FLAT.AUDIO — Personal data processing policy

Personal Data Processing Policy

This document is effective only together with the User Agreement and the Website Terms of Use.

General Provisions
1. This Personal Data Processing Policy (hereinafter referred to as the Policy) is an official document of Ploskosti Zvuka LLC (OGRN 1207700383230, INN 9705148820) (hereinafter referred to as the Operator), and sets out the collection and processing of personal data, and the safeguarding of information security regarding Users, in connection with the use of the Website and its Services, located at: https://flat.audio (hereinafter referred to as the Website), or in connection with interacting with us. Any person may review the Policy on the website at: https://flat.audio/privacy.
2. The Policy is an integral part of the Public Offer posted on the website on the Internet at: https://flat.audio/agreement.
3. This Policy has been developed in furtherance of the requirements of Federal Law No. 152-FZ dated 27.07.2006 "On Personal Data" (hereinafter referred to as the Personal Data Law), for the purpose of ensuring the protection of the rights and freedoms of individuals and citizens in the processing of their personal data, including protection of the rights to privacy, and to personal and family secrets.
4. The Policy applies to all personal data processed by the Operator.
5. The Policy applies to relations in the field of personal data processing that have arisen for the Company both before and after the approval of this Policy.
6. Use of the Website's services means the User's unconditional agreement with this Policy and the terms of processing of the User's Personal Data set out therein; if the User does not agree with such terms, the User must refrain from using the Website.
7. Relations connected with the processing of personal data of Website users are governed by this Policy, other official documents of the Operator, and the applicable legislation of the Russian Federation. Personal data is processed on the basis of the following principles:
  - the lawfulness of the purposes and methods of personal data processing;
  - good faith;
  - compliance of the purposes of personal data processing with the purposes determined and declared in advance at the time of collection of the personal data;
  - compliance of the scope and nature of the personal data being processed, and of the methods of personal data processing, with the purposes of personal data processing. The personal data being processed is not excessive in relation to the declared purposes of its processing.
Key Terms
1. "User" – a legally capable individual using the Website and its Services (including representatives of legal entities/individual entrepreneurs using or intending to use the Website, including on the basis of a relevant agreement concluded with the Operator).
2. "Personal Data" – any information relating directly or indirectly to an identified or identifiable individual (a personal data subject) that may be used to identify a particular person.
3. "Personal Data Operator" – Ploskosti Zvuka LLC.
4. "Processing of Personal Data" – any action (operation) or set of actions (operations) performed with personal data, whether or not using automation tools. The processing of personal data includes, among other things:
  - collection
  - recording
  - systematization
  - accumulation
  - storage
  - clarification (updating, modification)
  - retrieval
  - use
  - transfer (disclosure, access)
  - blocking
  - erasure
  - destruction
5. "Automated Processing of Personal Data" – the processing of personal data by means of computer technology.
6. "Disclosure of Personal Data" – actions aimed at revealing personal data to a specific person or to a specific group of persons.
7. "Blocking of Personal Data" – the temporary suspension of personal data processing (except where processing is necessary to clarify personal data).
8. "Destruction of Personal Data" – actions as a result of which it becomes impossible to restore the content of personal data in a personal data information system and/or as a result of which the physical media containing personal data are destroyed.
9. "Personal Data Information System" – a set of personal data contained in databases, together with the information technologies and technical means ensuring their processing.
Other terms shall be construed in accordance with the provisions of the Personal Data Law.

Composition of the Personal Data Processed and the Purposes of Processing

The purpose of processing personal data is to fulfil the Operator's obligations to Users in connection with the use of the Website and its services. The processing of Users' personal data is carried out with the consent of the personal data subject to the processing of their personal data. The need to process personal data is due to the performance of a duty imposed on the Operator by the legislation of the Russian Federation.
A User's personal data may be requested at any time, including when the User contacts the Operator. The Operator may use such data in accordance with this Policy. It may also combine such information with other information for the purpose of providing and improving its products, services, content, and communications.
The Operator does not process special categories of personal data or biometric personal data under this Policy.

