Consent to the Processing of Personal Data
CONSENT TO THE PROCESSING OF PERSONAL DATA
I, a user of the website https://tsuyuperfumes.art and its subdomains (hereinafter referred to as the “Website”), acting of my own free will, in my own interest, and confirming my legal capacity, in accordance with Federal Law No. 152-FZ of July 27, 2006, “On Personal Data,” hereby grant my consent to Individual Entrepreneur Ksenia Stanislavovna Yao, TIN 519017997774, OGRNIP No. 324237500380660 (hereinafter referred to as the “Operator”), consent to the processing of my personal data under the terms set forth in this document.
I confirm that the personal data I have provided is accurate, belongs to me, or that I have a lawful basis for providing it to the Operator.
This consent is specific, subject-specific, informed, voluntary, and unambiguous.
The processing of personal data for the purpose of sending advertising and promotional messages is not authorized under this Consent and requires separate consent. Opting out of the advertising mailing list does not prevent the placement or fulfillment of an order.
1. List of Personal Data
Depending on my activities on the Site and the information I provide, the Operator has the right to process the following personal data:
last name, first name, and middle name—if available and provided;
phone number;
email address;
shipping address;
information about the recipient of the order, if the recipient is a different person;
information about the order’s contents, cost, order number, and status;
the selected payment method and payment status information;
the selected shipping method;
information contained in communications, complaints, requests, and correspondence with the Operator;
bank account information required for a refund if the refund cannot be processed using the original payment method;
Technical information automatically transmitted when using the Site, including IP address, browser and device information, cookies, and information about your activities on the Site, to the extent provided for in the Personal Data Processing Policy.
The operator does not receive or store the Buyer’s full bank card details if the payment is processed by a bank or a payment service. The user provides this information directly to the relevant payment service.
2. Purposes of Personal Data Processing
Goal #1: Order Processing and Fulfillment
Personal data is processed for the following purposes:
identification of the Buyer;
order acceptance and confirmation;
the conclusion and performance of a retail sales contract;
clarification of the order details and terms;
to notify the Buyer of the order status;
delivery of the Goods to the Buyer or to a recipient designated by the Buyer.
For this purpose, the following may be processed:
last name, first name, and middle name;
phone number;
email address;
order details;
recipient information;
Shipping address and method.
Categories of entities:
Website users, customers, and recipients of orders.
Processing and retention period:
Until the obligations under the agreement have been fully fulfilled, and after their fulfillment—for the period necessary to comply with the requirements of the legislation of the Russian Federation and to protect the Operator’s legitimate interests.
Objective No. 2: Processing Payments and Complying with Legal Requirements Regarding Payments
Personal data is processed for the following purposes:
processing the payment for the order;
proof of payment;
generating and sending a cash register receipt;
refund;
compliance with the requirements of the laws governing accounting and tax reporting and the use of cash registers.
For this purpose, the following may be processed:
last name and first name;
phone number;
email address;
order number, total amount, and order details;
payment method and status;
bank account information required for a refund.
Categories of entities:
Buyers and payers.
Processing and retention period:
Throughout the term of the contract and the subsequent document retention period established by the laws of the Russian Federation.
Goal #3: Arranging Order Delivery
Personal data is processed for the following purposes:
handing the order over to the delivery service;
determining the address and delivery method;
communication with the Buyer or recipient;
updates on the order’s status;
delivery of the order to the pickup location;
Returning an unclaimed order to the Operator.
For this purpose, the following may be processed:
the Buyer’s or recipient’s last name, first name, and patronymic;
phone number;
email address—if necessary;
shipping address;
order number and details regarding the order contents, to the extent necessary for delivery;
the selected shipping method.
Categories of entities:
Buyers and payers.
Processing and retention period:
Until the delivery is completed, the order is returned, and all delivery-related obligations are fully fulfilled; and thereafter, for the period provided for by the laws of the Russian Federation.
To achieve this purpose, the necessary personal data may be provided to the selected delivery service, courier company, or the owner of the order pickup location.
Objective No. 4: Handling Inquiries, Complaints, Returns, and Customer Support
Personal data is processed for the following purposes:
responses to the Buyer’s inquiries;
claims processing;
verifying order information;
exchange or return of the Product;
refund;
dispute resolution;
to protect the rights and legitimate interests of the Buyer and the Operator.
For this purpose, the following may be processed:
last name, first name, and middle name;
phone number;
email address;
information about the order, payment, and delivery;
information contained in the letter and correspondence;
photographs or other materials provided by the Buyer;
bank account information required for a refund.
Categories of entities:
Website users, customers, payers, and recipients of orders.
Processing and retention period:
Until the review of the request is completed, the demands are fulfilled, and the dispute is resolved; and thereafter, for the duration of the document retention periods and statutes of limitations established by law.
Objective No. 5: Ensuring the Operation and Security of the Website
Personal data is processed for the following purposes:
- to ensure the proper functioning of the Website;
- saving the user’s selected settings;
- ensuring the security of the Site;
- preventing fraudulent activities;
- identifying technical errors;
- to analyze and improve the Site’s performance.
