Personal Data Processing Policy

1. General provisions

This personal data processing policy has been prepared in accordance with the requirements of Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" and defines the procedure for processing personal data and the measures taken by Lobanov Andrey Sergeevich (the Operator) to ensure personal data security.

1.1. The Operator's most important purpose and condition for carrying out its activities is respect for human and civil rights and freedoms during personal data processing, including protection of privacy, personal secrets, and family secrets.

1.2. This Operator policy on personal data processing applies to all information that the Operator may receive about visitors to https://heroes-olden-era.com/.

2. Basic terms used in this Policy

2.1. Automated processing of personal data means personal data processing using computer technology.

2.2. Blocking of personal data means temporary suspension of personal data processing, except when processing is necessary to clarify personal data.

2.3. Website means the set of graphic and informational materials, software, and databases that make them available on the internet at https://heroes-olden-era.com/.

2.4. Personal data information system means the set of personal data contained in databases and the information technologies and technical means used for processing it.

2.5. Depersonalization of personal data means actions after which it is impossible to determine, without additional information, whether personal data belongs to a specific User or other personal data subject.

2.6. Personal data processing means any action or set of actions performed with or without automation tools on personal data, including collection, recording, systematization, accumulation, storage, clarification, updating, modification, extraction, use, transfer, distribution, provision, access, depersonalization, blocking, deletion, and destruction.

2.7. Operator means a state body, municipal body, legal entity, or individual that independently or jointly with others organizes and/or carries out personal data processing, and determines the purposes of processing, the composition of personal data to be processed, and the actions performed with personal data.

2.8. Personal data means any information directly or indirectly relating to an identified or identifiable User of https://heroes-olden-era.com/.

2.9. Personal data permitted by the personal data subject for distribution means personal data made available to an unlimited number of persons by the subject's consent in the manner provided by the Personal Data Law.

2.10. User means any visitor to https://heroes-olden-era.com/.

2.11. Provision of personal data means actions aimed at disclosing personal data to a specific person or specific group of persons.

2.12. Distribution of personal data means actions aimed at disclosing personal data to an indefinite group of persons, including publication in mass media, placement in information and telecommunications networks, or granting access by any other means.

2.13. Cross-border transfer of personal data means transfer of personal data to the territory of a foreign state, foreign public authority, foreign individual, or foreign legal entity.

2.14. Destruction of personal data means actions after which personal data is irreversibly destroyed and cannot be restored in the personal data information system, and/or material media containing personal data are destroyed.

3. Main rights and obligations of the Operator

3.1. The Operator has the right to receive reliable information and/or documents containing personal data from the personal data subject; to continue processing personal data without consent where the Personal Data Law provides grounds for doing so after consent is withdrawn or a request to stop processing is received; and to independently determine the composition and list of measures necessary and sufficient to fulfill the obligations provided by the Personal Data Law and related regulations, unless otherwise provided by law.

3.2. The Operator must provide the personal data subject, upon request, with information relating to processing of their personal data; organize personal data processing in accordance with the procedure established by Russian law; respond to requests and inquiries from personal data subjects and their legal representatives in accordance with the Personal Data Law; provide requested information to the authorized body for protection of personal data subjects' rights within 10 days of receiving such request; publish or otherwise provide unrestricted access to this Policy; take legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution, and other unlawful actions; stop transfer, distribution, provision, and access to personal data, stop processing, and destroy personal data in the cases and manner provided by the Personal Data Law; and perform other duties provided by the Personal Data Law.

4. Main rights and obligations of personal data subjects

4.1. Personal data subjects have the right to receive information about processing of their personal data, except in cases provided by federal law; to require the Operator to clarify, block, or destroy their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated processing purpose; to set a condition of prior consent when personal data is processed for marketing; to withdraw consent to processing and request termination of processing; to appeal unlawful actions or omissions by the Operator to the authorized body or in court; and to exercise other rights provided by Russian law.

4.2. Personal data subjects must provide reliable data about themselves and inform the Operator when their personal data is clarified, updated, or changed.

4.3. Persons who provide the Operator with inaccurate information about themselves or information about another personal data subject without that subject's consent are liable under Russian law.

5. Principles of personal data processing

5.1. Personal data is processed lawfully and fairly.

5.2. Processing is limited to specific, predetermined, and lawful purposes. Processing incompatible with the purposes of collection is not allowed.

5.3. Databases containing personal data processed for mutually incompatible purposes must not be combined.

5.4. Only personal data that corresponds to the purposes of processing is processed.

5.5. The content and scope of processed personal data correspond to the stated processing purposes. Excessive processing is not allowed.

5.6. Personal data must be accurate, sufficient, and, where necessary, up to date in relation to processing purposes. The Operator takes necessary measures to delete or clarify incomplete or inaccurate data.

