Personal Data Processing Policy

LLC "Visiology"
(Version 2.0 dated May 21, 2024)

1. General Provisions
This Personal Data Processing Policy of LLC "Visiology" (hereinafter referred to as the "Policy") has been prepared in accordance with Federal Law No. 152-FZ dated July 27, 2006, "On Personal Data" and defines the main principles, purposes, conditions, and procedures for processing personal data and measures to ensure their security, undertaken by LLC "Visiology" (hereinafter referred to as the "Operator").
1.1. The Operator considers the observance of human and civil rights and freedoms, including the protection of the right to privacy, personal and family secrecy, to be a primary goal and condition in processing personal data.
1.2. This Policy applies to all information the Operator may receive about visitors to the website https://visiology.com.
1.3. This Policy has been developed in accordance with the following regulatory documents:
  • Constitution of the Russian Federation;
  • Civil Code of the Russian Federation;
  • Labor Code of the Russian Federation;
  • Federal Law No. 152-FZ "On Personal Data";
  • Federal Law No. 149-FZ "On Information, Information Technologies and Information Protection";
  • Russian Government Resolution No. 687 dated September 15, 2008;
  • Russian Government Resolution No. 1119 dated November 1, 2012;
  • FSTEC Order No. 21 dated February 18, 2013;
  • Basic threat model for the security of personal data, approved February 15, 2008;
  • Internal regulatory documents of the Operator governing data processing and information security.

2. Key Terms Used in the Policy
2.1. Automated processing — processing using computing technology.
2.2. Blocking — temporary suspension of processing.
2.3. Website — the combination of graphic and informational content, software, and databases available at https://visiology.com.
2.4. Information system — databases and related IT systems for data processing.
2.5. Anonymization — actions that render it impossible to identify a data subject without additional information.
2.6. Processing — any action performed with or without automation tools, including collection, recording, systematization, accumulation, storage, clarification, extraction, use, transfer, anonymization, blocking, deletion, destruction.
2.7. Operator — LLC "Visiology" (OGRN: 1157746032400; INN: 7705352195).
2.8. Personal data — any information relating to an identified or identifiable individual.
2.9. Public personal data — data made publicly available by the subject with consent, per 152-FZ.
2.10. Provision — disclosure to a specific person or group.
2.11. Dissemination — disclosure to an indefinite group, including publication and network distribution.
2.12. Cross-border transfer — transfer to a foreign state, individual, or legal entity.
2.13. Destruction — irreversible deletion rendering data unrecoverable.

3. Rights and Obligations of the Operator
3.1. The Operator has the right to:
  • Receive accurate data from the subject;
  • Continue processing upon withdrawal of consent if legal grounds under 152-FZ exist;
  • Determine necessary measures to fulfill obligations under the law.
3.2. The Operator is obliged to:
  • Provide information to the data subject upon request;
  • Organize processing as per Russian law;
  • Respond to requests and appeals in accordance with 152-FZ;
  • Provide necessary information to the regulatory authority within 30 days upon request;
  • Publish this Policy and ensure public access to it;
  • Take legal, organizational, and technical measures to secure personal data;
  • Cease dissemination and delete data as required under 152-FZ;
  • Fulfill other obligations established by 152-FZ.

4. Rights and Obligations of Personal Data Subjects
4.1. Subjects have the right to:
  • Receive information on their data processing;
  • Request correction, blocking, or deletion of data that is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary;
  • Set conditions for marketing-related processing;
  • Withdraw consent;
  • Appeal wrongful actions or inactions to the authority or in court;
  • Exercise other rights under Russian law.
4.2. Subjects are obliged to:
  • Provide accurate data;
  • Inform the Operator of any updates.
4.3. Those who provide false or unauthorized third-party data bear responsibility under Russian law.

