PERSONAL DATA PROCESSING POLICY FOR PERSONAL DATA OF VISITORS TO THE WEBSITE: ECOOIL-GROUP.COM, ECOOIL-GROUP.RU

1. GENERAL PROVISIONS

1.1. This Policy regarding the personal data processing (hereinafter - the "Policy") has been prepared according to clause 2, part 1 of Article 18.1 of Federal Law of the Russian Federation No. 152-FZ "On Personal Data" dated July 27, 2006 (hereinafter - the "Law"), as well as to the requirements of the General Data Protection Regulation of the European Union (GDPR) and determines the position of the legal entity ECOOIL JSC (OGRN: 1066829046525, INN: 6829020539, registration address: 392521, Russian Federation, Tambov Region, Tambovsky district, village settlement of Bolshaya Lipovitsa, 77 A Sovetskaya St., and/or its affiliates, (hereinafter - the "Company") in the field of processing and protection of personal data (hereinafter - the "Data"), observance of the rights and freedoms of every person and, in particular, the right to privacy, personal and family secrets.

2. SCOPE OF APPLICATION

2.1. This Policy shall be applied to the Data received both before and after the entry of this Policy into force.

2.2. Understanding the Data importance and value, as well as taking care of the observance of the constitutional rights of citizens of the Russian Federation and citizens of other states, the Company shall ensure the reliable protection of the Data.

3. DEFINITIONS

3.1. Data is understood as any information relating directly or indirectly to a specific or identifiable individual (citizen), i.e. including, in particular: last name, first name, patronymic name, registration/mailing address, email, phone, IP-address.

3.2. Data processing means any action (operation) or a set of actions (operations) with the Data performed with and/or without using automation tools. Such actions (operations) include: collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of the Data.

3.3. Data security is the Data protection from illegal and/or unauthorized access, destruction, alteration, blocking, copying, provision, distribution, as well as from other illegal actions in relation to the Data.

4. LEGAL BASIS AND PURPOSES OF DATA PROCESSING

4.1. The processing and security of the Data in the Company shall be carried out according to the requirements of the Constitution of the Russian Federation, the Law, the Labor Code of the Russian Federation, bylaws, other defining cases and features of the Data processing according to federal laws of the Russian Federation, guidelines and methodological documents of the Federal Service for Technical and Export Control of Russia and the Federal Security Service of Russia, as well as the General Data Protection Regulation of the European Union.

4.2. The subjects of the Data processed by the Company are:

• customers - consumers, including visitors to the website ecooil-group.com, ecooil-group.ru, owned by the Company, recipients of services;

4.3. The Company shall process the Data of the subjects for the following purposes:

implementation of the functions, powers and duties assigned to the Company by the legislation of the Russian Federation according to federal laws, including, but not limited to: the Civil Code of the Russian Federation, the Tax Code of the Russian Federation, the Labor Code of the Russian Federation, the Family Code of the Russian Federation, Federal Law of No. 27-FZ "On individual (personified) accounting in the compulsory pension insurance system” dated 01.04.1996, Federal Law No. 152-FZ "On personal data” dated 27.07.2006, Federal Law No. 53-FZ "On military obligations and military service” dated 28.03.1998, Federal Law No. 31-FZ "On mobilization preparation and mobilization in the Russian Federation” dated 26.02.1997, Federal Law No. 14-FZ "On limited liability companies” dated 08.02.1998, Federal Law No. 2300-1 "On protection of consumer rights” dated 07.02.1992, Federal Law No. 129-FZ "On accounting” dated 21.11. 1996, Federal Law No. 326-FZ "On compulsory health insurance in the Russian Federation” dated 29.11.2010,of customers - consumers, with the purpose of:

• providing information on goods/services, ongoing promotions and special offers;
• analyzing the quality of the service provided by the Company and improving the quality of the service to the Company's customers;
• informing about the order status;
• execution of the contract, including the sale and purchase contract, provision of services, as well as accounting of services rendered to consumers for mutual settlements implementation;
• delivery of the ordered goods to the customer, return of the goods.