5.7. Personal data is stored in a form that allows identification of the subject no longer than required by processing purposes, unless another period is established by federal law or contract. Processed personal data is destroyed or depersonalized when processing purposes are achieved or no longer need to be achieved, unless otherwise provided by federal law.

6. Purposes of personal data processing

Processing purpose: conducting statistical research and analyzing user activity on the website.

Personal data: IP address, cookies, website behavior data (page views, clicks, session duration), and technical characteristics of the device.

Legal grounds: consent of the personal data subject to processing under Part 1 of Article 6 of Federal Law No. 152-FZ of July 27, 2006.

Types of personal data processing: collection, recording, systematization, accumulation, storage, destruction, and depersonalization of personal data.

Transfer of personal data.

7. Conditions for personal data processing

7.1. Personal data is processed with the consent of the personal data subject.

7.2. Processing is necessary to achieve purposes provided by an international treaty of the Russian Federation or by law, or to perform the functions, powers, and duties imposed on the Operator by Russian law.

7.3. Processing is necessary for the administration of justice or execution of a judicial act or act of another authority or official subject to execution under Russian enforcement law.

7.4. Processing is necessary for performance of a contract to which the personal data subject is a party, beneficiary, or guarantor, or to conclude such a contract at the initiative of the subject.

7.5. Processing is necessary to exercise the rights and legitimate interests of the Operator or third parties, or to achieve socially significant purposes, provided this does not violate the rights and freedoms of the personal data subject.

7.6. Publicly available personal data is processed when access has been granted by the subject or at the subject's request.

7.7. Personal data subject to publication or mandatory disclosure under federal law is processed.

8. Procedure for collecting, storing, transferring, and otherwise processing personal data

8.1. The Operator ensures the safety of personal data and takes all possible measures to prevent access by unauthorized persons.

8.2. The Operator may transfer the User's personal data to third parties, namely web analytics services (Google Analytics and Yandex Metrica), to achieve the purposes stated in section 6 of this Policy. Such transfer is made only with the User's consent to personal data processing through acceptance of the cookie notice. In other cases, personal data may be transferred to third parties only on grounds provided by applicable Russian law.

8.3. If inaccuracies are found in personal data, the User may update it by sending the Operator a notice at admin@heroes-olden-era.com marked "Personal data update".

8.4. The period of personal data processing is determined by achievement of the purposes for which the personal data was collected, unless another period is provided by contract or applicable law. The User may withdraw consent to personal data processing at any time by sending the Operator a notice by email to admin@heroes-olden-era.com marked "Withdrawal of consent to personal data processing".

8.5. Information collected by third-party services, including payment systems, communication tools, and other service providers, is stored and processed by those parties according to their user agreements and privacy policies. The Operator is not responsible for actions of third parties, including the service providers mentioned in this clause.

8.6. Restrictions established by the personal data subject on transfer, processing, or processing conditions for personal data permitted for distribution do not apply where processing is carried out in state, public, or other public interests defined by Russian law.

8.7. The Operator ensures confidentiality of personal data during processing.

8.8. The Operator stores personal data in a form allowing identification of the subject no longer than required by processing purposes, unless a storage period is established by federal law or contract.

8.9. Processing may stop when processing purposes are achieved, the consent period expires, consent is withdrawn, a request to stop processing is received, or unlawful processing is identified.

9. Actions performed by the Operator with received personal data

9.1. The Operator collects, records, systematizes, accumulates, stores, clarifies, updates, modifies, extracts, uses, transfers, distributes, provides, grants access to, depersonalizes, blocks, deletes, and destroys personal data.

9.2. The Operator carries out automated personal data processing with or without receiving and/or transmitting information over information and telecommunications networks.

10. Cross-border transfer of personal data

10.1. Before starting cross-border transfer of personal data, the Operator must notify the authorized body for protection of personal data subjects' rights of its intention to carry out such transfer. This notice is submitted separately from the notice of intent to process personal data.

10.2. Before submitting the above notice, the Operator must obtain relevant information from the foreign public authorities, foreign individuals, or foreign legal entities to whom the personal data is planned to be transferred.

11. Confidentiality of personal data

The Operator and other persons who receive access to personal data must not disclose personal data to third parties or distribute personal data without the consent of the personal data subject, unless otherwise provided by federal law.

12. Final provisions

12.1. The User may receive clarifications on questions concerning processing of their personal data by contacting the Operator by email at admin@heroes-olden-era.com.

12.2. Any changes to the Operator's personal data processing policy will be reflected in this document. The Policy remains in effect indefinitely until replaced by a new version.

12.3. The current version of the Policy is freely available on the internet at https://heroes-olden-era.com/ru/privacy.