5. List of Processed Personal Data
5.1. The Operator may process the following personal data (hereinafter referred to as "Personal Data"):
  • Last name, first name, and patronymic.
  • Email address.
  • Telephone numbers.
  • Other personal data provided by the data subject.
5.2. The Website also collects and processes anonymized data about visitors (including cookies) through web analytics services (such as Yandex Metrica, Google Analytics, and others).
5.3. The Operator does not process special categories of personal data related to racial or ethnic origin, political opinions, religious or philosophical beliefs, or sexual life.
5.4. The processing of personal data permitted for dissemination from among the special categories specified in Part 1, Article 10 of Federal Law No. 152-FZ is allowed, provided that the prohibitions and conditions set out in Article 10.1 of Federal Law No. 152-FZ are observed.
5.5. Consent to the processing of personal data permitted for dissemination is given separately from other consents to the processing of personal data. In doing so, the conditions specified in Article 10.1 of Federal Law No. 152-FZ must be met. The requirements for the content of such consent are established by the authorized body for the protection of the rights of personal data subjects.
5.5.1. Consent to the processing of personal data permitted for dissemination is provided directly to the Operator.
5.5.2. The Operator must, within three (3) business days from the receipt of such consent from the data subject, publish information about the conditions of processing, and about any prohibitions or conditions on processing by an unlimited number of persons, of the personal data permitted for dissemination.
5.5.3. The transfer (dissemination, provision, access) of personal data permitted for dissemination by the data subject must be terminated at any time upon the data subject’s request. Such a request must include the last name, first name, patronymic (if any), contact information (phone number, email address, or mailing address) of the data subject, as well as a list of personal data whose processing is to be terminated. The personal data specified in such a request may only be processed by the Operator to whom the request was addressed.
5.5.4. Consent to the processing of personal data permitted for dissemination shall be deemed revoked upon receipt by the Operator of the request specified in Clause 5.5.3 of this Personal Data Processing Policy.

6. Principles of Personal Data Processing
6.1. Personal data processing shall be carried out on a lawful and fair basis.
6.2. The processing of personal data shall be limited to the achievement of specific, predetermined, and lawful purposes. Processing of personal data incompatible with the purposes of data collection is not permitted.
6.3. The merging of databases containing personal data processed for incompatible purposes is not allowed.
6.4. Only personal data that is relevant to the purposes of processing shall be subject to processing.
6.5. The content and scope of processed personal data must correspond to the declared purposes of processing. The processing of excessive personal data in relation to the stated purposes is not permitted.
6.6. Accuracy, sufficiency, and, where necessary, relevance of personal data to the purposes of processing must be ensured. The Operator shall take necessary measures and/or ensure that such measures are taken to delete or clarify incomplete or inaccurate data.
6.7. Personal data must be stored in a form that allows the identification of the data subject no longer than necessary to fulfill the purposes of processing, unless a longer storage period is required by federal law or a contract to which the data subject is a party, beneficiary, or guarantor. Processed personal data shall be destroyed or anonymized upon achievement of the processing purposes or if the need to achieve those purposes is lost, unless otherwise required by federal law.

7. Purposes of Personal Data Processing
7.1. The purposes of processing the User's personal data are:
  • Promotion of the Operator's and/or third parties' goods, works, and services on the market through direct communication with potential clients and consumers via electronic communication networks, including postal services, telephone, and mobile communication;
  • Ensuring the proper fulfillment of obligations under contracts and agreements entered into by the Operator;
  • Fulfillment of other requirements stipulated by the legislation of the Russian Federation, the Operator's Charter, and organizational-administrative documents;
  • Conclusion, execution, and termination of civil law contracts;
  • Providing access to services, information, and/or materials available on the Website.
7.2. The Operator also has the right to send the personal data subject notifications (including advertising messages) about new products and services, special offers, and various events. The data subject may always opt out of receiving such informational messages by sending an email to the Operator at info@visiology.com with the subject "Unsubscribe from notifications about new products, services, and special offers".
7.3. Anonymized data of personal data subjects collected through web analytics services is used to gather information about the actions of data subjects on the Website.

