Personal Data Processing Policy

1. General Provisions

This personal data processing policy has been prepared in accordance with the requirements of Federal Law No. 152-FZ "On Personal Data" dated 27 July 2006 (hereinafter the Personal Data Law) and defines the procedure for processing personal data and the measures taken to ensure personal data security by Limited Liability Company "MEGAPOLIS-SERVICE ESTATELIGA" (OGRN 5147746344752, INN 7722862823, KPP 772201001, address: room 7, premises XIV, building 2, 50 Aviamotornaya Street, Moscow, 111024, email: info@estateliga.ru, hereinafter the Operator).

1.1. The Operator sets as its most important objective and condition of its activities the observance of human and civil rights and freedoms when processing personal data, including the protection of rights to privacy, personal secrecy, and family secrecy.

1.2. This Operator policy on personal data processing (hereinafter the Policy) applies to all information that the Operator may receive about visitors to the website https://homeliga.ae.

 

2. Key Terms Used in the Policy

2.1. Automated processing of personal data means processing personal data using computer equipment.

2.2. Blocking of personal data means temporary suspension of personal data processing, except where processing is necessary to clarify personal data.

2.3. Website means a set of graphic and informational materials, computer programs, and databases that ensure their availability on the internet at the network address: https://homeliga.ae.

2.4. Personal data information system means a set of personal data contained in databases and the information technologies and technical means that ensure their processing.

2.5. Depersonalization of personal data means actions that make it impossible to determine, without using additional information, whether personal data belongs to a specific User or another personal data subject.

2.6. Processing of personal data means any action (operation) or set of actions (operations) performed with or without automation tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, and destruction of personal data.

2.7. Operator means a state authority, municipal authority, legal entity, or individual that independently or jointly with other persons organizes and/or carries out personal data processing, and also determines the purposes of personal data processing, the composition of personal data to be processed, and the actions (operations) performed with personal data.

2.8. Personal data means any information relating directly or indirectly to an identified or identifiable User of the website https://homeliga.ae.

2.9. Personal data permitted by the personal data subject for distribution means personal data to which access by an unlimited number of persons has been provided by the personal data subject by giving consent to the processing of personal data permitted by the personal data subject for distribution in the manner provided for by the Personal Data Law (hereinafter personal data permitted for distribution) https://homeliga.ae.

2.11. Provision of personal data means actions aimed at disclosing personal data to a specific person or a specific group of persons.

2.12. Distribution of personal data means any actions aimed at disclosing personal data to an indefinite number of persons (transfer of personal data) or at familiarizing an unlimited number of persons with personal data, including disclosure of personal data in mass media, publication in information and telecommunication networks, or providing access to personal data by any other means.

2.13. Destruction of personal data means any actions as a result of which personal data is irretrievably destroyed with no possibility of further recovery of the contents of personal data in the personal data information system and/or the physical media containing personal data are destroyed.

2.14. Cookies are small files created and stored by the browser when visiting our websites and services. Cookie files are stored on the device and allow us to monitor the quality of websites and services and the characteristics of their use, as well as to optimize marketing activities on the internet.

3. Main Rights and Obligations of the Operator

3.1. The Operator has the right to:

- receive accurate information and/or documents containing personal data from the personal data subject;

- if the personal data subject withdraws consent to personal data processing or sends a request to stop personal data processing, continue processing personal data without the subject's consent if there are grounds specified in the Personal Data Law;

- independently determine the composition and list of measures necessary and sufficient to ensure compliance with the obligations provided for by the Personal Data Law and the regulatory legal acts adopted in accordance with it, unless otherwise provided for by the Personal Data Law or other federal laws.

3.2. The Operator is obliged to:

- provide the personal data subject, upon request, with information concerning the processing of their personal data;

- organize personal data processing in the manner established by the current legislation of the Russian Federation;

- respond to requests and inquiries from personal data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;

- provide the authorized body for the protection of the rights of personal data subjects, upon request of that body, with the necessary information within 10 days from the date of receipt of such request;

- publish or otherwise provide unrestricted access to this Policy on personal data processing;

- take legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, alteration, blocking, copying, provision, distribution, and other unlawful actions with respect to personal data;

- stop the transfer (distribution, provision, access) of personal data, stop processing, and destroy personal data in the manner and cases provided for by the Personal Data Law;

- fulfill other obligations provided for by the Personal Data Law.

4. Main Rights and Obligations of Personal Data Subjects

4.1. Personal data subjects have the right to:

- receive information concerning the processing of their personal data, except in cases provided for by federal laws. The information is provided to the personal data subject by the Operator in an accessible form and must not contain personal data relating to other personal data subjects, except where there are lawful grounds for disclosing such personal data. The list of information and the procedure for obtaining it are established by the Personal Data Law;

- require the Operator to clarify their personal data, block it, or destroy it if the personal data is incomplete, outdated, inaccurate, unlawfully obtained, or not necessary for the stated purpose of processing, and to take measures provided by law to protect their rights;

- make prior consent a condition for processing personal data for the purpose of promoting goods, works, and services on the market;

- withdraw consent to personal data processing and send a request to stop personal data processing;

- appeal to the authorized body for the protection of the rights of personal data subjects or to a court against unlawful actions or inaction of the Operator when processing their personal data;

- exercise other rights provided for by the legislation of the Russian Federation.

