1. General Provisions
This Personal Data Processing Policy (hereinafter referred to as the "Policy") is prepared in accordance with the requirements of Federal Law No. 152-FZ "On Personal Data" dated July 27, 2006 (hereinafter referred to as the "Personal Data Law") and defines the procedure for processing personal data and measures to ensure the security of personal data implemented by LLC "Dewis Group" (hereinafter referred to as the "Operator").
1.1. The Operator’s primary objective is to respect and ensure the rights and freedoms of individuals and citizens when processing their personal data, including the protection of privacy, personal, and family secrets.
1.2. This Policy applies to all information the Operator may receive about visitors to the website
https://dewisgroup.com.
2. Key Definitions Used in the Policy
2.1. Automated processing of personal data — processing of personal data using computing tools.
2.2. Blocking of personal data — temporary suspension of personal data processing (except in cases where processing is necessary for the clarification of personal data).
2.3. Website — a collection of graphical and informational materials, as well as software and databases, ensuring their availability on the Internet at the network address
https://dewisgroup.com.
2.4. Information system of personal data — a set of personal data contained in databases and the information technologies and technical tools that ensure their processing.
2.5. Depersonalization of personal data — actions that make it impossible to determine the ownership of personal data to a specific User or another subject of personal data without the use of additional information.
2.6. Processing of personal data — any action (operation) or set of actions (operations) performed with or without the use of automation tools on personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, or destruction of personal data.
2.7. Operator — a state authority, municipal authority, legal entity, or individual that independently or jointly with others organizes and (or) performs the processing of personal data, as well as determines the purposes of personal data
processing, the composition of personal data to be processed, and the actions (operations) performed with personal data.
2.8. Personal data — any information that directly or indirectly relates to a specific or identifiable User of the website
https://dewisgroup.com.
2.9. Personal data authorized by the data subject for distribution — personal data to which an unlimited number of individuals have access, provided by the data subject through their consent to process personal data authorized for distribution in accordance with the Personal Data Law (hereinafter referred to as personal data authorized for distribution).
2.10. User — any visitor to the website
https://dewisgroup.com.
2.11. Provision of personal data — actions aimed at disclosing personal data to a specific individual or a defined group of individuals.
2.12. Distribution of personal data — any actions aimed at disclosing personal data to an unlimited number of individuals (transfer of personal data) or making personal data available to an unlimited number of individuals, including publishing personal data in mass media, posting in information and telecommunication networks, or providing access to personal data by any other means.
2.13. Cross-border transfer of personal data — the transfer of personal data to the territory of a foreign state to a foreign government authority, foreign individual, or foreign legal entity.
2.14. Destruction of personal data — any actions resulting in the irreversible destruction of personal data, making it impossible to further restore the content of personal data in the personal data information system and/or the destruction of physical carriers of personal data.
3.Rights and Obligations of the Operator
3.1. The Operator has the right to:
- Obtain accurate information and/or documents containing personal data from the data subject;
- In case of withdrawal of consent by the data subject for the processing of personal data, the Operator has the right to continue processing personal data without the data subject’s consent if there are grounds specified in the Personal Data Law;
- Independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of the obligations stipulated by the Personal Data Law and the normative legal acts adopted in accordance with it, unless otherwise provided by the Personal Data Law or other federal laws.
3.2. The Operator is obliged to:
- Provide the data subject with information related to the processing of their personal data upon request;
- Organize the processing of personal data in accordance with the procedure established by the current legislation of the Russian Federation;
- Respond to requests and inquiries from data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
- Notify the authorized body for the protection of the rights of data subjects, upon request, with the necessary information within 30 days from the date of receipt of such request;
- Publish or otherwise ensure unrestricted access to this Privacy Policy regarding the processing of personal data;
- Take legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, alteration, blocking, copying, provision, distribution of personal data, as well as from other unlawful actions regarding personal data;
- Cease the transfer (distribution, provision, access) of personal data, stop processing, and destroy personal data in the cases and manner provided by the Personal Data Law;
- Fulfill other obligations provided by the Personal Data Law.
4.Rights and Obligations of Data Subjects
4.1. Data subjects have the right to:
- Receive information regarding the processing of their personal data, except in cases provided for by federal laws. The information is provided to the data subject by the Operator in an accessible form, and it should not contain personal data related to other data subjects, except when there are legal grounds for disclosing such personal data. The list of information and the procedure for its receipt are established by the Personal Data Law;
- Request the Operator to clarify their personal data, block or destroy it if the personal data is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated purpose of processing, as well as take legal measures to protect their rights;
- Set the condition of prior consent for the processing of personal data for the purposes of promoting goods, works, and services on the market;
- Withdraw consent for the processing of personal data;
- Appeal to the authorized body for the protection of the rights of data subjects or take legal action in court regarding unlawful actions or inactions by the Operator in the processing of their personal data;
- Exercise other rights provided by the legislation of the Russian Federation.
