PERSONAL DATA PROCESSING POLICY

Operator - legal entity that independently or in cooperation with other entities organizes and/or processes personal data as well as determines the purposes of personal data processing, the scope of personal data to be processed, and the actions (operations) performed with personal data.

Personal data subject - a particular or identified individual.

Personal data - any information referring directly or indirectly to a particular individual (hereinafter referred to as a "personal data subject" or a “subject”).

Personal data processing – any action (operation) or a combination of actions (operations) performed both automatically and manually with personal data, including collection, recording, arrangement, accumulation, storage, specification (updating, changing), extraction, use, transfer (including distribution, provision, access), anonymizing, blocking, deletion and destruction of personal data.

Distribution of personal data – actions related to making the data available to indefinite range of persons.

Provision of personal data - actions related to making the data available to a definite person or a definite range of persons.

Blocking of personal data - the temporary cessation of personal data processing.

Anonymization of personal data - actions performed on personal data that makes it impossible to link the data to a particular personal data subject.

Destruction of personal data - actions performed on personal data contained in the respective database that prevent such data from being restored and (or) actions aimed at the physical destruction of the tangible medium of personal data.

Site – software of Operator which is a set of interrelated web-services and modules, constituting together one space of service delivery to Users within the Internet, located on https://incosmetix.com/

1. 1.1. The Personal Data Processing Policy (hereinafter the “Policy”) is compiled and applied by Innovator Cosmetics LLC (hereinafter the “Operator”) in accordance with Sub-clause 2 of Part I of Article 18.1 of the Federal Law of 27.07.2006 No. 152-FZ "On Personal Data" (hereinafter the " Law").
2. 1.2. This Policy defines activities of the Operator regarding the processing of personal data; it establishes procedures to prevent violations of the Russian Federation legislation related to the processing of personal data.
3. 1.3. By accepting the Policy, a personal data subject gives informed and active consent to process personal data under the conditions provided by the Policy and the Law. The Operator proceeds from the following:
4. • A personal data subject provides fully reliable information. The Operator does not authenticate it. All the risks related to the provision of unreliable information are to be borne by the personal data subject.
5. • A personal data subject has the right to give the relevant consent. If for some reason the personal data subject does not have such a right, the consent to process personal data is to be given by his/her legal representative.
6. 1.4. In some cases provided in the Law, the Operator has the right to process personal data without the consent of the personal data subject. The lawful cases for processing are set out in Article 6 of the Law.
7. 1.5. A personal data subject may withdraw his/her consent to personal data processing at any time. After a personal data subject revokes his/her consent to personal data processing, the Operator terminates the processing and destroys the processed personal data within 30 days from the date of receipt of a request.
8. 1.6. In order to improve the quality of service and upgrade the Site, the Operator can use cookie files.