8. Conditions for Processing Personal Data
8.1. Personal data is processed with the consent of the data subject.
8.2. Processing of personal data is necessary to achieve the purposes established by an international treaty of the Russian Federation or by law, or to exercise the powers and duties imposed on the Operator by Russian legislation.
8.3. Processing of personal data is necessary for the administration of justice, the execution of a court order or another enforceable act.
8.4. Processing of personal data is necessary for the performance of a contract to which the personal data subject is a party or a beneficiary/guarantor, or for the conclusion of such a contract at the request of the data subject.
8.5. Processing of personal data is necessary for the realization of the legitimate interests of the Operator or third parties or to achieve socially significant goals, provided that it does not violate the rights and freedoms of the personal data subject.
8.6. Processing of publicly available personal data provided by the subject or at their request is carried out.
8.7. Processing of personal data subject to publication or mandatory disclosure under federal law is carried out.

9. Procedure for Collection, Storage, Transmission, and Other Types of Personal Data Processing
9.1. The Operator ensures the security of personal data and takes all reasonable measures to prevent unauthorized access.
9.2. Personal data will never be transferred to third parties, except in cases provided by law or with the subject’s consent for the performance of a civil law contract.
9.3. If inaccuracies are found in personal data, the data subject may update them by sending a notification to the Operator at info@visiology.com with the subject "Update of personal data".
9.4. The processing period is defined by the purpose for which the data was collected unless otherwise provided by contract or applicable law. The User may withdraw consent at any time by sending a notice to info@visiology.com with the subject "Withdrawal of consent to personal data processing".
9.5. All information collected by third-party services (e.g., payment systems, communication services) is stored and processed by them according to their own User Agreements and Privacy Policies. The data subject must review these documents independently. The Operator is not responsible for third-party actions.
9.6. Restrictions imposed by the subject on dissemination or conditions of processing do not apply when personal data is processed for public, governmental, or other public interest purposes as defined by law.
9.7. The Operator ensures the confidentiality of personal data during processing.
9.8. Personal data is stored in a form that allows the identification of the data subject no longer than necessary unless otherwise established by federal law or contract.
9.9. Grounds for termination of processing may include achievement of the processing purpose, expiration or withdrawal of consent, or identification of unlawful processing.

10. List of Actions Performed by the Operator with Collected Personal Data
10.1. The Operator carries out collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), anonymization, blocking, deletion, and destruction of personal data.
10.2. The Operator performs automated processing of personal data with or without transmission over telecommunications networks.

11. Cross-Border Transfer of Personal Data
11.1. Before initiating the cross-border transfer of personal data, the Operator must ensure that the foreign country provides adequate protection of personal data subjects' rights.
11.2. Cross-border transfer to countries not providing such protection may occur only with the subject’s written consent or if required for the performance of a contract to which the subject is a party.

12. Confidentiality of Personal Data
12.1. Information classified as personal data that becomes known to the Operator is confidential and protected by law.
12.2. Employees and other persons who have access to personal data have signed a confidentiality agreement and have been informed of the legal consequences of violating confidentiality and personal data laws.

13. Final Provisions
13.1. The User may request clarification on any issues related to personal data processing by contacting the Operator via email.
13.2. This Policy applies to any operation or set of operations performed on personal data, with or without the use of automation tools, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), anonymization, blocking, deletion, destruction.
13.3. Other rights and obligations of the Operator as a personal data controller are determined by Russian law.
13.4. The Operator is obliged to publish or otherwise ensure unrestricted access to this Policy in accordance with Part 2, Article 18.1 of Federal Law No. 152-FZ. The electronic version of the Policy is available at: https://visiology.com/privacy.
13.5. The Operator has the right to amend this Policy. The new version comes into effect upon approval and publication on the Operator's website unless otherwise specified.

14. Operator Details:
LLC "Visiology"
OGRN: 1157746032400
INN: 7705352195, KPP: 772701001
Address: 117218, Moscow, Krzhizhanovskogo St., 29, Bldg. 2, Mezzanine 3, Room X, Offices 11–17