foreign individual, or foreign legal entity.

“Cookies” means data automatically transmitted to the Operator when the Website and/or Service is used by software installed on the User’s device, including IP address, geographic location, browser and operating system information, technical characteristics of the hardware and software, and the date and time of access to the Website and/or Service. By accepting this Policy, the User agrees to the use of cookies.

“Third Parties” means individuals or legal entities acting in their own interests or representing the interests of other persons in their relations with the Operator under or in connection with proposed or concluded civil-law agreements.

3. PRINCIPLES AND CONDITIONS OF PERSONAL DATA PROCESSING

3.1. The Operator processes personal data in accordance with the following principles:

  • PD is processed lawfully and fairly;
  • processing is limited to specific, predetermined, and lawful purposes;
  • processing incompatible with the purposes for which PD was collected is not permitted;
  • databases containing PD processed for incompatible purposes are not combined;
  • the content and scope of processed PD correspond to the stated purposes;
  • processed PD is not excessive in relation to the stated purposes;
  • the accuracy, sufficiency, and, where necessary, relevance of PD are maintained.

3.2. The Operator may process personal data using automated means, without automated means, or by mixed processing methods.

3.3. The Operator regularly reviews whether its PD processing procedures comply with these principles when processing procedures or PDIS are created or modified and when applicable laws or regulations change.

3.4. Personal data is retained no longer than required for the purposes of processing and is destroyed when those purposes have been achieved or are no longer relevant, unless otherwise required by law.

3.5. Processing may be terminated when its purposes have been achieved, consent has expired or been withdrawn, or unlawful processing has been identified, unless continued processing is permitted or required by law.

3.6. When collecting personal data, including through the Internet, the Operator records, systematizes, accumulates, stores, updates, and retrieves personal data of citizens of the Russian Federation using databases located in the Russian Federation. Where the User selects payment in US dollars, a limited set of data may subsequently be transferred to the Republic of Cyprus as described in Section 6 of this Policy.

3.7. The Operator does not make decisions that produce legal consequences for PD subjects or otherwise affect their rights and legitimate interests solely on the basis of automated processing, except for automated actions expressly requested by the User or necessary to perform the agreement where permitted by law.

3.8. Personal data is confidential. The Operator’s employees must not answer questions relating to PD processing by telephone or through communication channels that do not allow the identity of the requesting person to be verified.

4. PERSONAL DATA PROCESSED BY THE OPERATOR

Website Users

Data processed:

  • full name;
  • telephone number;
  • email address;
  • date of birth;
  • gender.

Purpose: registering the User on the Website and providing the functionality of the Personal Account.

Website Visitors

Data processed: cookies and technical information about use of the Website.

Purpose: operating the Website, improving usability, fixing errors, analyzing visits, and developing new functionality.

Users Purchasing Paid Access to the Service

Personal data and related information processed:

  • email address;
  • internal User, shop, and payment record identifiers;
  • selected PRO plan, offer identifier, and number of access days;
  • payment type — one-time or automatically renewing — and payment frequency;
  • payment amount and currency;
  • selected payment partner;
  • payment-page language and User time zone;
  • technical invoice, payment, contract, parent-contract, and subscription identifiers;
  • payment, access-fulfilment, and subscription statuses;
  • dates of payment creation and confirmation, successful and unsuccessful charges, provision of PRO, the next charge, reminder delivery, cancellation request, cancellation, and subscription expiry;
  • information about the accepted versions of the Terms of Use and Privacy Policy and the time at which consent to automatic renewal was recorded;
  • technical payment or subscription event messages received from the payment partner;
  • refund, chargeback, or payment-dispute information;
  • information voluntarily provided by the User to support.

Purposes: creating, accounting for, and reconciling one-time and recurring payments; providing and extending PRO; accumulating paid days; displaying payment history and statuses; sending reminders of upcoming charges; cancelling automatic renewal; reviewing refunds, chargebacks, enquiries, and disputes; complying with the Operator’s obligations; and protecting the parties’ rights.

4.1. When a User visits the Website, the Operator may collect technical information, including the IP address, device type, operating system and browser, unique device identifier, referring website address, and the User’s path through the Website.

4.2. As the User browses the Website, the Operator may use automated technologies to collect information about links followed, pages or content viewed, viewing time, content response time, loading errors, and visit duration. This information may be collected through cookies, web beacons, and third-party web analytics services and is used to operate the Website, improve services, fix errors, and simplify Website use.