4.2. Personal data subjects are obliged to:

- provide the Operator with accurate data about themselves;

- inform the Operator about clarification (updating, modification) of their personal data.

4.3. Persons who have provided the Operator with inaccurate information about themselves or information about another personal data subject without the latter's consent are liable in accordance with the legislation of the Russian Federation.

5. Principles of Personal Data Processing

5.1. Personal data is processed on a lawful and fair basis.

5.2. Personal data processing is limited to achieving specific, predetermined, and lawful purposes. Processing of personal data incompatible with the purposes of collecting personal data is not allowed.

5.3. Databases containing personal data processed for mutually incompatible purposes may not be combined.

5.4. Only personal data that corresponds to the purposes of its processing is subject to processing.

5.5. The content and scope of processed personal data correspond to the stated processing purposes. Excessive processing of personal data in relation to the stated purposes of processing is not allowed.

5.6. When processing personal data, the accuracy and sufficiency of personal data and, where necessary, its relevance to the purposes of personal data processing are ensured. The Operator takes the necessary measures and/or ensures that such measures are taken to delete or clarify incomplete or inaccurate data.

5.7. Personal data is stored in a form that makes it possible to identify the personal data subject for no longer than required by the purposes of personal data processing, unless the storage period for personal data is established by federal law or by a contract to which the personal data subject is a party, beneficiary, or guarantor. Processed personal data is destroyed or depersonalized when the processing purposes are achieved or when it is no longer necessary to achieve those purposes, unless otherwise provided for by federal law.

6. Purposes of Personal Data Processing

6.1. Personal data is processed by the Operator for the following purposes:

- consulting Users on the selection of real estate properties and providing information about real estate properties, including by making calls, sending messages (SMS, email, messengers), and processing incoming requests submitted on the website;

- forming and processing User requests for the subsequent conclusion of civil law contracts, preparing, concluding, performing, and terminating civil law contracts, including service agreements for selecting real estate properties and supporting real estate transactions;

- interacting with Users in connection with the performance of contractual obligations, including transaction support, document management, and other actions necessary to perform obligations;

- processing User inquiries, providing feedback, and consulting on the Operator's services;

- ensuring the operation of the website, analyzing user activity, and improving website quality, including using cookies, IP address, and other data about the User's actions on the website;

- complying with the requirements of the legislation of the Russian Federation, including tax, accounting, and other mandatory requirements.

6.2. For the above purposes, the Operator may process the following personal data:

- surname, first name, patronymic;

- phone number;

- email address;

- content of the text message/request;

- IP address;

- cookies;

- information about the User's actions on the website, including depersonalized analytics data.

6.3. Legal grounds for personal data processing.

The Operator processes personal data in the following cases:

- processing of personal data is necessary for the exercise and performance of functions, powers, and obligations imposed on the Operator by the legislation of the Russian Federation;

- processing of personal data is necessary for the performance of a contract, as well as for the conclusion of a contract at the initiative of the personal data subject or a contract under which the personal data subject will be a beneficiary or guarantor;

- consent of the personal data subject has been provided.

6.4. The Operator processes personal data by the following methods:

- collection, recording, systematization, accumulation, and storage of personal data;

- clarification (updating, modification), extraction, and use of personal data;

- transfer (provision, access) of personal data to third parties to the extent necessary to achieve the processing purposes, provided that the requirements of the legislation of the Russian Federation are observed;

- blocking, deletion, and destruction of personal data.

7. Conditions for Personal Data Processing

7.1. Personal data is processed in accordance with the requirements of the legislation of the Russian Federation and on the basis of an appropriate legal ground.

7.2. Personal data is processed exclusively for the purposes specified in this Policy and may not be used for other purposes without additional consent of the personal data subject.

7.3. The scope of personal data being processed must correspond to the stated processing purposes and must not be excessive in relation to them.

7.4. Personal data is stored for no longer than required by the purposes of its processing, unless otherwise provided for by the legislation of the Russian Federation or by a contract with the personal data subject.

7.5. If an unlawful or accidental transfer of personal data is detected that has resulted in a violation of the rights of personal data subjects, the Operator notifies Roskomnadzor within 24 hours from the moment the incident is detected and, within 72 hours, sends information on the results of the investigation and the measures taken.

8. Procedure for Collection, Storage, Transfer, and Other Types of Personal Data Processing

The security of personal data processed by the Operator is ensured by implementing legal, organizational, and technical measures necessary to fully comply with the requirements of current legislation in the field of personal data protection.

