1. General provisions
1.1. This personal data processing policy has been prepared in accordance with Federal Law No. 152-FZ of 27 July 2006, “On Personal Data” (the Personal Data Law). It sets out the procedures for processing personal data and the measures taken to protect it by the All-Russian Public Organization of Disabled People with Multiple Sclerosis (the Operator).
1.2. Respect for human and civil rights and freedoms when processing personal data, including the protection of privacy and personal and family confidentiality, is an essential objective and condition of the Operator’s activities.
1.3. This Policy applies to all information the Operator may obtain about visitors to the website (the Site). The Site does not control, and is not responsible for, third-party websites accessible through its links.
1.4. Use of the Site’s services signifies the User’s unconditional acceptance of this Policy and its conditions for processing personal information. Users who disagree with these conditions should refrain from using the services.
2. Definitions
2.1. Automated processing of personal data: processing using computer technology.
2.2. Blocking personal data: temporarily suspending processing, except where processing is necessary to clarify the data.
2.3. Site: the collection of graphic and information materials, software and databases that make them available on the Internet.
2.4. Personal data information system: personal data held in databases together with the information technologies and technical facilities used to process it.
2.5. Anonymisation: actions that make it impossible, without additional information, to determine whether personal data belongs to a particular User or another data subject.
2.6. Processing of personal data: any action or combination of actions, performed with or without automation, including collection, recording, organisation, accumulation, storage, clarification (updating or amendment), retrieval, use, transfer (distribution, provision or access), anonymisation, blocking, deletion and destruction.
2.7. Operator: a state or municipal authority, legal entity or individual that, alone or jointly, organises or performs processing and determines its purposes, the data to be processed and the operations to be performed.
2.8. Personal data: any information relating directly or indirectly to an identified or identifiable User of the Site.
2.9. Personal data authorised for distribution: data to which the data subject has granted access to an unlimited number of people by giving consent in the manner prescribed by the Personal Data Law.
2.10. User: any visitor to the Site.
2.11. Provision of personal data: actions intended to disclose data to a particular person or a defined group of people.
2.12. Distribution of personal data: actions intended to disclose data to an undefined group of people or make it available to an unlimited number of people, including publication in the media or information and telecommunications networks, or provision of access by other means.
2.13. Cross-border transfer: transfer of personal data to a foreign country’s authority, foreign individual or foreign legal entity.
2.14. Destruction of personal data: actions that irreversibly destroy data so that its content cannot be restored in an information system, and/or destroy its physical storage media.
3. Rights and duties of the Operator
3.1. The Operator may obtain accurate information and/or documents containing personal data from a data subject; continue processing after consent is withdrawn where the Personal Data Law provides a basis; and determine the measures necessary and sufficient to fulfil its statutory duties, unless the Personal Data Law or other federal laws provide otherwise.
3.2. The Operator must provide information about processing at the data subject’s request; organise processing in accordance with Russian law; respond to requests from data subjects and their legal representatives; provide the authorised personal data protection authority with requested information within 10 working days; publish this Policy or otherwise provide unrestricted access to it; take legal, organisational and technical measures against unlawful or accidental access, destruction, alteration, blocking, copying, provision, distribution and other unlawful actions; stop transfer and processing and destroy data in the cases and manner prescribed by law; and fulfil other duties under the Personal Data Law.
4. Rights and duties of data subjects
4.1. Data subjects may obtain information about processing, except as provided by federal law. Information must be provided in an accessible form and must not contain another person’s data unless there is a lawful basis for disclosure. The Personal Data Law specifies the information and procedure for obtaining it. Data subjects may request clarification, blocking or destruction of incomplete, outdated, inaccurate, unlawfully obtained or unnecessary data; take statutory measures to protect their rights; require prior consent for processing for the promotion of goods, work or services; withdraw consent; challenge unlawful acts or omissions before the authorised authority or a court; and exercise other rights under Russian law.
4.2. Data subjects must provide accurate information about themselves and notify the Operator when their data is clarified, updated or changed.
4.3. Persons who provide false information about themselves, or another person’s information without that person’s consent, are liable under Russian law.
5. Personal data processed by the Operator
5.1. Surname, first name and patronymic.
5.2. Email address.
5.3. Telephone numbers.
5.4. Year, month, date and place of birth.
5.5. Photographs.
5.6. Place of work and position.
5.6.1. Health status.
5.7. The Site collects and processes anonymised visitor data, including cookies, using Internet statistics services such as Yandex Metrica and others.
5.8. The data listed above is collectively referred to in this Policy as Personal Data.
5.9. The Operator does not process special categories concerning racial or national origin, political views, religious or philosophical beliefs, or intimate life.
5.10. Processing data authorised for distribution from the special categories specified in Article 10(1) of the Personal Data Law is permitted subject to the restrictions and conditions in Article 10.1.
5.11. Consent to process data authorised for distribution is obtained separately from other processing consents, subject in particular to Article 10.1. The authorised authority determines the requirements for its content.
5.11.1. The User gives this consent directly to the Operator.
5.11.2. Within three working days of receiving it, the Operator must publish information about processing conditions and restrictions or conditions on processing by an unlimited number of people.