4.2. Data subjects are obliged to:
- Provide the Operator with accurate information about themselves;
- Notify the Operator of any updates (changes, modifications) to their personal data.
4.3. Individuals who provide the Operator with false information about themselves or information about another data subject without their consent are responsible in accordance with the legislation of the Russian Federation.
5.The Operator may process the following personal data of the User:
- Last name, first name, patronymic.
- Email address.
- Phone numbers.
5.2. The website also collects and processes anonymized data about visitors (including "cookie" files) using internet statistics services (Yandex Metrica, Google Analytics, and others).
5.3. The above-mentioned data are collectively referred to as Personal Data in this Privacy Policy.
5.4. The Operator does not process special categories of personal data concerning racial or ethnic origin, political views, religious or philosophical beliefs, intimate life.
5.5. The processing of personal data authorized for distribution from the special categories of personal data specified in Part 1 of Article 10 of the Personal Data Law is permitted, provided that the prohibitions and conditions outlined in Article 10.1 of the Personal Data Law are adhered to.
5.6. The User’s consent to the processing of personal data authorized for distribution is obtained separately from other consents for the processing of their personal data. The conditions outlined, in particular, in Article 10.1 of the Personal Data Law are followed. The requirements for the content of such consent are established by the authorized body for the protection of the rights of data subjects.
5.6.1. The User provides the Operator with consent for the processing of personal data authorized for distribution directly.
5.6.2. The Operator must, within no more than three business days from the receipt of the User’s consent, publish information about the conditions of processing, including any prohibitions and conditions for the processing of personal data authorized for distribution to an unlimited number of individuals.
5.6.3. The transfer (distribution, provision, access) of personal data authorized by the data subject for distribution must be stopped at any time upon the request of the data subject. This request must include the full name (if applicable), contact information (phone number, email address, or postal address) of the data subject, as well as a list of personal data to be ceased from processing. The personal data specified in this request may only be processed by the Operator to whom it is directed.
5.6.4. The consent for the processing of personal data authorized for distribution ceases to be valid from the moment the Operator receives the request outlined in paragraph 5.9.3 of this Policy regarding the processing of personal data.
6.Principles of Personal Data Processing
6.1. Personal data is processed on a lawful and fair basis.
6.2. The processing of personal data is limited to achieving specific, predefined, and lawful purposes. The processing of personal data incompatible with the purposes of data collection is not permitted.
6.3. The merging of databases containing personal data, whose processing is carried out for incompatible purposes, is not allowed.
6.4. Only personal data that aligns with the purposes of its processing will be processed.
6.5. The content and scope of the processed personal data correspond to the stated purposes of processing. The processing of personal data in excess of the stated purposes is not permitted.
6.6. When processing personal data, the accuracy, sufficiency, and, where necessary, relevance of personal data in relation to the purposes of processing are ensured. The Operator takes necessary measures and/or ensures the adoption of measures to delete or clarify incomplete or inaccurate data.
6.7. Personal data is stored in a form that allows identification of the data subject for no longer than required by the purposes of processing, unless the storage period is established by federal law, contract, or is required by the subject of the personal data as a party, beneficiary, or guarantor under such a contract. The processed personal data is destroyed or anonymized once the processing goals are achieved or if the need to achieve those goals no longer exists, unless otherwise provided by federal law.
7.Purposes of Personal Data Processing
7.1. The purpose of processing the User’s personal data is:
- To inform the User by sending electronic emails;
- To conclude, perform, and terminate civil law contracts;
- To provide the User with access to services, information, and/or materials available on the website https://dewisgroup.com.
7.2. The Operator also has the right to send notifications to the User about new products and services, special offers, and various events. The User can always opt out of receiving informational messages by sending a letter to the Operator at
info@dewis.ltd with the subject "Opt-out of notifications about new products and services and special offers."
7.3. Anonymized data of Users, collected through internet statistics services, is used to gather information about the Users' actions on the website, to improve the quality of the site and its content.
8.Legal Grounds for Processing Personal Data
8.1. The legal grounds for the Operator to process personal data are:
- The Federal Law "On Personal Data" of 27.07.2006 No. 152-FZ;
- Federal laws and other regulatory acts in the field of personal data protection;
- User consent for the processing of their personal data, and for the processing of personal data authorized for distribution.
8.2. The Operator processes the User’s personal data only if it is filled out and/or submitted by the User independently through special forms on the website
https://dewisgroup.com or sent to the Operator via email. By filling out the relevant forms and/or sending their personal data to the Operator, the User expresses their consent to this Policy.
