Personal data processing policy

Personal data operator

The personal data operator for visitors to medovik-altay.ru is ООО «МЕДОВИК АЛТАЯ».

Taxpayer identification number (INN): 2222797246.
Tax registration reason code (KPP): 224601001.
Primary state registration number (OGRN): 1112223007632.
Registered address (in Russian): 659040, Алтайский край, с. Калманка, ул. Буденного, 5.

For personal data enquiries, including requests to correct your data or withdraw consent, contact the operator at info@medovik-altay.ru.

1. Scope of this policy

This policy sets out the purposes and rules for processing personal data of visitors to medovik-altay.ru, people contacting ООО «МЕДОВИК АЛТАЯ», customers, suppliers including beekeepers, and representatives of business partners.

It covers data obtained through website forms, email, telephone and other communications with the operator in connection with an enquiry or a contract. Employment-related processing is governed by separate internal documents.

The policy is based on Russian Federal Law No. 152-FZ on Personal Data, Federal Law No. 38-FZ on Advertising, and applicable civil, accounting, tax and archival requirements.

This policy provides information about processing. Visiting the website, browser settings, reading the policy or submitting an enquiry does not by itself replace separate consent where consent is required.

2. Sources of personal data

The operator obtains information directly from people submitting a form, writing, calling, negotiating or providing documents for a contract. Website visits also involve technical information about requests to the website and its services.

A representative or business partner supplying information about another person must have a lawful basis. The operator must assess that basis and inform the data subject unless a statutory exception applies. Public availability alone does not authorise unrestricted use of personal data.

An initial enquiry does not require a passport copy, bank documents, health information or other details unrelated to the question. Supply information about other people only where there is a lawful basis.

3. Purposes, data, bases and retention

3.1. Enquiries and negotiations

People concerned: People requesting a price list, product information, cooperation, contract manufacturing or procurement, and their representatives.
Data: The name, telephone number and email supplied, the enquiry and correspondence, and organisation and job title where relevant. Only information necessary to respond and negotiate may be processed.
Basis: Article 6(1)(5) of Law No. 152-FZ for a contract initiated by the data subject; Article 6(1)(7), subject to the person’s rights, for business communications with a partner’s representative; separate consent under Article 6(1)(1) for other enquiries without an independent lawful basis.
End of processing: The response and related negotiations are complete, or further negotiations are declined. If no contract is concluded, data must not be retained for unspecified future use; any further retention requires its own purpose and basis.

3.2. Customer and business contracts

People concerned: Individual customers, sole traders and representatives of business partners.
Data: Name, contact details, representative authority, orders and performance records. Delivery address, payment details and other contractual information may be requested only as needed for the particular contract and settlement.
Basis: Article 6(1)(5) of Law No. 152-FZ for a contract with the person; Article 6(1)(7) for necessary communications with representatives while respecting their rights; Article 6(1)(2) for specific accounting, tax and document-retention duties.
End of processing: Obligations have been fulfilled or terminated, applicable mandatory retention periods for the relevant documents have expired, and existing claims have been resolved. Retention to protect rights is limited to the necessary data and a justified period.

3.3. Procurement from beekeepers and other suppliers

People concerned: Prospective and existing individual suppliers, sole traders and supplier representatives.
Data: Initial enquiries involve contact details and the offer. Preparation and performance of a procurement contract may require identification and contractual information, a taxpayer number, payment details and relevant farm or apiary information. Passport particulars may be processed only where justified by the contract or a specific statutory duty.
Basis: Articles 6(1)(2) and 6(1)(5) of Law No. 152-FZ for applicable statutory duties and a contract with the person; Article 6(1)(7) for communications with representatives while respecting their rights. Processing beyond independent bases requires separate consent.
End of processing: For an initial offer: negotiations end without a contract. For a concluded contract: obligations are fulfilled and applicable mandatory document-retention periods and claim handling have ended.

3.4. Advertising communications

People concerned: People who have separately agreed to receive advertising from ООО «МЕДОВИК АЛТАЯ».
Data: A name where needed to address the person, contact details only for the channels chosen, and evidence of consent and withdrawal.
Basis: Prior advertising consent under Article 18 of Law No. 38-FZ and consent to promotional processing under Article 15 and Article 6(1)(1) of Law No. 152-FZ. This policy and an ordinary enquiry do not replace those consents.
End of processing: The relevant consent is withdrawn or expires, or the advertising purpose ends, whichever happens first. Advertising must stop immediately after an opt-out request.

