PERSONAL DATA PROCESSING POLICY OF "НАЗАД В БУДУЩЕЕ"

All terms used in this policy with a capital letter have the following meanings:

"Platform" means software for the distance selling of food products, prepared dishes, beverages and other goods of a similar and ancillary nature on the information and telecommunications network "Internet", comprising the Seller's website, its mobile applications for the "iOS" and "Android" operating systems, modules for integrating online acquiring with acquiring banks (JSC "Tinkoff Bank", PJSC "Sberbank", JSC "Alfa-Bank"), and modules for integration with third-party Goods and Order accounting systems ("iiko", "r-keeper", "Poster").

"Seller" means "НАЗАД В БУДУЩЕЕ" (PSRN: 1147847127757 TIN: 7839494297), address: 193312, Санкт-Петербург г, Коллонтай ул, дом 28, корпус 1, литер А, квартира 366 — namely the person using the Platform on a paid basis to conduct commercial activity, organising and carrying out the processing of personal data on the Platform, and determining the purposes of processing personal data, the composition of the personal data to be processed and the actions (operations) performed with personal data.

"Buyer" means an individual using the Platform to review the Seller's range and the terms of sale of the Goods and/or to purchase/receive Goods, in accordance with the purpose of the Platform and the terms set out by the Seller in the offer to Buyers.

"Recipient" means an individual designated by the Buyer as the Recipient of the Order.

"Order" means a request to purchase Goods submitted by the Buyer through the Platform. By placing an Order, the Buyer enters into a contract with the Seller for the sale of the Goods and, where necessary, for the provision of Goods delivery services.

"Goods" means food products, dishes, beverages and other goods of a similar and ancillary nature.

"Third parties" means persons accepting and/or processing the Order, delivering and/or handing over the Goods, as well as the Seller's partners, persons carrying out joint activities with the Seller on the Platform, other persons involved for the purposes of concluding and/or performing contracts entered into between the Seller and the Buyer through direct or indirect use of the Platform, or persons to whom the transfer of personal data is provided for by the applicable legislation of the Russian Federation.

"Personal data" means any information relating directly or indirectly to a specified or identifiable individual.

"Processing of personal data" means any action (operation) or set of actions (operations) performed on personal data, whether automated or not. Such actions (operations) include, in particular, collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (provision, access), matching, depersonalisation, blocking, deletion and destruction of personal data.

"Security of personal data" means the protection of personal data against unauthorised and/or unlawful access, destruction, modification, blocking, copying, provision, dissemination and other unlawful actions.

2.1. This Personal Data Processing Policy (hereinafter the "Policy") has been created by the Seller in accordance with the provisions of Federal Law of the Russian Federation No. 152-FZ of 27 July 2006 "On Personal Data" (hereinafter the "Law"), including clause 2 of part 1 of Article 18.1 of that Law.

2.2. The purpose of this Policy is to set out the Seller's position regarding the processing and protection of personal data (hereinafter "personal data"). It contains information about the collection, storage, use and transfer of personal data, as well as the requirements for their security. It also covers the rights of the persons whose personal data are processed.

2.3. This Policy applies to all actions related to the processing of personal data by the Seller and Third parties.

2.4. By placing an Order, registering/logging in to the Platform by any available means, submitting a claim/feedback, creating an Account or using any other functionality of the Platform, the Buyer consents to the processing of their personal data by the Seller and Third parties, including personal data received from Third parties during registration/login using third-party services. By starting to use the Platform, the Buyer expresses agreement with this Personal Data Processing Policy. The Platform cannot fulfil the Buyer's Orders without the Buyer's agreement to the Personal Data Processing Policy.

2.5. The Seller acts as an independent operator in respect of the processing of personal data received from Buyers (Recipients) and/or Third parties within the meaning established by the "Terms and definitions" section of this Policy. The Seller processes these data for the purpose of performing contracts for the sale of Goods, contracts for the provision of Goods delivery services and other contracts concluded on the Platform between the Buyer and the Seller, with or without the involvement of Third parties.

