1. General provisions
1.1. This Policy is issued in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (the “Law”) and sets out how the operator named above (the “Operator”) processes personal data and the measures it takes to keep it secure.
1.2. The Policy applies to personal data the Operator receives from visitors of the website https://event-plus.ru (the “Website”), including through the request form.
1.3. The Policy does not govern the processing of event attendees' data in apps built on the EventPlus platform. Such data is processed on behalf of event organizers under the documents the organizer provides to attendees.
2. Terms
Terms are used as defined in Article 3 of the Law. The data subject is the individual to whom the personal data relates (the “User”).
3. Purposes, data, legal grounds and retention
| Purpose | Data | Legal ground | Retention |
|---|---|---|---|
| Reviewing a request and contacting the User to discuss the event and the terms of using the platform | name; phone number and/or email address; company name; event type, dates and size; preferred contact method; message text | the User's consent (Art. 6(1)(1) of the Law), given separately in the request form | until the purpose is achieved, but no longer than 3 years after the last change to the request, or until consent is withdrawn |
| Confirming that consent was given | IP address, browser details (user agent), date and time of submission, consent version, page and advertising tags (UTM) the request was sent from | the User's consent (Art. 6(1)(1)) | together with the request |
| Preparing and concluding a contract at the User's initiative | data from the request and correspondence | Art. 6(1)(5) of the Law | until the contract is concluded or declined; afterwards as required by law for contractual documents |
| Ensuring the Website works and is secure | IP address, date and time of the request, page address, browser details in server logs | the Operator's legitimate interest (Art. 6(1)(7)) | no longer than 30 days |
3.1. The Operator does not process special categories of personal data or biometric data.
3.2. The Operator does not verify the data provided and assumes the User provides their own data.
3.3. The Operator does not make decisions with legal effects for the User based solely on automated processing.
4. How data is processed
4.1. Processing includes collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, blocking, deletion and destruction, with and without automation.
4.2. Personal data of citizens of the Russian Federation is recorded, systematized, accumulated, stored, clarified and retrieved using databases located in the Russian Federation (Art. 18(5) of the Law): servers of the hosting provider Timeweb Cloud in Moscow (Russian Federation).
4.3. The Operator does not disclose personal data or provide it to third parties, except where required by Russian law.
4.4. No cross-border transfer of personal data takes place. The Operator receives notifications of new requests by email at a Russian mail service (Yandex Mail).
4.5. The Operator does not use request data for marketing mailings.
4.6. Once the purposes are achieved, the retention period expires, consent is withdrawn or unlawful processing is identified, the data is destroyed within the time limits set by Article 21 of the Law.
5. User rights
- to receive information about the processing of their personal data (Art. 14(7) of the Law);
- to demand that their data be clarified, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose;
- to withdraw consent;
- to appeal against the Operator's actions to Roskomnadzor (the Russian data protection authority) or in court.
6. Requests and withdrawal of consent
6.1. Requests and withdrawal of consent can be sent to a.bolobolkin@yandex.ru or by post to apt. 30, 9/1 Kuzmy Minina St., Novosibirsk, Novosibirsk Region, Russian Federation. Please include the name and contact details given in your request so the Operator can find the data.
6.2. The Operator responds within 10 business days of receipt; this may be extended by up to 5 business days with a reasoned notice (Art. 20 of the Law).
6.3. Upon withdrawal of consent, the Operator stops processing and destroys the data within 30 days of receiving the withdrawal, unless federal law provides otherwise (Art. 21(5)).
7. Security measures
The Operator takes the legal, organizational and technical measures required by Articles 18.1 and 19 of the Law, including: HTTPS-only data transfer; access to requests only for authorized persons with personal accounts; key-only server access; rate limiting and protection against automated submissions; regular backups stored in Russia; automatic deletion after the retention period; processing only the data needed for the stated purposes.
8. Cookies and technical data
See Cookies and technical data.
9. Final provisions
The Operator may amend this Policy. A new version takes effect when published on the Website. Matters not covered by this Policy are governed by the laws of the Russian Federation.