Personal data processing policy
1. General
1.1. This Policy sets out how the personal data of users of the website petamash.com and petamash.ru (the “Site”) is processed and protected. It has been prepared in accordance with Russian Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (the “Law”).
1.2. Data controller: PETAMASH (the “Controller”), address: B-02, 11/F, Wing Hing Factory Building, 31-33 Ng Fong Street, San Po Kong, Kowloon, Hong Kong, Hong Kong Business Registration No. 41701621-000-08-26-1, contact e-mail: HKGPETAMASH@gmail.com.
1.3. This Policy is publicly available on the Site. Matters related to the Site in general (cookies, links) are covered by the Privacy policy.
2. Definitions
- Personal data — any information relating directly or indirectly to an identified or identifiable individual (data subject).
- Processing — any operation on personal data: collection, recording, organisation, accumulation, storage, adaptation, retrieval, use, transfer, blocking, erasure and destruction.
- User — a visitor who sends an enquiry through the form on the Site.
3. Purposes, data and retention
3.1. Purpose: handling the user’s enquiry, advising on equipment, delivery and service, preparing a commercial offer and contacting the user.
Data: name, phone number, e-mail address, equipment category and model of interest, message, and the address of the page the enquiry was sent from.
Data subjects: users of the Site who send an enquiry.
Retention: until the purpose is achieved, but no longer than 3 years after the user’s last contact, or until consent is withdrawn — whichever comes first.
3.2. The Controller does not process special categories of personal data or biometric data.
4. Legal basis
Processing is based on the user’s consent, given by ticking the consent box before sending the form (Art. 6(1)(1) of the Law), and on the need to conclude and perform a contract with the user (Art. 6(1)(5) of the Law).
5. How data is processed
5.1. The Controller collects, records, organises, accumulates, stores, adapts, uses, blocks, erases and destroys personal data, using automated means.
5.2. Enquiry form data is sent to the Controller by e-mail. The Site is hosted by Timeweb LLC (Russia); enquiries are received via Gmail (Google LLC, USA).
5.3. When collecting personal data of citizens of the Russian Federation, the Controller records, organises, accumulates, stores, adapts and retrieves it using databases located in the Russian Federation, as required by Art. 18(5) of the Law. Enquiries sent via the Site are delivered to the Controller’s mailbox hosted by Gmail (Google LLC, USA), which constitutes a cross-border transfer of personal data.
5.4. The Controller does not share personal data with third parties other than those listed in clause 5.2, except where required by the laws of the Russian Federation.
5.5. Personal data is destroyed within 30 days once the purpose is achieved, the retention period expires or consent is withdrawn.
6. User rights
Users have the right to:
- obtain information about the processing of their personal data;
- request that their data be corrected, blocked or destroyed if it is incomplete, outdated, inaccurate or unlawfully processed;
- withdraw their consent to processing;
- lodge a complaint with Roskomnadzor or a court.
7. Controller’s obligations and safeguards
The Controller processes personal data lawfully and fairly, only for the stated purposes and to the extent necessary. The Controller takes legal, organisational and technical measures to protect data against unauthorised or accidental access, destruction, alteration, blocking, copying or disclosure: access to enquiries is limited, the Site uses a secure connection (HTTPS), and the mailbox is protected.
8. Requests and withdrawal of consent
8.1. Requests regarding personal data and withdrawal of consent should be sent to HKGPETAMASH@gmail.com. Please include your name and the contact details used in the enquiry.
8.2. The Controller responds within 10 working days of receipt. This period may be extended by up to 5 working days, with the user notified of the reasons.
8.3. Once consent is withdrawn, the Controller stops processing and destroys the personal data within 30 days, unless otherwise required by law.
9. Final provisions
The Controller may amend this Policy. The new version takes effect when published on the Site. The current version is always available on this page.