1. 2.1. The processing of personal data is performed for the purposes of:
2. • complying with the legislative and other statutory acts of the Russian Federation, and local regulations of the Operator;
3. • complying with the obligations imposed upon the Operator by the legislation of the Russian Federation;
4. • drafting, signing, executing and terminating agreements with counterparties;
5. • exercising the rights and legal interests of the Operator as part of the activities stipulated by the Articles of Association and other local regulations of the Operator or third parties, or activities aimed at achieving socially desirable purposes;
6. • other legitimate purposes.
7. 2.2. The processing of personal data is conducted by the Operator due to the following principles:
8. • personal data processing is performed on a legal basis and legitimate purposes of personal data processing, as well as on integrity and fairness in the activities of the Operator.
9. • personal data must be accurate and sufficient to the purposes of personal data processing. It is unacceptable to process personal data, which contradict the purposes of personal data collection.
10. • personal data are not subject to processing unless they meet the purposes of their processing;
11. • the scope and amount of personal data comply with the stated purposes of processing;
12. • it is not allowed to combine databases containing personal data which are processed for incompatible purposes;
13. • personal data processing must be accurate, sufficient and, if necessary, relevant to the purposes of personal data processing. The Operator takes the required measures or makes efforts to delete or refine incomplete or inaccurate personal data;
14. • personal data are stored in the form that makes it possible to identify the data subject for no longer than required for the purposes of personal data processing;
15. • personal data of citizens of the Russian Federation are to be recorded, systematized, accumulated, stored, refined (updated or changed), extracted through databases located on the territory of the Russian Federation.
16. 2.3. When a personal data subject fills in feedback forms and applications for services of the Site, inputs personal data and contact information to liaise, sends messages in order to receive email newsletters with resource materials, the Subject provides, while the Operator processes the following personal data:
17. • first name and/or surname;
18. • date of birth (if required) ;
19. • e-mail address;
20. • contact telephone number;
21. • image (if provided by the Subject);
22. • other materials, including photos and videos received when using the services of the Site.
23. If a Subject uses the services of the Site, fills in forms and applications on behalf of another individual, the Subject provides personal data of that person and operates on behalf of the mentioned person.
24. In this case, a Subject is fully responsible to ensure that individuals, whose data are being processed, are aware of that and completely agree to have the data processed in compliance with the Policy.
25. 2.4. When a personal data subject has an intend to receive information from the Site, and/or access paid or free services, and/or take any other action on the Site, he/she understands and confirms that:
26. • the Operator is entitled to send advertisement and information content to the Subject who has put the personal data in any application form when using the Site. The advertisement and information content can be transferred via:
27. 1. emails;
28. 2. SMS;
29. 3. other messenger services;
30. 4. social media services;
31. 5. phone calls, including automatic.
32. • the Operator is entitled to send advertisement and information content not only of the own options and offers, but also of special offers of partners, i.e. legal entities, sole proprietors, self-employed citizens, and other individuals cooperating with the Operator.
33. • In the case of disagreement with the Policy terms, a personal data subject should not input personal data on the Site and refrain from using it.
34. 2.5. Personal data mentioned above are processed by automatic or manual processing means. When processing personal data without automatic means, the Operator should be guided by the terms, approved by the Decree of the Government of the Russian Federation No. 687 dated September 15, 2008.
35. 2.6. The Operator shall be obliged, when processing data, to take legal, organizational and technical measures necessary to protect personal data in accordance with Article 19 of the Federal Law of 27.07.2006 No. 152-FZ "On Personal Data".
36. 2.7. The Operator shall be obliged to refrain from disclosing to third parties or disseminating those personal data without the consent of the personal data subject, except as otherwise provided by federal laws and the Policy.
37. 2.8. Evaluation of the damage, which may be caused to data subjects in the event of the violation of the Federal Law of 27.07.2006 No. 152-FZ "On Personal Data", is determined in compliance with Article 15, 151, 152, 1101 of the Civil Code of the Russian Federation.
38. 2.8.1. The ratios between losses suffered by the personal data subjects and measures taken to prevent, reduce or eliminate the consequences of the damage incurred are determined in compliance with the Federal Law of 27.07.2006 No. 152-FZ "On Personal Data".
39. 2.9. Conditions of personal data processing carried out by the Operator:
40. 1) personal data are processed since the start of using the services of the Site, or other activities related to the point 2.3 of the current Policy.
41. 2) According to the point 5 of Part 1 of Article 6 of the Federal Law of 27.07.2006 No. 152-FZ "On Personal Data", if a personal data subject accepts an offer on its own initiative to which the personal data subject is a party or under which it is a beneficiary, obtaining consent to process personal data is not required.
42. 3) The terms of the current Policy are publically available.
43. 2.10. Personal data are stored in the form that makes it possible to identify the data subject.
44. 2.11. Personal data undergoing processing are destroyed or depersonalized as soon as the purposes of processing are achieved.
45. 2.12. Interaction with the relevant federal executive authorities concerning the processing and protection of personal data of subjects is being conducted within the framework of the legislation of the Russian Federation.

1. 3.1. In order to fulfill obligations to Users, to improve the speed and effectiveness of sending advertisement and information content via mail (if approved by the written consent confirming Users’ interest in receiving messages), to keep the Users better informed about new service opportunities, the Operator is legally entitled to involve third parties to process the personal data. Personal data transmission amount is set under the terms of agreements.
2. 3.2. The third parties who have obtained an access to personal data receive the following user data: the surname, first name and patronymic, contact telephone number, e-mail address. User can refuse to transmit the data as well as to unsubscribe from email newsletters.
3. 3.3. The Operator shall thoroughly choose third party partners to trust them the processing of personal data (solely within the framework of the current Policy). When making a third-party contract, all the rights and obligations of participating parties related to serve the interests of users are regulated by the contract. The third party partners shall guarantee the following:
4. • to carry out the processing of using local databases of the Russian Federation;
5. • to keep the provided information confidential when it is processed or used;
6. • to ensure the security of personal data being processed, i.e. to use data protection facilities; to detect instances of unauthorized access to personal data and take measures to restore personal data; to restrict access to personal data; to monitor activities related to personal data; to monitor and evaluate the effectiveness of measures taken to ensure the security of personal data.
7. • the data recipients are not entitled to disclose personal data further to other third-parties.

1. 4.1. A person responsible for the arrangement of personal data processing is the Operator or the legal representative.
2. 4.2. A person responsible for the arrangement of personal data processing:
3. 4.2.1. exercises internal control over compliance with the legislation of the Russian Federation concerning personal data, including requirements relating to the protection of personal data;
4. 4.2.2. organizes the acceptance and processing of applications and requests from personal data subjects or their representatives;
5. 4.2.3. takes measures to detect instances of unauthorized access to personal data;
6. 4.2.4. monitors measures taken to ensure the security of personal data;
7. 4.2.5. exercises internal control and (or) audit over compliance of personal data processing with the Federal Law of 27.07.2006 No. 152-FZ "On Personal Data" and normative legal acts adopted in accordance with this Law.

1. 5.1. Personal data subjects or their representatives have rights provided by the Federal Law of 27.07.2006 No. 152-FZ "On Personal Data".
2. 5.2. The Operator ensures the rights of personal data subjects under the procedure established by Chapter 3 and 4 of the Federal Law of 27.07.2006 No. 152-FZ "On Personal Data".
3. 5.3. The authority of the representative to promote the interests of each personal data subject is confirmed by the relevant attorney.
4. 5.4. The information referred to in Part 7 of Article 14 of The Federal Law of 27.07.2006 No. 152-FZ "On Personal Data" shall be provided to a personal data subject by the Operator in an accessible form, and shall not contain personal data relating to other data subjects, except where there are lawful grounds for the disclosure of such personal data. The information can be duplicated on paper if o required by a personal data subject.
5. 5.5. The information referred to in Part 7 of Article 14 of The Federal Law of 27.07.2006 No. 152-FZ "On Personal Data" shall be provided to a personal data subject or a legitimate representative upon application or upon receipt of a request from the personal data subject or his/her legitimate representative. A request shall contain the number of the principal identification document of the personal data subject or of his/her legitimate representative, information as to the date of issue of that document and the body which issued it, information evidencing the personal data subject’s relationship with the operator (number of contract, date of conclusion of contract, reference designation and (or) other information) or information which otherwise confirms the processing of the personal data by the operator, and the signature of the personal data subject or of his representative. A request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.
6. 5.6. A request may be sent in the form of an electronic document and signed with an electronic signature in accordance with the legislation of the Russian Federation.
7. 5.7. The Operator shall be obliged to make personal data relating to a particular data subject available by that data subject or his/her representative free of charge, considering location and working hours of the data subject.

1. 6.1. The Operator has the right to change the current Policy at any time. Normally, the changes are related to bringing the Policy into line with the changes of the Law and are aimed to ensure the greater security of personal data of the subjects.
2. 6.2. The Operator is obliged neither to make substantive changes, nor to put additional burden or restrictions of rights of personal data subjects, established by the current Policy, without prior notice.
3. 6.3. The Operator notifies the personal data subject about any changes put in the current Policy to let the Subject examine the updates. The amendment notice can be displayed on the Site (via a pop-up window or an icon) or sent by email. By continuing to use our service, you confirm that you agree to the updated Policy.

1. 7.1. All issues related to the personal data processing and not mentioned in the current Policy are resolved in accordance with legislation of the Russian Federation regarding the personal data.