The Operator processes the following categories and list of Personal Data, in respect of the following categories of subjects, in the following ways, for each of the following purposes:

Purposes of Processing	Categories and List	Categories of Subjects	Methods of Processing
Handling requests received from individuals/clients	Other categories of personal data (not special or biometric): surname, first name, patronymic, date of birth, contact phone numbers, email addresses, bank card/bank account details, identity document details (including identifying information from such documents), residential address, social media account details, avatar.	User	Automated method using automation tools; without transfer over the legal entity's internal network; with transfer over the Internet; list of actions (operations): collection, recording, systematization, accumulation, storage, use, clarification (updating, modification), retrieval, transfer (disclosure, access), blocking, erasure, destruction
Organizing promotional mailings	Other categories of personal data (not special or biometric): surname, first name, patronymic, contact phone numbers, email addresses	User	Mixed method Automated method using automation tools; without transfer over the legal entity's internal network; with transfer over the Internet; list of actions (operations): collection, recording, systematization, accumulation, storage, use, clarification (updating, modification), retrieval, transfer (disclosure, access), blocking, erasure, destruction.
Handling ticket refunds by purchasers	Other categories of personal data (not special or biometric): surname, first name, patronymic, date of birth, contact phone numbers, email addresses, bank card/bank account details, INN, identity document details (including identifying information from such documents)	User	Automated method using automation tools; without transfer over the legal entity's internal network; with transfer over the Internet; list of actions (operations): collection, recording, systematization, accumulation, storage, use, clarification (updating, modification), retrieval, transfer (disclosure, access), blocking, erasure, destruction
Forwarding tickets to another mailbox	Other categories of personal data (not special or biometric): surname, first name, patronymic, contact phone numbers, email addresses	User	Mixed method Automated method using automation tools; without transfer over the legal entity's internal network; with transfer over the Internet; list of actions (operations): collection, recording, systematization, accumulation, storage, use, clarification (updating, modification), retrieval, transfer (disclosure, access), blocking, erasure, destruction.
Ensuring the Operator's compliance with the laws of the Russian Federation and other regulatory legal acts	Other categories of personal data (not special or biometric): surname, first name, patronymic, date of birth, contact phone numbers, email addresses, bank card/bank account details, place of work and position held, INN, identity document details (including identifying information from such documents), residential address, social media account details, avatar, income information (where applicable).	User	Mixed method Automated method using automation tools; without transfer over the legal entity's internal network; with transfer over the Internet; list of actions (operations): collection, recording, systematization, accumulation, storage, use, clarification (updating, modification), retrieval, transfer (disclosure, access), blocking, erasure, destruction.
Collection, processing, and provision of statistical data, including identifying security threats to the Website, Users, and/or third parties	Other categories of personal data (not special or biometric): surname, first name, patronymic, date of birth, contact phone numbers, email addresses, bank card/bank account details, place of work and position held, INN, identity document details (including identifying information from such documents), residential address, social media account details, avatar, income information (where applicable).	User	Automated method using automation tools; without transfer over the legal entity's internal network; with transfer over the Internet; list of actions (operations): collection, recording, systematization, accumulation, storage, use, clarification (updating, modification), retrieval, transfer (disclosure, access), blocking, erasure, destruction
Maintaining personnel and accounting records	Other categories of personal data (not special or biometric): surname, first name, patronymic, date of birth, contact phone numbers, email addresses, bank card/bank account details, place of work and position held, INN, identity document details (including identifying information from such documents), residential address, social media account details, avatar, income information (where applicable).	User	Mixed method using automation tools and/or without the use of such tools. List of actions (operations): collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, transfer (disclosure, access), blocking, erasure, destruction.
Preparing, concluding, and performing a civil-law contract, including in connection with the use of the Website, and providing access to the Website, its content, functionality, and account/personal account	Other categories of personal data (not special or biometric): surname, first name, patronymic, date of birth, citizenship, contact phone numbers, email addresses, bank card/bank account details, INN, identity document details (including identifying information from such documents), residential address, registration address, social media account details, avatar, income information (where applicable).	User	Automated method using automation tools; without transfer over the legal entity's internal network; with transfer over the Internet; list of actions (operations): collection, recording, systematization, accumulation, storage, use, clarification (updating, modification), retrieval, transfer (disclosure, access), blocking, erasure, destruction