5. PRINCIPLES AND CONDITIONS OF DATA PROCESSING

5.1. During the Data processing, the Company shall adhere to the following principles: the Data processing shall be carried out on a legal and fair basis; the Data shall not be disclosed to third parties and shall not be distributed without the consent of the Data subject, except for cases requiring the Data disclosure at the request of authorized state bodies, legal proceedings; determination of specific legitimate purposes before the start of the Data processing (including collection); the only collected Data is the one required and sufficient for the stated purpose of processing; unification of databases containing the Data, the processing of which is carried out for purposes incompatible with each other, is not allowed; the Data processing shall be limited to the achievement of specific, predetermined and legitimate purposes; the processed Data is subject to destruction or depersonalization upon achievement of the processing goals or in case of loss of the need to achieve these goals, unless otherwise provided by federal law.

5.2. The Company may include the Data of subjects into publicly available sources of the Data, while the Company takes the subject's written consent to the processing of the subject’s Data, or by expressing the consent through the website form (checkbox), by clicking which the subject of personal data expresses his/her consent.

5.3. The Company shall not process the Data related to race, nationality, political views, religious, philosophical and other beliefs, intimate life, membership in public associations, including trade unions.

5.4. The Biometric Data (the information that characterizes the physiological and biological features of a person, on the basis of which, it is possible to establish his/her identity and which is used by the Operator to establish the identity of the Data subject) shall not be processed by the Company.

5.5. The Company shall not carry out cross-border transfers of the Data.

5.6. In cases established by the legislation of the Russian Federation, the Company shall have the right to transfer the Data to third parties (Federal Tax Service, State Pension Fund and other state bodies).

5.7. The transfer of personal data to third parties can be carried out only in cases established by the legislation of the Russian Federation and by an agreement with the participation of the User or with his/her consent. With this Consent, the User hereby confirms his/her consent to the provision of the User's personal data by the Company to the following partners and bodies, as well as agrees to the processing of the User's personal data by these partners (bodies) in the scopes, methods and for the period specified in this Consent, but no more than it is required to ensure the purposes of processing indicated on the website https://ecooil-group.com, https://ecooil-group.ru for performing certain functions of the Company, namely:

• BEGET LLC (Address: 195112, St. Petersburg, 8B Carl Fabergé Sq., office 726A, INN: 7801451618) - for the processing of personal data (last name, first name, patronymic name, registration/mailing address, email, phone, IP-address) according to this Policy, for the following purposes: storage, using the website ecooil-group.com, ecooil-group.ru

The website may use third-party Internet services that collect information independent of us: GoogleAnalytics, GoogleAdSense, Yandex.Metrica, Yandex.Direct. The data they collect may be shared with other services within these organizations, and they may use the data to personalize the advertisements of their own advertisement network.  You can read the user agreements of these organizations on their websites. There you can also refuse from collecting personal data, e.g. using blockers for Google Analytics, YandexMetrica. We do not transfer personal data to other organizations and services not specified in this Privacy Policy. The only exception is the transfer of information under the legal requirements of state bodies authorized to carry out these actions.

5.8. Persons who perform the Data processing on the basis of an agreement concluded with the Company (the Operator’s instruction) shall comply with the principles and rules for the processing and protection of the Data provided for by the Law. For each third party, the agreement defines a list of actions (operations) with the Data that will be performed by the third party who processes the Data, the purposes of processing, the obligation of such party to maintain confidentiality and ensure the security of the Data during processing, the requirements for the protection of the processed Data according to the Law.

5.9. In order to comply with the requirements of the current legislation of the Russian Federation and own contractual obligations, the Data processing in the Company shall be carried out both with and without the use of automation tools. The set of processing operations includes the Data collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (provision, access), depersonalization, blocking, deletion, destruction.

5.10. It is prohibited for the Company to make decisions on the basis of exclusively automated Data processing, that generate legal consequences in relation to the Data subject or otherwise affect his/her rights and legitimate interests, except as otherwise provided for by the legislation of the Russian Federation.

6. RIGHTS AND OBLIGATIONS OF THE DATA SUBJECTS AND THE COMPANY IN PART OF THE DATA PROCESSING

6.1. The subject whose Data is processed by the Company shall have the right:

- to receive from the Company:

• the confirmation of the fact of the Data processing and the information on the availability of the Data related to the relevant Data subject;
• the information on the legal grounds and purposes of the Data processing;
• the information on the methods of the Data processing used by the Company;
• the information about the Company’s name and location;
• the information about persons (with the exception of the Company’s employees) having access to the Data or to whom the Data may be disclosed on the basis of an agreement with the Company or on the basis of federal law;
• the list of processed Data related to the Data subject, and the information on the source of the Data receipt, unless another procedure for providing such Data is set out by federal law;
• the information about the terms of the Data processing, including the terms of the Data storage;
• the information on the procedure for exercising by the Data subject of the rights provided for by the Law;
• the name (full name) and address of the person processing the Data on behalf of the Company;
• other information provided for by the Law or other regulatory legal acts of the Russian Federation;

