Personal Data Processing Policy
1. General provisions
1.1. This Personal Data Processing Policy (hereinafter - the Policy) has been developed by Limited Liability Company "SALITA" (hereinafter - the Operator) in furtherance of the requirements of Federal Law No. 152-FZ "On Personal Data" dated 27.07.2006, other regulatory legal acts of the Russian Federation in the field of personal data, and taking into account the recommendations of the authorized body for the protection of the rights of personal data subjects.
1.2. The Policy sets out the principles, purposes, conditions and procedure for processing personal data carried out by the Operator, as well as the measures taken by the Operator to ensure the security of personal data and compliance with the rights of personal data subjects.
1.3. The Policy applies, in particular, to the processing of personal data received by the Operator through the website https://salita.biz, as well as through information systems and technical means related to the operation of the site.
1.4. This Policy is a publicly available document and is posted on the Operator's website.
1.5. The Policy applies to the personal data of individuals who interact with the Operator through the site, submit inquiries or requests, or otherwise contact SALITA regarding its services and real estate properties.
1.6. Processing of personal data of employees and job applicants is carried out by the Operator on the basis of separate internal regulations and documents governing such relationships, and by this Policy to the extent it directly applies to such persons.
2. Information about the Operator
2.1. The personal data operator is: Limited Liability Company "SALITA" (short name - OOO "SALITA").
TIN (INN): 6143047061, PSRN (OGRN): 1026101932559.
Registered and actual address: 347360, Rostov Region, Volgodonsk, Lenina St., 65.
Website: https://salita.biz. E-mail: salita@salita.biz. Phone: 8 909 440-80-80.
2.2. The person responsible for organizing the processing of personal data is appointed by the Operator in accordance with Article 22.1 of Federal Law No. 152-FZ.
2.3. Information about the appointed responsible person is held by the Operator and provided in the cases and manner prescribed by the legislation of the Russian Federation.
2.4. Requests from personal data subjects regarding the processing of their personal data are to be sent to: salita@salita.biz.
3. Key definitions
3.1. For the purposes of this Policy, the following key terms are used:
- Personal data - any information relating directly or indirectly to an identified or identifiable individual.
- Processing of personal data - any action (operation) or set of actions performed with personal data, with or without the use of automation tools.
- Operator - OOO "SALITA", organizing and/or carrying out the processing of personal data, independently or jointly with other persons.
- Personal data subject - the individual to whom the personal data relates.
- Automated processing - processing of personal data using computing equipment.
- Disclosure of personal data - actions aimed at revealing personal data to a specific person or group of persons.
- Cross-border transfer of personal data - transfer of personal data to the territory of a foreign state, to a foreign public authority, foreign individual, or foreign legal entity.
- Destruction of personal data - actions that make it impossible to restore the content of personal data in a personal data information system and/or that result in the destruction of physical media containing personal data.
4. Principles of personal data processing
4.1. The Operator processes personal data based on the following principles:
- lawfulness and fairness of processing;
- limiting processing to the achievement of specific, predetermined and lawful purposes;
- preventing the processing of personal data incompatible with the purposes of their collection;
- ensuring the content and volume of processed personal data corresponds to the stated purposes of processing;
- preventing excessive personal data;
- ensuring the accuracy and relevance of personal data;
- storing personal data no longer than required by the purposes of processing, unless a different period is established by the legislation of the Russian Federation;
- ensuring the confidentiality of personal data;
- ensuring the security of personal data during processing.
4.2. The Operator does not process personal data to an extent that does not correspond to the stated purposes.
4.3. The Operator does not make decisions based solely on automated processing of personal data if such a decision produces legal consequences for the personal data subject or otherwise affects their rights and legitimate interests.
5. Categories of personal data subjects
5.1. The Operator may process the personal data of the following categories of subjects: site visitors, prospective clients, clients, property owners, buyers, sellers, tenants, landlords, representatives of legal entities.
5.2. Personal data of employees and job applicants is processed by the Operator as part of separate processing procedures and on the basis of separate internal documents.