5.11.3. Transfer (distribution, provision or access) of data authorised for distribution must stop whenever the data subject requests it. The request must include the subject’s surname, first name, patronymic if applicable, contact details (telephone, email or postal address), and the data whose processing must stop. The data specified in the request may be processed only by the Operator to which it is addressed.
5.11.4. Consent to process data authorised for distribution ceases when the Operator receives the request described in clause 5.11.3.
6. Processing principles
6.1. Processing must be lawful and fair.
6.2. Processing is limited to specific, predetermined and lawful purposes. Processing incompatible with the purposes of collection is not permitted.
6.3. Databases containing data processed for incompatible purposes must not be combined.
6.4. Only data relevant to the processing purposes may be processed.
6.5. The content and volume of data must correspond to the stated purposes and must not be excessive.
6.6. Data must be accurate, sufficient and, where necessary, current for the processing purposes. The Operator takes or ensures the necessary measures to delete or clarify incomplete or inaccurate data.
6.7. Data is retained in an identifiable form no longer than necessary for processing purposes, unless a federal law or a contract to which the data subject is a party, beneficiary or guarantor specifies a retention period. Data is destroyed or anonymised when the purposes are achieved or no longer necessary, unless federal law provides otherwise.
7. Purposes of processing
7.1. Processing purposes are to inform Users by email and provide access to services, information and/or materials on the Site.
7.2. The Operator may send notifications about new products and services, special offers and events. Users may opt out at any time by emailing
7.3. Anonymised data collected through Internet statistics services is used to obtain information about Users’ actions and improve the Site and its content.
8. Legal bases for processing
8.1. The legal bases are the Operator’s charter and founding documents; federal laws and other personal data protection regulations; and Users’ consent to processing, including processing of data authorised for distribution.
8.2. The Operator processes data only where the User independently enters and/or submits it through forms on the Site or sends it by email. Completing the forms and/or submitting personal data expresses acceptance of this Policy.
8.3. Anonymised data is processed where permitted by the User’s browser settings, including enabled cookies and JavaScript.
8.4. Data subjects decide independently whether to provide their data and give consent freely, of their own will and in their own interest.
9. Conditions for processing
9.1. Processing is carried out with the data subject’s consent.
9.2. Processing may be necessary to achieve purposes specified by a Russian international treaty or law, or to fulfil statutory functions, powers and duties.
9.3. Processing may be necessary for the administration of justice or execution of a court order or an act of another authority or official enforceable under Russian enforcement legislation.
9.4. Processing may be necessary to perform a contract to which the data subject is a party, beneficiary or guarantor, or to conclude a contract at the subject’s initiative or under which the subject will be a beneficiary or guarantor.
9.5. Processing may be necessary to exercise the legitimate rights and interests of the Operator or third parties or achieve socially significant purposes, provided the data subject’s rights and freedoms are not infringed.
9.6. Data made accessible to an unlimited number of people by or at the request of the data subject may be processed (publicly available personal data).
9.7. Data subject to publication or mandatory disclosure under federal law may be processed.
10. Collection, storage, transfer and other processing
10.1. Security is ensured through legal, organisational and technical measures necessary to comply fully with applicable personal data protection legislation.
10.2. The Operator safeguards data and takes all possible measures to prevent unauthorised access.
10.3. Users’ data will not be transferred to third parties except to comply with applicable law or where the subject consents to transfer for performance of civil-law contractual obligations.
10.4. Processing duration is determined by achievement of the collection purposes, unless a contract or applicable law specifies otherwise. Users may withdraw consent at any time by emailing
10.5. Information collected by third-party services, including payment systems, communications services and other providers, is stored and processed by those parties under their user agreements and privacy policies. Users and/or data subjects must familiarise themselves with these documents in a timely manner. The Operator is not responsible for third parties’ actions, including those providers.
10.6. Restrictions imposed by the data subject on transfer (except granting access), processing, or processing conditions (except obtaining access) for data authorised for distribution do not apply to processing in state, public or other public interests defined by Russian law.
10.7. The Operator ensures confidentiality during processing.
10.8. Data is stored in an identifiable form no longer than necessary for processing purposes, unless a federal law or contract to which the subject is a party, beneficiary or guarantor specifies a retention period.
10.9. Processing may cease when its purposes are achieved, consent expires or is withdrawn, or unlawful processing is identified.
11. Operations performed on Users’ data
11.1. The Operator collects, records, organises, accumulates, stores, clarifies (updates or changes), retrieves, uses, transfers (distributes, provides or grants access), anonymises, blocks, deletes and destroys personal data.
11.2. The Operator performs automated processing with or without receipt and/or transmission of information through information and telecommunications networks.
12. Cross-border transfers
12.1. Before a cross-border transfer, the Operator must establish that the destination country provides reliable protection of data subjects’ rights.
12.2. Transfer to countries that do not meet that requirement may take place only with the data subject’s written consent and/or for performance of a contract to which the data subject is a party.
13. Confidentiality
13.1. The Operator and other persons with access to personal data must not disclose it to third parties or distribute it without the data subject’s consent, unless federal law provides otherwise.