Privacy Policy on Personal Data Processing
1. General Provisions
This personal data processing policy has been developed in accordance with the requirements of Law (hereinafter referred to as the Personal Data Law) and defines the procedure for personal data processing and measures to ensure the security of personal data taken by Winter.cy (hereinafter referred to as the Operator).
1.1. The Operator's most important goal and condition for carrying out its activities is to ensure the rights and freedoms of individuals during the processing of their personal data, including protecting the rights to privacy and the confidentiality of personal and family life.
1.2. This policy of the Operator regarding personal data processing (hereinafter referred to as the Policy) applies to all information that the Operator may receive about visitors to the website https://winter.cy
2. Key Terms Used in the Policy
2.1. Automated Personal Data Processing — processing of personal data using computing technology.
2.2. Blocking of Personal Data — temporary cessation of personal data processing (except when processing is necessary to clarify personal data).
2.3. Website — a collection of graphic and informational materials, as well as computer programs and databases that ensure their availability on the internet at the address https://winter.cy
2.4. Personal Data Information System — a collection of personal data contained in databases and ensuring their processing using information technologies and technical means.
2.5. Anonymization of Personal Data — actions that make it impossible to determine the personal data subject without using additional information.
2.6. Personal Data Processing — any action (operation) or set of actions (operations) carried out with personal data, using or without the use of automation tools, including collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (dissemination, provision, access), anonymization, blocking, deletion, and destruction of personal data.
2.7. Operator — a government agency, municipal authority, legal entity, or individual, independently or together with other entities, organizing and/or carrying out personal data processing and determining the purposes of personal data processing, the composition of personal data subject to processing, and actions (operations) performed with personal data.
2.8. Personal Data — any information directly or indirectly related to a specific or identifiable User of the website https://winter.cy
2.9. Personal Data Authorized for Distribution by the Data Subject — personal data, access to which has been provided by the data subject to an unlimited number of people by giving consent to the processing of personal data authorized for distribution in the manner prescribed by the Personal Data Law.
2.10. User — any visitor to the website https://winter.cy
2.11. Provision of Personal Data — actions aimed at disclosing personal data to a specific person or group of people.
2.12. Distribution of Personal Data — any actions aimed at disclosing personal data to an indefinite number of persons (transfer of personal data) or making personal data accessible to an unlimited number of people, including publication in the media, placement in information and telecommunications networks, or providing access to personal data by any other means.
2.13. Cross-border Transfer of Personal Data — transfer of personal data to a foreign country to a foreign government authority, foreign individual, or foreign legal entity.
2.14. Destruction of Personal Data — any actions that result in the irreversible destruction of personal data, making it impossible to restore the content of personal data in the personal data information system and/or destroying physical media containing personal data.
3. Operator’s Rights and Responsibilities
3.1. The Operator has the right to:
- receive accurate information and/or documents containing personal data from the data subject;
- in case of withdrawal of consent for the processing of personal data by the data subject, continue processing personal data without consent, if there are grounds specified in the Personal Data Law;
- independently determine the set of measures required and sufficient to comply with obligations provided by the Personal Data Law and other regulations, unless otherwise stipulated by the Personal Data Law or other laws.
3.2. The Operator is obliged to:
- provide the data subject, upon request, with information related to the processing of their personal data;
- organize personal data processing in accordance with current legislation;
- respond to requests and inquiries from data subjects and their legal representatives in accordance with the requirements of the Personal Data Law;
- report to the authorized body for personal data protection within 10 days from the receipt of such a request;
- publish or otherwise ensure unlimited access to this Policy on the processing of personal data;
- take legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution, and other unlawful actions;
- cease the transfer (dissemination, provision, access) of personal data, terminate processing, and destroy personal data in accordance with the Personal Data Law;
- perform other obligations as provided by the Personal Data Law.
4. Rights and Obligations of Personal Data Subjects
4.1. Data subjects have the right to:
- receive information concerning the processing of their personal data, except in cases stipulated by federal laws;
- request the operator to correct, block, or delete their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the declared processing purpose;
- withdraw consent for the processing of personal data at any time;
- challenge unlawful actions or omissions of the Operator in processing personal data before the authorized body or in court.
- provide the Operator with accurate data about themselves;
- notify the Operator about the correction (updating, changing) of their personal data.
5. Principles of Personal Data Processing
5.1. Personal data is processed legally and fairly.
5.2. Personal data processing is limited to achieving specific, predetermined, and legitimate goals.
5.3. The merging of databases containing personal data that are processed for incompatible purposes is prohibited.
5.4. Only personal data that serves the purposes of processing are processed.
5.5. The content and volume of personal data processed must correspond to the declared goals of processing.
5.6. The accuracy, sufficiency, and relevance of personal data to the processing goals are ensured.
5.7. Personal data is stored in a form that allows identification of the personal data subject for no longer than is necessary for processing.
6. Purpose of Personal Data Processing
Purpose of Processing: Clarifying order details
Personal Data: Last name, first name, patronymic; email address; phone numbers; date and place of birth
We process personal data in accordance with applicable data protection laws, including but not limited to:
- The General Data Protection Regulation (GDPR) for users in the European Economic Area (EEA).
- The California Consumer Privacy Act (CCPA) for users in California, USA.
- Other national and international data protection laws as required.
7. Conditions for Personal Data Processing
7.1. Processing of personal data is carried out with the consent of the personal data subject.
7.2. Processing is necessary for the performance of functions, rights, and obligations established by Russian Federation legislation.
7.3. Processing is required to execute judicial acts or public duties as per Russian law.
8. Procedure for Collection, Storage, Transfer, and Other Processing of Personal Data
8.1. The Operator ensures the safety of personal data by implementing legal, organizational, and technical measures.
8.2. Personal data will not be transferred to third parties unless required by law or with the consent of the data subject.
9. Actions Performed by the Operator with Received Personal Data
9.1. The Operator collects, records, systematizes, accumulates, stores, updates, uses, and destroys personal data.
9.2. The Operator performs automated personal data processing.
10. Cross-border Transfer of Personal Data
The Operator must notify the authorized body before conducting cross-border transfer of personal data.
11. Confidentiality of Personal Data
The Operator is obligated not to disclose personal data to third parties without the consent of the data subject.
12. Final Provisions
12.1. Users can contact the Operator for clarifications regarding the processing of their personal data via email at hello@cisc.com.cy
12.2. Any changes to this Privacy Policy will be reflected in this document.
12.3. The current version of the Policy is available online at https://winter.cy/privacy-policy