6. Purposes of personal data processing
6.1. The Operator processes personal data for the following purposes.
6.1.1. Handling requests and returning calls
Currently not carried out - the site's forms do not collect a phone number (see the notice at the beginning of this Policy). The main purpose of processing the phone number provided by a site user, once such collection resumes, is: to enable feedback with the user at their initiative, including a phone call by a SALITA employee to the phone number provided by the user, in order to give a consultation, clarify the request, and discuss the matter of interest to the user related to services and real estate properties.
6.1.2. The Operator does not use the phone number provided for a callback to send advertising messages, advertising calls, SMS messages or other advertising communications without a separate lawful basis for doing so.
6.1.3. Analysis of site traffic and advertising campaign effectiveness
The Operator uses the Yandex Metrica web-analytics service, counter No. 62715751, to: analyze site traffic; determine traffic sources; analyze visitor behavior on site pages; evaluate the effectiveness of advertising campaigns and channels; analyze technical parameters of the site's operation; improve the structure, content, and user experience of the site.
Yandex states that the Metrica counter automatically transmits site-visit data to generate statistical information; browser identifiers stored in cookies and localStorage, among other things, are used to count visitors.
7. Categories and scope of personal data
7.1. Data provided through site forms
Currently, the site's forms do not request a phone number and contain no other fields for collecting personal data - collection has been suspended by the Operator pending a separate decision. Once forms are used again, a phone number may be requested through them.
7.1.1. Depending on the nature of the request, the user may voluntarily provide information relating to the property. Information about the property that may potentially be provided includes: property address, street, house number, apartment number, floor, property area, living area, kitchen area, number of rooms, price or desired price, property type, description, notes, cadastral number, photographs, property documents.
7.1.2. The list of property information applies only to the extent such information is actually provided by the user and is necessary to review their request.
7.1.3. The Operator does not require the provision of such information if it is not necessary for a specific request.
8. Legal grounds for processing
8.1. Personal data processing is carried out by the Operator in accordance with Federal Law No. 152-FZ and other applicable regulatory legal acts of the Russian Federation.
8.2. Legal grounds for processing may include: consent of the personal data subject to the processing of their personal data; the need for processing to carry out functions, powers, and duties assigned to the Operator by the legislation of the Russian Federation; the need for processing to conclude a contract at the initiative of the personal data subject, or a contract to which the personal data subject is a party, beneficiary, or guarantor; other grounds provided for by Part 1 of Article 6 of Federal Law No. 152-FZ.
8.3. The specific legal basis is determined by the Operator taking into account the nature of the specific processing, the category of personal data, and the purpose of processing.
8.4. When processing a phone number for a callback, the Operator obtains and records the consent of the personal data subject in the form established by the Operator, where such processing requires consent.
9. Obtaining consent to the processing of personal data
9.1. The consent of the personal data subject must be specific, informed, deliberate and unambiguous.
9.2. The Operator ensures the ability to confirm that consent was obtained.
9.3. Consent to the processing of personal data is executed separately from other information and/or documents confirmed or signed by the personal data subject, in the cases and manner prescribed by the legislation of the Russian Federation.
9.4. When submitting a request through the site, the user must independently take an action confirming the provision of consent, in particular by checking the corresponding box in the form.
9.5. The Operator retains information confirming that consent was obtained for the period necessary to confirm the lawfulness of the processing.
9.6. The personal data subject has the right to withdraw their consent by sending a corresponding request to the Operator.
9.7. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal, unless otherwise provided by law.
10. Use of Yandex Metrica and cookies
10.1. The site uses the Yandex Metrica web-analytics service, counter No. 62715751.
10.2. Yandex Metrica is used to analyze site traffic, traffic sources, user behavior, and the effectiveness of advertising campaigns.
10.3. Cookies, localStorage, and other technical browser identifiers may be used while Yandex Metrica operates.
10.4. Yandex states that Metrica uses anonymous browser identifiers stored in cookies and localStorage to count visitors.
10.5. Within the Metrica code provided by the Operator, the user's phone number is not directly transmitted to Yandex Metrica.