8.1. Personal data may be transferred to third parties, including the Operator's contractors, that ensure the operation of the website, CRM systems, and analytics services, subject to confidentiality.

8.1.1. To ensure the security of forms published on the Website and protect them from automated data entry (spam), the Operator uses the Yandex SmartCaptcha service.

When the service is used, data processing is carried out in accordance with the Yandex Privacy Policy and the Terms of Use of the Yandex SmartCaptcha service, published at:

- https://yandex.ru/legal/confidential/

- https://yandex.ru/legal/smartcaptcha_notice/

8.2. Transfer of personal data to third parties is carried out to the extent necessary to achieve the purposes of personal data processing, provided that the requirements of the legislation of the Russian Federation are observed and the confidentiality of personal data is ensured.

8.3. If inaccuracies are identified in personal data, the User may update it independently by sending a notice to the Operator's email address info@estateliga.ru with the subject line "Updating personal data".

8.4. The period of personal data processing is determined by achievement of the purposes for which the personal data was collected, unless another period is provided for by contract or applicable legislation. The User may withdraw consent to personal data processing at any time by sending a notice to the Operator by email to info@estateliga.ru with the subject line "Withdrawal of consent to personal data processing".

8.5. Third-party services engaged by the Operator to ensure the operation of the website, CRM systems, and analytics process personal data on behalf of the Operator on the basis of concluded personal data processing agreements in accordance with the requirements of Part 3 of Article 6 of Federal Law No. 152-FZ. The Operator is responsible to the personal data subject for the actions of such persons.

8.6. When processing personal data, the Operator ensures the confidentiality of personal data.

8.7. The Operator stores personal data in a form that makes it possible to identify the personal data subject for no longer than required by the purposes of personal data processing, unless the storage period for personal data is established by federal law or by a contract to which the personal data subject is a party, beneficiary, or guarantor.

8.8. A condition for termination of personal data processing may be achievement of the purposes of personal data processing, expiration of the consent of the personal data subject, withdrawal of consent by the personal data subject or a request to stop personal data processing, as well as detection of unlawful personal data processing.

8.9. The Operator has the right to transfer Users' personal data to third parties, including the Operator's contractors, solely to the extent necessary to achieve the purposes of personal data processing, including selection of real estate properties, consultation of Users, transaction support, and interaction with Users.

Such persons may include:

- organizations that ensure the operation of the website, CRM systems, telephony, messengers, and analytics services.

8.11. When collecting personal data of citizens of the Russian Federation, the Operator ensures recording, systematization, accumulation, storage, clarification (updating, modification), and extraction of such personal data using databases located in the territory of the Russian Federation.

9. List of Actions Performed by the Operator with Received Personal Data

9.1. The Operator collects, records, systematizes, accumulates, stores, clarifies (updates, modifies), extracts, uses, transfers (provides, grants access), blocks, deletes, and destroys personal data.

9.2. The Operator carries out automated processing of personal data with or without receipt and/or transfer of the received information through information and telecommunication networks.

10. Confidentiality of Personal Data

10.1. The Operator and other persons who have obtained access to personal data are obliged not to disclose personal data to third parties and not to distribute personal data without the consent of the personal data subject, unless otherwise provided for by federal law.

11. Procedure for Approval and Amendment of the Policy

11.1. The Policy is approved and put into effect by decision of the Operator and remains in effect until it is canceled.

11.2. The Operator has the right to amend the Policy as necessary (hereinafter Amendments). Amendments are approved by decision of the Operator. In such case, the amended version of the Policy is published on the Website with an indication of the date from which it takes effect.

11.3. Personal data subjects undertake to independently monitor Amendments. Visiting/using the Website by personal data subjects after the amended version of the Policy takes effect means that such personal data subjects have read the provisions of the amended version of the Policy.

11.4. The Policy is reviewed as necessary, but at least once every 3 (three) years from the previous review of the Policy.

11.5. The Policy may be reviewed before the period specified in the Policy in the event of changes to:

(1) regulatory legal rules governing personal data processing and protection in the Russian Federation;

(2) other local acts of the Operator that directly or indirectly regulate personal data processing and protection;

(3) the actual procedure by which the Operator organizes personal data processing and protection;

(4) the Operator's activities and organizational structure;

(5) the Operator's relationships with personal data subjects, contractors, and other persons;

(6) the reasons for and substance of deviations from compliance with the Operator's local acts;

(7) the reasons for and substance of identified personal data (computer) incidents;

(8) other factors that may materially and negatively affect personal data processing and protection by the Operator.

12. Final Provisions

12.1. The User may obtain any clarification on questions of interest concerning the processing of their personal data by contacting the Operator by email at info@estateliga.ru.

12.2. This document will reflect any changes to the Operator's personal data processing policy. The Policy remains valid indefinitely until replaced by a new version.

12.3. The current version of the Policy is freely available on the internet at: https://homeliga.ae.