2.6. This Policy applies to personal data obtained both before and after the introduction of this Policy.

3.1. The Seller is responsible for processing and ensuring the security of personal data in order to fulfil its obligations under the legislation of the Russian Federation, including but not limited to the Constitution of the Russian Federation, Federal Law No. 152-FZ of 27 July 2006 "On Personal Data", as well as other applicable laws of the Russian Federation, guidelines and methodologies of supervisory authorities and the Seller's internal regulations.

3.2. The processing of personal data by the Seller may be carried out in the following circumstances and on the following legal grounds:

3.3. The persons whose personal data are processed by the Seller through the Platform include Buyers, Recipients of the Goods (where the buyer designates another individual as the Recipient of the Goods), as well as any other individuals who submit applications, requests, claims or other communications (documents, letters) to the Seller.

3.4. The Seller processes the personal data of the following categories of persons:

a) Buyers, for purposes such as:

b) Recipients of Goods purchased by Buyers, for delivery purposes.

c) Persons involved in the delivery process (couriers, persons responsible for handing over the Goods).

d) Persons who submit to the Platform statements about infringements of their rights or the rights of Third parties, for the purposes of processing those statements, exchanging information with the relevant parties involved in the alleged infringements, assisting in the settlement of claims and deciding on the application of the measures of liability provided for by the Rules of Use of the Platform and other Platform documents.

e) Employees of the Seller, for the purposes of performing employment contracts in accordance with the legislation of the Russian Federation.

f) The Seller's counterparties, whose personal data are processed within the contractual relations between the parties.

3.5. If the Buyer provides the Seller with the personal data of another person for processing, it is presumed that the Buyer has obtained that person's consent to the provision of their personal data to the Seller.

4.1. The personal data processed by the Seller include information obtained during registration, login and order placement, such as surname, first name, patronymic, date of birth, gender, phone number, email address, registration address, work address, delivery address and cookies. In addition, information obtained during interaction with Buyers is processed, such as gender, age, passport details, payment details, city of residence and address. Information relating to the placement or fulfilment of Buyers' Orders is also processed, including information about the delivery method, payment status and, where necessary, data about the ultimate Recipient of the Goods (such as surname, first name, patronymic, delivery address and phone number). The data processed also include the Buyer's claims submitted through the Platform or by any other means, as well as reviews of Goods and Sellers, geolocation information and data on the Buyer's behaviour on the Platform (for example, Goods and categories viewed, items added to the "Cart"). The Seller also processes the unique identifier of the Buyer's Personal account. A more detailed list of the Personal data processed, together with the purposes, time limits, legal grounds and methods of processing and destroying personal data, is set out in Annex No. 1 to this Policy.

4.2. The Seller processes certain categories of personal data of persons who contact the Seller with claims, reviews or statements about alleged infringements of their rights. These include the surname, first name and patronymic, passport details (or details of another identity document), and the contact information (phone and/or fax numbers, email address) of the person submitting the claim, review or statement.

4.3. The personal data referred to in the preceding clauses may be obtained by the Seller by such means as: the completion by personal data subjects of the relevant forms on the Platform, the sending of correspondence or emails to the Seller's email addresses, and the provision of data by Third parties during the Buyer's registration and/or login via third-party services. In addition, personal data may be obtained from Third parties in accordance with the requirements of applicable law. The Seller may also obtain personal data through the automated processing and systematisation of information provided by personal data subjects.

4.4. The Seller uses on the Platform the web analytics service "Yandex.Metrica" provided by LLC "Yandex", as well as the "top.mail.ru" service provided by LLC "VK", in order to collect and analyse statistical information about visits to and use of the Platform, assess the effectiveness of advertising and marketing campaigns, improve the structure, content and functionality of the Platform, and make it more convenient for the Buyer to use.

4.5. When the "Yandex.Metrica" and "top.mail.ru" services operate, cookies may be placed on the Buyer's device, and information about the Buyer's actions when using the Platform, the technical parameters of their device and the software used, the date and time of the session, the addresses of the pages visited and other similar information may be transmitted automatically. Such data are processed by LLC "Yandex" and LLC "VK" in their own name in the manner and on the terms provided for by the Terms of Use of the "Yandex.Metrica" and "top.mail.ru" services and their Privacy Policy, while the Seller has access only to depersonalised statistical data.

