1.1. The Personal Data Processing Policy (hereinafter referred to as the Policy) is aimed at protecting the rights and freedoms of individuals whose personal data is processed by North-West Ltd (hereinafter referred to as the Operator).
1.2. The Policy of personal data processing (hereinafter - the Policy) is developed in accordance with the Federal Law dated 27.07.2006. No. 152-FZ "On Personal Data" (hereinafter - the Federal Law "On Personal Data").
1.3. The following basic concepts are used in the Policy:

• automated processing of personal data - processing of personal data by means of computer equipment;
• personal data information system - a set of personal data contained in databases and information technologies and technical means ensuring their processing;
• depersonalization of personal data - actions, as a result of which it is impossible to determine, without using additional information, the belonging of personal data to a particular subject of personal data;
• processing of personal data - any action (operation) or set of actions (operations) performed with or without the use of automation means with personal data, including collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data;
• operator - a state authority, municipal authority, legal or natural person, independently or jointly with other persons organizing and (or) carrying out processing of personal data, as well as determining the purposes of personal data processing, composition of personal data subject to processing, actions (operations) performed with personal data;
• personal data - any information relating to a directly or indirectly defined or identifiable natural person (subject of personal data).

1.4. The Policy contains information subject to disclosure in accordance with part 1 of Article 14 of the Federal Law "On Personal Data" and is a publicly available document.

2.1. When processing personal data, the operator is guided by the following principles:

• legality and fairness;
• limiting the processing of personal data to the achievement of specific, predetermined and legitimate purposes;
• prevention of personal data processing incompatible with the purposes of personal data collection;
• preventing the merging of databases containing personal data processed for incompatible purposes;
• processing only those personal data that meet the purposes of their processing;
• compliance of the content and scope of processed personal data with the stated purposes of processing;
• preventing the processing of personal data that are redundant in relation to the stated purposes of their processing;
• ensuring the accuracy, sufficiency and relevance of personal data in relation to the purposes of personal data processing;
• depersonalization of personal data upon achievement of the purposes of their processing or in case of loss of necessity in achievement of these purposes, in case of impossibility for the Operator to eliminate the admitted violations of personal data, unless otherwise provided for by the federal law.

2.2. The Operator obtains personal data directly from the subjects of personal data.
2.3. The Operator does not verify the reliability of personal data provided by users. The Operator assumes that the user provides personal data in his/her own interest without the intention to violate the rights and legitimate interests of third parties and the Operator or cause losses to them.
2.4. The Operator processes personal data by automated and non-automated methods, with or without the use of computer means.
2.5. The operator and other persons who have access to personal data are obliged not to disclose to third parties and not to disseminate personal data without the consent of the subject of personal data, unless otherwise provided for by federal law.

3.1. The Operator processes the following clients' personal data:

• first name, middle name and surname;
• e-mail address;
• contact phone number (optionally).

3.2. The Operator processes clients' personal data in order to comply with the legislation of the Russian Federation, as well as for the purpose of:

• user identification;
• sending the user notices and information related to the use of the site, provision of services, as well as processing user requests and applications;
• informing about new products, special promotions and offers.

The consent to the processing of personal data, expressed by the user through adherence to this Policy, is valid indefinitely, but can be withdrawn by him at any time on the basis of a personal statement sent to the operator's address indicated on the website.
Upon receipt of such an application, the operator shall immediately anonymize the user's personal data.

5.1. The Operator appoints a person responsible for the organization of personal data processing to perform the duties stipulated by the Federal Law "On Personal Data" and regulatory legal acts adopted in accordance with it.
5.2. The Operator applies a set of legal, organizational and technical measures to ensure security of personal data to ensure confidentiality of personal data and their protection from unlawful actions:

• provides unrestricted access to the Policy, a copy of which is posted at the Operator's location and on the Operator's website;
• in pursuance of the Policy, approves and enforces the document "Regulation on personal data processing" (hereinafter referred to as the Regulation) and other local acts;
• familiarizes employees with the provisions of the legislation on personal data, as well as with the Policy and Regulations;
• authorizes employees to access personal data processed in the Operator's personal data information system, as well as their tangible carriers, only for the performance of labor duties;
• establishes rules of access to personal data processed in the Operator's personal data information system, as well as ensures registration and record keeping of all actions with them;
• assesses the harm that may be caused to personal data subjects in case of violation of the Federal Law "On Personal Data";
• determines security threats to personal data during their processing in the Operator's personal data information system;
• applies organizational and technical measures and uses information protection means necessary to achieve the established level of personal data protection;
• detects facts of unauthorized access to personal data and takes response measures, including recovery of personal data modified or destroyed due to unauthorized access to them;
• assesses the effectiveness of the measures taken to ensure personal data security before the Operator's personal data information system is put into operation;
• exercises internal control over compliance of personal data processing with the Federal Law "On Personal Data", regulatory legal acts adopted in accordance with it, personal data protection requirements, Policy, Regulations and other local acts, including control over measures taken to ensure personal data security and their level of protection during processing in the Operator's personal data information system.

6.1. The subject of personal data has the right to:

• receive personal data relating to the subject and information concerning their processing;
• clarify, block or destroy his/her personal data if they are incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purpose of processing;
• revoke his/her consent to the processing of personal data;
• protection of their rights and legitimate interests, including compensation for losses and compensation for moral harm in court;
• the right to appeal against actions or inaction of the Operator to the authorized body for the protection of the rights of personal data subjects or in court.

6.2. To exercise their rights and legitimate interests, personal data subjects have the right to apply to the Operator or send a request in person or with the help of a representative. The request must contain the information specified in part 3 of Article 14 of the Federal Law "On Personal Data".