Personal Data Protection Policy

GENERAL PROVISIONS
1. This Personal Data Protection Policy (hereinafter referred to as the Policy) has been developed by LLC «Fortuna» (hereinafter referred to as the Company) in accordance with Federal Law No. 152-FZ dated July 27, 2006 «On Personal Data» and other regulatory legal acts of the Russian Federation, with the purpose of ensuring the protection of the rights and freedoms of individuals when processing their personal data by the Company.
2. The Policy determines the purposes, procedure and conditions of processing, distribution, provision, destruction of personal data, categories of data subjects, a list of processed personal data, measures aimed at ensuring the protection of personal data.
3. Unlimited access to the Policy is ensured by its publication on the Company’s website on the Internet: https://fortuna.top/ (hereinafter referred to as the Website).
4. The Policy is subject to review and update in case of changes to the current legislation of the Russian Federation on personal data, as well as in other cases at the discretion of the Company.
TERMS AND DEFINITIONS
1. Personal Data — any information relating to a directly or indirectly identified or identifiable natural person (data subject).
2. Operator — a government agency, municipal agency, legal entity or individual that independently or jointly with other persons organizes and (or) carries out the processing of personal data, and also determines the purposes of processing personal data, the composition of personal data to be processed, actions (operations) performed with personal data.
3. Processing of Personal Data — any action (operation) or set of actions (operations) performed using automated means or without such means with personal data, including collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transmission (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.
4. Distribution of Personal Data — actions aimed at disclosing personal data to an indefinite circle of persons.
5. Provision of Personal Data — actions aimed at disclosing personal data to a specific person or specific circle of persons.
6. Destruction of Personal Data — actions as a result of which it becomes impossible to recover the content of personal data in a personal data information system and (or) as a result of which material carriers of personal data are destroyed.
7. Depersonalization of Personal Data — actions as a result of which it becomes impossible without using additional information to determine the belonging of personal data to a specific data subject.
8. Personal Data Information System — a set of personal data contained in databases and information technologies and technical means that ensure their processing.

PURPOSES OF PROCESSING PERSONAL DATA, CATEGORIES OF DATA SUBJECTS, LIST OF PERSONAL DATA

The Company carries out the processing of personal data exclusively for the achievement of specific, predetermined and lawful purposes for which they were provided by the data subject (hereinafter referred to as the Subject).

Depending on the category of the Subject and the purpose of processing personal data, the composition of personal data may include:

Category of Subject	Purpose of Personal Data Processing	List of Processed Personal Data
Employees of the Company and applicants for vacant positions.	Ensuring compliance with the labor legislation of the Russian Federation, including personnel management, recruitment and selection of candidates for employment, formalization of employment relations, maintaining personnel, accounting and military records and reporting.	Contained in the Provision «On Personal Data of Employees of LLC ’Mistral Trading’». You can familiarize yourself with this provision in the office of LLC ’Mistral Trading’ at: 121170, Russia, Moscow, Dorogomilovo Municipal District, Poklonnaya Street, Building 3, Floor 5, Room 28.
Counterparties, potential counterparties, including heads, employees, representatives of counterparties.	Carrying out activities in accordance with the Charter of the Company, in particular: exercising due diligence in the selection of counterparties; conclusion and performance of contracts with counterparties	Details of the document confirming identity; TIN (Tax Identification Number); SNILS (Pension Insurance Number).
Natural persons participating in advertising and marketing activities of the Company.	Carrying out activities in accordance with the Charter of the Company, in particular: promotion of goods produced by the Company through conducting advertising and marketing campaigns	Last name, first name, patronymic; email address; contact phone number.
Consumers of products manufactured and/or sold by the Company	Carrying out activities in accordance with the Charter of the Company, in particular: control over the quality of produced goods by providing the data subject with the opportunity to contact the Company through a feedback form on the Website.	Last name, first name, patronymic; email address; contact phone number.
Website users.	Carrying out activities in accordance with the Charter of the Company, in particular: analyzing Website traffic and user behavior in order to improve its functionality and content	Cookie files.

The Company may carry out the processing of personal data of other categories of Subjects for other purposes not specified in this Policy, provided that the requirements provided for in this Policy regarding the processing of personal data and the legislation of the Russian Federation are met.
Processing of personal data incompatible with the purposes of collection of personal data is not permitted.
Processed personal data should not be excessive in relation to the stated purposes of their processing.