5.1. When processing personal data, the Seller is guided by the following principles:

5.2. The Seller does not process personal data concerning race, ethnicity, political views, religion, philosophy, beliefs, health, private life or membership of public associations, including trade unions, nor biometric data. Voice input and verification of personal data are not carried out over unsecured data transmission channels. The provision of data by personal data subjects to the Seller's employees is voluntary and implies that the data obtained will be used in accordance with this Policy.

5.3. The Seller reserves the right to entrust the processing of personal data to Third parties with the Buyer's consent. Such consent is expressed by giving consent in the form of acceptance of the offer or on the basis of an agreement with the Seller and/or such Third parties. Such delegation of processing powers may take place for the following purposes:

5.4. The Seller may transfer the personal data of Buyers and of the persons designated by Buyers as Recipients of Orders to other persons via the Internet, in accordance with the rules established by the applicable legislation of the Russian Federation.

a) Persons processing personal data on behalf of the Seller or the Platform, including delivery services, must comply with the principles and rules for processing and protecting personal data set out in applicable law.

5.5. The Seller has the right to disclose personal data to Third parties with the individual's consent, subject to the following conditions:

a) Such data are necessary for the performance of contracts by the Seller, delivery services and the Seller's related counterparties that provide the Seller with services for the technical and information support of the Seller's processes. These may include, in particular, services for processing Buyers' Orders, accepting payment for them and arranging their delivery, as well as providing technical support.

b) In order to protect the rights and legitimate interests of the Platform or Third parties, where an individual breaches any terms of use of the Platform, this Policy or the applicable legislation of the Russian Federation.

c) In compliance with a court decision or in accordance with the requirements of applicable law.

d) Pursuant to lawful requests from competent state authorities.

5.6. In order to achieve the purposes for which personal data are used, the Buyer and/or the Recipient agrees and gives the Seller consent to the processing (including collection, recording, systematisation, accumulation, storage, clarification (updating, modification), comparison, extraction, use, depersonalisation, blocking, deletion and destruction) of their account and other personal data. Third parties acting on behalf of the Platform or processing personal data in accordance with applicable law may take part in such processing.

a) Third parties engaged in the processing of personal data act as independent data processors. The Buyer and/or the Recipient consents to the transfer of their personal data required for the performance of the contract concluded using the Platform to such third party. The Buyer and/or the Recipient confirm and agree that the obligations and rights relating to giving consent to the processing of personal data by a Third party, and to the subsequent processing of their personal data by the Third party as an independent data processor, lie between the Buyer and the Third party or between the Recipient and the Third party, in accordance with the terms of the consent given by the Buyer and/or the Recipient. To withdraw such consent to the processing of personal data, the Buyer and/or the Recipient must follow the instructions set out in point "e" of clause 6.1 of this policy.

5.7. In order to comply with the requirements of the legislation of the Russian Federation and contractual obligations, the Seller and Third parties process personal data with or without the use of automation tools. The actions relating to processing include the collection, recording, systematisation, accumulation, storage, clarification (updating, modification), extraction, use, transfer (dissemination, provision, access), depersonalisation, blocking, deletion and destruction of personal data.

5.8. The Seller and Third parties do not take decisions that have legal consequences for individuals or affect their rights and interests solely by means of automated processing of personal information.

5.9. The Seller and Third parties do not verify the accuracy or reliability of the information provided by Buyers and/or Recipients to the Platform. The Seller and Third parties proceed on the basis that Buyers and/or Recipients act reasonably and in good faith, providing sufficient and accurate information and keeping it up to date.