10.6. The Operator must not transmit identifying information, including a phone number, to Yandex Metrica unless such transmission is provided for by the service's functionality and a necessary lawful basis is ensured. Yandex separately prohibits the transmission of identifying information to Metrica, except for functions provided by the service.
10.7. With respect to the personal data of site visitors processed by Yandex Metrica on the Operator's instructions, the Operator is the personal data operator, and Yandex acts on the Operator's instructions within the scope of providing the service.
10.8. The Operator provides users with information about the use of analytics technologies through this Policy and other informational messages on the site.
10.9. The Operator ensures the ability to stop data collection by Metrica in the cases and by the means provided for by the service's functionality and the law.
11. Localization of personal data
11.1. When collecting personal data of Russian Federation citizens, the Operator ensures the recording, systematization, accumulation, storage, clarification, and retrieval of personal data using databases located within the territory of the Russian Federation, in the cases prescribed by the legislation of the Russian Federation.
11.2. The Operator's primary database containing personal data received through the site is located within the territory of the Russian Federation.
11.3. MySQL is used as the database management system.
11.4. The hosting infrastructure of the site and its related technical components is provided using Timeweb services.
11.5. The transfer of individual data to foreign services does not eliminate the legislative requirements for localizing the primary collection and processing of personal data of Russian Federation citizens.
12. Transfer and disclosure of access to personal data
12.1. Access to personal data is granted only to persons who need such access to perform their duties and achieve the purposes of processing.
12.2. Recipients of personal data may include: authorized SALITA employees; persons processing personal data on behalf of the Operator, in the cases and to the extent provided for by law and relevant agreements; Yandex - with respect to data collected via Yandex Metrica, within the terms of use of the relevant service; other persons only where a corresponding lawful basis exists.
12.3. Personal data is not transferred to third parties for their own independent advertising purposes.
12.4. The Operator does not sell users' personal data.
12.5. The Operator does not disclose personal data to an indefinite group of persons.
13. Personal data storage periods
13.1. Personal data is processed and stored no longer than required by the purposes of processing, unless a different period is established by the legislation of the Russian Federation or another lawful basis.
13.2. For requests received through the site that did not result in a concluded contract: storage period - 3 months.
13.3. After this period expires, the request is subject to deletion unless there is another lawful basis for further storage.
13.4. For the client database, the Operator establishes a storage period of 1 year, unless there are grounds for longer storage.
13.5. If a contract has been concluded between the Operator and the personal data subject, certain personal data may be stored for the period necessary to perform the contract, as well as for the periods established by the legislation of the Russian Federation for the storage of relevant documents and information.
13.6. Where an obligation arises for longer storage of personal data in accordance with the legislation of the Russian Federation, the relevant data may be stored longer than the periods specified in this Policy.
14. Procedure for destroying personal data
14.1. Personal data is destroyed when the purposes of its processing are achieved, or upon other lawful grounds for terminating processing.
14.2. Requests from the site are subject to deletion after 3 months, unless there are lawful grounds for further storage.
14.3. Electronic data is destroyed by deleting the relevant data from information systems and other information resources used by the Operator, to the extent technically possible.
14.4. Where physical media containing personal data must be destroyed, methods are used that preclude the possibility of restoring the personal data contained on them.
14.5. If personal data has been transferred to a person processing it on the Operator's instructions, the Operator takes measures to ensure its destruction upon the expiry of the processing period in accordance with the contract and applicable legislation.
14.6. The destruction of personal data is documented in the manner established by the Operator's internal regulations.
15. Ensuring the security of personal data
15.1. The Operator takes the necessary legal, organizational and technical measures to protect personal data from: unlawful or accidental access; destruction; alteration; blocking; copying; disclosure; distribution; other unlawful actions.
15.2. The Operator limits access to personal data to the circle of persons who need such access to perform their duties.
15.3. Access to information systems is protected using identification, authentication, and access-control means established by the Operator.
15.4. The Operator takes measures to ensure the security of the server infrastructure, database, and software components of the site.
15.5. The Operator carries out internal monitoring of compliance with the requirements of Russian Federation legislation in the field of personal data.