4.3. Cookies may be collected and processed using Yandex Metrica, a web analytics service provided by Yandex LLC (16 Leo Tolstoy St., Moscow, 119021). Further information is available in the Yandex Metrica documentation and the Yandex Privacy Policy.

4.4. The Operator processes analytical, marketing, and technical cookies. Analytical and marketing cookies help determine User preferences and analyze page visits. Technical cookies are necessary for normal operation of the Website and cannot be disabled through the Website.

4.5. The User may restrict cookies in the browser settings. Restricting technical cookies may affect certain Website functions.

4.6. When purchasing paid access, the User may be redirected to an external payment service. The Operator does not request the full bank card number, card expiration date, CVV/CVC code, SMS codes, or online-banking credentials. The User enters such information directly on the relevant payment service page, and that service processes the information under its own rules. When the User visits the external payment page, the relevant service may also independently collect the IP address, browser and device information, cookies, and other technical data under its privacy policy.

4.7. For a USD payment, the Operator sends the payment partner the User’s email address, selected offer identifier, USD currency, payment frequency, payment-page language, and technical return-page URLs. The payment amount is determined by the selected offer and is not sent by the Operator as a separate field when the payment is created. To check a payment or subscription, the relevant technical identifier is sent. To cancel automatic renewal, the User’s email address and subscription contract identifier are sent.

4.8. The Operator receives from the payment partner the technical identifiers, amount and currency, payment type and frequency, statuses, and dates necessary to confirm and reconcile the payment or subscription, provide PRO, display payment history, send reminders, and cancel future charges. Automated notifications received from the payment partner may be retained in their original form for accurate record-keeping, safe reprocessing, and dispute resolution. The User is not required to submit a separate manual verification request for an integrated payment.

5. GROUNDS FOR PERSONAL DATA PROCESSING

5.1. Personal data may be processed:

  • where consent to personal data processing has been obtained;
  • where processing is necessary for purposes provided by law or to perform functions, powers, and duties imposed on the Operator;
  • where processing is necessary for the administration of justice or enforcement of an enforceable judicial act or act of another body or official;
  • to conclude an agreement at the initiative of the PD subject and perform an agreement to which the PD subject is a party or beneficiary;
  • where processing is necessary to protect the life, health, or other vital interests of the PD subject and consent cannot be obtained;
  • where processing is necessary to exercise the rights and legitimate interests of the Operator and/or third parties, provided that the rights and freedoms of the PD subject are not violated;
  • for statistical or other research purposes subject to mandatory depersonalization of personal data;
  • where personal data must be published or disclosed by law.

5.2. Where written consent is not required under Federal Law No. 152-FZ, consent may be given by the PD subject or the subject’s representative in any form that allows the fact of consent to be confirmed, including electronically.

5.3. Information relating to paid access is processed to conclude and perform the agreement with the User; create, account for, and reconcile one-time and recurring payments; provide and extend PRO; accumulate paid days; display payment history; send service notifications; cancel automatic renewal; review refunds and chargebacks; process enquiries and disputes; comply with legal requirements; and protect the rights and legitimate interests of the Operator and the User.

6. TRANSFER OF PERSONAL DATA

6.1. In the course of its activities, the Operator may entrust personal data processing to third parties with the consent of the PD subject unless otherwise permitted by the laws of the Russian Federation. A person processing personal data on behalf of the Operator must comply with the applicable processing principles and rules, confidentiality obligations, and personal data security requirements.

6.2. A data-processing instruction specifies the personal data, the actions to be performed with those data, the processing purposes, confidentiality and security obligations, and any other mandatory terms required by law.

6.3. Where the User selects payment in US dollars, the Operator makes a cross-border transfer of a limited set of personal data to the Republic of Cyprus. The recipient is LAVALANE LTD, registration number HE 387079, registered at 3 Kallipoleos Street, Office 102, 1055 Nicosia, Cyprus. The transfer is made to create and manage the selected payment or subscription, confirm its status, provide PRO access, and cancel future charges, on an applicable legal basis and after the requirements of Russian law governing cross-border transfers of personal data have been met.

6.4. To create a payment or subscription, LAVALANE LTD receives the User’s email address, the selected offer identifier, USD currency, payment frequency, payment-page language, and technical return-page URLs. To check an operation, the technical identifier of the relevant payment or subscription is sent. To cancel automatic renewal, the User’s email address and subscription contract identifier are sent. The technical return-page URLs do not contain User or payment identifiers.