6.1. Individuals whose personal data are processed by the Seller have the following rights:

a) Individuals have the right at any time to update or supplement the personal data they have provided by logging in to their personal account on the Platform, where the Platform allows such changes to be made.

b) Individuals may request the deletion of their personal data by sending a written notice to the Seller specifying the personal data they wish to have deleted.

c) Individuals have the right to obtain the following information from the Seller:

d) Individuals may require the Seller to correct, block or destroy their personal data if those data are incomplete, outdated, inaccurate, unlawfully obtained or no longer necessary for the purposes of processing.

e) Individuals have the right at any time to withdraw their consent to the processing of personal data by sending a duly certified email to info@starterapp.ru. Once the Seller has received the withdrawal of consent, the processing of personal data will cease and the individual's personal data will be deleted, except where processing must continue in accordance with the legislation of the Russian Federation. In addition, withdrawal of consent will also be treated as a unilateral refusal to perform any related Orders, where such withdrawal makes fulfilment of the Orders impossible.

f) Individuals have the right to demand the cessation of any unlawful actions carried out by the Seller and/or Third parties in relation to their personal data.

g) Individuals have the right to take lawful measures to protect their rights and interests, including to claim compensation for losses or damage in court.

h) The rights set out in this section may be restricted in accordance with the legislation of the Russian Federation or where the Seller and/or Third parties process personal data on lawful grounds other than the individual's consent.

7.1. The Seller is obliged to:

a) Upon request, provide the individual with information about the processing of their personal data or reject the request in accordance with the applicable legislation of the Russian Federation within thirty days of receiving the request.

b) At the individual's request, within seven business days clarify, block or delete the personal data processed if those data are incomplete, outdated, inaccurate, unlawfully obtained or no longer necessary for the stated purpose of processing. Such a request must be supported by evidence provided by the individual or their representative.

c) Keep a record of requests relating to the processing of personal data, noting the requests submitted by individuals and the actions taken by the Seller in response to those requests.

d) Inform the individual about the processing of their personal data where those data were not obtained directly from the individual, except in the cases specified in clause 1 of Article 6 of Federal Law No. 152-FZ of 27 July 2006 "On Personal Data".

e) Immediately cease processing personal data and destroy the relevant data within thirty days after the purpose of processing has been achieved, unless otherwise provided by an agreement between the Seller, the Courier and the individual, or unless the Seller has a lawful right to process personal data without the individual's consent.

f) Where an individual withdraws consent to the processing of their personal data, immediately cease processing and destroy the personal data within thirty days from the date of withdrawal, unless otherwise provided by an agreement between the Platform and the individual.

g) Where an individual demands that the processing of personal data be stopped, immediately cease processing such personal data, except in the cases provided for by law.

h) When collecting personal data, including through online channels, the Seller ensures that the recording, systematisation, accumulation, storage, clarification (updating, modification) and extraction of the personal data of citizens of the Russian Federation are carried out using databases located in the territory of the Russian Federation.

8.1. The Seller implements the necessary legal, organisational and technical measures to protect personal data against unauthorised access, destruction, modification, blocking, copying, provision, dissemination and other unlawful actions.

8.2. The implementation of such measures includes:

9.1. The period for processing (storing) personal data is determined on the basis of the purposes of processing the data and in accordance with the terms of the contracts with the data subjects and the requirements of applicable law:

9.2. Upon expiry of the period for processing (storing) personal data, they are subject to destruction, unless otherwise provided by the legislation of the Russian Federation. Storage of personal data after processing has ceased is permitted only after they have been depersonalised.

10.1. Individuals whose personal data are processed by the Seller may obtain clarifications regarding the processing of their personal data by contacting the Seller in person or by sending a written request to the Seller's address.

11.1. The Seller may collect and process the following information, including data that are not personal:

11.2. The Seller processes and stores the search queries that the Buyer makes on the Platform in order to create and analyse statistics on the use of the various sections of the Platform and to identify the Goods that are in greatest demand.

11.3. The Seller automatically receives certain types of information when the Buyer interacts with the Platform, including through web protocols and Cookies.

12.1. The Seller reserves the right to amend this Policy from time to time in line with changes in the Seller's services, the Goods, the functionality of the Platform, or in order to comply with applicable law. The updated version of this Policy takes effect from the moment of its publication, unless otherwise stated.

to the Personal Data Processing Policy of "НАЗАД В БУДУЩЕЕ".

to the Personal Data Processing Policy of "НАЗАД В БУДУЩЕЕ".

List of Personal data that may be transferred to Third parties: