Policy on the Processing of Personal Data
1. General Provisions
1.1. This Policy on the Processing of Personal Data (hereinafter — the Policy) has been developed in accordance with the Constitution of the Russian Federation, Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (hereinafter — Federal Law No. 152-FZ), Federal Law No. 149-FZ of 27.07.2006 "On Information, Information Technologies and Information Protection", and other regulatory legal acts of the Russian Federation in the field of personal data.
1.2. Personal data controller (Operator):
Name Sole proprietor Gurnitskiy Aleksey Evgenievich
OGRNIP 319246800032475
INN 246310471139
1.3. This Policy applies to all information that the Operator may obtain about visitors and users:
of the Fantasos.tech website (hereinafter — the Site);
of the @fantasos_bot Telegram bot (hereinafter — the Bot).
Hereinafter, the Site and the Bot are jointly referred to as the "Service".
1.4. The Operator considers respect for the rights and freedoms of individuals and citizens in the processing of their personal data, including protection of the right to privacy and personal and family secrets, to be the most important goal and condition of carrying out its activities.
1.5. Use of the Service means the unconditional consent of the User to this Policy and the personal data processing terms set out in it. If the User disagrees with the terms of the Policy, the User must refrain from using the Service.
1.6. This Policy is a publicly available document and is posted at: https://fantasos.tech/privacy
2. Basic Definitions
2.1. Personal data — any information relating directly or indirectly to an identified or identifiable individual (a data subject).
2.2. Processing of personal data — any action (operation) or set of actions (operations) performed on personal data, with or without the use of automation tools, including collection, recording, systematization, accumulation, storage, clarification (updating, amendment), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, and destruction of personal data.
2.3. Automated processing of personal data — processing of personal data using computer technology.
2.4. The Operator — Sole proprietor Gurnitskiy Aleksey Evgenievich, who independently or jointly with other persons organizes and/or carries out the processing of personal data, and determines the purposes of personal data processing, the composition of personal data to be processed, and the actions (operations) performed with personal data.
2.5. The User — any visitor of the Site and/or user of the Bot.
2.6. Data subject — an individual to whom personal data relates, directly or indirectly.
2.7. Provision of personal data — actions aimed at disclosing personal data to a specific person or a specific group of persons.
2.8. Distribution of personal data — any actions aimed at disclosing personal data to an indefinite group of persons.
2.9. Blocking of personal data — temporary suspension of personal data processing (except where the processing is necessary to clarify the personal data).
2.10. Destruction of personal data — actions as a result of which it becomes impossible to restore the content of personal data in a personal data information system and/or the physical media containing the personal data are destroyed.
2.11. Depersonalization of personal data — actions as a result of which it becomes impossible, without using additional information, to determine that certain personal data belongs to a specific data subject.
2.12. Personal data information system — a set of personal data contained in databases and the information technologies and technical means that ensure its processing.
2.13. Cross-border transfer of personal data — transfer of personal data to the territory of a foreign state to an authority of a foreign state, a foreign individual, or a foreign legal entity.
2.14. Cookie file — a piece of data created by the browser and sent by the Service, which is stored on the device of the User.
3. Principles of Personal Data Processing
The Operator processes personal data on the basis of the following principles:
3.1. Lawfulness and fairness of personal data processing.
3.2. Limitation of personal data processing to the achievement of specific, predetermined, and lawful purposes. Processing of personal data that is incompatible with the purposes of the personal data collection is not allowed.
3.3. Prohibition of combining databases containing personal data that is processed for incompatible purposes.
3.4. Processing only of personal data that meets the purposes of its processing.
3.5. Compliance of the content and scope of the personal data processed with the stated purposes of processing. Prohibition of excessive personal data processing in relation to the stated purposes of its processing.
3.6. Ensuring the accuracy, sufficiency, and relevance of personal data in relation to the purposes of personal data processing.
3.7. Destruction of personal data upon achievement of the purposes of its processing or in the event that the need to achieve those purposes is lost, if the Operator is unable to eliminate violations committed with respect to the personal data, unless otherwise provided by federal law.
4. Conditions for Processing Personal Data
4.1. The Operator processes personal data if at least one of the following conditions is present:
the processing of personal data is carried out with the consent of the data subject to the processing of their personal data;
the processing of personal data is necessary to achieve purposes provided for by an international treaty of the Russian Federation or by law;
the processing of personal data is necessary for the administration of justice, the execution of a judicial act, or an act of another authority or official;
the processing of personal data is necessary for the performance of a contract to which the data subject is a party, as well as for concluding a contract at the initiative of the data subject;
the processing of personal data is necessary to exercise the rights and legitimate interests of the Operator or third parties, provided that this does not violate the rights and freedoms of the data subject.
4.2. The Operator processes the personal data of the User only if it is entered and/or sent by the User independently through the dedicated forms on the Site, in the Bot, or by email.
4.3. By filling in the relevant forms and/or sending their personal data to the Operator, the User expresses their consent to this Policy.
4.4. The data subject independently decides whether to provide their personal data and gives consent freely, of their own will, and in their own interest.
4.5. The Operator and other persons who have gained access to personal data do not disclose it to third parties and do not distribute it without the consent of the data subject, unless otherwise provided by federal law.
5. Purposes and Scope of Personal Data Processing
5.1. Personal data is processed for the following purposes:
Purpose of processing Data processed
Registration and identification of the User in the Service Name (nickname), email address, phone number
Processing of User requests and inquiries Name, email address, phone number, content of the inquiry
Conclusion and performance of contracts with Users Last name, first name, patronymic, email address, phone number
Sending notifications and information about the operation of the Service Email address, phone number
Informing about new products, services, and promotions Email address, phone number (subject to consent)
Statistical analysis and improvement of the Service Depersonalized technical data
5.2. Technical data collected automatically:
IP address;
type and version of the operating system and browser;
device type and screen resolution;
geolocation (country/city);
traffic source;
language of the operating system and browser;
actions on the Site (clicks, scrolls, link visits).
5.3. The Operator does not process special categories of personal data relating to racial or ethnic origin, political views, religious or philosophical beliefs, health, or intimate life.
5.4. The personal data processed by the Operator belongs to the category of general personal data and is processed by automated means.
6. Use of Cookies
6.1. The Operator uses automated data collection technologies (including cookies, log files, web beacons) for the following purposes:
Operation of the Service — ensuring the normal operation of the Site, navigation between pages, access to protected sections;
Statistical analysis — analysis of depersonalized attendance parameters (frequency, session duration, geographic distribution);
Optimization of the Service — identifying technical failures, adapting the interface to behavioral patterns;
Audience research — building aggregated reports on the behavioral characteristics of users.
6.2. On the Site and in the Bot, depersonalized data about visitors is collected and processed using web analytics services (Yandex Metrica and others).
6.3. This data is not used to identify an individual and is depersonalized.
6.4. Cookie files do not belong to special categories or biometric personal data in accordance with Art. 10–11 of Federal Law No. 152-FZ.
6.5. The User has the right to refuse the processing of cookies through the corresponding browser settings or by clicking the "Decline" button on the cookie banner (if available).
6.6. The Operator processes depersonalized data about the User if this is permitted by the User's browser settings (storage of cookies and use of JavaScript technology are enabled).
7. Rights of Data Subjects
7.1. A data subject has the right to:
receive information relating to the processing of their personal data, in the manner, form, and within the time limits established by personal data legislation;
demand clarification of their personal data, its blocking, or destruction if the personal data is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing;
set a condition of prior consent for the processing of personal data for the purposes of promoting goods, works, and services;
withdraw their consent to the processing of personal data;
appeal against unlawful actions or inaction of the Operator in the processing of their personal data to the authorized body for the protection of the rights of data subjects (Roskomnadzor) or in court;
exercise other rights provided for by the legislation of the Russian Federation.
7.2. Data subjects are obliged to:
provide the Operator with accurate data about themselves;
notify the Operator of any clarification (update, change) of their personal data.
7.3. Persons who have provided the Operator with inaccurate information about themselves, or information about another data subject without the latter's consent, bear liability in accordance with the legislation of the Russian Federation.
8. Obligations of the Operator
8.1. The Operator is obliged to:
provide the data subject, at their request, with information relating to the processing of their personal data;
organize the processing of personal data in the manner established by the current legislation of the Russian Federation;
respond to requests and inquiries from data subjects and their legal representatives in accordance with the requirements of Federal Law No. 152-FZ;
provide the authorized body for the protection of the rights of data subjects, at its request, with the necessary information within 30 days of receiving such a request;
ensure unrestricted access to this Policy;
take legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, provision, distribution of personal data, as well as from other unlawful actions with respect to personal data;
stop the transfer (distribution, provision, access) of personal data, stop processing, and destroy personal data in the manner and cases provided for by Federal Law No. 152-FZ;
perform other duties provided for by Federal Law No. 152-FZ.