With the consent of, or on the instructions of, the User, other Personal Data provided by the User may be processed.
The following retention and processing periods, as well as the procedure for the destruction of Personal Data, apply to all purposes of Processing of Personal Data specified in this Policy:
1. Periods of Processing and storage of Personal Data: until the purpose of processing the Personal Data has been achieved, unless the User expresses a different intention, including by withdrawing consent to the processing of Personal Data;
2. The Operator does not carry out cross-border transfers of personal data;
The Operator's servers are used to store personal data. The Operator does not transfer personal data to third parties, except in cases where such transfer is carried out with consent in the cases provided for by law. The Operator monitors the use of the personal data provided and is responsible for the use of such personal data. The Operator undertakes not to disclose personal data received from the User.

Rights and Obligations
1. A User is entitled to:
  1. decide, freely, of the User's own will, and in the User's own interest, whether to provide the User's Personal Data to the Operator and to consent to its Processing.
  2. receive information relating to the Processing of the User's Personal Data.
  3. require the Operator to clarify, block, or destroy the Personal Data if the Personal Data is incomplete, outdated, inaccurate, unlawfully obtained, or is not necessary for the declared purpose of Processing.
  4. appeal against actions (or omissions) of the Operator that process Personal Data in violation of the requirements of the Legislation or otherwise violate the User's rights and freedoms, to the authorized body for the protection of the rights of personal data subjects or in court.
  5. take measures provided for by law to protect the User's rights and lawful interests, including through recovery of losses and/or compensation for moral harm in court.
2. A User is obliged to:
  1. provide the Operator only with accurate information about themselves.
  2. provide documents containing personal data to the extent necessary for the purpose of processing.
  3. inform the Operator of any clarification (updating, modification) of the User's personal data.
3. The Operator is obliged to:
  1. take the measures necessary and sufficient to comply with the rights of Users and to perform the obligations provided for by the Legislation.
  2. appoint a person responsible for the Processing of Personal Data.
  3. adopt internal documents on matters relating to the Processing of Personal Data and ensuring its security.
  4. familiarize employees with the internal documents against signature.
  5. conduct employee training on a regular basis and communicate the requirements of the Legislation to them.
  6. conduct internal audits on a regular basis and monitor the compliance of Personal Data Processing processes with the Legislation.
  7. regularly assess the harm that could be caused to Users in the event of a violation of their rights and of the requirements of the Legislation.
  8. provide a User with information relating to the Processing of the User's Personal Data upon receipt of a request from such User.
  9. cease Processing upon discovery of facts of unlawful Processing of Personal Data.
  10. destroy Personal Data in the manner established by the Legislation if it is not possible to ensure the lawfulness of the Processing of Personal Data.
  11. block Personal Data and clarify it in the manner established by the Legislation upon discovery of the fact of an inaccuracy.
4. The Operator is entitled to:
  1. receive from the personal data subject accurate information and/or documents containing Personal Data.
  2. require the personal data subject to promptly clarify the Personal Data provided.
Procedure and Conditions for the Processing of Personal Data
1. The Operator's Processing of Personal Data is permitted in the following cases:
  1. where the User has given consent to the Processing of the User's Personal Data;
  2. where grounds exist, provided for by the Legislation, permitting the processing of Personal Data in the absence of the User's consent.
2. The Operator carries out the Processing of a User's Personal Data both without and with the use of automation tools.
3. The Operator does not process Personal Data belonging to special categories relating to racial or ethnic origin, political views, religious or philosophical beliefs, state of health, intimate life, or membership of public associations, nor biometric Personal Data, except in cases expressly provided for by the Legislation.
4. The Operator is entitled to transfer a User's Personal Data without the User's consent to the following persons:
  1. government authorities, including inquiry and investigation authorities, and local self-government authorities, upon their reasoned request;
  2. other persons to whom the transfer of Personal Data is expressly provided for by the Legislation.
5. The Operator ensures the confidentiality of Personal Data; in particular, the Operator does not disclose Personal Data to third parties and does not disseminate it without the User's consent, unless otherwise provided for by the Legislation.
6. The Operator ensures the security of Personal Data in the manner provided for by the Legislation, including by:
  1. identifying security threats when Personal Data is Processed in Personal Data Information Systems;
  2. applying organizational and technical measures to ensure the security of Personal Data during its Processing in Personal Data Information Systems, necessary to comply with the requirements for the protection of Personal Data, compliance with which ensures the levels of protection of Personal Data established by the Government of the Russian Federation;
  3. keeping a record of physical media containing Personal Data;