3.5. Website operation and security

People concerned: Website visitors and people using its forms.
Data: IP address, request time and URL, technical browser and device information, referring page where sent by the browser, error information and technical identifiers necessary for functions and protection against misuse. This information is not automatically anonymous.
Basis: Article 6(1)(7) of Law No. 152-FZ for necessary, proportionate operation and security measures that respect visitors’ rights. Optional processing based on consent requires prior consent.
End of processing: The operation and security review for the period covered by the record is complete. Records of a specific incident are kept separately only until the investigation and related claims are resolved. Log rotation periods must reflect these purposes and be set in internal rules.

3.6. Data requests and legal duties

People concerned: People making requests about their data and their representatives.
Data: The request and response, a contact address, information needed to verify identity or authority, and records of actions taken. Documents and particulars beyond what is necessary must not be requested.
Basis: Article 6(1)(2) of Law No. 152-FZ for statutory duties; Article 6(1)(7) for necessary protection of rights and evidence of lawful action, subject to the data subject’s rights.
End of processing: The request and related duties, checks or claims are complete. Records are retained only for the applicable mandatory or justified evidential period and must not be used for advertising.

A full passport copy is not a condition for an initial enquiry or supply offer. Any need to obtain a document copy must be assessed separately; listing “passport” among documents does not justify copying every page.

4. How data is processed

Depending on the purpose, processing may be automated or manual and involve collection, recording, organisation, accumulation, storage, correction, retrieval, use, access, transfer to a specified recipient, restriction, deletion and destruction. Anonymisation may be used only in accordance with its applicable requirements.

Operations are limited to what is necessary for the relevant purpose. Employee and contractor access must be limited to their tasks. Enquiries are not intended for publication or disclosure to the general public.

This policy does not provide for collecting sensitive categories or biometric data for ordinary enquiries. Any necessary processing in a separate lawful process requires its own basis and statutory safeguards. Publishing employee details or photographs also requires a separate basis; visitor consent does not cover it.

Where processing relies on consent, that consent must be specific, informed, unambiguous and separate from this policy and other documents being confirmed. Before collection, the person must receive information about the purpose, data, operations, duration and withdrawal method. The operator must be able to prove consent and the version accepted.

Declining advertising must not prevent a price enquiry, a response or a contract. Advertising consent is separate and covers only the channels expressly chosen. Details in an enquiry, contract or public source do not by themselves authorise adding someone to a mailing list.

To opt out, reply to the advertising message, use the opt-out method provided in it, or email info@medovik-altay.ru. Identify the contact and channel concerned. Advertising to that contact must stop immediately once the request is received.

Consent to data processing may be withdrawn at the same address. Withdrawal does not end processing that the operator must or may continue on an independent lawful basis, such as retaining mandatory accounting records. That basis and the remaining data must be separately justified.

6. Technical data and embedded services

Loading pages and protecting the website involves the technical information listed in section 3.5. Website functions and embedded services may use cookies and similar identifiers only with an appropriate basis. Enabling cookies or JavaScript in a browser is not consent to every processing purpose.

Pages use font resources for typography and Yandex Maps for the map. When an external resource loads, its provider receives network and technical information needed for the request, including the IP address; other information depends on the service and browser settings. This information must not be described as anonymous without assessment.

Optional technologies relying on consent may process data only after a separate prior choice. Refusal and changes to that choice must be possible. The technical necessity of one function does not automatically extend to analytics or advertising.

The website links to messaging and social platforms. Visits and conversations take place in the service chosen, which also processes data under its own rules. A link does not mean enquiry contents are automatically sent to that service, and does not remove the operator’s obligations for data it obtains or uses there.

7. Access and disclosures

Data may be disclosed only to specified recipients, to the extent necessary and on a lawful basis: authorised employees, infrastructure and communications providers, parties involved in performing a particular contract, and public authorities where required by law.

Website enquiries are stored in the website database. Email services are used for work notifications and correspondence; storage services are used for working data and backups. These services serve different functions: message delivery, working-data storage or recovery. Information about particular recipients, their roles and processing grounds is provided on request under the applicable statutory procedure. Access to a copy must not be used for a new incompatible purpose.

Entrusting processing to another party requires the applicable lawful basis, including consent where Article 6(3) of Law No. 152-FZ requires it, and contractual instructions defining data, operations, purpose, confidentiality, security and incident duties. The operator retains its statutory responsibility to the data subject for entrusted processing.