- to demand from the Company:

• the clarification of own Data, its blocking or destruction if the Data is incomplete, outdated, inaccurate, illegally obtained or is not required for the stated purpose of processing;
• to revoke own consent to the Data processing at any time; to demand the elimination of illegal actions of the Company in relation to the subject’s Data;
• to appeal against the actions or inaction of the Company to the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) or in court if the Data subject believes that the Company is processing his/her Data in violation of the requirements of the Law or otherwise violates his/her rights and freedom;

- to protect own rights and legitimate interests, including compensation for damages and/or compensation for moral damage in court.

6.2. In the process of the Data processing, the Company is obliged to:

• provide the Data subject, upon his/her request, with information regarding the processing of his/her personal data, or legally provide a refusal within thirty days from the date of receipt of the request from the Data subject or his/her representative;
• explain to the Data subject the legal consequences of refusing to provide the Data if the Data provision is mandatory according to federal law;
• prior to the start of the Data processing (if the Data was not received from the Data subject), provide the Data subject with the following information, except for the cases provided for in part 4 of Article 18 of the Law:

1. name or last name, first name, patronymic name and address of the Company or its representative;
2. the purpose of the Data processing and its legal basis;
3. intended Data users;
4. the rights of Data subjects established by the Law;
5. the source of the Data receipt.

• perform necessary legal, organizational and technical activities or ensure them in order to protect the Data from unauthorized or accidental access, destruction, alteration, blocking, copying, provision, distribution, as well as from other illegal actions in relation to the Data;
• publish on the Internet and provide unrestricted access using the Internet to the document defining its policy in relation to the Data processing, to the information on the implemented data protection requirements;
• providethe Data subjects and/or their representatives with the free-of-charge opportunity to familiarize themselves with the Data when submitting an appropriate request within 30 days from the date of receipt of such a request;
• block unlawfully processed Data related to the Data subject, or ensure its blocking (if the Data processing is carried out by another person acting on behalf of the Company) from the moment of contacting or receiving a request for a verification period, in case of unlawful Data processing when contacting the Data subject or his/her representative or at the request of the Data subject or his/her representative or an authorized body for the protection of rights of personal data subjects;
• clarify the Data or ensure its clarification (if the Data processing is carried out by another person acting on behalf of the Company) within 7 working days from the date of submission of the information and remove the Data blocking, in case of confirmation of the fact of the Data inaccuracy based on the information provided by the Data subject or his/her representative;
• stop the unlawful Data processing or ensure the termination of the unlawful Data processing by a person acting on behalf of the Company, in the event of the discovery of the unlawful Data processing carried out by the Company or a person acting on the basis of an agreement with the Company, within a period not exceeding 3 working days from the date of this discovery;
• stop the Data processing or ensure its termination (if the Data processing is carried out by another person acting under an agreement with the Company) and destroy the Data or ensure its destruction (if the Data processing is carried out by another person acting under an agreement with the Company) after achieving the purpose of the Data processing, unless otherwise provided for by the agreement, the party, the beneficiary or the guarantor to which is the Data subject, if the purpose of the Data processing is achieved;
• stop the Data processing or ensure its termination and destroy the Data or ensure its destruction if the Data subject withdraws consent to the Data processing, if the Company is not entitled to process the Data without the consent of the Data subject;
• keep a register of applications of PD subjects, which should contain records about requests of Data subjects for receiving the Data, as well as the facts of providing the Data according these requests.

7. DATA PROTECTION REQUIREMENTS

7.1. When processing the Data, the Company takes necessary legal, organizational and technical measures to protect the Data from illegal and/or unauthorized access, destruction, alteration, blocking, copying, provision, distribution, as well as from other illegal actions in relation to the Data.