  4. detecting facts of unauthorized access to Personal Data and taking measures to protect it;
  5. establishing rules of access to Personal Data processed in a Personal Data Information System, and ensuring the registration and recording of all actions performed with Personal Data in the Personal Data Information System;
  6. monitoring the measures taken to ensure the security of Personal Data and the level of protection of Personal Data Information Systems.
7. Access to Information Systems containing Personal Data is secured by a system of passwords. Passwords are set by authorized employees of the Operator and are communicated individually to the Operator's employees who have access to Personal Data. The Operator restricts access to a User's Personal Data to only those employees who require it in accordance with their job duties.
8. Personal Data is collected, stored, and processed within the territory of the Russian Federation.
Destruction of Personal Data
1. The Operator is obliged to destroy a User's personal data (cease its processing) in the following cases:
  1. upon confirmation of the fact that personal data is inaccurate or that its processing is unlawful, inaccurate personal data shall be clarified within 7 (seven) business days from the date documents containing up-to-date data are provided, and the unlawful processing of personal data must cease within a period not exceeding 3 (three) business days from the date the unlawful processing is discovered. If it is not possible to ensure the lawfulness of the processing of personal data, the Operator, within a period not exceeding 10 (ten) business days from the date the unlawful processing of personal data is discovered, is obliged to destroy such personal data or ensure its destruction (if the processing of personal data is carried out by another person acting on the Operator's instructions);
  2. upon the purposes of processing personal data being achieved, and also in the event a personal data subject withdraws consent to its processing, the personal data shall be destroyed within a period not exceeding 30 (thirty) days from the date the purpose was achieved or from the date such withdrawal was received, respectively (unless a different period is established by legislation), unless the Operator is entitled to carry out processing without the consent of the personal data subject on the grounds provided for by the Personal Data Law or other federal laws;
  3. if a personal data subject applies with a demand to cease the processing of personal data, the Operator, within a period not exceeding 10 (ten) business days from the date such demand is received, unless a different period is established by legislation, is obliged to cease the processing of personal data or ensure that processing is ceased (if processing is carried out by another person acting on the Operator's instructions), except in the cases provided for by clauses 2-11 of Part 1 of Article 6 of the Personal Data Law;
  4. if it is not possible to destroy personal data within the time frames indicated above, the Operator shall block such personal data or ensure that it is blocked (if the processing of personal data is carried out by another person acting on the Operator's instructions) and shall ensure the destruction of the personal data within a period of no more than 6 (six) months, unless a different period is established by federal laws.
2. Documents containing personal data on paper media are destroyed, upon cessation of the processing of personal data, by physical destruction (shredding in a special device) of the paper media.
3. Personal data on electronic media is destroyed by deletion from the electronic media using methods and means that guarantee the removal of residual information.
Cookies and Other Identification Technologies
1. Cookies are used on the website https://flat.audio. Information about how and when a User visits the Company's website helps improve it. A cookie file may only be created if this is permitted in the web browser's settings.
2. Cookie files are files or pieces of information that may be stored on your computer (or other internet-enabled devices, such as a smartphone or tablet) when you visit the Website. This type of file may store various information, such as browser type, operating system used, language settings or other personal page settings, information about your use of the website, order information, or login data. As a rule, cookies are not used to collect data that directly identifies an individual. However, information obtained through cookies may be linked to an individual at the moment such individual's personal information is provided in combination with information such as an email address.
3. Cookies are used for:
  - customizing the content of the Website's pages in accordance with the User's preferences, and optimizing the Website; in particular, these files allow your device to be recognized and, accordingly, allow the display of the Website's pages to be adapted to your individual needs;
  - generating statistics that help us understand how Users use the Website, allowing us to improve the structure and content of the Website;
  - maintaining a Website User's session (after logging in), so that Users do not need to re-enter their login and password on every page.
4. Accordingly, cookies do not harm your device and allow us to provide you with faster and better navigation of the Website. Cookies are, as a rule, present in significant numbers in every user's browser and are sometimes retained for extended periods.
5. We use cookies to save your preferences on our website. By browsing our Website, you consent to the use of cookies.
6. In any browser, cookies are accessible only to the website that created them. Other websites will not have access to these files. A User may configure the browser to accept all cookies, to decline all cookies, or to notify the User when a cookie is created.