Where a recipient acts as an independent operator, its role and the transfer basis must be assessed separately. A service’s terms do not replace the transfer basis required for ООО «МЕДОВИК АЛТАЯ». Information about particular recipients and parties entrusted with processing is available under Article 14 of Law No. 152-FZ.

8. Localisation and cross-border transfers

When collecting personal data of Russian citizens, the operator must comply with Article 18(5) of Law No. 152-FZ: the operations specified there must not use databases outside Russia except where a statutory exception applies.

Assessing a cross-border transfer requires a separate determination of recipients, countries, data and the transfer basis. This includes email copies, backup archives, external page resources and messaging. Encrypting an archive does not automatically anonymise its contents.

Before a cross-border transfer, the operator must meet Article 12 of Law No. 152-FZ: obtain the required recipient and security information, assess it and submit a separate notification to Roskomnadzor unless a statutory exception applies. Applicable waiting periods, restrictions or prohibitions and requirements to stop processing must be observed.

A person’s consent, a provider contract or a main website hosted in Russia does not by itself replace that procedure. This policy is not cross-border transfer consent and does not confirm that a notification has been filed for the operator.

9. Retention, restriction and destruction

Each purpose is subject to the end conditions in section 3. Data must not be retained indefinitely merely because it appeared in an enquiry or backup. A legal duty to retain part of a document does not authorise continued processing of all other data for the former purpose.

When a processing purpose is achieved or consent is withdrawn, the operator stops processing and destroys the data, or ensures those actions are taken, in accordance with the procedure and time limits established by Russian law. Where processing may continue on an independent lawful basis, only data necessary for that basis is retained. Advertising messages must stop immediately upon receipt of an opt-out request.

Deletion must cover relevant website records, email, exports, work systems and entrusted processing. Moving a record to trash does not by itself prove destruction.

Backups serve recovery, not restarting discontinued processing. Previously applied restrictions and deletions must be reapplied after recovery. Where destruction within the statutory time limit is impossible, the operator ensures restriction and subsequent destruction in accordance with the procedure and time limits in Article 21(6) of Law No. 152-FZ. An ordinary long backup rotation does not itself replace that procedure.

Evidence of consent, opt-out, request handling or protection of specific rights may be retained separately on an independent basis, in a minimal scope and for a justified period. It must not be used to continue advertising. Destruction must be documented where required by law.

10. Your rights and requests

You may obtain processing information and access your data, request correction, restriction or destruction where the law provides, withdraw consent, opt out of advertising and complain to Roskomnadzor or a court.

Send requests to info@medovik-altay.ru or the operator’s registered address. Explain the request and provide information sufficient to locate your data. Formal access requests are subject to Article 14 of Law No. 152-FZ; the operator may clarify an appropriate way to verify identity or authority. A full passport copy is not needed merely to opt out of advertising.

Processing information and access, or a reasoned refusal where permitted: within 10 working days of receipt; a reasoned extension of no more than 5 working days is possible.
Correction of information shown to be incomplete, inaccurate or outdated: within 7 working days of supporting information being provided.
Destruction of data confirmed to have been obtained unlawfully or to be unnecessary for the stated purpose: in accordance with the procedure and time limits in Article 20 of Law No. 152-FZ.
A request to stop processing: under Article 21(5.1) of Law No. 152-FZ, within 10 working days, subject to statutory exceptions and a possible reasoned extension of no more than 5 working days.
Advertising opt-out: advertising must stop immediately.

If the law permits retaining some information, the operator must explain the basis, data retained and applicable period. A refusal or lack of response may be challenged; contacting the operator does not limit your right to seek protection.

11. Safeguards and operator duties

The operator must organise safeguards proportionate to the information and risks: assign responsibilities and access rights, maintain confidentiality, protect systems and communications, monitor data operations, address incidents and check entrusted processing. Safeguards must cover working data, email, exports and backups.

Unlawful processing must be restricted, stopped and remedied under Article 21 of Law No. 152-FZ. Incidents affecting data subjects’ rights trigger the statutory duties to notify Roskomnadzor and investigate.

Roskomnadzor requests must be answered within 10 working days; a reasoned extension of no more than 5 working days is permitted. Processing and cross-border notifications are separate duties under Articles 22 and 12 of Law No. 152-FZ. Publishing this policy does not replace them.

12. Policy updates

The current policy is published on a separate website page. Changes take effect when the relevant version is published and do not retrospectively expand consent already given. Where a change of purpose, data or conditions requires new consent, it must be obtained separately.

The Russian and English versions must reflect the same rules. Questions about processing, particular recipients and applicable periods may be sent to info@medovik-altay.ru.

Menu