CONDITIONS FOR PROCESSING PERSONAL DATA
1. The Company carries out the processing of personal data in the following ways:
  - non-automated processing of personal data;
  - automated processing of personal data with the transmission of the received information over information and telecommunication networks or without such transmission;
  - mixed processing of personal data.
2. Processing of personal data is carried out with the written consent of the Subject to the processing of personal data, as well as without such consent in cases provided for by the legislation of the Russian Federation.
3. Consent to the processing of personal data may be obtained by placing a «checkmark» («V») by the Subject next to the electronic document «Consent to the Processing of Personal Data» on the Website. This form is equivalent to a written form if it does not contradict the current legislation.
4. Storage of personal data is carried out in a form that allows for the identification of the Subject, for no longer than required by the purposes of processing personal data, unless the period of storage of personal data is established by the current legislation of the Russian Federation, consent of the Subject, a contract, a party or beneficiary to which is the Subject.
5. The Company stops processing personal data upon achievement of the purposes of processing personal data, expiration of the validity period of consent or revocation of the Subject’s consent to the processing of his personal data, as well as upon identification of unlawful processing of personal data.
CONDITIONS FOR PROVISION AND DISTRIBUTION OF PERSONAL DATA
1. Provision and distribution of personal data to third parties is carried out with the written consent of the Subject, unless otherwise provided for by the legislation of the Russian Federation. Consent to the provision of personal data to a third party, as well as consent to the processing of personal data permitted by the data subject for distribution, is issued separately from other consents of the Subject.
2. Processing of personal data provided to a third party, as well as permitted by the Subject for distribution, must be stopped at any time upon his request, except in cases where the processing of personal data is carried out for the purpose of performing functions, powers and obligations imposed by the legislation of the Russian Federation on state agencies, municipal agencies, as well as organizations subordinate to such agencies.
3. Cross-border transfer of personal data by the Company is not carried out.
CLARIFICATION, BLOCKING, DESTRUCTION OF PERSONAL DATA
1. In case of identification of inaccurate personal data upon the appeal of the Subject or at the request of the authorized body for the protection of the rights of data subjects, the Company blocks the personal data relating to this Subject from the moment of such appeal or receipt of such a request for the period of verification, if blocking of personal data does not violate the rights and legitimate interests of the data subject or third parties.
2. In case of confirmation of the fact of inaccuracy of personal data, the Company on the basis of information provided by the Subject or the authorized body for the protection of the rights of data subjects, or other necessary documents clarifies the personal data within 7 (seven) business days from the date of submission of such information and removes the blocking of personal data.
3. Destruction of personal data is carried out in the following cases and timeframes:
  - achievement of the purposes of processing personal data — within 30 (thirty) calendar days from the date of achievement of the purpose of processing personal data, unless otherwise provided for by a contract, a party, beneficiary or guarantor to which is the Subject, or other agreement between the Company and the Subject;
  - revocation by the data subject of consent to the processing of his personal data, if retention of personal data is no longer required for the purposes of processing personal data — within 30 (thirty) calendar days from the date of receipt of the revocation;
  - provision by the data subject or his legal representative of confirmation that the personal data was unlawfully obtained or is not necessary for the stated purposes of processing — within 7 (seven) business days from the date of submission by the Subject of the corresponding information;
  - inability to ensure lawfulness of personal data processing — within 10 (ten) business days from the date of identification of unlawful processing of personal data;
  - in other cases provided for by legislation, a contract, a party, beneficiary or guarantor to which is the Subject, or other agreement between the Company and the Subject.
4. The fact of destruction of personal data is confirmed by an act on the destruction of personal data.
MEASURES AIMED AT ENSURING THE PERFORMANCE OF OBLIGATIONS ON PROCESSING AND PROTECTION OF PERSONAL DATA
1. The Company takes the necessary legal, organizational and technical measures to protect personal data from unlawful or accidental access to them, destruction, modification, blocking, distribution and other unauthorized actions, including:
  - adopts local regulatory acts and other documents regulating relations in the field of processing and protection of personal data;
  - appoints persons responsible for the organization of personal data processing, responsible for the processing of personal data of individual categories of Subjects, responsible for ensuring the security of personal data in the structural subdivisions and information systems of the Operator;
  - creates the necessary conditions for working with personal data;
  - organizes work with information systems in which personal data is processed;
  - stores personal data under conditions that ensure their safety and exclude unlawful access to them;
  - identifies threats to the security of personal data during their processing;
  - creates restrictions or prohibits access to personal data of Subjects.
RIGHTS OF THE SUBJECT
1. The Subject has the right to:
  - revoke consent to the processing of personal data, or to the provision of personal data to a third party, or to the processing of personal data permitted by the data subject for distribution;
  - send to the Company other requests and requirements provided for by Federal Law No. 152-FZ dated July 27, 2006 «On Personal Data».
2. In case of revocation by the Subject of consent to the processing of personal data, the Operator has the right to continue processing personal data without the consent of the Subject if there are grounds provided for by Federal Law No. 152-FZ dated July 27, 2006 «On Personal Data».
3. The rights of the Subject specified in this section of the Policy may be exercised by sending a written application to the Company in the following ways:
  - By email: info@tkmistral.ru.
  - By the legal address of the Company by registered letter with notification, valuable letter, or in person: 121170, Russia, Moscow, Dorogomilovo Municipal District, Poklonnaya Street, Building 3, Floor 5, Room 28.
USE OF COOKIES
1. Upon the first visit to the Website using a new browser, or in case of viewing the Website in «Incognito» mode, a pop-up banner opens, informing the Subject about the collection of cookies, and an «I Understand» button that allows you to hide the banner.
2. By continuing to use the Website, the Subject provides his consent to the processing of his cookies, and also confirms agreement with the provisions of the Policy regarding the processing of cookies.
3. The Subject has the right to prohibit the collection of cookies in the settings of his browser, in which case some pages of the Website may not work.
4. The Company uses cookies for the purpose of creating objective statistics using specialized tools («Google Analytics», «Yandex.Metrica»), which allow assessing the functionality of the Website and evaluating parameters reflecting its traffic.
5. Third-party organizations do not have access to the cookies of the Company’s Website. Third-party organizations place their own cookies and have their own cookie usage policies.
6. The Company does not use cookies to establish the identity of the Subject, as well as for the purpose of conducting mailings or other promotional activities using web technologies.