For this purpose, the following may be processed:
- IP address;
- Information about the browser, operating system, and device;
- date and time of the visit;
- information about the user’s activities on the Site;
- technical journals;
- cookies and other similar identifiers.
Categories of entities:
Users and visitors to the Site.
Processing and retention period:
For the period necessary to achieve the specified purposes, taking into account the timeframes set forth in the Personal Data Processing Policy and the settings for the cookies used.
The terms of use for cookies and web analytics services are governed by the Personal Data Processing Policy and the Cookie Notice posted on the Website.
3. Processing of Personal Data
I hereby grant the Operator consent to perform the following actions with my personal data:
collection;
entry;
systematization;
accumulation;
storage;
clarification, updating, and modification;
excerpt;
use;
disclosure in the form of provision or access to persons who process data on behalf of the Operator;
blocking;
deletion;
destruction.
The operator may not disclose my personal data or grant access to it to an unspecified group of individuals without my separate consent or another legal basis.
4. Processing Methods
Personal data may be processed:
using automation tools;
without the use of automation tools;
using a mixed method;
via the Operator’s internal network;
via the Internet, in compliance with the laws of the Russian Federation.
The initial recording, organization, collection, storage, updating, and retrieval of personal data of citizens of the Russian Federation are carried out using databases located within the territory of the Russian Federation.
5. Data Processing by Third Parties
The data controller may entrust the processing of personal data to third parties engaged to support the operation of the online store and fulfill orders, including:
a hosting and technical infrastructure provider;
the Site’s developer and technical administrator;
CRM system provider;
bank and payment service;
fiscal data operator;
a delivery service, a courier company, and a pickup location;
an email and push notification service provider;
an organization that provides accounting, legal, or technical support to the Operator.
Such individuals are provided only with the amount of personal data necessary to perform the relevant function. Processing is carried out on the basis of a contract with the Controller and subject to compliance with confidentiality and personal data security requirements.
Up-to-date information about the parties that process personal data on behalf of the Operator and the information systems used is provided in the Personal Data Processing Policy.
6. Term of the Consent
This consent is effective from the time it is provided until the first of the following events occurs:
achieving the purposes of processing personal data;
withdrawal of consent;
the Operator’s cessation of operations;
the expiration of the retention periods for the relevant documents and data as prescribed by law.
Withdrawal of consent does not affect the lawfulness of the processing of personal data carried out prior to its receipt.
After consent is withdrawn, the Operator has the right to continue processing personal data without consent if there are grounds provided for by the legislation of the Russian Federation, including if the processing is necessary to fulfill a concluded contract, to fulfill the Operator’s obligations established by law, or to exercise and protect the Operator’s rights and legitimate interests.
7. Procedure for Granting Consent
This consent is provided by checking the box—which is not pre-checked—next to the text: “I consent to the processing of my personal data.”
The text next to the checkbox must include a link to this consent form. Checking the box constitutes an action that unequivocally confirms that the user has read this document and agrees to the terms set forth herein.
The date of consent is the date the checkbox is selected on the Website. The Operator has the right to retain information confirming the granting of consent, including the date, time, method of consent, user ID, contact information used, and the version of the consent form.
This consent is provided separately from the Personal Data Processing Policy, the Public Offer, the consent to receive promotional messages, and other documents confirmed by the user.
8. Withdrawal of Consent and the Rights of the Data Subject
I have the right to:
to receive information about the processing of my personal data;
request the correction, blocking, or deletion of incomplete, outdated, inaccurate, or unlawfully processed data;
revoke this consent;
request that the processing of personal data be discontinued;
to appeal the Operator’s actions or inaction to Roskomnadzor or through the courts.
To withdraw consent or submit a request, you must send a statement to the Operator’s email address: tsuyuperfumes@gmail.com. The statement must include information that allows the Operator to identify the requester and determine which personal data processing should be discontinued.
The data controller shall cease processing personal data at the request of the data subject within a period not exceeding 10 (ten) business days from the date of receipt of the request, except in cases where processing may continue on a lawful basis. This period may be extended by no more than 5 (five) business days, provided that a reasoned notice is sent to the data subject.
If, following the withdrawal of consent, there are no other legal grounds for storing personal data, the Operator shall destroy such data or ensure its destruction within a period not exceeding 30 (thirty) days from the date of receipt of the withdrawal notice.
The destruction of personal data is confirmed in accordance with the procedures established by the laws of the Russian Federation.
I confirm that I have read this Agreement, that I understand its contents, and that the consent I am providing is freely given, specific, clear, informed, deliberate, and unambiguous.
Contact Information for the Personal Data Controller
Operator: Sole Proprietor Ksenia Stanislavovna Yao
INN: 519017997774
OGRNIP: 324237500380660
Сайт: https://tsuyuperfumes.art
Email: tsuyuperfumes@gmail.com