7.2. Such measures according to the Law include, in particular:

• appointment of a person responsible for organizing the Data processing and a person responsible for ensuring the Data security;
• development and approval of local acts on the Data processing and protection;
• application of legal, organizational and technical measures to ensure the Data security:

1. identification of threats to the Data security during its processing in personal data information systems;
2. application of organizational and technical measures to ensure the Data security during its processing in personal data information systems, necessary to fulfill the requirements for the Data protection, the implementation of which is ensured by the levels of the Data security specified by the Government of the Russian Federation;
3. application of procedures for assessing the conformity of information protection means that have been verified according to the established procedure;
4. assessment of the effectiveness of taken measures to ensure the Data security prior to the commissioning of the personal data information system;
5. accounting of machine Data carriers, if the Data is stored using machine media;
6. detection of facts of unauthorized access to the Data and taking measures to prevent similar incidents in the future;
7. recovery of the Data, which was modified or destroyed due to unauthorized access thereto;
8. establishing rules for accessing the Data processed in the personal data information system, as well as ensuring registration and accounting of all actions performed with the Data in the personal data information system.

• control over the measures taken to ensure the Data security and the level of security of personal data information systems;
• assessment of harm that may be caused to Data subjects in case of violation of requirements of the Law, the ratio of this harm and measures taken by the Company for ensuring the fulfillment of obligations provided for by the Law;
• compliance with the conditions that exclude the unauthorized access to material data carriers and ensure the Data safety;
• familiarization of the Company's employees who directly process the Data with the provisions of the legislation of the Russian Federation relating to the Data, including the Data protection requirements, local acts for the Data processing and protection, and training of the Company's employees.

8. TERMS OF DATA PROCESSING (STORAGE)

8.1. The terms of the Data processing (storage) shall be determined based on the purposes of the Data processing, according to the term of an agreement with the Data subject, the requirements of federal laws, the requirements of the Data operators on whose behalf the Company processes the Data, the basic rules for the archives of organizations, and the limitation period.

8.2. The Data, the processing (storage) period of which has expired, shall be destroyed, unless otherwise provided by federal law. The Data storage after the termination of its processing is allowed only after its depersonalization.

9. PROCEDURE FOR OBTAINING EXPLANATIONS ON DATA PROCESSING ISSUES

9.1. Persons whose Data is processed by the Company can receive clarifications on the processing of their Data by contacting the Company personally or by sending a corresponding written request to the address of the Company's location: 392521, Russian Federation, Tambov Region, Tambovsky district, village settlement of Bolshaya Lipovitsa, 77A Sovetskaya St.

9.2. If an official request is sent to the Company, the following should be indicated in the request text:

• last name, first name, patronymic name of the Data subject or his/her representative;
• the number of the main identity document of the Data subject or his/her representative, the information on the date of issue of the specified document and the issuing authority;
• the information confirming that the Data subject has relationships with the Company;
• the information for feedback at a response to the request by the Company;
• the signature of the Data subject (or his/her representative). If the request is sent in electronic form, it shall be in the form of an electronic document with an electronic signature according to the legislation of the Russian Federation.

10. FEATURES OF PROCESSING AND PROTECTION OF DATA COLLECTED BY THE COMPANY USING THE INTERNET

10.1. The Company processes the Data received from users of the Website from the resource: ecooil-group.com, ecooil-group.ru (hereinafter collectively referred to as the Website), as well as incoming to the Company's phone: +7(4752)62-43-00, +7(4752)62-41-00, +7(953)711-41-11, +7(900)490-16-13, +7(900)496-01-01, +7(908)297-07-57, +7(900)490-16-12, to the Company's email: info@ecooil-group.com, sale@ecooil-group.com, agro68.com@mail.ru, ecooil68.com@gmail.com, logisteco68@gmail.com via the Company's feedback form at: ecooil-group.com, ecooil-group.ru.

10.2. In order to collect data via the Internet, the Company uses two main methods:

10.2.1. Data provision (self-entry):

• last name
• first name
• patronymic name
• registration/mailing address
• email
• phone

10.3. from Data Subjects via the Company’s phone: ecooil-group.com, ecooil-group.ru (hereinafter collectively referred to as the Website), as well as incoming to the Company's phone: +7(4752)62-43-00, +7(4752)62-41-00, +7(953)711-41-11, +7(900)490-16-13, +7(900)496-01-01, +7(908)297-07-57, +7(900)490-16-12, to the Company's email: info@ecooil-group.com, sale@ecooil-group.com, agro68.com@mail.ru, ecooil68.com@gmail.com, logisteco68@gmail.com, via the Company's feedback form at: ecooil-group.com, ecooil-group.ru, via the Company's feedback form at: ecooil-group.com, ecooil-group.ru for asking questions about the Company's products.