User Requests: How to Contact the Operator
1. If a User has any questions regarding the Policy or the processing of Personal Data, the User may contact the Operator using the contact details provided for feedback.
2. Users are entitled to send the Operator their requests, including requests regarding the use of their personal data, or requests to withdraw consent to the processing of personal data, in writing to the address indicated in the "Operator's Details" section, or in the form of an electronic document signed with a qualified electronic signature in accordance with the legislation of the Russian Federation.
3. The Operator undertakes to review and send a response to a User's request within 30 days from the date the request is received.

Operator's Details
Ploskosti Zvuka LLC

OGRN: 1207700383230

INN: 9705148820

KPP: 770501001

Legal and postal address: 119017, Moscow, Zamoskvorechye municipal district, Pyatnitskaya St., 37, premises 1/1

E-mail: team@flat.audio

Other
After registering on the Website and/or its services, you may receive periodic mailings (informational, promotional, and other) to your registered email address and/or mobile phone number, as well as automatic confirmation of your purchases and service notifications.

A User may receive mailings to an email address and/or mobile phone number. You may unsubscribe from emails and/or SMS messages at any time using the special link included at the bottom of each message, or by emailing us at team@flat.audio with the subject line "UNSUBSCRIBE", thereby stopping the sending of messages to your email address.

In order to fulfil a personal data subject's requests, the Operator may require the subject's identity to be established and may request additional information confirming the subject's involvement in a relationship with the Operator, or information otherwise confirming the fact of processing of personal data by the Operator. In addition, the applicable legislation of the Russian Federation may establish restrictions and other conditions relating to the rights of personal data subjects referred to above.

This Policy and the relations between the User and the Operator are governed by the applicable legislation of the Russian Federation.

In all other respects not directly addressed in the Policy, the Operator undertakes to be guided by the norms and provisions of Federal Law No. 152-FZ dated 27.07.2006 "On Personal Data". A visitor to the Website and/or the Company's services who provides personal data and information thereby agrees to the provisions of this Policy. The Operator reserves the right to make any changes to the Policy at any time, at its own discretion, for the purpose of further improving the system for protecting Users' submitted personal data against unauthorized access, without the User's consent. When the Operator makes material changes to the Policy, a corresponding notice is posted on the website together with the updated version of the Policy. This Policy does not apply to the actions or internet resources of third parties. The Website collects and processes anonymized data about visitors using internet statistics services (Yandex Metrica and others).