8.2. The Operator has the right to:
receive from the data subject accurate information and/or documents containing personal data;
in the event that the data subject withdraws their consent to the processing of personal data, continue processing the personal data without the consent of the data subject if grounds specified in Federal Law No. 152-FZ are present;
independently determine the composition and list of measures necessary and sufficient to ensure compliance with the obligations provided for by Federal Law No. 152-FZ.
9. Measures to Protect Personal Data
9.1. The Operator ensures the collection, recording, systematization, accumulation, storage, clarification (updating, amendment), and extraction of the personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation.
9.2. The security of personal data is ensured through the implementation of legal, organizational, and technical measures necessary to meet the requirements of federal legislation in the field of personal data protection.
9.3. To prevent unauthorized access to personal data, the Operator applies the following organizational and technical measures:
appointment of a person responsible for organizing the processing of personal data;
ensuring the safety of personal data during storage and preventing unauthorized access to it;
limiting the group of persons authorized to process personal data;
identifying threats to the security of personal data during its processing and building threat models based on them;
developing a personal data protection system based on the threat model;
differentiating user access to information resources and hardware/software tools for processing information;
registering and recording the actions of users of personal data information systems;
using antivirus tools and personal data protection system recovery tools;
applying firewalls, intrusion detection tools, security analysis tools, and cryptographic information protection tools;
using secure communication channels for the transfer of personal data.
9.4. The Operator has taken the measures provided for by Part 2 of Art. 18.1 and Part 1 of Art. 19 of Federal Law No. 152-FZ.
10. Transfer of Personal Data to Third Parties
10.1. The personal data of the User is not transferred to third parties, except in the following cases:
the data subject has consented to the transfer of the data to a third party for the performance of obligations under a contract;
the transfer is necessary within the framework of the User's use of the Service's functionality;
the transfer is provided for by Russian or other applicable legislation within the framework of an established procedure;
the transfer takes place as part of the sale or other transfer of the business (in whole or in part), in which case the acquirer assumes all obligations to comply with the terms of this Policy.
10.2. The Operator has the right to entrust the processing of personal data to another person with the consent of the data subject, on the basis of a concluded agreement. A person processing personal data on behalf of the Operator is obliged to observe the principles and rules of personal data processing provided for by Federal Law No. 152-FZ and this Policy.
10.3. The Operator has the right to transfer technical data (log files and cookies) to third parties — analytics service providers — for the purposes of statistical accounting, optimizing the operation of the Service, and researching the target audience.
10.4. All information collected by third-party services, including payment systems, communication providers, and other service providers, is stored and processed by those persons in accordance with their own Terms of Service and Privacy Policy. The Operator is not liable for the actions of third parties.
11. Cross-Border Transfer of Personal Data
11.1. Before carrying out a cross-border transfer of personal data, the Operator must ensure that the foreign state to whose territory the personal data is intended to be transferred provides reliable protection of the rights of data subjects.
11.2. Cross-border transfer of personal data to the territory of foreign states that do not provide reliable protection of the rights of data subjects may be carried out only in the following cases:
there is written consent of the data subject to the cross-border transfer of their personal data;
the transfer is necessary for the performance of a contract to which the data subject is a party.
11.3. Before carrying out cross-border transfer of personal data, the Operator must notify the authorized body for the protection of the rights of data subjects of its intention to carry out the cross-border transfer of personal data.
12. Updating, Correction, and Deletion of Personal Data
12.1. If inaccuracies are found in the personal data, the User may update it independently by sending the Operator a notice to the email address support@fantasos.tech marked "Update of personal data".
12.2. If an inaccuracy in the personal data or the unlawfulness of its processing is confirmed, the personal data shall be updated by the Operator, and processing shall be discontinued in accordance with Art. 21 of Federal Law No. 152-FZ.
12.3. The User may withdraw their consent to the processing of personal data at any time by sending the Operator a notice to the email address support@fantasos.tech marked "Withdrawal of consent to the processing of personal data".
12.4. Upon achievement of the purposes of personal data processing, as well as in the event that the data subject withdraws their consent to its processing, the personal data shall be destroyed, unless:
otherwise provided for by a contract to which the data subject is a party;
the Operator is not entitled to process the data without the consent of the data subject on grounds provided for by Federal Law No. 152-FZ or other federal laws.
12.5. The period of personal data processing is determined by the achievement of the purposes for which the personal data was collected, unless a different period is provided for by a contract or current legislation.
12.6. Personal data is stored in a form that allows the data subject to be identified for no longer than is required by the purposes of personal data processing.
12.7. Personal data is destroyed by erasing it from the Operator's servers.
13. Final Provisions
13.1. The User may obtain any clarifications on questions of interest regarding the processing of their personal data by contacting the Operator:
by email: support@fantasos.tech