10.4. Automatically collected information

The Company may collect and process the following information not being the personal data:

• IP address
• information about the interests of users on the Website based on the entered search queries of the Website users about the goods being sold and offered for sale by the Company, in order to provide up-to-date information to the Company’s customers when using the Website, as well as to summarize and analyze information about which the Website sections and products are in greatest demand among the Company’s customers;
• processing and storing search queries from the Website users in order to summarize and create customer statistics on the use of the Website sections.
• information on technical data: visit time, browser settings, operating system, as well as other technical information required for the correct display of the Website content. It is impossible to identify the visitor’s identity using this data.

The Company automatically receives some types of information obtained in the process of users’ interaction with the Website, correspondence by e-mail, etc. This refers to technologies and services, such as web protocols, cookies, web marks, as well as applications and tools of the specified third party.

Cookies are used for the convenience and correct display of the Website content. These are small files that are stored on your device. They help the Website remember information about you, e.g. the language you are viewing the Website and pages you have already opened; this information will be useful during your next visit, which will make browsing the Website more convenient. You can independently configure the acceptance or blocking of cookies in your browser. Failure to accept cookies may limit the Website performance.

At the same time, web marks, cookies and other monitoring technologies do not make it possible to automatically receive the Data. If the Website user provides own data at own discretion, e.g. when filling out a feedback form or sending an e-mail, it is the only time when the processes of automatic collection of detailed information are launched for the convenience of using websites and/or improvement of interaction with users.

10.5. Data usage

The Company has the right to use the provided Data according to the stated purposes of its collection with the consent of the Data subject, if such consent is required according to the requirements of the legislation of the Russian Federation in the Data field.

The obtained Data in a generalized and impersonal form can be used to better understand the needs of buyers of the goods and services sold by the Company and to improve the quality of service.

10.6. Data transfer

The Company may entrust the Data processing to third parties only with the consent of the Data subject. The Data may also be transferred to third parties in the following cases:

a) As a response to legitimate requests from authorized state bodies, according to laws, court decisions, etc.

b) The Data cannot be transferred to third parties for marketing, commercial and other similar purposes, except in cases of obtaining the prior consent of the Data subject.

10.7. The Website contains links to other web resources, which may contain useful and interesting information for the Website users. However, this Policy shall not apply to such other websites. Users who follow links to other websites are advised to familiarize themselves with the Data processing policies of such websites.

10.8. The Website User can at any time revoke his/her consent to the Data processing either by sending a message to or by calling the phone number of the Company: ecooil-group.com, ecooil-group.ru (hereinafter collectively referred to as the Website), as well as incoming to the Company's phone: +7(4752)62-43-00, +7(4752)62-41-00, +7(953)711-41-11, +7(900)490-16-13, +7(900)496-01-01, +7(908)297-07-57, +7(900)490-16-12, to the Company's email: info@ecooil-group.com, sale@ecooil-group.com, agro68.com@mail.ru, ecooil68.com@gmail.com, logisteco68@gmail.com, via the Company's feedback form at: ecooil-group.com, ecooil-group.ru, or by sending a written notification to the Company's address: 392521, Russian Federation, Tambov Region, Tambovsky district, village settlement of Bolshaya Lipovitsa, 77A Sovetskaya St. After receiving such message, the processing of the User's Data will be terminated, and the Data will be deleted, unless the processing can be continued according to the law. 

Final Provisions

This Policy is a local regulation of the Company. This Policy is publicly available. The general availability of this Policy is ensured by publication on the Company's Website. This Policy may be revised in any of the following cases:

• when changing the legislation of the Russian Federation and the European Union in the field of personal data processing and protection;
• in cases of instructions from the competent state authorities to eliminate inconsistencies affecting the scope of the Policy;
• by decision of the Company’s management;
• when changing the Data processing purposes and terms;
• when changing the organizational structure, structure of information and/or telecommunication systems (or introducing new ones);
• when applying new technologies for the Data processing and protection (including transmission, storage);

in case of a need to change the Data processing process related to the Company’s activities. In case of failure to comply with the provisions of this Policy, the Company and its employees shall be liable according to the current legislation of the Russian Federation. The control over the fulfillment of the requirements of this Policy shall be carried out by persons responsible for organizing the Data processing in the Company, as well as for the personal data security.