1. General Provisions
1.1. The Operator's Policy on the Processing of Personal Data (hereinafter, the Policy) has been developed to ensure the protection of the rights and freedoms of the personal data subject when processing their personal data, including protection of the right to privacy, personal and family secrecy.
1.2. Key terms used in the Policy:
- personal data — any information relating to a directly or indirectly identified or identifiable individual (personal data subject);
- processing of personal data — any action (operation) or set of actions (operations) performed on personal data, whether or not using automation tools, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion and destruction of personal data;
- personal data operator (Operator) – Sole Proprietor Tulkebaeva Angelina Flarisovna, INN: 024004020431, OGRNIP: 326745600150190;
- website – playnaruto.ru;
- email – [email protected].
1.3. The Operator, having obtained access to personal data, is obliged to maintain the confidentiality of personal data — not to disclose it to third parties and not to distribute it without the consent of the personal data subject, unless otherwise provided by federal law.
2. Purposes of Collecting Personal Data
2.1. The processing of personal data is limited to the achievement of specific, predetermined and legitimate purposes. Processing of personal data that is incompatible with the purposes of its collection is not permitted.
2.2. The purposes of the Operator's processing of personal data include:
- concluding an agreement with the personal data subject.
3. Legal Grounds for Processing Personal Data
3.1. The legal grounds for the processing of personal data are:
- consent to the processing of personal data;
- an agreement concluded with the personal data subject.
3.2. Consent to the processing of personal data is expressed by the subject by placing a “V” mark next to the field “I agree to the terms of the personal data processing policy” and “I give my consent to the processing of personal data”, or another field of similar content on the Operator's Website.
4. Categories and List of Personal Data Processed, Categories of Personal Data Subjects
4.1. The content and scope of the personal data processed correspond to the stated purposes of processing. The personal data processed must not be excessive in relation to the stated purposes of its processing.
4.2. Category of personal data processed: general.
4.3. List of personal data processed:
4.3.2. For the purpose of concluding an agreement with the personal data subject: email address, IP address.
4.4. The categories of personal data subjects include:
4.4.1. Website Users.
5. Rights and Obligations of the Parties
5.1. The Operator has the right to:
- Receive accurate information from the personal data subject;
- Continue processing personal data after consent has been withdrawn, where lawful grounds exist;
- Determine the list of measures needed to fulfill the obligations established by law.
5.2. The Operator is obliged to:
- Provide the User with information about their personal data;
- Respond to a User's request within 10 days of its receipt, unless otherwise provided by the legislation of the Russian Federation;
- Organize the processing of personal data in accordance with the legislation of the Russian Federation;
- Protect personal data from unlawful access and leaks;
- Ensure unrestricted access to this Policy.
5.3. The User has the right to:
- Receive information about their personal data;
- Request clarification, blocking or destruction of their personal data;
- Withdraw consent to the processing of personal data;
- Appeal the Operator's actions to authorized bodies.
5.4. The User is obliged to:
- Provide the Operator with accurate information about themselves.
6. Procedure and Conditions for Processing Personal Data
6.1. The Operator performs the following actions with personal data: collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer, depersonalization, blocking and deletion of personal data.
6.2. The processing of personal data is carried out by mixed means, without transfer over the Operator's internal network, but with transfer over the internet.
6.3. The Operator does not carry out cross-border transfer of data, in accordance with the rules on localization of personal data processing.
6.4. The processing of personal data by the Operator is limited to the achievement of specific, predetermined and legitimate purposes established by this Policy. Only personal data that meets the purposes of its processing and is specified in this Policy is subject to processing. The content and scope of the personal data processed must correspond to the stated purposes of processing.
6.5. The source of the personal data received is the Website.
6.6. The place of storage of personal data is the Operator's local computer.
6.7. The condition for termination of personal data processing is:
- termination of the Operator's activity (liquidation of the sole proprietorship), together with the Website;
- achievement of the purposes of processing;
- withdrawal of consent by the personal data subject;
- identification of unlawful processing of personal data.
6.8. The retention period for personal data is until consent to its processing is withdrawn by the subject.
6.9. Transfer of personal data to third parties is possible in the following cases:
- transfer of data to delivery services for the purpose of fulfilling an agreement between the Operator and the subject;
- to comply with the requirements of the legislation of the Russian Federation.
6.10. The Operator and other persons who have gained access to personal data are obliged not to disclose it to third parties and not to distribute it without the consent of the personal data subject.
6.11. The Operator takes the following measures to ensure the security of personal data:
- appointing, where the Operator is a legal entity (sole proprietor), a person responsible for organizing the processing of personal data;
- issuing, where the Operator is a legal entity, documents defining the Operator's policy on the processing of personal data;
- familiarizing employees of the Operator who directly process personal data with the provisions of the legislation of the Russian Federation on personal data, including requirements for the protection of personal data, documents defining the Operator's policy on the processing of personal data, local acts on personal data processing matters, and/or training such employees;
- establishing rules for access to personal data processed in the personal data information system, as well as ensuring the registration and recording of all actions performed with personal data in that system.
6.12. The Operator ensures the security of personal data by means of:
Web and access
- Encryption: TLS-based HTTPS.
- Authentication: password and mandatory two-factor authentication (2FA) by default.
- Access tokens: temporary “electronic passes”, issued after login/2FA, transmitted only over HTTPS, stored in secure cookies, used exclusively for authentication/authorization.
- Access control: role-based permissions on a least-privilege basis; logging of logins and key operations.
Data and storage
- Backup: for recovery purposes only, within the territory of the Russian Federation, with limited retention periods.