8.3. The Operator processes anonymized data about the User if this is allowed in the User’s browser settings (including saving "cookie" files and using JavaScript technology).
8.4. The data subject independently decides whether to provide their personal data and gives consent freely, voluntarily, and in their own interest.
9.Conditions for Processing Personal Data
9.1. The processing of personal data is carried out with the consent of the data subject to process their personal data.
9.2. The processing of personal data is necessary to achieve the purposes set forth by international treaties of the Russian Federation or by law, to perform functions, powers, and duties assigned to the Operator by the legislation of the Russian Federation.
9.3. The processing of personal data is necessary for the administration of justice, the execution of a judicial act, the act of another body or official, which must be executed in accordance with the legislation of the Russian Federation on enforcement proceedings.
9.4. The processing of personal data is necessary for the performance of a contract to which the data subject is a party, or a beneficiary or guarantor under such a contract, as well as for the conclusion of a contract initiated by the data subject, or a contract under which the data subject will be a beneficiary or guarantor.
9.5. The processing of personal data is necessary for the exercise of the rights and legitimate interests of the operator or third parties, or for achieving socially significant goals, provided that the rights and freedoms of the data subject are not violated.
9.6. The processing of personal data is carried out when access to which is provided by the data subject or at their request (hereinafter referred to as publicly available personal data).
9.7. The processing of personal data is carried out if the data is subject to publication or mandatory disclosure in accordance with federal law.
10.Procedure for Collection, Storage, Transfer, and Other Types of Processing of Personal Data
The security of personal data processed by the Operator is ensured through the implementation of legal, organizational, and technical measures necessary to fully comply with the requirements of current legislation in the field of personal data protection.
10.1. The Operator ensures the protection of personal data and takes all possible measures to prevent unauthorized access to personal data.
10.2. The personal data of the User will never, under any circumstances, be transferred to third parties, except in cases related to the enforcement of applicable laws or when the data subject has given consent to the Operator for the transfer of data to a third party for the fulfillment of obligations under a civil contract.
10.3. In case of identifying inaccuracies in personal data, the User can update them independently by sending a notification to the Operator at the Operator’s email address
info@dewis.ltd with the subject "Personal Data Update."
10.4. The term for processing personal data is determined by the achievement of the purposes for which the personal data was collected, unless a different term is provided by the contract or applicable legislation. The User can withdraw their consent to the processing of personal data at any time by sending a notification to the Operator via email at
info@dewis.ltd with the subject "Withdrawal of Consent to Process Personal Data."
10.5. All information collected by third-party services, including payment systems, communication services, and other service providers, is stored and processed by these parties (Operators) in accordance with their User Agreement and Privacy Policy. The data subject and/or User is required to review these documents in a timely manner. The Operator is not responsible for the actions of third parties, including the service providers mentioned in this section.
10.6. Restrictions set by the data subject on the transfer (except for providing access), as well as on the processing or conditions of processing (except for obtaining access) of personal data authorized for distribution, do not apply in cases of personal data processing in state, public, or other public interests as defined by the legislation of the Russian Federation.
10.7. The Operator ensures the confidentiality of personal data during processing.
10.8. The Operator stores personal data in a form that allows identification of the data subject for no longer than required by the purposes of processing, unless the storage period is established by federal law, contract, or required by the data subject as a party, beneficiary, or guarantor under such a contract.
10.9. A condition for the cessation of personal data processing may be the achievement of the processing purposes, the expiration of the data subject’s consent, the withdrawal of consent by the data subject, or the identification of unlawful processing of personal data.
11.List of Actions Performed by the Operator with Received Personal Data
11.1. The Operator performs the collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), anonymization, blocking, deletion, and destruction of personal data.
11.2. The Operator performs automated processing of personal data with the receipt and/or transfer of the received information via information and telecommunication networks or without it.
12.Cross-border Transfer of Personal Data
12.1. Before initiating the cross-border transfer of personal data, the Operator must ensure that the foreign country to which the personal data is to be transferred provides reliable protection of the rights of data subjects.
12.2. The cross-border transfer of personal data to countries that do not meet the above requirements can only occur if there is written consent from the data subject for the cross-border transfer of their personal data and/or for the performance of a contract to which the data subject is a party.
13.Confidentiality of Personal Data
The Operator and other individuals who have access to personal data are obliged not to disclose or distribute personal data to third parties without the consent of the data subject, unless otherwise provided by federal law.
14.Final Provisions
14.1. The User can obtain any clarifications regarding issues related to the processing of their personal data by contacting the Operator via email at
info@dewis.ltd.
14.2. Any changes to the Operator’s personal data processing policy will be reflected in this document. The Policy is valid indefinitely until replaced by a new version.
14.3. The current version of the Policy is freely available on the internet at
https://dewisgroup.com/privacy.