6.5. The Operator receives from LAVALANE LTD the information required to perform the agreement and manage the payment: technical identifiers, buyer email address, amount and currency, operation type, frequency and status, creation and payment times, the next charge, cancellation and subscription-expiry dates, and information about errors, refunds, chargebacks, and disputed operations, where supplied.

6.6. The Operator does not provide LAVALANE LTD with the User’s Hanziway password, full bank card number, card expiration date, CVV/CVC code, SMS codes, or online-banking credentials. Information entered by the User directly on the external payment page and technical information collected when that page is visited are processed by LAVALANE LTD and its service providers under the LAVALANE LTD Privacy Policy.

6.7. If the User voluntarily provides additional information concerning a disputed, incorrect, or duplicate payment, that information is used only to locate and verify the payment, provide access, review a refund, resolve the dispute, and protect the parties’ rights.

7. PERSONAL DATA SECURITY MEASURES

7.1. The Operator takes necessary and sufficient legal, organizational, and technical measures to protect PD against unauthorized or accidental access, destruction, modification, blocking, copying, distribution, and other unlawful actions. Such measures include:

  • appointing a person responsible for PD processing;
  • applying organizational and technical security measures when PD is processed in information systems;
  • monitoring unauthorized access incidents and taking measures to prevent similar incidents;
  • monitoring the security measures and the level of protection of PDIS.

8. RIGHTS OF THE PERSONAL DATA SUBJECT

8.1. The personal data subject has the right to:

  • receive information about the processing of the subject’s personal data;
  • withdraw previously given consent; where another legal basis exists, the Operator may continue processing in accordance with Part 2 of Article 9 and Parts 4 and 5 of Article 21 of Federal Law No. 152-FZ;
  • request clarification, blocking, or destruction of personal data that are incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated purpose, and request termination of processing where the purpose has been achieved.

8.2. To exercise and protect their rights, the PD subject or the subject’s representative may send an electronic request to hanziway@yandex.ru.

8.3. The request must describe the requirement and include:

  • the subject’s full name;
  • identity-document number, issue date and issuing authority, or other information allowing the subject to be identified unambiguously;
  • information confirming the relationship with the Operator or otherwise confirming that the Operator processes the subject’s personal data;
  • a signature where required by applicable law for the relevant type of request.

8.4. Where a representative submits the request, the request must also identify the representative and include proof of authority.

8.5. The Operator responds in the form in which the request was submitted unless the request states otherwise.

9. PROCEDURE FOR DESTRUCTION OF PERSONAL DATA

9.1. Personal data is subject to destruction:

  • when the processing purpose has been achieved or is no longer relevant, unless otherwise provided by Federal Law No. 152-FZ;
  • when the laws or regulations establishing the legal basis for processing are amended or repealed;
  • when unlawful processing is identified;
  • when the personal data subject withdraws consent, unless otherwise provided by Federal Law No. 152-FZ.

9.2. Personal data is destroyed within 30 (thirty) days after receipt of a consent-withdrawal notice or discovery of data subject to destruction, unless another period is required by law or by an agreement between the PD subject and the Operator. Unlawfully processed data is destroyed within no more than 10 (ten) business days after the unlawful processing is identified, unless applicable law provides otherwise.

9.3. Physical media containing personal data held in archives and personal data contained in electronic archives are destroyed in accordance with the archival laws of the Russian Federation.

9.4. Information relating to payments, subscriptions, automatic renewal, paid access, reminders, cancellations, refunds, chargebacks, and disputes is retained for as long as necessary for those purposes, performance of the Operator’s contractual, legal, and accounting obligations, accounting for services provided, and protection of the parties’ rights and legitimate interests, unless a different period is required by the laws of the Russian Federation.

10. FINAL PROVISIONS

10.1. The Operator’s officers and employees who violate the requirements governing personal data processing and protection are liable in accordance with the laws of the Russian Federation.

10.2. Each employee of the Operator must maintain the confidentiality of PD learned in the course of the employee’s duties and is liable for unlawful disclosure in accordance with applicable law.

10.3. The Operator may amend and update this Policy, including:

  • when laws or regulations governing personal data processing change;
  • when personal data processing procedures are created or modified;
  • following audits, security reviews, or identification of systems or procedures that do not comply with this Policy.

10.4. Unless otherwise stated in this Policy, amendments take effect when the new version is published on the Website.

10.5. Matters not covered by this Policy are governed by the applicable laws of the Russian Federation.