15.6. In the event of a personal data security breach, the Operator takes measures to establish the circumstances of the breach, limit its consequences, restore security, and fulfill the obligations prescribed by law.
16. Rights of personal data subjects
16.1. A personal data subject has the right to: obtain information about the processing of their personal data; obtain information about the purposes of processing; obtain information about the legal grounds for processing; obtain information about the categories and composition of processed personal data; demand clarification of their personal data; demand blocking or destruction of personal data in cases provided for by law; withdraw consent to the processing of personal data; appeal the actions or omissions of the Operator in the manner established by law; exercise other rights provided for by the legislation of the Russian Federation.
16.2. The rights of a personal data subject are exercised in the manner established by Federal Law No. 152-FZ.
17. Procedure for requests from personal data subjects
17.1. To exercise their rights, a personal data subject may send a request to the Operator:
E-mail: salita@salita.biz
Postal address: 347360, Rostov Region, Volgodonsk, Lenina St., 65.
17.2. The request must allow the Operator to identify the applicant and determine the substance of their claim.
17.3. If necessary, the Operator has the right to request additional information necessary to confirm the applicant's identity and to prevent the disclosure of personal data to an improper person.
17.4. A response to the request is provided within the periods and in the manner established by the legislation of the Russian Federation.
18. Withdrawal of consent
18.1. A personal data subject has the right to withdraw consent to the processing of personal data by sending a corresponding request to: salita@salita.biz.
18.2. It is recommended that the request include: last name, first name, patronymic (if any); the phone number previously provided to the Operator; the substance of the request; and the preferred method of receiving a response.
18.3. Upon receiving the withdrawal, the Operator ceases processing personal data unless other grounds provided for by law exist for continued processing.
19. Person responsible for organizing personal data processing
19.1. The Operator has appointed a person responsible for organizing the processing of personal data, in accordance with Article 22.1 of Federal Law No. 152-FZ.
19.2. The full name of the responsible person is not published in this Policy.
19.3. Requests from personal data subjects are accepted directly by the Operator at: salita@salita.biz.
19.4. Information about the person responsible for organizing the processing of personal data is held by the Operator and provided to authorized government bodies in the cases and manner established by law.
20. Processing of personal data while using the site
20.1. When visiting the site, technical information necessary to ensure the site's operation and analytics may be automatically processed.
20.2. Such information may include: IP address; date and time of access; the address of the requested page; referral source; browser information; operating system information; device information; technical identifiers; information about user actions on the site; information collected via Yandex Metrica.
20.3. The actual set of technical data processed depends on the operation of the browser, server, connected services, and the site's settings.
20.4. The Operator does not use the site's technical data for automated decision-making regarding the provision or refusal of services to the user.
21. Processing restrictions
21.1. The Operator does not: sell personal data; transfer personal data for third parties' own independent advertising purposes; make automated decisions that produce legal consequences for the subject; profile users for the purpose of making decisions about the provision of services; transmit the phone number to Yandex Metrica within the normal operation of the installed counter.
21.2. The Operator processes only the personal data necessary to achieve the relevant purposes.
22. Amendments to the Policy
22.1. The Operator has the right to amend this Policy in the event of changes to the legislation of the Russian Federation, the procedure for processing personal data, the Operator's information systems, or the services used.
22.2. A new version of the Policy takes effect from the moment it is posted on the site, unless otherwise established by the Policy itself.
22.3. The current version of the Policy is posted at: https://salita.biz.
22.4. The date of the last update is indicated at the beginning of this Policy.
23. Final provisions
23.1. This Policy is the main public document of SALITA defining the principles of personal data processing within the processes governed by this Policy.
23.2. Matters not governed by this Policy are governed by Federal Law No. 152-FZ "On Personal Data" dated 27.07.2006, the Civil Code of the Russian Federation, and other federal laws and regulatory legal acts of the Russian Federation.
23.3. If any provisions of this Policy conflict with the mandatory requirements of the legislation of the Russian Federation, the corresponding legislative requirements apply, and the Operator takes measures to bring the Policy into compliance.